Exploring Delay-based PUFs for Energy-Efficient Low-Overhead Security of Wearable Devices
Source: arXiv:2607.14395 · Published 2026-07-15 · By Venkata Prasanth Yanambaka, Uma Choppali, Saraju P. Mohanty
TL;DR
This paper addresses the critical need for energy-efficient, low-overhead hardware security mechanisms tailored to resource-constrained wearable IoT devices that continuously collect and transmit sensitive personal data. The authors focus on Physical Unclonable Functions (PUFs) as hardware-assisted security primitives that generate device-unique cryptographic keys by leveraging intrinsic manufacturing variations. Specifically, two delay-based PUF architectures—the Arbiter PUF and the Hybrid Oscillator Arbiter (HOA) PUF—are analyzed for their suitability in low-power wearable security applications. Through detailed design, simulation, and power consumption evaluation, the study demonstrates that the HOA PUF consumes only 2.7 μW, considerably less than the 25 μW consumed by the Arbiter PUF, enabling robust security with minimal energy overhead in IoT ecosystems. These results position the HOA PUF as a compelling choice for energy-constrained wearable devices, facilitating hardware-rooted trust without compromising battery life.
Key findings
- Arbiter PUF consumes approximately 25 μW to generate cryptographic keys suitable for wearable IoT devices.
- Hybrid Oscillator Arbiter (HOA) PUF achieves significantly lower power consumption at 2.7 μW.
- Both Arbiter and HOA PUF architectures demonstrate low key generation error rates, supporting reliable cryptographic key extraction.
- PUF-generated keys are inherently unique per device due to manufacturing variations, preventing key cloning.
- HOA PUF architecture combines ring oscillator and arbiter PUF elements with inverter-based delay stages to maximize energy efficiency.
- Simulations were conducted on FinFET-based 22nm and 20nm technology nodes to model real-world manufacturing variability and power characteristics.
- PUFs can dynamically reconfigure keys on-the-fly, enhancing security under active attack conditions by generating multiple strong keys from the same device.
- PUF architectures provide minimal power overhead, suitable for integration into wearable devices without degrading battery life or performance.
Threat model
The adversary is assumed to be capable of passive adversarial attacks such as eavesdropping, side-channel attempts to extract keys, or active software exploits on wearable IoT devices. However, the attacker cannot physically clone or perfectly replicate the unique nanoscale manufacturing variations that produce the PUF’s intrinsic randomness. The PUF module’s keys are considered unclonable and reconfigurable, which means even if an attacker obtains a key, it can be renewed dynamically. The adversary cannot directly access or alter the PUF’s internal physical properties but may attempt cryptanalysis or machine learning to model the challenge-response behavior.
Methodology — deep read
The paper begins by identifying the threat model: adversaries capable of intercepting or compromising wearable devices to access sensitive user data but unable to physically clone device hardware or perfectly replicate silicon manufacturing variations. The study assumes resource-constrained devices with strict power budgets needing lightweight cryptographic key generation.
The authors analyze two principal PUF architectures: Arbiter PUF and Hybrid Oscillator Arbiter (HOA) PUF. Both rely on subtle, uncontrollable manufacturing variations affecting transistor gate delays to produce unique challenge-response pairs (CRPs). The Arbiter PUF uses cascaded multiplexers with a D flip-flop arbiter to output a 1-bit response per challenge input based on delay differences between two signal paths. The HOA PUF combines ring oscillators feeding multiplexers, whose outputs serve as inputs to a D flip-flop arbiter; the ring oscillators generate frequency variations intrinsic to device fabrication.
Simulations of these architectures were performed using FinFET process models at 22nm and 20nm nodes to realistically capture nanoscale variations impacting timing and power consumption. The authors constructed the architectures in FPGA-like environments allowing rapid prototyping. Power consumption was measured under challenge conditions, with results indicating HOA PUF requires substantially less power than the Arbiter PUF.
The paper discusses methods for scaling output key lengths by combining multiple PUF instances, but acknowledges that not all possible challenge-response pairs satisfy figures of merit necessary for cryptographic use (e.g., uniqueness, reliability, and randomness). They also highlight the reconfigurability of keys enabling on-the-fly regeneration to mitigate hardware attacks.
Evaluation used metrics including power consumption (μW), error rates in key generation, uniqueness across devices, reliability under environmental fluctuations, and resistance to machine learning attacks as cited from related work. Baselines include existing PUF architectures like SRAM PUF and ring oscillator PUF.
