PUF-LAMT+: A Lightweight Authentication Protocol with CRP Throttling and Hybrid Fuzzy Extractors for Modeling-Resistant Medical IoT Security

Abstrak

In the past few years, the development of Medical Internet of Things (MIoT) systems has dramatically changed patient care by providing the means of real-time health monitoringand data-based diagnostics. However, these require a large number of CRPs. It may be exploited by model-based attacks, like machine learning (ML) attacks, to exploit the predictability of PUFs after a large number of CRPs are leaked. To mitigate this vulnerability,we present PUF-LAMT+, a lightweight authentication protocol that is resistant to ML-based modeling attacks under resource-constrained MIoT circumstances. Our research contribution is a protocol that is immune against a modeling attack, which integrates three main features: (1) PUF challenge obfuscation with session-specific entropy to shield from raw CRP exposure, (2) CRP throttling to restrict CRP re-use and to degrade modeling precision, and (3) hybrid fuzzy extractors that depose of noisy PUF outputs with help of auxiliary entropy sources. We prove security of the protocol in ProVerif in the Dolev-Yao model: It provides mutual authentication, key freshness, and anonymity. We also assess resistance to supervised ML attacks (SVM, logistic regression, and shallow neural networks) with synthetic CRPdatasets, where accuracy (50%) after obfuscation was observed. An entropy analysis shows that a session key entropy of 128 bits is secure. Performance evaluation confirms that PUF-LAMT+ provides an average authentication latency of 1.3 ms, a communication cost of 576 bytes, and the least storage overhead, which is improved over the committed schemes like LAMT and Hu et al. PUF-LAMT+ offers strong, scalable, and energy-efficient MIoT authentication that is specifically designed for MIoT applications like wearable sensors and implantable devices by filling the gap between theoretical security and practical application.

Kata kunci

• Selected:Physically Unclonable Functions (PUFs)
• CRP Throttling
• Hybrid Fuzzy Extractors
• Modeling Attack Resistance
• Medical IoT
• Lightweight Authentication