A PUF-based Root-of-Trust for resource-constrained IoT devices

Ensuring cybersecurity resilience in far-edge IoT devices remains a significant challenge, as these systems often lack dedicated hardware security elements such as TPMs or secure enclaves. This paper introduces a cost-effective, SRAM PUFbased RoT architecture tailored for resource-constrained devices, enabling secure authentication and local attestation without relying on persistent key storage. Leveraging a commercially available SRAM module and a syndrome-based fuzzy extractor, the proposed framework enables robust and unforgeable key reconstruction, while a lightweight KDF binds the device identity to device-specific system properties (dynamic or static), thereby providing attestation capabilities in resource-constrained environments. A realistic telehealth monitoring scenario, involving an ECG device and a trusted gateway, demonstrates the feasibility of deploying the solution in real-world use cases. Extensive benchmarking results validate the low overhead of cryptographic operations and trustworthiness evidence extraction, highlighting the practicality of the proposed approach for scalable, resilient far-edge infrastructures. The presented solution contributes to the broader objective of reinforcing device-centric security foundations within the evolving landscape of critical IoT deployments.