Integrated circuit performing authentication using challenge-response protocol and method using the same

Abstract

This disclosure relates to an integrated circuit that performs authentication using a challenge-response protocol and a method for using the same. The integrated circuit includes an internal challenge generator, a Physically Unclonable Function (PUF) block, and a response generator. The internal challenge generator is configured to receive a challenge, generate a plurality of internal challenges corresponding to the challenge, and generate at least one valid internal challenge among the plurality of internal challenges using filtering information. The Physically Unclonable Function (PUF) block is configured to generate a plurality of valid internal responses, each varying according to the plurality of valid internal challenges. The response generator is configured to output a response generated using the plurality of valid internal responses.

Description

[0001] This application claims the benefit of Korean Patent Application No. 10-2020-0009398, filed on January 23, 2020, with the Korean Intellectual Property Office, the entire disclosure of which is incorporated herein by reference. Technical Field

[0002] The inventive concept relates to an integrated circuit for performing authentication using a challenge-response method, and more specifically, to an integrated circuit for performing authentication using a physically unclonable function of a challenge-response method, and a method of using the integrated circuit. Background Technology

[0003] An integrated circuit is a collection of interconnected electronic circuits on a semiconductor substrate. Integrated circuits are located in electronic devices (such as mobile phones, computers, and televisions) and are used to perform processing tasks. In some cases, companies (enterprises) other than the manufacturer can recreate integrated circuits to mimic the performance characteristics of real components.

[0004] However, counterfeit and cloned integrated circuits pose a significant security threat. For example, counterfeit and cloned integrated circuits can cause security problems if installed in devices intended for use with different circuits.

[0005] Therefore, integrated circuits can be certified after manufacturing but before being installed in electronic devices. Integrated circuit certification ensures that the circuit is a genuine component and will perform as designed. However, certification processes can be resource-intensive, leading to slower results or higher power consumption. Therefore, there is a need in the art to reduce the computational power used in integrated circuit certification. Summary of the Invention

[0006] The inventive concept provides an integrated circuit for performing authentication using a challenge-response method, and more specifically, an integrated circuit for challenge-response authentication that provides a structure with physical anti-copying functionality, and a method for using the integrated circuit.

[0007] According to one aspect of the inventive concept, an integrated circuit configured to perform authentication using a challenge-response method is provided, the integrated circuit comprising: an internal challenge generator configured to: in authentication mode, receive a challenge, generate a plurality of internal challenges corresponding to the challenge, and generate at least one valid internal challenge among the plurality of internal challenges using filtering information; a Physically Unclonable Function (PUF) block configured to generate a plurality of valid internal responses that change according to the plurality of valid internal challenges; and a response generator configured to output a response generated using the plurality of valid internal responses.

[0008] According to another aspect of the inventive concept, an integrated circuit configured to perform authentication using a challenge-response method is provided, the integrated circuit comprising: an internal challenge generator configured to: in a registration mode, receive a plurality of challenges and sequentially generate a plurality of initial internal challenges corresponding to each of the plurality of challenges; a Physically Unclonable Function (PUF) block configured to generate a plurality of initial internal responses that change according to the plurality of initial internal challenges; and a response generator configured to: select at least one available valid initial internal response from among the plurality of initial internal responses and generate filtering information based on the selected at least one valid initial internal response.

[0009] According to another aspect of the inventive concept, a method is provided using an integrated circuit configured to perform authentication using a challenge-response method, the method comprising: receiving a challenge in an authentication mode; generating a plurality of internal challenges corresponding to the challenge; generating at least one valid internal challenge among the plurality of internal challenges using filtering information; generating a plurality of valid internal responses that vary according to each of the plurality of valid internal challenges using a Physically Unclonable Function (PUF) block; and outputting a response generated using the plurality of valid internal responses.

[0010] According to another aspect of the inventive concept, a method for authenticating an integrated circuit includes: receiving an authentication challenge while in an authentication mode of a challenge-response process including a registration mode and an authentication mode; identifying screening information, wherein the screening information is generated based on a plurality of internal responses created using a PUF block while in the registration mode; selecting at least one valid internal challenge from a plurality of initial internal challenges based on the screening information according to the authentication mode; and generating an authentication response to the authentication challenge using a PUF block based on the at least one valid internal challenge. Attached Figure Description

[0011] Embodiments of the inventive concept will become clearer from the following detailed description taken in conjunction with the accompanying drawings, in which:

[0012] Figure 1 This is a diagram illustrating a network system according to an embodiment;

[0013] Figure 2 This is a flowchart of a method for using integrated circuits according to an embodiment;

[0014] Figure 3 This is a block diagram illustrating an integrated circuit according to an embodiment;

[0015] Figure 4 This is a flowchart of a method for using integrated circuits according to an embodiment;

[0016] Figure 5This is a block diagram illustrating the internal challenge generator according to an embodiment;

[0017] Figure 6 This is a block diagram illustrating a response generator according to an embodiment;

[0018] Figure 7 This is a block diagram illustrating a Hamming weight generator according to an embodiment;

[0019] Figure 8 This is a graph showing the distribution of Hamming weights according to an embodiment;

[0020] Figures 9A to 9C These are diagrams illustrating the operation of the screen information generator according to the embodiments;

[0021] Figure 10 This is a block diagram illustrating an integrated circuit according to an embodiment;

[0022] Figure 11 This is a flowchart of a method for using integrated circuits according to an embodiment;

[0023] Figure 12 This is a block diagram illustrating the internal challenge generator according to an embodiment;

[0024] Figure 13 This is a diagram illustrating the operation of the internal challenge selector according to an embodiment;

[0025] Figure 14 This is a block diagram illustrating a response generator according to an embodiment;

[0026] Figure 15 This is a block diagram illustrating an integrated circuit according to an embodiment;

[0027] Figure 16 This is a block diagram illustrating an integrated circuit according to an embodiment;

[0028] Figure 17 This is a block diagram illustrating an integrated circuit according to an embodiment; and

[0029] Figure 18A and Figure 18B This is a block diagram illustrating an environment using integrated circuits according to an embodiment. Detailed Implementation

[0030] This disclosure generally relates to integrated circuits that perform authentication using a challenge-response method, and more specifically, to integrated circuits capable of performing authentication using physically unclonable functions (PUFs). Embodiments of this disclosure use a registration mode and an authentication mode to authenticate the integrated circuit without using an excessive number of PUF units. In registration mode, responses are generated for each of a plurality of challenges. Valid responses are then selected, and validity information (i.e., screen information) can be stored. In authentication mode, the screening information can be used to screen internal challenges before generating responses, thus avoiding excessive use of PUF units.

[0031] Challenge-response authentication is a form of authentication in which one entity poses a question (i.e., a challenge), and the other party must provide a valid answer (i.e., a response) to be authenticated. An example of a challenge-response protocol is password authentication, where the challenge is to ask for a password, and a valid response is the correct password. In some cases, multiple passwords can be used, each tagged with an identifier. The validator can ask for any of the passwords, and the other party must submit the correct password associated with that identifier. If the passwords are chosen independently, an adversary intercepting a challenge-response message pair will be unable to authenticate if different identifiers are submitted. In another example, the challenge-response process can use a PUF (Programmatical Object Framework).

[0032] A physically unclonable function (PUF) is a physical object that provides a physically defined "digital fingerprint" of its output (i.e., response) as a unique identifier for a given input and condition (i.e., challenge). For example, a PUF can be used in semiconductor devices (such as microprocessors). In some cases, a PUF is based on a unique physical change that occurs naturally during semiconductor manufacturing. Therefore, a PUF can be a physical entity implemented with a physical structure. PUFs are often implemented in integrated circuits, especially in applications with high security requirements.

[0033] In some examples, PUFs rely on the uniqueness of their physical microstructure, for example, on random physical factors introduced during manufacturing. These factors can be unpredictable and uncontrollable, making it virtually impossible to replicate or clone the structure. In some cases, PUFs implement challenge-response authentication to evaluate the microstructure without implementing a single cryptographic key. For example, when a physical stimulus is applied to the structure, it responds in an unpredictable (but repeatable) manner due to the complex interaction between the stimulus and the device's physical microstructure. The applied stimulus is called a challenge, and the PUF's response is called a response. A specific challenge and its corresponding response together form a challenge-response pair (CRP). Thus, the identity of the device can be established through properties of the microstructure itself. In some cases, because the structure is not directly revealed by the challenge-response mechanism, the device is resistant to spoofing attacks.

