Method, system and electronic device for device requesting registration and authentication, and storage medium

Abstract

The application relates to a device request registration and authentication method and system, an electronic device and a storage medium, the method comprising the following steps: after receiving a registration permission signal, sending a device ID, a unique identity R and a shared key K to a server; sending an authentication request to the server and receiving a random number R3 returned by the server; calling a TIADC-PUF, generating a unique identity R' based on a generated random number R2, auxiliary data S and a pre-generated input sequence through a fuzzy extractor, calculating a ciphertext A through a hash algorithm according to the unique identity R', the shared key K and the random number R3, and sending the ciphertext A and the device ID to the server for authentication by the server; and receiving authentication result information sent by the server; the scheme improves the information security in the data interaction process, meanwhile, the output of the TIACD-PUF is used as the data source for generating the unique identity, the interference ability to temperature and voltage is effectively improved, a PUF does not need to be additionally designed, and the hardware area overhead is reduced.

Description

Technical Field

[0001] This invention relates to the field of hardware security, and in particular to a method, system, electronic device, and storage medium for requesting device registration and authentication. Background Technology

[0002] With the rapid development of information technology, cyberspace and hardware device security issues have received increasing attention. Physically Unclonable Functions (PUFs), as a novel hardware security protection method, have garnered widespread interest from researchers. PUFs possess properties such as stability, uniqueness, and non-cloning, enabling the generation of unique digital signatures, thus finding wide application in hardware security fields (e.g., authentication, IP / IC protection, key generation). Delay-based PUFs (the propagation of digital signals is affected by various factors such as MOSFET channel length, width, threshold voltage, oxide layer thickness, and metal wire shape, resulting in some randomness in the delay) can be broadly categorized into three types: arbitrator-based PUFs, ring oscillator-based PUFs, and glitch-based PUFs. Each of these three types of PUFs has its own advantages and disadvantages.

[0003] An analog-to-digital converter (ADC) is an essential hardware component for interacting with the external environment. However, due to the trade-off between the sampling rate and accuracy of an ADC, the performance of a traditional monolithic ADC cannot meet the requirements in certain high-speed, high-precision scenarios. The emergence of the Time-Interleaved Analog-Digital Converter (TIADC) can fundamentally solve this problem. TIADC utilizes multiple ADCs to process data in parallel, significantly increasing the sampling rate without reducing sampling accuracy. However, affected by temperature and voltage fluctuations, as well as manufacturing errors, the timing of the TIADC can become misaligned, resulting in sampling time mismatch as described in this invention. This introduces a large amount of noise into the results, and may even lead to errors. Therefore, it is necessary to calibrate the output of the TIADC. Calibration generally consists of two stages: the first stage is error extraction, and the second stage is error correction.

[0004] For TIADC, the error of each channel is almost unique. This data characteristic is similar to that of PUF-generated data. However, traditional PUF requires a dedicated PUF as the data source for generating data sequences or unique identifiers. For certified devices equipped with TIADC, how to effectively combine the output sequence of TIADC with the output of PUF, obtain the sampled output sequence of TIADC to replace the current signal generated by PUF and then use it for device certification has become a technical problem that the industry urgently needs to solve. Summary of the Invention

[0005] The purpose of this invention is to effectively utilize the differences in the output signals of each sub-channel of TIADC to replace the traditional PUF, referred to here as TIADC-PUF. It also uses a fuzzy extractor to generate a unique identifier as needed, and the authenticated device does not store the unique identifier, thus effectively improving the information security of the data interaction process.

[0006] In a first aspect, according to embodiments of the present invention, a method for a device to request registration and authentication is provided, applied to an authenticated device, wherein the method includes:

[0007] After receiving the registration permission signal sent by the server, the output sequence of the TIADC-PUF with noise at the first moment is retrieved as the first output sequence. The fuzz extractor uses the first output sequence as input to generate a unique identifier R and an auxiliary dataset. The device ID, unique identifier R and shared key K are sent to the server, and the auxiliary dataset is stored in the storage module.

[0008] Send an authentication request to the server and receive a random number R3 generated by the server based on the authentication request;

[0009] The output sequence of the TIADC-PUF at the second time step with noise is retrieved as the second output sequence. A unique identifier R′ is generated by the fuzz extractor based on the random number R2, the auxiliary data S and the second output sequence. The ciphertext A is calculated by hash algorithm based on the unique identifier R′, the shared key K and the random number R3. The ciphertext A and the device ID are sent to the server for authentication.

[0010] Receive authentication result information sent by the server;

[0011] The auxiliary dataset includes auxiliary data S and random number R2. After receiving the output of TIADC-PUF at the first moment, the fuzz extractor generates random numbers R1 and R2, and generates auxiliary data S based on random number R1 and the output sequence of TIADC-PUF at the first moment.

