# FeRHA: Fuzzy-Extractor-Based RF and Hardware Fingerprinting Two-Factor Authentication
## 2 Related Work  
Numerous authentication methodologies and security provisions have been employed for the protection of wireless networks [22]. Nevertheless, these techniques are not suitable for IoT networks, characterized by low-cost and resource-limited devices that operate in an unsupervised environment. The storage of a device's identity in the memory, as practiced in several authentication techniques, might not be deemed entirely secure. In this regard, PUF-based schemes have been developed to overcome this issue by exploiting the unclonability and uniqueness of PUFs to generate a device signature [23; 24; 25]. Some work combines a PUF and a cryptosystem to protect the exchange CRP from eavesdroppers. For example, [PERSON] et al. [26] have developed an authentication protocol that utilizes PUFs in conjunction with identity-based encryption and a keyed hash function. [PERSON] et al. [27] have addressed the issue of counterfeit products by developing a tripartite authentication protocol and anti-counterfeit tag design based on Rabin public-key encryption and PUFs. The goal of this protocol is to ensure that no counterfeit products are produced and that only legitimate products are available to end users. PUF-IPA [28] is a cryptographic solution designed to safeguard the confidentiality of CRPs. This approach involves an advanced encryption standard (AES)-128-based encryption mechanism to avoid exposure of partial or complete CRPs. Yet, these approaches add complexity by encrypting the exchanged CRPs within IoT nodes. In addition, a third-party server is still required to manage the storage of CRPs and produce secret keys. In a similar vein, [PERSON] et al. [29] leveraged blockchain smart contracts for authenticating IoT devices with miners in the blockchain network. Nonetheless, this protocol uses the computationally intensive Diffie-Hellman key exchange protocol, which could trigger performance difficulties. [PERSON] et al. [30] pursued a multi-factor authentication protocol that combines PUFs with user passwords. [PERSON] and [PERSON] [31] used PUF for authentication and key generation for healthcare IoT devices. However, the CRPs are recorded in a database, which may pose a risk of vulnerability to PUF modeling attacks. [PERSON] et al. [32] developed an authentication scheme by integrating geometric threshold secret sharing with PUFs. Such a solution is designed to prevent storing CRPs in the verifier's database. Yet, the verifier is still obligated to retain both the sub-challenge bit-string and the response's hash. In summary, the aforementioned solutions utilize hashing or encryption, which are resource demanding and could be a limiting factor, particularly in the context of small devices. FeRHA, on the other hand, offers a superior solution by leveraging a combination of PUFs and RF fingerprinting for two-factor authentication. Additionally, our protocol capitalizes on the utilized hardware primitive to obscure the exchanged CRPs without applying any cryptography technique. Table 1 presents a comparison of the various authentication techniques used in the context of IoT. Despite the inherent unclonability, a PUF is still vulnerable to modeling attacks. An attacker could eavesdrop on a prover node with the intent of capturing transmitted authentication packets to other nodes, i.e., verifiers. Using the intercepted CRPs, the attacker may formulate a machine learning model, which mimics the prover's PUF. This enables the attacker to predict the mapping of responses to unobserved challenges. To mitigate such vulnerability, a number of techniques have been pursued. For example, [PERSON] et al. [33] transmitted a restricted number of response bits to the verifier rather than the complete bits. The selected response bits are defined by executing a synchronized random number generator between the prover and the verifier. An alternative strategy is to conceal the challenge bit-string using encryption [34]. [PERSON] et al. [35] introduced a PUF-based authentication method using secret sharing schemes.