[0034] The term "non-clonable" refers to the fact that even if PUF devices are manufactured as similar devices using the same process, each PUF device has a unique and unpredictable way of mapping the challenge to the response. Therefore, because precise control over the manufacturing process is infeasible, it is infeasible to construct a PUF with the same challenge-response behavior as another given PUF. Mathematically, non-clonability means that it is extremely difficult to compute an unknown response given other CRPs or some properties of the random components from the PUF. This is because the response is created through the complex interaction of the challenge with many or all random components. In other words, given the design of a PUF system without knowing all the physical properties of the random components, the CRP is highly unpredictable.

[0035] In some cases, authentication processing uses an internal response generated by the PUF block (i.e., in response to a challenge). Responses can be generated by filtering out invalid internal responses. However, filtering invalid internal responses in authentication processing consumes the resources of the electronic device.

[0036] According to some embodiments, filtering information is generated by evaluating internal responses in registration mode. For example, filtering information can be generated by evaluating multiple initial internal responses generated for each of a plurality of challenges received from the server. The filtering information may include information about the internal challenge corresponding to a valid initial internal response. The filtering information may also include valid bits of the internal challenge and a valid count after counting invalid internal challenges.

[0037] According to some embodiments, an internal challenge can be generated in response to a challenge received in authentication mode. Valid internal challenges can be selected from the generated internal challenges using filtering information. A response can be generated using the selected valid internal challenge. Therefore, in some examples, a response can be generated when both the valid internal challenge and response of the PUF unit are valid, without using an unwanted PUF unit. Embodiments of the inventive concept will be described in detail below with reference to the accompanying drawings.

[0038] Figure 1 This is a diagram illustrating a network system according to an embodiment.

[0039] Reference Figure 1 Network system 1 may include host 20 and integrated circuit 10. Host 20 may include authentication module 21. Host 20 may be a network system operated (or managed) by an entity with authentication authority over integrated circuit 10 (e.g., the network system of the manufacturer of integrated circuit 10). Host 20 may be implemented as a server. Integrated circuit 10 may connect to host 20 using wired or wireless networks.

[0040] In registration mode, authentication module 21 can register integrated circuit 10. In one embodiment, authentication module 21 can output multiple challenges to integrated circuit 10. Additionally or optionally, authentication module 21 can store challenge-response pairs corresponding to multiple challenges and multiple responses, with the multiple responses being received separately in response to the multiple challenges. Authentication module 21 can perform a registration operation once during the lifetime of integrated circuit 10 (e.g., after integrated circuit 10 is manufactured) according to registration mode. For example, the number of challenge-response pairs can be arbitrarily determined by host 20 to be equal to or greater than the number of times an authentication operation can be performed to authenticate integrated circuit 10 during its lifetime.

[0041] In authentication mode, authentication module 21 can perform authentication operations on integrated circuit 10.

[0042] In one embodiment, the authentication module 21 may arbitrarily determine any one of the multiple challenges CHA included in the challenge-response pair generated in the registration mode, and may output the determined challenge CHA to the integrated circuit 10. Additionally or optionally, the authentication module 21 may authenticate the integrated circuit 10 based on the response RES received from the integrated circuit 10 in response to the challenge CHA. In one embodiment, the authentication module 21 may authenticate the integrated circuit 10 based on whether the received response RES is the same as the response RES corresponding to the challenge CHA.

[0043] Integrated circuit 10 may be referred to as an integrated circuit or device for challenge-response certification. Integrated circuit 10 can generate a response RES corresponding to the challenge CHA. Integrated circuit 10 can be manufactured using semiconductor processes. Additionally or alternatively, integrated circuit 10 may be packaged in a single package or separately packaged in two or more packages.

[0044] Integrated circuit 10 may include an internal challenge generator 110. The internal challenge generator 110 can generate an internal challenge in response to a challenge CHA. In one embodiment, the internal challenge generator 110 can generate the internal challenge based on a nonlinear function. For example, the internal challenge generator 110 can generate the internal challenge by applying the challenge CHA to a hash function (e.g., Cyclic Redundancy Check 32 (CRC32), Message Digest Algorithm 5 (mda5), Secure Hash Algorithm 1 (SHA-1), SHA-256, or RACE (Race Integrity Primitives Evaluation Message Digest, RIPEMD-128)). Alternatively, the internal challenge generator 110 can generate the internal challenge by applying the challenge CHA to a cryptographic algorithm. For example, the cryptographic algorithm could be Data Encryption Standard (DES), Triple DES, Advanced Encryption Standard (AES), RSA (Rivest Shamir Adleman), or Elliptic Curve Cryptography (ECC). Alternatively, the internal challenge generator 110 can generate the internal challenge by applying the challenge CHA to a scrambling function and scrambling the data. In one embodiment, the internal challenge generator 110 can identify valid internal challenges among the generated internal challenges in authentication mode.

[0045] According to embodiments of the inventive concept, integrated circuit 10 can identify a valid internal challenge among a plurality of generated internal challenges. Additionally or optionally, embodiments of the inventive concept can use the valid internal challenge to generate a response RES. In one embodiment, in registration mode, integrated circuit 10 can identify a valid initial internal challenge among a plurality of initial internal challenges generated in response to each of the plurality of challenges, and store information about the valid initial internal challenge. In authentication mode, integrated circuit 10 selects a valid internal challenge generated in response to challenge CHA from the plurality of internal challenges based on the information about the valid initial internal challenge, and uses the valid internal challenge to generate a response RES.

[0046] For ease of description, in this specification, the initial internal challenge may be referred to as the internal challenge generated in the registration mode, and the initial internal response may be referred to as the internal response generated in the registration mode.

[0047] Figure 2This is a flowchart of a method for using integrated circuit 10 according to an embodiment. Figure 2 A method for registering and authenticating the integrated circuit 10, performed by the host 20, is shown.

[0048] Reference Figure 2 Host 20 can register integrated circuit 10 (S11), and integrated circuit 10 can correspondingly perform a registration operation. For example, host 20 can provide multiple challenges to integrated circuit 10, and integrated circuit 10 can provide multiple responses corresponding to the multiple challenges to host 20. Host 20 can manage challenge-response pairs, including multiple challenges and multiple responses, as a database DB.

[0049] During the registration process, integrated circuit 10 can generate screening information corresponding to each of the plurality of challenges (S12). In one embodiment, integrated circuit 10 can generate a plurality of initial internal challenges corresponding to each of the plurality of challenges, and the screening information may include information about valid initial internal challenges among the plurality of initial internal challenges. In one embodiment, integrated circuit 10 can generate initial internal responses corresponding to the initial internal challenges respectively. In some embodiments, integrated circuit 10 can determine whether the initial internal challenge is valid based on a Hamming weight for the initial internal challenge.

[0050] Filtering information can refer to information relating to the validity of internal challenges (i.e., internal challenges in authentication mode) or internal responses (i.e., internal responses in registration mode). Therefore, filtering information can be used to filter internal challenges or responses based on validity. For example, filtering information can include a series of values ​​indicating whether each of a plurality of internal challenges or internal responses is valid (i.e., available). In one example, a value "0" represents a valid internal challenge or valid internal response, while values ​​other than "0" represent invalid internal challenges or invalid internal responses.

[0051] The Hamming weight is the number of symbols that differ from the zero sign of the alphabet used. Therefore, the Hamming weight is equivalent to the Hamming distance (the number of positions where the symbols differ) from a string of all zeros of the same length. See below. Figure 6 This will be described in detail. In one embodiment, the integrated circuit 10 can store the generated filtering information in an internal storage device. In another embodiment, the integrated circuit 10 can output the generated filtering information to the host 20, and the host 20 can store the generated filtering information.

[0052] The host 20 can enter the authentication process at a specific time after the registration process is completed. During the authentication process, the host 20 can select any one of the challenge-response pairs stored in the database DB to authenticate the integrated circuit 10, and can generate a first challenge included in the selected challenge-response pair (S13). The host 20 can then provide the generated first challenge to the integrated circuit 10 (S14).