[0012] Preferably, the step of generating a unique identifier R and an auxiliary dataset using the first output sequence as input through a fuzz extractor includes:

[0013] After receiving the first output sequence, the fuzz extractor generates random numbers R1 and R2;

[0014] The random number R1 generated by the fuzz extractor is encoded by BCH and then XORed with the first output sequence to generate auxiliary data S. The generated random number R2 and the auxiliary data S constitute an auxiliary dataset.

[0015] The generated random number R2 is XORed with the first output sequence, and then subjected to SHA operation to form a unique identifier R.

[0016] Preferably, the method further includes:

[0017] After sending the device ID, unique identifier R, and shared key K to the server, the unique identifier R is deleted.

[0018] Preferably, the step of generating a unique identifier R′ based on the random number R2, the auxiliary data S, and the second output sequence using a fuzzy extractor includes:

[0019] The first operation sequence is obtained by performing an XOR operation and two BCH encodings on the random number R2 and the second output sequence.

[0020] The first operation sequence is XORed with the random number R2 in the auxiliary dataset to obtain the second operation sequence;

[0021] The second operation sequence and auxiliary data S are XORed and then subjected to SHA operation with the second output sequence to obtain the unique identifier R′.

[0022] Preferably, the method further includes: determining the output at the first time step / second time step based on retrieving the noisy TIADC-PUF;

[0023] The step of determining the output at the first moment based on retrieving the noisy TIADC-PUF includes:

[0024] At the first / second time point, the ADCs in each channel of the TIADC-PUF system with sampling time adaptation are sampled to obtain the digital output signals of each channel at the first / second time point.

[0025] The reference signal for the digital output signal of each channel at the first time / second time is determined, the digital output signal of each channel at the first time / second time is corrected, and the error of the digital output signal of each channel is extracted based on the Taylor expansion formula to form the output at the first time / second time.

[0026] Secondly, according to embodiments of the present invention, a method for a device to request registration and authentication is provided, applied to a server, wherein the method includes:

[0027] After sending a registration permission signal to the server, the device ID, unique identifier R, and shared key K sent by the authenticated device are received and saved.

[0028] Receive an authentication request sent by the device being authenticated, generate a random number R3 based on the authentication request, and send the random number R3 to the device being authenticated;

[0029] Receive ciphertext A and device ID sent by the device being authenticated to authenticate the device being authenticated;

[0030] Authentication of the certified device includes:

[0031] Query the unique identifier R corresponding to the device ID based on the device ID;

[0032] Ciphertext A′ is constructed using a hash algorithm based on the unique identifier R, the shared key K, and the random number R3.

[0033] Compare ciphertext A with ciphertext A′ and send the corresponding authentication result information to the authenticated device.

[0034] The unique identifier R′ is obtained by retrieving the output of the noisy TIADC-PUF at the second time step as the second output sequence, and is generated by the fuzz extractor based on the generated random number R2, the auxiliary data S and the second output sequence; the ciphertext A is obtained by the authenticated device through a hash algorithm based on the unique identifier R′, the shared key K and the random number R3.

[0035] Thirdly, according to embodiments of the present invention, a system for device registration and authentication is provided, applied to the authenticated device, comprising:

[0036] The first sending module is used to retrieve the output sequence of the noisy TIADC-PUF at the first moment from the first processing module as the first output sequence, generate a unique identifier R and an auxiliary dataset by using the first output sequence as input through a fuzz extractor, and then send the device ID, the unique identifier R and the shared key K to the server, and send the auxiliary dataset to the storage module.

[0037] The first receiving module is used to receive the registration permission signal sent by the server, and to receive the random number R3 generated by the server based on the authentication request;

[0038] The first processing module is used to retrieve the output of the noisy TIADC-PUF at the first time step as the first output sequence, and generate a unique identifier R and an auxiliary dataset using the first output sequence as input through a fuzz extractor; and

[0039] The output sequence of the noisy TIADC-PUF at the second time step is retrieved as the second output sequence. A unique identifier R′ is generated by the fuzz extractor based on the random number R2, the auxiliary data S and the second output sequence. The ciphertext A is calculated by a hash algorithm based on the unique identifier R′, the shared key K and the random number R3.

[0040] The first sending module is also used to send the ciphertext A and the device ID to the server for authentication by the server;

[0041] The first receiving module is also used to receive authentication result information sent by the server;

[0042] The auxiliary dataset includes auxiliary data S and random number R2. After receiving the output of TIADC-PUF at the first moment, the fuzz extractor generates random numbers R1 and R2, and generates auxiliary data S based on random number R1 and the output of TIADC-PUF at the first moment.

