Multimodal IoT Device Authentication using Behavioral and Physical Unclonable Functions and Kyber Public Key Encryption

Proper device identity management and authentication is a must for many Internet of Things (IoT) applications. Physical Unclonable Functions (PUFs) are a well-known solution for identifying IoT devices. However, they can be attacked using both intrusive and non-intrusive physical attacks. In this work, we propose a multimodal device authentication scheme using Behavioral and Physical Unclonable Functions (BPUFs), which is a more secure option than PUFs. Adequate server-side security is achieved because BPUF responses are processed in the encrypted domain using homomorphic encryption. Furthermore, helper data attacks are avoided and the solution is quantum-safe. The proposal has been evaluated on an ESP32 microcontroller considering the security against false acceptance attacks and the security level of the Kyber public key encryption used. Fixing the first security to more than 192 bits for the behavioral and physical functions, the execution times of the cryptographic operations range from 41.30 to 205.70 ms, working at 160 MHz, with communication bandwidths from 3,840 to 15,680 bytes, and non-volatile memory occupation from 800 to 1,568 bytes.