# FeRHA: Fuzzy-Extractor-Based RF and Hardware Fingerprinting Two-Factor Authentication
## 1 Introduction  
The Internet of Things (IoT) conceptually refers to the internetworking of a large number of heterogeneous nodes in an ad-hoc manner [1]. An IoT is defined as a network of interconnected computers, sensors and electronic devices, and actuators that have unique identifiers and the ability to exchange data over a network without manual or human-in-loop management. IoT constitutes a global revolution that profoundly impacts the lives of millions of individuals. Its overarching ambition is to establish machine-to-machine (M2M) communication, thereby enabling the autonomous operation of devices. The fundamental objective of IoT has always been to connect objects anywhere, anytime, and for any purpose, using any intelligent network [2]. In light of the IoT characteristics, decentralized management is a preferred approach in order to ensure effective management of the system. The implementation of decentralized management can offer a strategic advantage by ensuring the continuity of operations, even when access to a central server is disrupted. This approach can effectively eliminate the potential risks and challenges that may arise due to central server unavailability. Hence, it is advisable to adopt decentralized management as a means of ensuring operational stability and continuity. The widespread adoption of IoT networks has brought to the forefront significant security concerns. The openness and pervasiveness of these networks make them inherently vulnerable to infiltration, emphasizing the need for robust device authentication systems. Additionally, the connectivity of IoT devices renders them susceptible to unauthorizedaccess by adversaries from remote locations. Such an attack may use actuators to take harmful actions against the system or even endanger the user's safety. They can attack a device to obtain sensitive data such as location, health, and financial information [3; 4; 5]. Thus, device authentication is crucial to prevent infiltration of the IoT network. In essence, impersonating a legitimate device can be an effective way for an attacker to violate privacy and inject false data. Many lightweight protocols have been developed to establish mutual trust among nodes [6]. However, traditional methods of authentication that rely on key-based communication are susceptible to hacking, and can result in information leakage through side channel analysis and hardware Trojan insertion. These methods also result in significant power and area overheads [6]. To address the aforementioned challenges, quite a few security solutions have been proposed in the literature [7; 8]. Given the limited computation and communication resources of IoT devices, employing lightweight hardware-based security primitives, such as PUFs, has become an attractive design option [9]. The PUF concept is based on the inherent variations in the physical characteristics of a device, which can be exploited to generate a unique and device-dependent identity that is practically hard to replicate [10]. This unique identity can be used for authentication purposes to verify the trustworthiness of an entity based on its own physical characteristics rather than the content it exchanges. From a cryptographic perspective, PUFs are also deemed an attractive option for key generation, as they do not require a secure initial key to be exchanged between the communicating parties. Instead, cryptographic keys are generated using the unique PUF identity of the communicating devices, thereby ensuring a high level of security [11]. While quite a few PUF-based protocols can be found in the literature, mutual authentication of a pair of nodes requires the involvement of a trusted third party, e.g., a secure server [12]. Such a server needs to retain a number of challenge-response pairs (CRPs) for each of the network nodes. However, such an approach does not suit IoT frameworks where distributed network management is favored, if not required [13].