[0043] Fourthly, according to embodiments of the present invention, a system for device registration and authentication is provided, applied to a server, comprising:

[0044] The second receiving module is used to receive and store the device ID, unique identifier R, and shared key K sent by the authenticated device; and to receive the authentication request sent by the authenticated device.

[0045] The second processing module is used to generate a random number R3 based on the authentication request;

[0046] The second sending module is used to send the random number R3 to the authenticated device.

[0047] The second processing module is further configured to receive ciphertext A and device ID sent by the authenticated device to authenticate the authenticated device;

[0048] The second processing module includes:

[0049] The query unit is used to query the unique identifier R corresponding to the device ID based on the device ID;

[0050] The ciphertext construction unit is used to construct ciphertext A′ based on a unique identifier R, a shared key K, and a random number R3 using a hash algorithm.

[0051] The comparison unit is used to compare ciphertext A with ciphertext A′;

[0052] The second sending module is also used to send the corresponding authentication result information to the authenticated device.

[0053] The unique identifier R′ is obtained by retrieving the output of the noisy TIADC-PUF at the second time step as the second output sequence, and is generated by the fuzz extractor based on the generated random number R2, the auxiliary data S and the second output sequence; the ciphertext A is obtained by the authenticated device through a hash algorithm based on the unique identifier R′, the shared key K and the random number R3.

[0054] Fifthly, embodiments of the present invention provide an electronic device, including a memory and a processor, wherein the memory and the processor are communicatively connected, the memory is used to store computer instructions, and the processor is used to load and execute the computer instructions to implement a device request registration and authentication method as described in any of the preceding claims.

[0055] In a sixth aspect, embodiments of the present invention provide a computer-readable storage medium storing readable computer instructions, which, when loaded and run by a processor, execute a device request registration and authentication method as described in any of the preceding claims.

[0056] The technical solution of this invention can bring at least the following beneficial effects:

[0057] The present invention provides a method and system for device registration and authentication requests. According to the requirements, a fuzzy extractor is called to generate a unique identity identifier. The hardware non-cloning function is effectively used to make the device less susceptible to attack, thereby improving the information security during the data interaction process.

[0058] Meanwhile, the sampling TIADC acts as a traditional PUF, named TIADC-PUF here, and the output of TIADC-PUF replaces the output of the traditional PUF. For high-precision ADC devices, TIADC is an essential component. Therefore, this solution does not require setting up a dedicated PUF. The output of TIADC-PUF is directly used as the data source for generating unique identifiers, which has high reliability. It does not require additional hardware to generate data sequences, effectively improving the certified device's resistance to temperature and voltage interference, reducing the output error rate of hardware functions, and eliminating the need for other types of external PUFs, thus reducing hardware area and overhead. Attached Figure Description

[0059] Figure 1 This is a flowchart of a method for device request registration and authentication applied to the authenticated device in one embodiment of the present invention.

[0060] Figure 2 A schematic diagram illustrating the convergence of the output signal of the TIADC-PUF in one embodiment of the present invention;

[0061] Figure 3 A schematic diagram illustrating the generation of an auxiliary dataset and a unique identifier R by a fuzz extractor based on the first output sequence at the authenticated device end;

[0062] Figure 4 This is a flowchart of a method for device request registration and authentication applied to the authenticated device in another embodiment of the present invention.

[0063] Figure 5A schematic diagram illustrating how a fuzzy extractor restores a unique identifier R′ from the second output sequence and auxiliary dataset at the authenticated device end;

[0064] Figure 6 This is a schematic diagram of the output signal of TIADC-PUF in one embodiment of the present invention.

[0065] Figure 7 This is a flowchart of a method for device request registration and authentication applied to a server in one embodiment of the present invention.

[0066] Figure 8 This is a schematic diagram of a system for device registration and authentication applied to the authenticated device in one embodiment of the present invention;

[0067] Figure 9 This is a schematic diagram of a system for device request registration and authentication applied to a server in another embodiment of the present invention;

[0068] Figure 10 This is a schematic diagram of an electronic device provided in one embodiment of the present invention. Detailed Implementation

[0069] The present invention will be further described below with reference to specific accompanying drawings and embodiments.

[0070] This invention provides a method, system, electronic device, and storage medium for device registration and authentication. It utilizes the errors generated by each channel of the device's own TIADC as a unique identifier to effectively authenticate the device being authenticated, thereby achieving the purpose of secure and effective PUF authentication of the device based on the timing or output of TIADC.

[0071] This invention provides a method for a device to request authentication, applied to the device being authenticated. See [link to relevant documentation]. Figure 1 As shown, the device authentication request method in this solution includes at least the following steps:

[0072] Step S12: After receiving the registration permission signal sent by the server, retrieve the output sequence of the noisy TIADC-PUF at the first moment as the first output sequence, generate a unique identifier R and an auxiliary dataset by using the first output sequence as input through the fuzz extractor, send the device ID, unique identifier R and shared key K to the server, and store the auxiliary dataset in the storage module.

