# FeRHA: Fuzzy-Extractor-Based RF and Hardware Fingerprinting Two-Factor Authentication
## 2 Related Work
This method utilizes the distributed values generated during the process of authentication instead of communicating PUF responses directly. Using this method, the vulnerability of raw PUF responses being exposed is minimized. However, the proposed protocol is still susceptible to impersonation attacks and the disclosure of CRPs. P-MAP [13] enables mutual authentication while guarding against PUF modeling attacks by using two challenges and a unique bit-wise binary function specific to the devices involved. However, the challenge bits are vulnerable to unauthorized access by adversaries. Moreover, the security of the protocol heavily depends on keeping the binary function secured. Additionally, [PERSON] et al. [36] have proposed a three-factor authentication protocol for vehicular networks, which combines passwords, biometrics, and PUFs to authenticate vehicles and generate encryption. This protocol ensures secure communication by eliminating the need to store IDs in vehicle sensors. [PERSON] et al. [37] have conducted a study that integrates [PERSON]'s secret sharing and [PERSON]'s verifiable secret sharing with the PUF. However, these approaches bring a significant computational overhead and necessitate the involvement of a trusted third party (server) for mutual authentication. We posit that such involvement could have an adverse impact on performance, as the server may become a bottleneck and require continuous availability. Meanwhile, RF fingerprinting utilizes the unique characteristics of wireless signals to identify and authenticate IoT devices. Unlike traditional authentication methods, which rely on passwords or digital certificates, RF fingerprinting does not require any pre-shared secrets or complex cryptographic algorithms. Instead, it leverages the inherent variability of wireless signals to generate a unique fingerprint for each device, which can be used to verify its identity. Various studies have investigated the application of RF fingerprinting in IoT authentication. [PERSON] et al. [38] delved into the use of RF fingerprinting to authenticate IoT devices. They emphasized the efficacy of this method in achieving high identification accuracy without the need for additional hardware or complex cryptographic mechanisms. The authors demonstrated how RF fingerprinting can successfully differentiate between legitimate IoT devices and unauthorized entities. Recently, [PERSON] et al. [39] have presented a thorough analysis of RF fingerprinting techniques applied to IoT authentication. The study placed special emphasis on the integration of RF characteristics, such as signal strength, phase, and frequency response, as a means to identify devices. However, addressing the noise mitigation in the authentication process using RFF was not considered in their approach. Furthermore, [PERSON] et al. [40] investigated the potential of utilizing machine learning algorithms in combination with RF fingerprinting to enhance the authentication of IoT devices. By employing supervised learning techniques, the authors were able to demonstrate notable improvements in the accuracy and reliability of IoT device authentication. However, relying on RF fingerprinting as the primary authentication factor raises security concerns. [PERSON] et al. [41] have investigated the susceptibility of RF fingerprinting systems to adversarial attacks, highlighting the potential for misclassification and unauthorized access. In particular, they demonstrate that adversarial perturbations can be deliberately crafted using machine learning algorithms to deceive RF fingerprinting classifiers. FeRHA mitigates such vulnerability by incorporating RF fingerprinting as a secondary factor. Our approach capitalizes on the unique characteristics of RF fingerprints to obscure the transmitted CRPs, while avoiding reliance solely on RF fingerprinting to authenticate network devices. Few studies have considered PUFs and RF fingerprints as factors for authenticating IoT nodes. In instance, [PERSON] et al.