[0053] Integrated circuit 10 can receive a first challenge and generate a first response using filtering information (S15). In one embodiment, integrated circuit 10 can generate multiple internal challenges using the first challenge, and can use filtering information to identify valid internal challenges among the multiple internal challenges. Integrated circuit 10 can generate a first response using valid internal challenges. Integrated circuit 10 can provide the generated first response to host 20 (S16).

[0054] Host 20 can evaluate the received first response (S17). For example, host 20 can use a database DB to estimate the response corresponding to the first challenge. Additionally or optionally, host 20 can evaluate the first response by comparing the estimated response with the first response. When the estimated response matches the first response, host 20 can determine that the authentication of integrated circuit 10 is successful; otherwise, it can determine that the authentication of integrated circuit 10 is unsuccessful.

[0055] Figure 3 This is a block diagram illustrating an integrated circuit 10 according to an embodiment. Figure 3 The operation of integrated circuit 10 in registration mode is illustrated. (Previous reference) Figure 1 The repeated descriptions given have been omitted.

[0056] Reference Figure 3 The integrated circuit 10 may include an internal challenge generator 110a, a physically unclonable function (PUF) block 120a, and a response generator 130a. The internal challenge generator 110a can perform operations related to... Figure 1 The operation is the same or similar to the operation in the registration mode of the internal challenge generator 110.

[0057] In registration mode, the internal challenge generator 110a can be accessed from the outside (e.g., Figure 1 The host 20 receives multiple challenges CHA1 to CHAn, where n is an integer greater than 1. The multiple challenges CHA1 to CHAn may include a set of challenges available for challenge-response pairs and can be arbitrarily determined by the host 20. The number of challenges CHA1 to CHAn may correspond to the number of times the integrated circuit 10 is certified during its lifetime and can be arbitrarily determined by the host 20.

[0058] The internal challenge generator 110a can sequentially generate multiple initial internal challenges II_CHAk corresponding to each of the multiple challenges CHA1 to CHAN, where k is an integer greater than 1, using a transformation algorithm. For example, multiple initial internal challenges can be generated in response to a single challenge. In one embodiment, the transformation algorithm may include the above-mentioned references. Figure 1 Any of the encryption algorithm, hash algorithm, and scrambling algorithm described.

[0059] PUF block 120a can sequentially receive multiple initial internal challenges II_CHAk and sequentially generate multiple initial internal responses II_RESk corresponding to the multiple initial internal challenges II_CHAk. PUF block 120a may include multiple PUF source circuits. PUF source circuits can generate signals with unique values ​​according to the PUF; in this specification, PUF source circuits may be referred to as PUF units. PUF can be used to provide unique values ​​corresponding to hardware based on the inherent characteristics of the associated hardware. For example, even when multiple pieces of hardware (such as semiconductor chips) are manufactured using the same process, each of the multiple pieces of hardware will be different from each other. Slight variations will occur in the multiple pieces of hardware. Based on these variations, the unique value of the hardware can be extracted, and the extracted value can be used for security applications (such as secure communication, secure data processing, user identification, and firmware updates).

[0060] In some embodiments, the PUF source circuit included in PUF block 120a can have any structure that generates a bit signal with a unique value. As a non-limiting example, the PUF source circuit can include a static random access memory (RAM) type PUF structure based on values ​​stored in SRAM cells, a ring oscillator structure based on frequency fluctuations, a leakage-based PUF structure based on leakage current, or an arbiter PUF structure in which the signal path is arbitrarily determined. Additionally or alternatively, the PUF source circuit can generate a bit signal with a unique value based on the difference in threshold levels of logic gates.

[0061] PUF block 120a can generate an initial internal response II_RESk based on signals generated by multiple PUF source circuits and an initial internal challenge II_CHAk. Therefore, the initial internal response II_RESk can differ from the initial internal response generated by a PUF block included in another integrated circuit of the same structure from the same initial internal challenge II_CHAk. In some embodiments, PUF block 120a can generate an n-bit (where n is an integer greater than 0) initial internal response II_RESk. For example, PUF block 120a may include n PUF source circuits, each of which can generate a bit signal corresponding to 1 bit.

[0062] Response generator 130a can receive an initial internal response II_RESk and can sequentially generate multiple responses RES1 to RESn from the initial internal response II_RESk, where n is an integer greater than 1. Additionally or optionally, response generator 130a can generate filtering information Info_SCR based on the initial internal response II_RESk. In one embodiment, response generator 130a can generate the filtering information Info_SCR based on the n-bit (where n is a natural number greater than 0) Hamming weights of the initial internal response II_RESk.

[0063] The Hamming weight of a string is the number of symbols that differ from the zero sign of the alphabet used. The Hamming weight is equivalent to the Hamming distance from a string of all zeros of the same length. In the case of a string with a given number of bits, the Hamming weight is the number of '1's in the string, or the sum of the given number of binary representations with the l1 norm of the bit vector. In the binary case, the Hamming weight can also be referred to as population count, popcount, sideways sum (or digit summation), or bit summation. Therefore, the Hamming weight HW of an n-bit initial internal response II_RESk (see reference) Figure 6 It can have values ​​from 0 to n.

[0064] The initial internal response II_RESk generated by PUF block 120a can differ from the internal response generated by another integrated circuit. Therefore, the Hamming weights of the internal responses generated by the integrated circuits can have a distribution between 0 and n. For example, while the number of integrated circuits generating an initial internal response II_RESk with approximately n / 2 Hamming weights is relatively large, the number of integrated circuits generating an initial internal response II_RESk with approximately 0 or n Hamming weights can be relatively small.

[0065] For successful challenge-response authentication, a constant response corresponding to the same challenge can be generated. The response generator 130a can prevent the accumulation of errors that may occur in the PUF block 120a by generating multiple responses RES1 to RESN based on Hamming weights. For example, although at least some of the multiple PUF source circuits included in the PUF block 120a can generate bit signals with constant values, others may generate bit signals with variable values ​​depending on conditions (e.g., time, temperature, voltage, etc.). While the former are referred to as stable PUF source circuits, the latter can be referred to as unstable PUF source circuits. Errors may occur due to unstable PUF source circuits when multiple bit signals output from multiple PUF source circuits are combined using logical operations (e.g., AND, OR, etc.) to generate a response. In other words, errors in unstable PUF source circuits may accumulate in the response. However, as described later, since Hamming weights are used in the response generation operation by response generator 130a, the accumulation of errors due to unstable PUF source circuitry can be prevented, and as a result, a constant response corresponding to the same challenge can be generated.

[0066] In embodiments of the inventive concept, the response generator 130a can determine whether the initial internal response II_RESk is valid based on the Hamming weight HW of the initial internal response II_RESk, and can generate information about the initial internal challenge II_CHAk corresponding to the valid initial internal response II_RESk as filtering information Info_SCR. Additionally or optionally, in the authentication mode described later in FIG9, errors that might be generated in PUF block 120a can be prevented in advance by selecting a valid internal challenge using the filtering information Info_SCR.

[0067] In one embodiment, the internal challenge generator 110a, the PUF block 120a, and the response generator 130a can operate independently of each other. In other words, after the internal challenge generator 110a generates a first initial internal challenge corresponding to the first challenge, the PUF block 120a can generate a first initial internal response corresponding to the first initial internal challenge, while the internal challenge generator 110a generates a second initial internal challenge corresponding to the second challenge. Additionally or optionally, the response generator 130a can also generate a response independently of the internal challenge generator 110a and the PUF block 120a. As described above, because each component of the integrated circuit 10 operates independently according to the inventive concept, the integrated circuit 10 can quickly and efficiently perform the response generation operation corresponding to the challenge from the host 20.

[0068] Figure 4 This is a flowchart of a method for using integrated circuit 10 according to an embodiment. Figure 4 A method for using integrated circuit 10 in registration mode is shown.

[0069] Reference Figure 4 The host 20 can generate multiple challenges included in the challenge group (S21) and provide the generated multiple challenges to the integrated circuit 10 (S22). The integrated circuit 10 can sequentially generate initial internal responses corresponding to the multiple challenges (S23). In one embodiment, the integrated circuit 10 may include a PUF block 120a. The integrated circuit 10 can generate multiple initial internal challenges corresponding to each of the multiple challenges, and the PUF block 120a can be used to sequentially generate multiple initial internal responses that change according to the multiple initial internal challenges.