[0073] Step S14: Send an authentication request to the server and receive a random number R3 generated by the server based on the authentication request;

[0074] Step S16: Retrieve the noisy TIADC-PUF, use the output sequence at the second time as the second output sequence, generate a unique identifier R′ based on the random number R2, the auxiliary data S and the second output sequence using a fuzz extractor, calculate ciphertext A using a hash algorithm based on the unique identifier R′, the shared key K and the random number R3, and send ciphertext A and the device ID to the server for authentication.

[0075] Step S18: Receive the authentication result information sent by the server;

[0076] The auxiliary dataset includes auxiliary data S and random number R2. After receiving the first output sequence of TIADC-PUF, the fuzz extractor generates random numbers R1 and R2, and generates auxiliary data S based on random number R1 and the output of TIADC-PUF at the first moment.

[0077] In this embodiment of the invention, after receiving the registration permission signal from the server, the authenticated device first sends some of its own attribute information to the server so that the server can store it and complete the registration of the authenticated device. This attribute information includes at least the device ID, unique identifier R, and shared key K of the authenticated device. The timing of sending this attribute information is after it receives the registration permission signal from the server.

[0078] Before sending these attribute information, a unique identifier R must first be obtained or generated. For information security during data interaction, this scheme does not store the unique identifier on the authenticated device side, but generates it by calling the fuzz extractor when needed. Therefore, after receiving the registration permission signal from the server, the output of the noisy TIADC-PUF at the first moment is retrieved as the first output sequence. The fuzz extractor uses the first output sequence as input to generate the unique identifier R and the auxiliary dataset. Then, the unique identifier R, along with the device ID and the shared key K, is sent to the server to complete the registration of the authenticated device.

[0079] It should be noted that sending attribute information to the server is generally for the registration stage. If registration has already been completed, this step is not necessary, and subsequent authentication processes include all steps except for this step S12.

[0080] After sending its own attribute information, the system then sends an authentication request to the server. It should be noted that this step can be performed simultaneously with the sending of the attribute information, or it can be performed in separate steps.

[0081] After sending the authentication request to the server, the receiving server generates a random number R3 based on the received authentication request. It should be noted that this random number R3 is for subsequent ciphertext generation and its size is not critical. It serves as auxiliary data for comparing the generated ciphertexts, primarily increasing the complexity of the ciphertext and thus enhancing information security during data exchange. Furthermore, this solution does not impose excessive requirements on the specific algorithm and process by which the server generates the random number R3; a conventional algorithm is sufficient.

[0082] In this embodiment of the invention, after receiving the random number R3 sent by the server, the noisy TIADC-PUF is retrieved, and its output signal at this moment is retrieved as the second output sequence. The fuzzy extractor generates a unique identifier R′ based on the random number R2, the auxiliary data S and the second output sequence. After obtaining the second output sequence, the fuzzy extractor internally generates two random numbers, R1 and R2, and then generates the unique identifier R′ based on the random number R1 and the obtained second output sequence.

[0083] After generating a unique identifier R′, the ciphertext A is generated using a hash algorithm based on the unique identifier R′, the shared key K, and the random number R3 from the server. The generated ciphertext A and the device ID are then sent to the server for authentication.

[0084] After sending ciphertext A and the device ID to the server, the server will also retrieve and calculate ciphertext A′ using the same hash algorithm. By comparing ciphertext A and ciphertext A′, the server determines whether the authenticated device has passed authentication. Specifically, if ciphertext A and ciphertext A′ match, the authenticated device passes authentication and receives a "authentication passed" signal from the server; otherwise, if ciphertext A and ciphertext A′ do not match, the authenticated device fails authentication and receives a "authentication failed" signal from the server.

[0085] As can be seen, in this embodiment of the invention, the authenticated device performs two processes of generating unique identifiers using a fuzzy extractor, generating unique identifiers R and R′ respectively. The first process is to complete the registration process on the server. Simultaneously, the fuzzy extractor initially generates the unique identifier R based on two random numbers R1 and R2 it generates, along with the first output sequence, to generate auxiliary data S and the unique identifier R. After generating the auxiliary data S, it saves the auxiliary data S and the random number R2 as an auxiliary dataset. When generating the unique identifier R′ again, it directly retrieves the saved auxiliary dataset and uses the output sequence of the TIADC-PUF at the current time as another input to generate the unique identifier R′.

