# A Lightweight and Practical Anonymous Authentication Protocol Based on Bit-Self-Test PUF
## 1 Introduction  
Nowadays, with the popularity of IoT applications, the use of lightweight devices such as Radio Frequency Identification (RFID) and Near Field Communication (NFC) is becoming more widespread. When these devices communicate information over open and insecure communication channels, there is a high risk that data can be easily intercepted or tampered with by attackers, thus becoming an entry point for attackers to access IoT devices or personal data. This flexible access makes it possible for any insecure device endpoint to have an impact on the security of the entire IoT system [1, 2, 3]. Therefore, it is particularly important to design a lightweight, efficient, and reliable mutual authentication protocol. The unpredictable output of PUFs makes them a good choice for security primitives in lightweight systems such as RFID and NFC. Compared with traditional protocols, the PUF-based protocols have more security characteristics, such as preventing device-side tampering, probing, and cloning attacks [4, 5, 6, 7, 8, 9, 10, 11]. PUF is a special physical entity that uses uncontrollable random process deviations in the manufacturing process of an integrated circuit to generate a unique mapping relationship, to which an unpredictable response \(R\) can be generated in real-time by inputting a random challenge \(C\) to the PUF circuit [12]. Due to this feature, the key informationrequired for authentication does not need to be stored as plaintext or ciphertext in the non-volatile memory (NVM) inside the chip but is generated in real time by the PUF circuit inside the chip. Moreover, due to the unclonable property of the PUF, even if an attacker could probe the circuit structure of the chip, he would not be able to access the key information, thus ensuring the security of data storage. However, PUF responses are highly susceptible to environmental factors such as voltage, temperature, and pressure [13], so the original PUF response is not reliable enough and cannot be used directly in authentication, random number generation, and key generation. Existing schemes commonly use error correction codes (ECCs) [14; 15; 16; 17; 18] to recover the correct key from the original PUF response. Researchers have proposed techniques such as Pattern Matching [19], Index-Based Syndrome (IBS) [20], FE [17], or Multiple Evaluation (ME) [15] for removing noise from the PUF response or enhancing the reliability of the PUF response. However, these methods require the introduction of complex algorithms for generating helper data or involve complex mathematical operations, thus making the implementation process very complex with high implementation overheads, which is limited in the application fields of lightweight overhead. Moreover, there are some potential security issues with using the ECCs, such as the fact that the implementation is complicated and the public helper data may disclose the information of the keys [21; 22; 23]. In addition, the authentication protocol is vulnerable to an attacker stealing enough CRPs of the PUF from an insecure channel during the execution process to simulate the PUF mapping relationship and perform a modeling attack on the PUF [24] to decrypt the important information in the authentication, resulting in security vulnerability on both sides of the authentication. Researchers have increased the strength of PUF circuits against modeling attacks by adding non-linear units to the PUF [25] to increase the complexity of their mapping, or by encrypting the CRPs and helper data during the authentication process [26] before being transmitted. However, the introduction of various anti-modeling methods and encryption algorithms that alter the PUF structure undoubtedly increases the hardware overhead, which is not suitable for low-cost RFID with less than 2000 gates circuits. Therefore, the design of a suitable encryption algorithm and a lightweight authentication protocol is essential for RFID systems that require high security and low overhead.