[0070] Integrated circuit 10 can select a valid initial internal response from a plurality of initial internal responses based on Hamming weights (S24). In one embodiment, integrated circuit 10 can calculate a Hamming weight for each of the plurality of initial internal responses and determine the validity of each of the plurality of initial internal responses by comparing the calculated Hamming weights with a reference value.

[0071] Integrated circuit 10 can generate screening information based on a valid initial internal response (S25). In one embodiment, the screening information may include information about a valid initial internal challenge corresponding to a valid initial internal response. In another embodiment, the screening information may include information about a valid initial internal response.

[0072] Integrated circuit 10 can generate a response for each of a plurality of challenges based on a valid initial internal response (S26). Integrated circuit 10 can then provide the generated response to host 20 (S27). Host 20 can receive the generated response and store challenge-response pairs including the response and the corresponding challenge (S28). In one embodiment, integrated circuit 10 can transmit generated filtering information to host 20. Host 20 can store the transmitted filtering information.

[0073] Figure 5 This is a block diagram illustrating the internal challenge generator 110a according to an embodiment. Figure 5 The operation of the internal challenge generator 110a in registration mode is shown. (Refer to...) Figure 3 The repeated descriptions given have been omitted.

[0074] Reference Figure 5 The internal challenge generator 110a may include a challenge buffer 111a and a conversion module 112a. In registration mode, the challenge buffer 111a may store challenges from external sources (e.g., Figure 1The host 20 receives multiple challenges CHA1 to CHAN, and the conversion module 112a can sequentially read the multiple challenges CHA1 to CHAN from the challenge buffer 111a. Therefore, the challenge buffer 111a may include at least one storage device, which may include, but is not limited to, storage cells (such as SRAM cells, dynamic RAM (DRAM) cells, flash memory cells, magnetoresistive RAM (MRAM) cells, and phase-change RAM (PRAM) cells).

[0075] The conversion module 112a can read the first challenge CHAk from the challenge buffer 111a and can sequentially generate a plurality of first initial internal challenges II_CHAk from the first challenge CHAk using a conversion algorithm. In one embodiment, the conversion module 112a can receive an n-bit first challenge CHAk and generate m first initial internal challenges II_CHAk (where m is an integer greater than 0) from a plurality of first initial internal challenges II_CHAk by applying the first challenge CHAk to the conversion algorithm. Each of the m first initial internal challenges II_CHAk may include 1 bit of data.

[0076] In one embodiment, the conversion algorithm may include one or more of encryption algorithms, hashing algorithms, and scrambling algorithms. The conversion module 112a can generate multiple first initial internal challenges II_CHAk by repeatedly applying the conversion algorithm to the first challenge CHAk. For example, the conversion module 112a can generate the first first initial internal challenge by applying the conversion algorithm to the first challenge CHAk once, and can generate the m-th first initial internal challenge by applying the conversion algorithm to the first challenge CHAk m times.

[0077] although Figure 5 Not shown in the text, but as Figure 3 As described above, multiple first initial internal challenges II_CHAk can be output to PUF block 120a, and multiple first initial internal responses II_RESk, uniquely corresponding to each of the multiple first initial internal challenges II_CHAk, can be generated by PUF block 120a.

[0078] Figure 6 This is a block diagram illustrating a response generator 130a according to an embodiment. Figure 6 The operation of the response generator 130a in registration mode is shown. (See reference...) Figure 3 The repeated descriptions given have been omitted.

[0079] Reference Figure 6The response generator 130a may include an internal response buffer 131a, a filter information generator 132a, a Hamming weight generator 133a, a filter information buffer 134a, a response accumulator 135a, and a recovery module 136a.

[0080] In registration mode, the internal response buffer 131a can store data from PUF block 120a (see reference). Figure 3 The internal response buffer 131a receives multiple first initial internal responses II_RESk. The filtering information generator 132a and the Hamming weight generator 133a can sequentially read the multiple first initial internal responses II_RESk from the internal response buffer 131a. Therefore, the internal response buffer 131a may include at least one storage device, which may include, but is not limited to, SRAM cells, DRAM cells, flash memory cells, MRAM cells, PRAM cells, etc.

[0081] The Hamming weight generator 133a can generate a Hamming weight HW for each of the multiple first initial internal responses II_RESk read from the internal response buffer 131a. See later. Figure 7 The process of generating Hamming weights HW by the Hamming weight generator 133a is described in detail. The Hamming weight generator 133a can output the generated Hamming weights HW to the filter information generator 132a.

[0082] The filtering information generator 132a can determine whether a plurality of first initial internal responses II_RESk are valid based on the Hamming weights HW. In one embodiment, the filtering information generator 132a may include a comparator CMP. The comparator CMP can compare the Hamming weights HW with at least one reference value TV, and the filtering information generator 132a can generate valid bits for the validity of each of the plurality of first initial internal responses II_RESk based on the comparison results, and can use the valid bits to generate filtering information Info_SCR.

[0083] The filter information generator 132a can store the generated filter information Info_SCR in the filter information buffer 134a. The filter information Info_SCR stored in the filter information buffer 134a can be used later in the authentication process. The filter information buffer 134a may include at least one storage device, which may include, but is not limited to, SRAM cells, DRAM cells, flash memory cells, MRAM cells, PRAM cells, etc. Figure 6 In one embodiment, the internal response buffer 131a and the filtering information buffer 134a are shown as separate components. The internal response buffer 131a and the filtering information buffer 134a can be configured as a single storage device.

[0084] The filtering information generator 132a can select a valid first initial internal response VII_RESk from a plurality of first initial internal responses II_RESk based on the valid bits, and can output the valid first initial internal response VII_RESk to the response accumulator 135a. The response accumulator 135a can generate a first original response RESk' by accumulating the valid first initial internal responses VII_RESk.

[0085] Recovery module 136a can generate a first response RESk by applying a recovery algorithm to the first original response RESk', and can output the generated first response RESk to an external source (e.g., Figure 1 (Host 20 in the context of the host). For example, the first response RESK could be related to... Figure 4 The response corresponding to the first challenge CHAk in the algorithm. In one embodiment, the recovery algorithm may represent an algorithm used to recover the data transformed by the internal challenge generator 110a, and may include any one of a decryption algorithm, a hashing algorithm, and a descrambling algorithm. In one embodiment, the recovery algorithm may be determined based on the transformation algorithm used by the internal challenge generator 110a.

[0086] A decryption algorithm can refer to the process used to decrypt data. Encryption is the process of transforming data into something that appears random. Decryption is the process of transforming encrypted data back to its original form. Symmetric encryption can be used to encrypt large amounts of data. For example, a symmetric key can be used during both encryption and decryption processes. In some examples, encryption algorithms can be used to make it as difficult as possible to decrypt data without using a key. In some cases, there may not be a technique that is significantly better than trying every possible key. For such algorithms, using a longer key makes it more difficult to decrypt data without the key. Examples of encryption algorithms include those based on the Data Encryption Standard (DES), Triple DES, Advanced Encryption Standard (AES), RSA (Rivest Shamir Adleman), or Elliptic Curve Cryptography (ECC).

[0087] A hash function is a function that can be used to map data of various sizes to fixed-size values. The value returned by a hash function is called a hash value, hash code, digest, or simply a hash. The value can be used to index a fixed-size table called a hash table. Indexing a hash table using a hash function is called hashing or distributed storage addressing. In some cases, hash functions and their associated hash tables are used in data storage and retrieval applications to access data in a short and almost constant amount of time using only slightly more storage space than the data or record itself. Therefore, hashing is a computationally and spatially efficient form of data access that avoids the non-linear access time of ordered lists, unordered lists, and structured trees. In some cases, hash functions can avoid the exponential storage requirements of direct access to the state space of large or variable-length keys. In some cases, the use of hash functions relies on the statistical properties of the key and function interaction. Hash functions can also be used in information security applications such as cryptography.

[0088] A scrambling algorithm is a function that transposes, inverts, or otherwise encodes data to make it incomprehensible to a receiver not equipped with a corresponding descrambling algorithm. A descrambling algorithm can decode the data. Since encryption refers to operations performed in the digital domain, scrambling typically refers to operations performed in the analog domain. In some cases, scrambling is done by adding components to the original signal or altering some significant components of the original signal to make extraction of the original signal more difficult. Examples of the latter can include removing or altering vertical or horizontal sync pulses. In some cases, scramblers can also encrypt devices. In some cases, the scrambler manipulates the data stream before transmission. The operation can be reversed by a descrambler on the receiving side. According to one example, the scrambler replaces a sequence with another sequence without removing unwanted sequences.