No code release or public dataset is mentioned, but the methodology is reproducible given the detailed architecture diagrams and FinFET process node parameters. No adversarial attacks or distribution shift evaluations were explicitly conducted, focusing mainly on power and architectural simulation.
A concrete example detailed the HOA PUF structure: two groups of identical ring oscillators connect to multiplexers controlled by input challenge bits; outputs feed a single D flip-flop arbiter that outputs a bit based on relative arrival times resulting from frequency differences induced by manufacturing variations. This process, repeated across multiple RO pairs, generates cryptographic keys at notably low power costs.
Technical innovations
- Design and simulation of a Hybrid Oscillator Arbiter (HOA) PUF combining ring oscillator frequency variations with arbiter PUF delay measurement to minimize power consumption.
- Demonstration that HOA PUF consumes an order of magnitude less power (2.7 μW) than traditional Arbiter PUF (25 μW) while maintaining security properties.
- Use of inverter-based delay elements and multiplexed ring oscillator groups to increase key generation efficiency and energy savings.
- Evaluation of PUF architectures within FinFET technology nodes (22nm, 20nm), reflecting realistic manufacturing process variations for IoT deployment.
Baselines vs proposed
- Arbiter PUF: power consumption = 25 μW vs HOA PUF: 2.7 μW for comparable key generation
- Related ring oscillator PUFs in prior work consuming ~140 nW (OC-PUF) with different reliability metrics
- VGSOT-MTJ PUF: 63.67 fJ/bit energy with 0.27 Gb/s bit rate vs HOA PUF trade-off balancing power and complexity (exact throughput unclear)
Figures from the paper
Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.14395.
Fig 1: illustrates the architecture of wearable devices within the broader IoT ecosystem. Recent advances in consumer-
Fig 2: Security Challenges of Wearable Devices.
Fig 3 (page 2).
Fig 4 (page 2).
Fig 5 (page 2).
Fig 3: Working of a PUF.
Fig 4: CRP - Based Classfication of PUF.
Fig 8 (page 3).
Limitations
- No experimental validation on physical hardware; results are from simulations only, limiting real-world applicability.
- Lack of adversarial or side-channel attack evaluation to assess robustness against practical security threats.
- Environmental variations (temperature, voltage) impacts on PUF reliability were discussed but not extensively quantified.
- No direct comparison to software-only lightweight cryptographic key generation approaches on similar platforms.
- Code, designs, or datasets are not publicly released limiting reproducibility by external researchers.
- Machine learning-based modeling attacks are noted as a vulnerability for certain PUF types but not empirically tested here.
Open questions / follow-ons
- How do these PUF architectures perform under real-world environmental stressors like temperature swings and voltage noise affecting wearable devices?
- What is the resilience of HOA PUF and Arbiter PUF to advanced machine learning-based modeling attacks in practice?
- Can the HOA PUF architecture be integrated and tested on actual silicon chips or commercial wearable prototypes to confirm simulated power gains?
- How scalable are these PUF designs to multi-bit key generation while maintaining low error rates and high uniqueness in diverse IoT deployments?
Why it matters for bot defense
For bot-defense and CAPTCHA practitioners, this research highlights the potential of integrating hardware-rooted security primitives like PUFs into wearable and resource-constrained IoT devices commonly used for authentication and user interaction. The low power consumption and minimal overhead of the HOA PUF architecture suggest it can provide robust device identity and key generation without adversely impacting device battery life or user experience. This can aid in securely binding cryptographic credentials to physical devices in the field, reducing risks of credential cloning or impersonation attacks. However, further security evaluation under adversarial conditions and real-world deployment remain necessary to assess robustness against sophisticated attackers. Practitioners should consider hardware-assisted security approaches like PUFs as complementary to software and behavioral bot detection methods, especially as wearable and IoT devices proliferate in CAPTCHA-sensitive environments.
Cite
@article{arxiv2607_14395,
title={ Exploring Delay-based PUFs for Energy-Efficient Low-Overhead Security of Wearable Devices },
author={ Venkata Prasanth Yanambaka and Uma Choppali and Saraju P. Mohanty },
journal={arXiv preprint arXiv:2607.14395},
year={ 2026 },
url={https://arxiv.org/abs/2607.14395}
}