A PUF-Based Security Framework for Fault and Intrusion Detection

Technical Summary: A PUF-Based Security Framework for Fault and Intrusion Detection

Problem Statement
Industrial Control Systems (ICS), such as water treatment plants and power stations, rely heavily on sensor feedback to maintain safety-critical processes within operational limits. Attacks on the measurement layer, often originating from supply chain vulnerabilities like embedded hardware Trojans, can compromise sensor readings. When controllers act on these spoofed or faulty data points, they may steer industrial processes toward dangerous states. Furthermore, non-malicious faults caused by electromagnetic interference, vibration, corrosion, or thermal drift can produce similar destabilizing effects. Traditional network-level security tools, such as firewalls, lack visibility into these measurement-layer anomalies. Additionally, conventional authentication methods relying on stored cryptographic keys are increasingly vulnerable to physical attacks and unauthorized access.

Methodology
This research proposes a hardware-root-of-trust framework that embeds a Physically Unclonable Function (PUF) at the measurement layer to authenticate sensor readings. The system integrates with standard ICS architectures without requiring structural changes, utilizing the TCP-MODBUS protocol to communicate between the PUF and the Programmable Logic Controller (PLC).

The methodology consists of three core components:

1. PUF Architecture: The PUF leverages inherent manufacturing variations in CMOS inverter transitions as an entropy source. It generates a response bitstream by sweeping transition regions of an inverter array to extract Total Harmonic Distortion (THD). This THD value is compared against a precomputed mean value stored in a Lookup Table (LUT) indexed by a challenge. To enhance security, a challenge seeds a Pseudo-Random Number Generator (PRNG) to dynamically determine distinct sweep regions, producing an 18-bit response vector from an 8-bit challenge space.
2. Verification Module: This module performs two types of checks:
   • PUF Verification: It validates the current sensor voltage against a learned baseline. It operates within a tolerance window (±2 units) around predefined tank level thresholds (0 to 300 in increments of 20). If a reading falls within a window, the module checks for a matching tank level–PUF response pair in memory.
   • Temporal Verification: This component tracks the difference between the maximum and minimum sensor readings in a queue. It compares the current maximum difference against a value recorded during the enrollment phase. If the difference exceeds the enrolled threshold, the temporal authentication fails.
3. Workflow: The system operates in two phases. During the Enrollment Phase, the system records valid tank level and PUF response pairs within the tolerance windows. During the Authentication Phase, the system performs real-time validation. A successful authentication (both PUF and temporal checks pass) results in a response code of "3". A failure in either check results in a code of "1", signaling a fault or attack.

Experimental Setup and Results
The framework was prototyped on a Hardware-in-the-Loop (HIL) water tank testbed using a Simulink-based PUF emulator, a Factory IO 3D simulator, and an OpenPLC running on a Raspberry Pi 4.

• Normal Operation: Over a 5.18-hour period of normal operation (286,281 samples), the system achieved 99.97% accuracy. There were 72 instances where the system flagged a deviation in the voltage-level baseline (response "2"), though temporal trends remained correct. This resulted in a false-positive rate of 0.025% for voltage signature authentication and zero false positives for temporal authentication.
• Sensor Fault Detection: The system successfully detected and flagged:
  • Spike Faults: High-amplitude impulse signals caused the PUF to transition from a normal state ("3") to an alert state ("1").
  • Hard-Over Faults: Both positive (saturation) and negative (zero collapse) abrupt shifts were detected, with the PUF correctly identifying temporal authentication failures.
• Hardware Trojan Detection: In a scenario where a hardware Trojan remained dormant for one hour before subtracting a constant value from sensor readings, the PUF detected the resulting temporal authentication failures. The system flagged all three Trojan activation periods, preventing the controller from maintaining the water level within the intended band and averting a potential overflow.

Key Contributions
The paper outlines three primary contributions:

1. A process-aware PUF-based sensor authentication framework that combines analog voltage fingerprints with temporal authentication to detect both gradual and abrupt deviations.
2. A hardware-in-the-loop testbed architecture that operationalizes PUF-based authentication within a water tank control system.
3. An empirical evaluation demonstrating high detection accuracy across sensor faults and adversarial scenarios, including hardware Trojans.

Significance
The authors claim this research provides a process-aware, vendor-agnostic approach capable of integrating with legacy plants. By embedding security at the hardware level, the framework offers a mechanism to detect sensor signal degradation and sophisticated supply chain attacks that traditional network monitoring tools cannot see. The system serves as a "true anchor" at the sensing layer, enhancing protection against both malicious tampering and environmental faults in mission-critical environments.

Future Work
The paper suggests future efforts to migrate the virtual PUF model to a Field Programmable Gate Array (FPGA) for real-time signal validation in every PLC cycle. Additionally, the authors propose benchmarking the approach across different ICS domains, testing accuracy in multi-sensor environments with interdependent controllers, and integrating the PUF with a trusted execution environment to create a computing cage for validating sensor responses.