[0086] It should be noted that both the previous TIADC-PUF output series (i.e., the first output sequence) and the subsequent TIADC-PUF output series (i.e., the second output sequence) are performed under the premise that the output signals of each channel of the TIADC have converged, as shown in the following figure. Figure 2 One specific embodiment is a TIADC-PUF containing four ADC channels. It can be seen that after a certain number of samplings, the output signals of each channel can converge to a stable value. The first output sequence and the second output sequence are performed after the signals of each channel have stabilized, thus ensuring that the unique identifiers obtained in the two cases are basically the same. Therefore, the ciphertext obtained is the same under normal circumstances. The convergence step size μ value adopted in this figure is 0.6.

[0087] Furthermore, in this embodiment, see Figure 3 As shown, in step S12, the method for generating a unique identifier R and an auxiliary dataset using the first output sequence as input through a fuzzy extractor includes:

[0088] 1) After receiving the first output sequence, the fuzz extractor generates random numbers R1 and R2;

[0089] 2) The random number R1 generated by the fuzzy extractor is encoded by BCH and then XORed with the first output sequence to generate auxiliary data S. The generated random number R2 and the auxiliary data S constitute an auxiliary dataset.

[0090] 3) Perform an XOR operation between the generated random number R2 and the first output sequence, and then perform a SHA operation to form a unique identifier R.

[0091] See Figure 3 As shown, when the fuzzy extractor is retrieved to generate auxiliary data S and unique identifier R′, it first generates random numbers R1 and R2. Then, random number R1 is encoded by BCH to obtain data R4. Data R4 is then XORed with the second output sequence t′ to generate auxiliary data S. Auxiliary data S and random number R2 together constitute an auxiliary dataset stored in the storage system of the authenticated device. The data sequence generated by XORing random number R2 with the second output sequence t′ is then SHA encoded to form the unique identifier R.

[0092] In an embodiment of the present invention, see Figure 4 As shown, the methods for device registration and authentication also include:

[0093] Step S13: After sending the device ID, unique identifier R and shared key K to the server, delete the unique identifier R.

[0094] As a preferred implementation, after sending the device ID, unique identifier R, and shared key K to the server, the unique identifier R is deleted from the storage module of the authenticated device; if it is not already stored in the storage module, it is discarded directly.

[0095] In an embodiment of the present invention, see Figure 5 As shown, in step S16, a unique identifier R′ is generated based on the random number R2, the auxiliary data S, and the second output sequence using a fuzzy extractor, including:

[0096] 1) The first operation sequence y1 is obtained by performing an XOR operation and two BCH encodings on the random number R2 in the auxiliary dataset and the second output sequence t′;

[0097] 2) The first operation sequence y1 is XORed with the random number R2 in the auxiliary dataset to obtain the second operation sequence y2;

[0098] 3) After performing an XOR operation on the second operation sequence and the auxiliary data S, and then performing an SHA operation on the second operation sequence y2, a unique identifier R′ is obtained.

[0099] As can be seen from the above, the fuzzy extractor can regenerate the unique identifier R′ based on the second output sequence t′, the auxiliary data S in the auxiliary dataset, and the random number R2. Therefore, instead of storing the unique identifier in the storage module of the authenticated device, only the auxiliary dataset is stored. Since the auxiliary dataset carries less device information, the security of the information exchange process is greatly improved.

[0100] In this embodiment of the invention, before sending the device ID, unique identifier R, auxiliary data S, and shared key K to the server, the method further includes:

[0101] Received "Registration Allowed" message from the server;

[0102] In this embodiment of the invention, before step S12, a "registration allowed" message from the server needs to be received; as an optional method, the registration request process of the authenticated device is as follows:

[0103] 1) Send the device ID and registration request to the server;

[0104] 2) Received the registration permission signal sent by the server.

[0105] When requesting registration, the device to be authenticated first sends its device ID and registration request to the server. After receiving the device ID and registration request from the device to be authenticated, the server checks whether the device ID has been registered before. Specifically, it checks whether the device ID exists in the server's storage module. If it does not exist, it means that the device ID has not been registered before, and the server sends a registration permission signal back to the device to be authenticated.

[0106] After receiving the registration permission signal, the authenticated device continues to execute step S12, sending the device ID, unique identifier R, and shared key K to the server to complete the registration and for the server to use for subsequent device authentication.

[0107] In this embodiment of the invention, the method for the authenticated device to request authentication further includes:

[0108] Determining the first output sequence / second output sequence based on retrieving the noisy TIADC-PUF; the determination of the first output sequence / second output sequence based on retrieving the noisy TIADC-PUF includes:

[0109] 1) At the first / second time, the ADCs in each channel of the TIADC system with sampling time adaptation are sampled to obtain the digital output signals of each channel at the first / second time.

[0110] 2) Determine the reference signal for the digital output signal of each channel at the first time / second time, correct the digital output signal of each channel at the first time / second time, and extract the error of the digital output signal of each channel to form the first output sequence / second output sequence.

[0111] It should be noted that the generation process of the first output sequence / second output sequence in this scheme is preferably performed under the premise that the mismatch and gain mismatch have been calibrated.