[0089] In one embodiment, the filter information generator 132a and the Hamming weight generator 133a can be used in registration mode and can be disabled after registration is complete. In authentication mode, a response can be generated without using the filter information Info_SCR to determine a valid internal response. See later. Figure 12 This will be described in detail.

[0090] Figure 7 This is a block diagram illustrating a Hamming weight generator 133a according to an embodiment.

[0091] Reference Figure 7The Hamming weight generator 133a can receive an n-bit initial internal response II_RES and can generate the Hamming weight HW of the initial internal response II_RES. Therefore, the Hamming weight generator 133a may include a serializer SER and a counter CNT.

[0092] To generate the Hamming weights HW for the initial internal response II_RES, a Hamming weight generator 133a with reduced power and size can be used. For example, Figure 1 The integrated circuit 10 can be included in a low-power and small-size device for use in the Internet of Things (IoT). Therefore, as described later, the Hamming weight generator 133a can generate the Hamming weight HW by serializing the initial internal response II_RES and counting the serialized initial internal response II_RES, rather than by adding each bit of the initial internal response II_RES.

[0093] The serializer SER can generate a pulse sequence SEQ by serializing an initial internal response II_RES. Therefore, the pulse sequence SEQ can comprise a series of pulses based on the bits of the initial internal response II_RES. The serializer SER can have any structure for serializing the initial internal response II_RES. The counter CNT can receive the pulse sequence SEQ from the serializer SER and output the Hamming weight HW by counting the pulses of the pulse sequence SEQ. The counter CNT can have any structure for counting the pulses of the pulse sequence SEQ, and in some embodiments, the counter CNT can comprise a ripple counter.

[0094] Figure 8 This is a graph showing the distribution of the Hamming weights HW according to an embodiment.

[0095] Reference Figure 6 and Figure 8 The comparator CMP can determine the effective bits by determining the Hamming weight HW based on two or more reference values ​​(e.g., a first reference value TV1 and a second reference value TV2). Figure 7 In the example, the comparator CMP can assign '0' as the value of the initial internal response for a Hamming weight HW that has a value less than the first reference value TV1, and can assign a first value (e.g., '1') indicating validity '0' to the valid bit VB. The comparator CMP can also assign '1' as the value of the initial internal response for a Hamming weight HW that has a value greater than the second reference value TV2, and can assign a first value (e.g., '1') indicating validity '0' to the valid bit VB.

[0096] The comparator CMP can assign a second value (e.g., '0') indicating invalidity 'X' to the valid bit VB of the initial internal response having a Hamming weight HW greater than or equal to a first reference value V1 and less than or equal to a second reference value TV2. In embodiments of the inventive concept, the filtering information generator 132a can determine the initial internal response with the first value indicating invalidity as the valid bit VB among a plurality of initial internal responses as a valid initial internal response, and can use the valid initial internal responses to generate responses. Additionally or optionally, the filtering information generator 132a can use the valid bit VB corresponding to each initial internal response to generate filtering information.

[0097] When the Hamming weight HW is compared with different first and second reference values ​​TV1 and TV2, the Hamming weight HM of the initial internal response value affected by the unstable PUF source circuit can be ignored, and the value of the initial internal response can remain constant even when the bit signal of the unstable PUF source circuit changes. In some embodiments, the first and second reference values ​​TV1 and TV2 can be determined based on a percentage of data. For example, the unstable PUF source circuit can be accumulated simultaneously with the fabrication of integrated circuit 10.

[0098] Figures 9A to 9C These are diagrams illustrating the operation of the filter information generators 132a, 132b, and 132c according to embodiments.

[0099] Reference Figure 6 and Figure 9A The filter information generator 132a can receive multiple initial internal responses II_RES from the internal response buffer 131a, and can receive the Hamming weight HW of each of the multiple initial internal responses II_RES from the Hamming weight generator 133a. The filter information generator 132a may include a comparator CMP, which can generate the valid bit VB by comparing a reference value TV with the Hamming weight HW.

[0100] exist Figure 9AIn the example, multiple initial internal responses II_RES may include first initial internal responses II_RES1 to sixth initial internal responses II_RES6. The filter information generator 132a can determine the first initial internal response II_RES1, the third initial internal response II_RES3, the fourth initial internal response II_RES4, and the sixth initial internal response II_RES6 as valid initial internal responses and correspondingly assign a first value '0' to the valid bit VB. Additionally or optionally, the filter information generator 132a can determine the second initial internal response II_RES2 and the fifth initial internal response II_RES5 as invalid initial internal responses and correspondingly assign a second value 'X' to the valid bit VB. The filter information generator 132a can store the valid bit VB of each initial internal response as filter information Info_SCR. Figure 8 In the example, the filter information generator 132a can store '1' corresponding to the first value 'O' and store '0' corresponding to the second value 'X', and then generate '101101' as the filter information Info_SCR.

[0101] In one embodiment, the response generator includes a counter that generates a valid count by counting valid initial internal responses among a plurality of initial internal responses based on Hamming weights. (See also...) Figure 6 and Figure 9B The filtering information generator 132b may further include a counter that counts the number of first initial internal responses II_RES1 to sixth initial internal responses II_RES6 up to the occurrence of the first value '0' in the valid bit VB. Since the initial internal response from the first initial internal response II_RES1 up to the occurrence of the first value '0' is the first initial internal response II_RES1, the counter CNT can generate '1' as the valid count CNT_V corresponding to the first initial internal response II_RES1. Next, the initial internal responses from the second initial internal response II_RES2 up to the occurrence of the first value '0' are both the second initial internal response II_RES2 and the third initial internal response II_RES3, and the counter CNT can generate '2' as the valid count CNT_V corresponding to the third initial internal response II_RES3.

[0102] Similarly, since the initial internal response from the fourth initial internal response II_RES4 until the first value 'O' appears is the fourth initial internal response II_RES4, the counter CNT can generate '1' as the valid count CNT_V corresponding to the fourth initial internal response II_RES4. Subsequently, since the initial internal responses from the fifth initial internal response II_RES5 until the first value 'O' appears are the fifth initial internal response II_RES5 and the sixth initial internal response II_RES6, the counter CNT can generate '2' as the valid count CNT_V corresponding to the sixth initial internal response II_RES6.

[0103] The filter information generator 132b can generate a valid count CNT_V as the filter information Info_SCR. Figure 9B In the example, the filter information generator 132b can store '1212' generated as a valid count CNT_V as filter information Info_SCR.

[0104] In one embodiment, the response generator includes a counter that generates an invalid count by counting invalid initial internal responses among a plurality of initial internal responses based on Hamming weights. (See also...) Figure 6 and Figure 9C The filtering information generator 132c may further include a counter for counting the number of first initial internal responses II_RES1 to sixth initial internal responses II_RES6 up to the occurrence of the second value 'X' in the valid bit VB. Since the initial internal responses from first initial internal response II_RES1 up to the occurrence of the second value 'X' are both first internal response II_RES1 and second initial internal response II_RES2, the counter CNT can generate '2' as an invalid count CNT_IV corresponding to the second initial internal response II_RES2. Next, since the initial internal responses from third initial internal response II_RES3 up to the occurrence of the second value 'X' are third initial internal response II_RES3, fourth initial internal response II_RES4, and fifth initial internal response II_RES5, the counter CNT can generate '3' as an invalid count CNT_IV corresponding to the fifth initial internal response II_RES5.

[0105] The filter information generator 132c can generate an invalid count CNT_IV as the filter information Info_SCR. Figure 9C In the example, the filter information generator 132c can store '23' generated as an invalid count CNT_IV as filter information Info_SCR.

[0106] Figure 10This is a block diagram illustrating an integrated circuit 10 according to an embodiment. Figure 10 The operation of integrated circuit 10 in authentication mode is shown. (Refer to...) Figure 1 and Figure 3 The repeated descriptions given have been omitted.

