Hardware-Intrinsic Multi-Layer Security: A New Frontier for 5G Enabled IIoT

View full-text article in PMC

. 2020 Mar 31;20(7):1963. doi: 10.3390/s20071963

Algorithm 2 Multi-layered security model using PUF: Client is an existing User [2]

Objective:

The seven layer cloud model consisting of FPGA clouds verifies the identity of a client FPGA ( $U_{A}$ ) who is requesting access.
The cloud model provides application access for the genuine client ( $U_{i}$ ).

Prerequisites:

An n-bit input, 1-bit output XOR PUF $P_{1}$ is reconfigured in all layers of the $C l o u d - F P G A$ . There exists a PUF for every authenticated user. PUF $P_{i j}$ represents the identity of the user i in the cloud layer j.
A combined mathematical model $M_{i}$ representing all the K PUFs in the cloud layers, resides with each user $U_{i}$ .
$C l o u d - F P G A$ and user $U_{i}$ have agreed on a fixed encoding scheme $E ()$ and a decoding scheme $D (.)$ , such that for any binary string $x, E (.)$ and $D (.)$ are injective, $X = E (x)$ and $D (X) = x$ .
$C l o u d - F P G A$ and user $U_{i}$ have agreed on a shuffling scheme $Y = S (X, r a n d)$ , and $S^{'} (Y, r a n d) = X$ where $r a n d$ is a random number.

Input:

S, $P_{C T}$ , $D B_{F W}$ , $D B_{M E T A}$ , $D B_{V A U L T}$ , $D B_{I P S}$ , $D B_{A N T I M A L}$

Tenant session: S
Contents of session packets: $P_{C T}$
Contents of FW: $D B_{F W}$
Contents of $T E N A N T_{M E T A} : D B_{M E T A}$
Contents of $T E N A N T_{V A U L T} : D B_{V A U L T}$
Contents of $I P S : D B_{I P S}$
Contents of $A N T I M A L W A R E : D B_{A N T I M A L}$

Note: $D B_{j}$ represents content $D B$ of layer j

Output:

A value in variable S to show that the application access is granted ( $S = 1$ ) or denied ( $S = 0$ ).

Steps:

1.
Initialize $V = 1$ , $E = 1$ , $F l a g = 0$
2.
$U_{B}$ requests $U_{A}$ , for an introduction to access application A
3.
$U_{A}$ to $M P$ : request introduction of $U_{B}$ to cloud layers $C_{j}$
4.
$M P$ to $U_{A}$ : $M P$ sends a random number $r a n d$ and a set of challenges $C H_{p}$ consisting of q challenge bits each of length ‘n’.
5.
$U_{A}$ calculates the following:
- $R A m_{p, j} = M A (C H_{p, j})$ , $p = 1 \dots q$ , $j = 1 \dots K$
- $R A m = {R A m_{p, j}$ , $1 \leq p \leq q$ , $1 \leq j \leq K$
- $C A_{A}$ = $S (E (R A m), r a n d)$
6.
$U_{A}$ to $M P$ : certificate $C A_{A}$
7.
foreach layer jdo
- (a)
  Initialize $M e m = 0$ , $M a t c h = 0$
- (b)
  If ( $E = 1$ )
  - i.
    $M P : R A m_{p, j} = S^{'} (D (C A_{A}), r a n d)$
  - ii.
    $M P$ to $C l o u d - C_{j}$ : Set of challenges $C H_{p}$ and $R A m_{p, j}$
  - iii.
    $C l o u d - C_{i}$ calculates the following
    
    $R A f_{p, j} = P A (C H_{p, j}), p = 1 \dots q, j = 1 \dots K$
    
    $N_{A j} = (1 - \frac{\sum_{(p = 1)}^{q} (R_{A m p} ⨁ R_{A f p}}{q})$
    
    if $N A j \geq 0.99$ $M e m = 1$
  - iv.
    if ( $P_{C T}$ $\in D B_{j}$ , | $D B_{j} \in {D B_{F W},$ $D B_{M E T A},$ $D B_{V A U L T}}$ AND $P_{C T} \notin D B_{j}$ , | $D B_{j} \in {D B_{I P S},$ $D B_{A N T I M A L}$ } ); $M a t c h = 1$
  - v.
    if ( $M e m & & M a t c h$ ), $E = 1$ ; proceed to next higher layer
  - vi.
    else Exit; set $E = 0$ , $F l a g = 0$
8.
if $V = 1$ ; Verified introducing client
- (a)
  foreach layer jdo
  - i
    $C l o u d - F P G A$ , $C_{j}$ initiates DPR and configures a new PUF $P_{B, j}$ , PUF $P_{B, j}$ represents the identity of the $U_{B}$ in the cloud layer j
  - ii
    $C_{j}$ to $M P$ PUF modeling parameters $p a r a m_{j}$
- (b)
  $M P$ generates a combined Mathematical model $M_{B}$ of all PUFs $P_{B, j}$ in the cloud layers
- (c)
  $M P$ generates obfuscated bitstreams of PUF mathematical model $M_{B}$
- (d)
  $M P$ initiates remote dynamic partial reconfiguration of PUF $M_{B}$ in the dynamic partition of the $c l i e n t - F P G A$ $U_{B}$
- (e)
  $F l a g = 1$ and exit; follow protocol-1. $U_{B}$ is same as any other existing client.