[0112] The following is a specific example for illustration:

[0113] against Figure 6 The illustrated TIADC, firstly, assuming the offset and gain mismatch have been calibrated, samples the signals of each channel of the TIADC system with sampling time mismatch, obtaining the digital output signals of each sub-channel ADC:

[0114] Y k [m]=Y((N*m+k)*T s +t k )

[0115] Where N represents the number of sub-channels, m represents the number of samplings (a positive integer), k represents the k-th channel in the sampling system, and T st represents the period of the sub-channel sampling clock. k This represents the sampling time error of the k-th channel.

[0116] Then, the digital output signals of each sub-channel ADC are input into the calibration module. The default error of the signal of the first channel to be calibrated is 0, and the signals of the other channels are calibrated in turn.

[0117] Continuing, the above-corrected signal is input into the error extraction module to extract the sampling time error of each channel;

[0118] Continuing, based on the extracted sampling time error, an iterative formula is used to converge it to a fixed value. The output value of the iterative formula (the converged fixed value) is then placed into the calibration circuit to compensate for the time mismatch error of each channel, thereby achieving the purpose of correcting the mismatch result.

[0119] The iterative formula can be:

[0120] t k q+1 =t k q +μ*Δt k

[0121] Where q = 0, 1, 2, ..., represents the number of convergence iterations. k represents the k-th channel. Initial value t k q＝0 μ is the convergence coefficient, a fixed value between 0 and 1, representing the convergence step size of the time error value. A larger μ results in faster convergence but lower accuracy. Conversely, a smaller μ results in slower convergence but higher accuracy. Therefore, a suitable value can be obtained through simulation experiments to achieve both fast convergence and a certain level of accuracy for the TIADC. In the example above, the convergence coefficient μ was 0.6.

[0122] This invention provides a method for device registration and authentication requests. It calls a fuzzy extractor to generate a unique identifier according to requirements, effectively utilizing hardware non-cloning functions to make the device less vulnerable to attacks and improving information security during data interaction.

[0123] Meanwhile, sampling the output of TIACD-PUF as the data source for generating a unique identifier effectively improves the authentication device's resistance to temperature and voltage interference, reduces the output error rate of hardware functions, eliminates the need for other types of PUFs, reduces hardware area, and eliminates the need for additional hardware to generate data sequences, thus reducing overhead.

[0124] Example 2

[0125] This invention also provides a method for device authentication requests, applied to a server, see [link to relevant documentation]. Figure 7 As shown, the method includes:

[0126] Step S72: After sending a registration permission signal to the authenticated device, receive and save the device ID, unique identifier R, and shared key K sent by the authenticated device.

[0127] Step S74: Receive the authentication request sent by the device being authenticated, generate a random number R3 based on the authentication request, and send the random number R3 to the device being authenticated;

[0128] Step S76: Receive the encrypted text A and device ID sent by the device being authenticated to authenticate the device;

[0129] In step S76, authenticating the device being authenticated includes:

[0130] Query the unique identifier R corresponding to the device ID based on the device ID;

[0131] Ciphertext A′ is constructed using a hash algorithm based on the unique identifier R, the shared key K, and the random number R3.

[0132] Compare ciphertext A with ciphertext A′ and send the corresponding authentication result information to the authenticated device.

[0133] The unique identifier R′ is obtained by retrieving the output of the noisy TIADC-PUF at the second time step as the second output sequence, and is generated by the fuzz extractor based on the generated random number R2, the auxiliary data S and the second output sequence; the ciphertext A is obtained by the authenticated device through a hash algorithm based on the unique identifier R′, the shared key K and the random number R3.

[0134] The authentication method for a device requested by an embodiment of the present invention authenticates the device based on a unique identifier R′ generated by the device using auxiliary data S, a random number R2, and a pre-generated input sequence. Specifically, the ciphertext A′ generated by the unique identifier R′, a shared key K, and a random number R3 is compared with the ciphertext A′ constructed by the server using a hash algorithm based on the unique identifier R, the shared key K, and the random number R3. Therefore, the unique identifier does not need to be stored in the storage module of the device being authenticated. The device generates a unique identifier by calling a fuzzy extractor as needed, effectively utilizing hardware non-cloning functions to make the device less vulnerable to attacks and improving information security during data interaction. Simultaneously, the device being authenticated is equipped with a TIACD-PUF, using the output of the TIACD-PUF as the data source for generating the unique identifier. This effectively improves the device's resistance to temperature and voltage interference, reduces the error rate of hardware function output, and eliminates the need for other types of external PUFs, reducing hardware area and overhead.