[0107] Reference Figure 10 The integrated circuit 10 may include an internal challenge generator 110b, a PUF block 120b, and a response generator 130b. Figure 10 The internal challenge generator 110b, PUF block 120b, and response generator 130b can be respectively connected to... Figure 3 The internal challenge generator 110a, PUF block 120a, and response generator 130a are configured in the same or similar ways. Figure 10 An embodiment of each of the internal challenge generator 110b, PUF block 120b, and response generator 130b operating in authentication mode is shown. Therefore, the above references... Figure 3 The repeated descriptions given for the internal challenge generator 110b, PUF block 120b and response generator 130b are omitted.

[0108] In authentication mode, the internal challenge generator 110b can be accessed from the outside (e.g., Figure 1 Host 20) receives the first challenge CHA. The first challenge CHA can be in Figure 3 The registration mode uses any one of the multiple challenges CHA1 to CHAN. The internal challenge generator 110b can receive filtering information Info_SCR. In one embodiment, the internal challenge generator 110b can receive the filtering information Info_SCR from the host 20. In another embodiment, the internal challenge generator 110b can read the filtering information Info_SCR from a storage device included in the integrated circuit 10.

[0109] The internal challenge generator 110b can sequentially generate multiple internal challenges corresponding to the first challenge CHA using a transformation algorithm. According to an embodiment of the inventive concept, the internal challenge generator 110b can select a valid internal challenge VI_CHA from the multiple internal challenges based on the filtering information Info_SCR generated in registration mode.

[0110] When Figure 9A As shown, when the valid bit VB is stored in the filtering information Info_SCR, the internal challenge generator 110b can select the internal challenge corresponding to the initial internal response with the first value '0' as the valid bit VB as the valid internal challenge VI_CHA.

[0111] When Figure 9BAs shown, when the valid count CNT_V is stored in the filtering information Info_SCR, the internal challenge generator 110b can select a valid initial internal response by counting the initial internal responses with the first value '0' as the valid bit VB based on the valid count CNT_V, and select the internal challenge corresponding to the valid initial internal response as the valid internal challenge VI_CHA.

[0112] When Figure 9C As shown, when the invalid count CNT_IV is stored in the filtering information Info_SCR, the internal challenge generator 110b can select invalid initial internal responses based on the invalid count CNT_IV for initial internal responses with a second value 'X' as the valid bit VB, and select the internal challenge corresponding to the valid initial internal response selected by excluding invalid initial internal responses as the valid internal challenge VI_CHA.

[0113] PUF block 120b can receive valid internal challenges VI_CHA and sequentially generate valid internal responses VI_RES corresponding to the valid internal challenges VI_CHA. Because the filtering operation for invalid internal responses has been performed through the filtering information Info_SCR, the valid internal responses VI_RES can include valid data with values ​​'1' or '0' based on Hamming weights.

[0114] Response generator 130b can receive valid internal responses VI_RES and can generate a first response RES by accumulating or concatenating valid internal responses VI_RES. In one embodiment, the first response RES can be the same as the response generated in response to the first challenge CHA in registration mode. In one embodiment, response generator 130b can generate the first response RES based on the Hamming weights of the valid internal responses VI_RES.

[0115] According to embodiments of the inventive concept, the internal challenge generator 110b can select a valid internal challenge VI_CHA from a plurality of internal challenges using the filtering information Info_SCR generated in registration mode. Additionally or optionally, the integrated circuit 10 can prevent the application of unwanted invalid internal challenges to the PUF block 120b by generating a first response RES using the valid internal challenge VI_CHA. As a result, the authentication speed can be improved.

[0116] Figure 11 This is a flowchart of a method for using integrated circuit 10 according to an embodiment. Figure 11 A method for using integrated circuit 10 in authentication mode is shown.

[0117] Reference Figure 11The host 20 can generate a first challenge from a set of challenges generated during the registration process (S31), and can provide the generated first challenge to the integrated circuit 10 (S32). The integrated circuit 10 can generate an internal challenge for the first challenge (S33). The integrated circuit 10 can select a valid internal challenge from the internal challenges based on screening information (S34). In one embodiment, a valid internal challenge may be an internal challenge corresponding to an initial internal response that was determined to be valid during the registration process. Therefore, the integrated circuit 10 can receive screening information. In one embodiment, the integrated circuit 10 can receive screening information from the host 20.

[0118] Integrated circuit 10 can use a selected valid internal challenge to generate a valid internal response (S35). In one embodiment, integrated circuit 10 can generate data that changes according to the valid internal challenge as a valid internal response via a PUF block. Integrated circuit 10 can generate a first response based on the valid internal response (S36) and provide the generated first response to host 20 (S37).

[0119] Host 20 can authenticate integrated circuit 10 based on the received first response and the challenge-response pair stored in the database (S38). In one embodiment, host 20 can authenticate integrated circuit 10 by receiving a response corresponding to the first challenge from the database DB and comparing the response received from the database with the first response. For example, when the response received from the database is the same as the first response, host 20 can determine that the authentication of integrated circuit 10 is successful, and when the response received from the database is different from the first response, host 20 can determine that the authentication of integrated circuit 10 is unsuccessful.

[0120] Therefore, according to one aspect of the inventive concept, a method for authenticating an integrated circuit includes: receiving an authentication challenge while in an authentication mode, which is a challenge-response process including a registration mode and an authentication mode; identifying screening information, wherein the screening information is generated based on a plurality of internal responses created using a PUF block while in the registration mode; selecting at least one valid internal challenge from a plurality of initial internal challenges based on the screening information according to the authentication mode; and generating an authentication response to the authentication challenge using a PUF block based on the at least one valid internal challenge.

[0121] In some examples, the method further includes: receiving multiple registration challenges while in registration mode; generating multiple initial internal responses for each registration challenge; selecting at least one valid internal response from the initial internal responses; generating filtering information based on the valid internal responses; and generating a registration response for each registration challenge based on at least one valid internal response.

[0122] In some examples, the method further includes: generating an internal challenge based on an authentication challenge received while in authentication mode; determining the validity of each internal challenge based on filtering information, wherein at least one valid internal challenge is selected based on validity; and generating at least one internal response using a PUF block based on at least one valid internal challenge, wherein the authentication response is generated based on at least one internal response.

[0123] Figure 12 This is a block diagram illustrating the internal challenge generator 110b according to an embodiment. Figure 12 The operation of the internal challenge generator 110b in authentication mode is shown. (Previous reference) Figure 5 The repeated descriptions given have been omitted.

[0124] Reference Figure 12 The internal challenge generator 110b may include a challenge buffer 111b, a conversion module 112b, and an internal challenge selector 113b. Because the challenge buffer 111b and the conversion module 112b perform respectively... Figure 5 The operations of the challenge buffer 111a and the conversion module 112a are the same or similar, so their repeated descriptions are omitted.

[0125] In authentication mode, challenge buffer 111b can store data from external sources (e.g., Figure 1 The host 20) receives the first challenge CHA, and the conversion module 112b can read the first challenge CHA from the challenge buffer 111b. The conversion module 112b can use a conversion algorithm to sequentially generate multiple internal challenges I_CHAs from the first challenge CHA.

[0126] The internal challenge selector 113b can select a valid internal challenge VI_CHA from multiple internal challenges I_CHA based on the filtering information Info_SCR in authentication mode. In one embodiment, the internal challenge selector 113b can be deactivated in registration mode and then activated after entering authentication mode.

[0127] After entering authentication mode, the internal challenge selector 113b can select from the filtering information buffer (e.g., Figure 6The filtering information buffer 134a) reads the filtering information Info_SCR. As described above, the filtering information Info_SCR may include information about valid initial internal responses. Because the multiple internal challenges I_CHA generated in response to the first challenge CHA in the authentication process are the same as the multiple valid initial internal challenges generated in response to the first challenge CHA in the registration process, the information about valid initial internal responses based on the filtering information Info_SCR can be equally applied to the internal responses generated in response to the multiple internal challenges I_CHA. In other words, the validity of the filtering information Info_SCR determines which can be applied to the internal responses and the initial internal responses. Therefore, the internal challenge selector 113b can select the internal challenge corresponding to the valid initial internal response among the multiple internal challenges I_CHA as the valid internal challenge VI_CHA.

