# A Lightweight and Practical Anonymous Authentication Protocol Based on Bit-Self-Test PUF
## 2 Related Work
### Analysis and Comparison of PUF-Based Protocols  
PUF-based protocols fall into two main categories, those used between devices and servers and those used between two different devices. In the first category of protocols, [PERSON], [PERSON] et al. [4] proposed a low-cost PUF authentication mechanism for RFID, where the tag containing the PUF produces a sufficient number of CRPs in a secure environment and stores them in the reader's database, but the authentication mechanism transmits challenges and responses in plaintext during the information transfer process, which means the attacker can capture a large number of CRPs to model the PUF mapping and perform modeling attacks on PUFs. [PERSON] et al. propose a lightweight authentication protocol with locking techniques for security issues such as machine learning on PUFs [4]. They limit the number of available CPRs; only trusted entities or servers can authorize access to new CRPs, and the method introduces random numbers on the device to prevent reliability-based attacks, increasing the security of the protocol. However, this method only supports a limited number of authentication cycles (approximately 10,000), which makes it unsuitable for IoT-based device deployments. [PERSON], [PERSON] et al. proposed an embedded platform authentication protocol based on the arithmetic logic unit PUF [5], which has good resistance to bypass attacks and overclocking attacks and does not involve the storage of important information and CRPs. However, its use of PDL logic to improve the uniformity of PUF responses and the inclusion of a fuzzy extractor to enhance the reliability of PUF responses resulted in a large implementation overhead on the device. [PERSON] et al. [6] proposed a lightweight PUF authentication protocol based on the substring matching technique, but this protocol does not implement mutual authentication between the two sides of the protocol while ensuring light weight, which has certain security risks. In [31], [PERSON] et al. proposed a provably secure PUF-based authentication protocol and gave an end-to-end design. The authors used FE based on ECCs to obtain PUF robust responses; moreover, they used a key update mechanism to achieve mutual authentication, satisfying most of the important required security requirements. However, there are some potential security and overhead issues with using the ECCs, such as that the implementation is complicated, the hardware execution overhead is large, and the public helper data may disclose the information of the keys [21; 22; 23]. In addition, when the FE generates the robust response \(r_{1}\), the helper data \(hd\) will be generated at the same time, and the helper data need to be encrypted by the SKE module using the SIMON algorithm [32]. However, when the FE and SKE modules are implemented on the single-chip microcomputer MSP430, they occupy 49.26% of the total memory. Moreover, the execution time of the SIMON algorithm will increase exponentially with the number of bits of the data being encrypted, as in [31]; for 64-bit and 128-bit data, the clock cycle changes from 39,583 to 252,829. Therefore, there are some deficiencies in [31], both in terms of the overhead and execution time of the protocol, which is not suitable for resource-constrained RFID devices. [PERSON] et al. [33] proposed a lightweight authentication protocol for RFID systems based on PUF that can guarantee forward and backward security; it also can resist DoS attacks and physical attacks, and meet most of the protocols' required security performance. Two authentication protocols are proposed in the paper, each considering the presence or absence of noise in the PUF. Although the hardware overhead of the protocol is very friendly in the case of using an ideal PUF, it is clear that a PUF without noise does not exist in practice.