[0135] Example 3

[0136] This invention provides a system for device registration and authentication requests, applied to the authenticated device. See [link to documentation]. Figure 8 As shown, it includes:

[0137] The first sending module 81 is used to retrieve the output of the noisy TIADC-PUF at the first moment as the first output sequence, generate a unique identifier R and an auxiliary dataset by using the first output sequence as input through a fuzz extractor, and then send the device ID, unique identifier R and shared key K to the server, and send the auxiliary dataset to the storage module.

[0138] The first receiving module 82 is used to receive a registration permission signal sent by the server, and to receive a random number R3 generated by the server based on the authentication request;

[0139] The first processing module 83 is used to retrieve the output of the noisy TIADC-PUF at the first time step as the first output sequence, and generate a unique identifier R and an auxiliary dataset by using the first output sequence as input through a fuzz extractor; and

[0140] The output sequence of the noisy TIADC-PUF at the second time step is retrieved as the second output sequence. A unique identifier R′ is generated by the fuzz extractor based on the random number R2, the auxiliary data S and the second output sequence. The ciphertext A is calculated by a hash algorithm based on the unique identifier R′, the shared key K and the random number R3.

[0141] The first sending module 81 is further configured to send the ciphertext A and the device ID to the server for authentication by the server;

[0142] The first receiving module is also used to receive authentication result information sent by the server;

[0143] The auxiliary dataset includes auxiliary data S and random number R2. After receiving the output of TIADC-PUF at the first moment, the fuzz extractor generates random numbers R1 and R2, and generates auxiliary data S based on random number R1 and the output of TIADC-PUF at the first moment.

[0144] This invention provides a system for an authenticated device to request authentication. After the first receiving module receives a random number R3 from the server, the first processing module 73 first retrieves a noisy TIADC-PUF and uses a fuzzy extractor to generate a unique identifier R′ based on the generated random number R2, the auxiliary data S, and the pre-generated input sequence. Then, the unique identifier R′, the shared key K, and the random number R3 are used to calculate ciphertext A using a hash algorithm. Ciphertext A and the device ID are then sent to the server for authentication. The first processing module 93 can call the fuzzy extractor to generate a unique identifier as needed. This effectively utilizes hardware non-cloning functions to make the device less vulnerable to attacks, improving information security during data interaction. Simultaneously, the fuzzy extractor uses the output of the TIADC-PUF as the data source for generating the unique identifier, effectively improving the authenticated device's resistance to temperature and voltage interference, reducing the output error rate of hardware functions, and eliminating the need for other types of external PUFs, thus reducing hardware area and overhead.

[0145] Example 4

[0146] This invention provides a system for device registration and authentication requests, applied to a server-side application. See [link to relevant documentation]. Figure 9 As shown, it includes:

[0147] The second receiving module 91 is used to receive and store the device ID, unique identifier R and shared key K sent by the authenticated device; and to receive the authentication request sent by the authenticated device.

[0148] The second processing module 92 is used to generate a random number R3 based on the authentication request;

[0149] The second sending module 93 is used to send the random number R3 to the authenticated device.

[0150] The second processing module 92 is further configured to receive ciphertext A and device ID sent by the authenticated device to authenticate the authenticated device;

[0151] The second processing module 92 includes:

[0152] Query unit 921 is used to query the unique identifier R corresponding to the device ID based on the device ID;

[0153] Ciphertext construction unit 922 is used to construct ciphertext A′ based on a unique identifier R, a shared key K, and a random number R3 using a hash algorithm.

[0154] The comparison unit 923 is used to compare ciphertext A with ciphertext A′;

[0155] The second sending module 93 is also used to send the corresponding authentication result information to the authenticated device.

[0156] The unique identifier R′ is obtained by retrieving the output of the noisy TIADC-PUF at the second time step as the second output sequence, and is generated by the fuzz extractor based on the generated random number R2, the auxiliary data S and the second output sequence; the ciphertext A is obtained by the authenticated device through a hash algorithm based on the unique identifier R′, the shared key K and the random number R3.

[0157] The authentication system provided in this embodiment of the invention, when authenticating a device, uses a second processing module to perform authentication based on a unique identifier R′ generated by the device using auxiliary data S, a random number R2, and a pre-generated input sequence. Specifically, it compares the ciphertext A′ generated by the unique identifier R′, a shared key K, and a random number R3 with the ciphertext A′ constructed by the server using a hash algorithm based on the unique identifier R, the shared key K, and the random number R3. Therefore, there is no need to store the unique identifier in the storage module of the device being authenticated. Instead, a fuzzy extractor is called to generate the unique identifier as needed, effectively utilizing hardware non-cloning functions to make the device less vulnerable to attacks and improving information security during data interaction. Simultaneously, using a TIACD-PUF sample as the data source for generating the unique identifier effectively improves the device's resistance to temperature and voltage interference, reduces the output error rate of hardware functions, and eliminates the need for other types of external PUFs, reducing hardware area and overhead.