[0128] According to embodiments of the inventive concept, invalid internal responses from the internal responses output from the PUF block are pre-filtered by determining valid internal challenges VI_CHA in advance using filtering information Info_SCR. Therefore, resources used to generate invalid internal responses (such as authentication time and PUF units) can be saved.

[0129] Figure 13 This is a diagram illustrating the operation of the internal challenge selector 113b according to an embodiment. (Previously referenced...) Figure 12 The repeated descriptions given have been omitted.

[0130] Reference Figure 13 The internal challenge selector 113b can receive multiple internal challenges I_CHA. Figure 13 In the example, multiple internal challenges I_CHA can include internal challenges I_CHA1 through I_CHA6. However, this is just an example, and a different number of internal challenges can be used.

[0131] The internal challenge selector 113b can obtain the valid bit VB from the filter information Info_SCR. For example, the internal challenge selector 113b can read the valid bit VB included in the filter information Info_SCR. For example, the internal challenge selector 113b can obtain the valid bit VB by determining the first value '0' or the second value 'X' of the valid bit using the valid count CNT_V or the invalid count CNT_IV included in the filter information Info_SCR.

[0132] Internal challenge selector 113b can select an internal challenge where the corresponding valid bit VB is the first value '0' as a valid internal challenge. Figure 13In the example, the valid bit VB corresponding to the first internal challenge I_CHA1, the third internal challenge I_CHA3, the fourth internal challenge I_CHA4, and the sixth internal challenge I_CHA6 has a first value '0'. Therefore, the internal challenge selector 113b can output the first internal challenge I_CHA1, the third internal challenge I_CHA3, the fourth internal challenge I_CHA4, and the sixth internal challenge I_CHA6 as valid internal challenges VI_CHA to the PUF block.

[0133] Figure 14 This is a block diagram illustrating a response generator 130b according to an embodiment. Figure 14 The operation of the response generator 130b in authentication mode is shown. (Refer to...) Figure 6 The repeated descriptions given have been omitted.

[0134] Reference Figure 10 and Figure 14 The response generator 130b may include an internal response buffer 131b, a response accumulator 135b, and a recovery module 136b. In authentication mode, the internal response buffer 131b may store valid internal responses VI_RES output from the PUF block 120b. The response accumulator 135b may generate a first raw response RES' by reading valid internal responses VI_RES from the internal response buffer 131b and sequentially accumulating or concatenating valid internal responses VI_RES. The recovery module 136b may generate a first response RES by applying a recovery algorithm to the first raw response RES', and may output the generated first response RES to an external source (e.g., ...). Figure 1 (Host 20 in the middle).

[0135] Figure 15 This is a block diagram illustrating an integrated circuit 10 according to an embodiment. Figure 15 The operation of integrated circuit 10 in authentication mode is illustrated. (Previous reference) Figure 10 The repeated descriptions given have been omitted.

[0136] Reference Figure 15 Integrated circuit 10 may include an internal challenge generator 110c, a PUF block 120c, and a response generator 130c. In authentication mode, the internal challenge generator 110c can be accessed from external sources (e.g., Figure 1 The host 20) receives the first challenge CHA. The internal challenge generator 110c can use a transformation algorithm to sequentially generate multiple internal challenges I_CHA corresponding to the first challenge CHA.

[0137] PUF block 120c can receive multiple internal challenges I_CHA and sequentially generate multiple corresponding internal responses I_RES. Response generator 130c can generate a first response RES by selecting valid internal responses from the multiple internal responses I_RE based on filtering information Info_SCR and accumulating or concatenating valid internal responses.

[0138] According to an embodiment, the response generator 130c can use the filtering information Info_SCR generated in the registration process to select a valid internal response from a plurality of internal responses. Additionally or optionally, the response generator 130c can use the valid internal responses to generate a first response RES. According to this embodiment, various resources can be saved in such a way that the response generator 130c selects a valid internal response using the filtering information Info_SCR.

[0139] Figure 16 This is a block diagram illustrating an integrated circuit 10d according to an embodiment. Figure 16 An example of an integrated circuit 10d including interface circuitry 140d is shown, which is activated during a registration operation. (See reference...) Figure 3 The repeated descriptions given have been omitted.

[0140] Reference Figure 16 The integrated circuit 10d may include an internal challenge generator 110d, a PUF block 120d, and a response generator 130d. Because the internal challenge generator 110d, PUF block 120d, and response generator 130d are related to... Figure 3 The internal challenge generator 110, PUF block 120 and response generator 130 are the same or similar, so their descriptions are omitted.

[0141] Interface circuit 140d can provide multiple responses RES1 to RESn to the outside of integrated circuit 10d during the registration operation of integrated circuit 10d. For example, interface circuit 140d can receive multiple responses RES1 to RESn and output a signal having multiple responses RES1 to RESn to the outside of integrated circuit 10d. A host (e.g., the manufacturer of integrated circuit 10d) can collect multiple responses RES1 to RESn based on the signals provided by integrated circuit 10d during the registration operation, and can securely store information for authenticating integrated circuit 10d based on the challenge provided to integrated circuit 10d and the collected multiple responses RES1 to RESn. The information for authenticating integrated circuit 10d can be used to authenticate integrated circuit 10d or devices including integrated circuit 10d after delivery of integrated circuit 10d.

[0142] Interface circuit 140d can be enabled during the registration operation and disabled after the registration operation is completed to protect multiple responses RES1 to RESn from attacks. While the enabled interface circuit 140d normally outputs signals including multiple responses RES1 to RESn, the disabled interface circuit 140d cannot output signals including multiple responses RES1 to RESn, or can output signals including information unrelated to the multiple responses RES1 to RESn. In one embodiment, interface circuit 140d can be irreversibly disabled. For example, interface circuit 140d may include at least one fuse, which can be disabled by blowing the fuse after the registration operation is completed.

[0143] Figure 17 This is a block diagram illustrating an integrated circuit 10e according to an embodiment. (Previously referenced...) Figures 1 to 16 The repeated descriptions given have been omitted.

[0144] Reference Figure 17 The integrated circuit 10e may include function blocks that perform other functions and physical copy protection functions of the challenge-authentication type. For example, as a system-on-a-chip (SoC), the integrated circuit 10e may also include an internal challenge generator 110e, a PUF block 120e, a response generator 130e, and a processor 150e. The processor 150e may include any processor that executes a series of instructions and may include a field-programmable gate array (FPGA), a hardware accelerator, etc. In one embodiment, the processor 150e may output various control signals for controlling the internal challenge generator 110e, PUF block 120e, and response generator 130e to the internal challenge generator 110e, PUF block 120e, and response generator 130e.

[0145] Processor 150e can communicate with another device via communication channel CH to send a challenge CHA and / or receive a response RES. Communication channel CH may include a wired channel and / or a wireless channel. For example, processor 150e may provide a challenge CHA to an internal challenge generator 110e based on a signal received via communication channel CH, and transmit a response RES provided by response generator 130e via communication channel CH.

[0146] Figure 18A and Figure 18B This is a block diagram illustrating an environment using integrated circuits according to an embodiment. Figure 18A The environment in which integrated circuits IC1 to ICm (where m is an integer greater than 1) are used in the registration operation is shown. Figure 18B An environment in which integrated circuits IC1 to ICm are used in the authentication operation is shown.

[0147] Reference Figure 18AA computing system 20f, operated by a host (e.g., the manufacturer of integrated circuits IC1 to ICm), can communicate with each of the integrated circuits IC1 to ICm. For example, the computing system 20f can provide multiple challenges to the first integrated circuit IC1 and obtain multiple responses from the first integrated circuit IC1 corresponding to the multiple challenges. The computing system 20f may include a database DB having multiple challenges provided to the first integrated circuit IC1 and multiple responses obtained from the first integrated circuit IC1 corresponding to the multiple challenges. For example, the database DB may store challenge-response pairs. In one embodiment, each of the integrated circuits IC1 to ICm can be configured according to the above reference. Figures 1 to 16 The described method operates in registration mode. In one embodiment, each of the integrated circuits IC1 to ICm can generate filtering information Info_SCR, which includes information about valid internal responses.

