Bias-Cancelling Four-Row Arbiter PUF for Improved Reliability and Security in Authentication

This work presents a 4-row cyclic Enhanced Arbiter PUF (EA-PUF) architecture designed to mitigate spatial delay bias while maintaining high reliability and resistance to modeling attacks. The proposed topology employs a rotation-symmetric four-lane switching network with antipodal pairing, enabling intrinsic gradient cancellation within a single arbiter race. We provide rigorous theoretical foundations through formal bias-cancellation theorems, proving that the 2-row direct-comparison topology cannot cancel gradient bias, while the 4-row design with mirrored placement achieves exact cancellation. A uniqueness proof demonstrates that the antipodal pairing (lanes 0,2 versus 1,3) is the only configuration achieving bias cancellation under mirror-symmetric placement. Hardware implementation on twelve Altera Field Programmable Gate Arrays (FPGAs), spanning heterogeneous and homogeneous device families, demonstrates strong physical symmetry. Timing analyzer of post-synthesis netlists reveals maximum lane delay skew reduced to 37 ps compared to 135 ps in a conventional 2-row Arbiter PUF. The design occupies only 76 LUTs, achieves fmax of 199.12 MHz, and consumes 0.17 mW total thermal power, showing minimal area and power overhead. Across all boards, we measured near-ideal uniqueness (35.58%-57.67%), reliability up to 96.49%, uniformity centered around 53.08%, and balanced bit aliasing (53.09%). Comprehensive entropy analysis yielded Shannon entropy median of 0.992 bits/bit and Min-entropy median of 0.862 bits/bit. Authentication metrics achieved low False Acceptance Rates (1.28%-2.86%) and False Rejection Rates (0.72%-2.37%). Extensive machine learning evaluation using Artificial Neural Networks (ANNs) with depths ranging from 3 to 10 layers demonstrated fundamental modeling resistance, with prediction accuracies plateauing near 54%-57%. These results validate the EA-PUF as a bias-resilient, resource-efficient, and secure candidate for deployment in constrained authentication environments.