# A Low-Complexity Security Scheme for Drone Communication Based on PUF and LDPC
## 3 Security Architecture
### ID Extraction  
In Table 2, it is important to note that the distribution of stack memory in different types of microcontrollers varies, and there is no unique extraction position or method. Typically, after the _.bss_ segment and the _.data_ segment, the heap space is incrementally allocated from the lowest address, while the stack space is decremented from the highest address. For example, in the Arduino MEGA, the stack is located on both sides of memory; so, extraction requires identifying the midpoint between the maximum heap space and maximum stack space, which may necessitate re-registration when updating the main program of the device. However, for the STM32F407 used in this study, by examining the memory mapping file (.map) generated during the compilation of the Keil project, it is found that RAM1 has a total size of 0x1c000 (112 KB) and RAM2 has a total size of 0x4000 (16 KB). RAM1 has a base address of 0x20,000,000, with a heap space of size 0x200 (512 B) at an offset of 0 xd8 from the base address, and a stack space of size 0x400 (1024 B) at an offset of 0x2d8. Therefore, we choose 128 bytes from the end of RAM1 (from 0x2001c000 to 0x2001 bf80) to be used to extract the fingerprint PUF and identity PUF.  
In the above RAM segment, 64 bytes near the end of the RAM are used to extract the identity PUF, the remaining 64 bytes are used as the identity PUF, and the start position of the identity PUF is recorded in the drone. The RAM fragment used for the identity PUF is subjected to 100 power-ups to test the stability of each bit. It is found that the number of unstable bits exceeds \(\alpha=20\%\). These 100 sets of data are labeled stable bits and unstable bits based on the threshold \(\tau=90\%\) (see Table 2, Step 3), where threshold \(\tau\), if set too high, results in a very stable segment but requires a large amount of storage for the unstable bit set \(S_{us}\), while setting the threshold too low exceeds the error correction performance of the LPDC codes. A segment containing 256 stable bits is extracted using a sliding window with a step size of 1 byte, and the window offset, the read length (approximately \(32B\times(1+\alpha)\approx 38B\) under the current threshold), and the unstable position set \(S_{us}\) (typically \(256 bits\times\alpha\tau\approx 46 bits\) need to be recorded) are recorded. The above information is written into the microcontroller program, and after re-powering the device 100 times, it is observed that there is \(n_{e}\in\{0,1,2\}\) bit flips with each power cycle. In short, in a 38-byte contiguous segment containing 256 bits of identity PUF, the remaining bits are recorded in the unstable set, and the bits of the identity PUF that are still subject to change are recorded in the predicted unstable set.  
Furthermore, if the response that the identity PUF receives each time is powered up is denoted by \(ID\), then the difference between \(ID\) and the registered \(ID\) can be denoted by \(\varepsilon=ID\oplus ID\), where \(\varepsilon\) is a 256-bit sequence containing \(n_{e}\) \"1\"s. The extraction results in the context of this study are shown in Table 4, indicating that both the Hamming weight and Hamming distance for the ID and RAM are close to the theoretical values in a statistical sense.