[0148] Reference Figure 18B The computing system 20g, operated by a host (e.g., the manufacturer of integrated circuits IC1 to ICm, or the manufacturer of devices 10_1 to 10_m, each including integrated circuits IC1 to ICm (e.g., an authorized user of integrated circuits 10_1 to 10_m)), can communicate with devices 10_1 to 10_m via network 30. Network 30 can include any network, and by way of non-limiting example, network 30 can include a cellular network, a local area network (LAN), a wireless local area network (WLAN), etc. Additionally or optionally, the computing system 20g and devices 10_1 to 10_m can communicate with each other via wired and / or wireless communication.

[0149] The computing system 20g may include a database DB', and the database DB' can be connected to... Figure 18A The database DB in the text is the same, or it may include databases based on... Figure 18A The data is generated by the database DB. The computing system 20g can authenticate devices 10_1 to 10_m based on the database DB. For example, the computing system 20g can generate a challenge based on the database DB and provide the challenge to the first device 10_1 via the network 30. The computing system 20g can receive a response generated by the first integrated circuit IC1 included in the first device 10_1 based on the challenge via the network 30, and can authenticate the first device 10_1 by evaluating the response based on the database DB. In one embodiment, each of the integrated circuits IC1 to ICm can be based on the above reference. Figures 1 to 16 The described method operates in authentication mode. In one embodiment, each of the integrated circuits IC1 to ICm can use filtering information to select a valid internal challenge and generate a response using the selected internal challenge.

[0150] Although the inventive concept has been specifically shown and described with reference to embodiments thereof, it will be understood that various changes in form and detail may be made therein without departing from the spirit and scope of the claims.

[0151] In this disclosure and claims, the word "or" indicates an inclusive enumeration, such as an enumeration of X, Y, or Z representing X or Y or Z or XY or XZ or YZ or XYZ. Furthermore, the phrase "based on" is not used to indicate a closed set of conditions. For example, a step described as "based on condition A" could be based on both condition A and condition B. In other words, the phrase "based on" should be interpreted as meaning "at least partially based on". Additionally, the words "a" or "an" indicate "at least one".

Claims

1. An integrated circuit configured to perform authentication using a challenge-response method, the integrated circuit comprising: An internal challenge generator is configured to: in authentication mode, receive a challenge, generate multiple internal challenges corresponding to the challenge, and use filtering information to select multiple valid internal challenges from among the multiple internal challenges; A physically unclonable functional block is configured to generate multiple valid internal responses, each varying according to the multiple valid internal challenges. as well as A response generator is configured to output a response generated using the plurality of valid internal responses. In this process, the internal challenge generator receives multiple challenges in registration mode and sequentially generates multiple initial internal challenges corresponding to each of the multiple challenges. The physically unclonable functional blocks generate multiple initial internal responses sequentially based on the multiple initial internal challenges, and The response generator is further configured to: calculate the Hamming weight of each of the plurality of initial internal responses, determine the validity of each of the plurality of initial internal responses by comparing the calculated Hamming weight with a reference value, select at least one valid initial internal response, and generate filtering information based on the at least one valid initial internal response, wherein the at least one valid internal response is available among the plurality of initial internal responses.

2. The integrated circuit according to claim 1, wherein, For an initial internal response of n bits, The response generator determines the initial internal response to be valid when the Hamming weight is less than a first reference value smaller than n / 2 or greater than a second reference value larger than n / 2, where n is an integer greater than 0. When the Hamming weight is equal to or greater than the first reference value and equal to or less than the second reference value, the response generator determines the initial internal response as invalid.

3. The integrated circuit according to claim 2, wherein, When the initial internal response is determined to be valid, the response generator generates a first value as the valid bit corresponding to the initial internal response. When the initial internal response is determined to be invalid, the response generator generates a second value, different from the first value, as the valid bit. The filtering information includes valid bits.

4. The integrated circuit according to claim 1, wherein, The response generator includes a counter. The counter generates a valid count by counting the valid initial internal responses among the plurality of initial internal responses based on Hamming weights, and The filtering information includes the valid count.

5. The integrated circuit according to claim 1, wherein, The response generator includes a counter. The counter generates an invalid count by counting invalid initial internal responses among the plurality of initial internal responses based on Hamming weights, and The filtering information includes invalid counts.

6. The integrated circuit according to any one of claims 1 to 5, wherein, In registration mode, the internal challenge generator uses a transformation algorithm to sequentially generate multiple initial internal challenges corresponding to each of the multiple challenges, and In authentication mode, the internal challenge generator receives a first challenge from among the plurality of challenges, sequentially generates a plurality of first internal challenges by applying a transformation algorithm to the first challenge, and selects a plurality of first valid internal challenges from among the plurality of first internal challenges using filtering information.

7. The integrated circuit according to claim 6, wherein, The physically unclonable functional block is also configured to sequentially generate multiple first valid internal responses, each corresponding to one of the multiple first valid internal challenges. The response generator is also configured to generate a first original response by accumulating or concatenating the plurality of first valid internal responses.

8. The integrated circuit according to claim 7, wherein, The response generator is also configured to use a recovery algorithm to restore the first original response to the first response corresponding to the first challenge.

9. The integrated circuit according to claim 8, wherein, The conversion algorithm includes any one of the encryption algorithm, hash algorithm, and scrambling algorithm, and The recovery algorithm can be any of the decryption algorithm, hash algorithm, and descrambling algorithm.

10. An integrated circuit configured to perform authentication using a challenge-response method, the integrated circuit comprising: An internal challenge generator is configured to: in registration mode, receive multiple challenges and sequentially generate multiple initial internal challenges corresponding to each of the multiple challenges; A physically unclonable functional block is configured to generate multiple initial internal responses that change according to the multiple initial internal challenges. as well as A response generator is configured to: calculate a Hamming weight for each of the plurality of initial internal responses, determine the validity of each of the plurality of initial internal responses by comparing the calculated Hamming weights with reference values, select at least one available valid initial internal response from among the plurality of initial internal responses, and generate filtering information based on the at least one valid initial internal response.

11. The integrated circuit according to claim 10, wherein, For an initial internal response of n bits, The response generator determines the initial internal response to be valid when the Hamming weight is less than a first reference value smaller than n / 2 or greater than a second reference value larger than n / 2, where n is an integer greater than 0. When the Hamming weight is equal to or greater than the first reference value and equal to or less than the second reference value, the response generator determines the initial internal response as invalid.

12. The integrated circuit according to claim 11, wherein, The response generator is also configured to: generate a first value as the valid bit corresponding to the initial internal response when the initial internal response is determined to be valid, and generate a second value different from the first value as the valid bit when the initial internal response is determined to be invalid. The filtering information includes valid bits.

13. The integrated circuit according to any one of claims 10 to 12, wherein, The response generator includes a counter. The counter is configured to generate a valid count by counting the valid initial internal responses among the plurality of initial internal responses based on Hamming weights, and The filtering information includes the valid count.

14. The integrated circuit according to any one of claims 10 to 12, wherein, The response generator includes a counter. The counter is configured to generate an invalid count by counting invalid initial internal responses among the plurality of initial internal responses based on Hamming weights, and The filtering information includes invalid counts.

15. A method for authenticating an integrated circuit, the method comprising: When in authentication mode, which includes a challenge-response process encompassing both registration and authentication modes, receive the authentication challenge; Multiple internal challenges corresponding to the generation and certification challenges; Identify filtering information, which is generated based on multiple initial internal responses created using physically unclonable function blocks while in registration mode; Based on the authentication mode and filtering information, at least one valid internal challenge is selected from the plurality of internal challenges; and The authentication response to the authentication challenge is generated using a physically unclonable function block based on at least one valid internal challenge. The method further includes: Accept multiple registration challenges while in registration mode; Multiple initial internal responses are generated for each registration challenge; Calculate the Hamming weight of each of the plurality of initial internal responses; The validity of each of the plurality of initial internal responses is determined by comparing the calculated Hamming weights with reference values; Select at least one valid initial internal response from the plurality of initial internal responses; and Filtering information is generated based on the at least one valid initial internal response.

16. The method according to claim 15, further comprising: A registration response for each registration challenge is generated based on the at least one valid initial internal response.

17. The method according to claim 15 or 16, further comprising: The validity of each internal challenge is determined based on the screening information, wherein at least one valid internal challenge is selected based on the validity; and At least one internal response is generated based on the at least one valid internal challenge using a physically non-clonable function block, wherein the authentication response is generated based on the at least one internal response.

Images