Abstract
Physical Unclonable Functions (PUFs) are promising security primitives for resource-constrained IoT devices. A critical aspect of PUF security research is to identify all potential security risks. This information about vulnerabilities is beneficial for both PUF developers and PUF-using application developers in terms of designing new PUFs to mitigate existing risks and avoid vulnerable PUFs. Recently, a PUF structure called Interpose PUF (IPUF) was proposed, which claims to be resistant to reliability attacks and machine learning modeling attacks. Related studies on this secure PUF design have demonstrated that some IPUFs can still be broken, but large IPUFs may remain secure against all known modeling attacks. In addition, all these studies either focus on plain challenge-response pair attacks or require prior knowledge of IPUF architecture implementation. However, depending on the claim of attack resistance to reliability attacks, we can employ a different attack approach to break IPUFs. In this paper, we describe a subspace pre-learning-based attack method that can rapidly and accurately break the IPUFs that were treated as secure in the earlier study, revealing a vulnerability in IPUFs if the open interface conforms to the way challenge-response data are accessed by the subspace pre-learning-based attack method.