  Advances in technology have enabled tremendous progress in the development of
a highly connected ecosystem of ubiquitous computing devices collectively
called the Internet of Things (IoT). Ensuring the security of IoT devices is a
high priority due to the sensitive nature of the collected data. Physically
Unclonable Functions (PUFs) have emerged as critical hardware primitive for
ensuring the security of IoT nodes. Malicious modeling of PUF architectures has
proven to be difficult due to the inherently stochastic nature of PUF
architectures. Extant approaches to malicious PUF modeling assume that a priori
knowledge and physical access to the PUF architecture is available for
malicious attack on the IoT node. However, many IoT networks make the
underlying assumption that the PUF architecture is sufficiently tamper-proof,
both physically and mathematically. In this work, we show that knowledge of the
underlying PUF structure is not necessary to clone a PUF. We present a novel
non-invasive, architecture independent, machine learning attack for strong PUF
designs with a cloning accuracy of 93.5% and improvements of up to 48.31% over
an alternative, two-stage brute force attack model. We also propose a
machine-learning based countermeasure, discriminator, which can distinguish
cloned PUF devices and authentic PUFs with an average accuracy of 96.01%. The
proposed discriminator can be used for rapidly authenticating millions of IoT
nodes remotely from the cloud server.