[0158] As another embodiment of the present invention, an electronic device is provided, comprising a memory and a processor, the memory and the processor being communicatively connected, the memory being used to store computer instructions, and the processor being used to load and execute the computer instructions to implement the device request and authentication method described above.

[0159] like Figure 10As shown, the electronic device may include: at least one processor 101, such as a CPU (Central Processing Unit), at least one communication interface 103, a memory 104, and at least one communication bus 102. The communication bus 102 is used to enable communication between these components. The communication interface 103 may include a display screen or a keyboard; optionally, the communication interface 103 may also include a standard wired interface or a wireless interface. The memory 104 may be high-speed RAM (Random Access Memory) or non-volatile memory, such as at least one disk drive. Optionally, the memory 104 may also be at least one storage device located remotely from the processor 101. The memory 104 stores application programs, and the processor 101 calls the program code stored in the memory 104 to execute any of the above-described method steps.

[0160] The communication bus 82 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The communication bus 102 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 10 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0161] The memory 104 may include volatile memory, such as random-access memory (RAM); the memory may also include non-volatile memory, such as flash memory, hard disk drive (HDD) or solid-state drive (SSD); the memory 104 may also include a combination of the above types of memory.

[0162] The processor 101 can be a central processing unit (CPU), a network processor (NP), or a combination of CPU and NP.

[0163] The processor 101 may further include a hardware chip. This hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0164] Optionally, the memory 104 is also used to store program instructions. The processor 101 can invoke the program instructions to implement the present invention. Figure 1 The method for device registration and authentication shown in the embodiment.

[0165] As another embodiment of the present invention, a storage medium is provided, comprising computer instructions that, when loaded and executed by a processor, implement the device request registration and authentication method described above.

[0166] In this embodiment of the invention, a non-transitory computer-readable storage medium is provided. The computer-readable storage medium stores computer-executable instructions that can execute the method for two-dimensional DOA estimation based on HLS in any of the above-described method embodiments. The storage medium may be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium may also include combinations of the above types of memory.

[0167] It is understood that the above embodiments are merely exemplary implementations used to illustrate the principles of the present invention, and the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A method for device registration and authentication requests, applied to the authenticated device, characterized in that, The method includes: After receiving the registration permission signal sent by the server, the output sequence of the TIADC-PUF with noise at the first moment is retrieved as the first output sequence. The fuzz extractor uses the first output sequence as input to generate a unique identifier R and an auxiliary dataset. The device ID, unique identifier R and shared key K are sent to the server, and the auxiliary dataset is stored in the storage module. Send an authentication request to the server and receive a random number R3 generated by the server based on the authentication request; The output sequence of the TIADC-PUF at the second time step with noise is retrieved as the second output sequence. A unique identifier R′ is generated by the fuzz extractor based on the random number R2, the auxiliary data S and the second output sequence. The ciphertext A is calculated by hash algorithm based on the unique identifier R′, the shared key K and the random number R3. The ciphertext A and the device ID are sent to the server for authentication. Receive authentication result information sent by the server; The auxiliary dataset includes auxiliary data S and random number R2. After receiving the first output sequence of TIADC-PUF, the fuzz extractor generates random numbers R1 and R2, and generates auxiliary data S based on random number R1 and the output sequence of TIADC-PUF at the first moment.

2. The method according to claim 1, characterized in that, The step of generating a unique identifier R and an auxiliary dataset by using the first output sequence as input through a fuzz extractor includes: After receiving the first output sequence, the fuzz extractor generates random numbers R1 and R2; The random number R1 generated by the fuzz extractor is encoded by BCH and then XORed with the first output sequence to generate auxiliary data S. The generated random number R2 and the auxiliary data S constitute an auxiliary dataset. The generated random number R2 is XORed with the first output sequence, and then subjected to SHA operation to form a unique identifier R.

3. The method according to claim 1, characterized in that, The method further includes: After sending the device ID, unique identifier R, and shared key K to the server, the unique identifier R is deleted.

4. The method according to claim 1, characterized in that, The step of generating a unique identifier R′ based on the random number R2, the auxiliary data S, and the second output sequence using a fuzzy extractor includes: The first operation sequence is obtained by performing an XOR operation and two BCH encodings on the random number R2 in the auxiliary dataset and the second output sequence. The first operation sequence is XORed with the random number R2 in the auxiliary dataset to obtain the second operation sequence; The second operation sequence and auxiliary data S are XORed and then subjected to SHA operation with the second output sequence to obtain the unique identifier R′.

5. The method according to claim 1, characterized in that, The method further includes: determining the output at the first time step / second time step based on the noisy TIADC-PUF; The step of determining the output at the first moment based on retrieving the noisy TIADC-PUF includes: At the first / second time point, the ADCs in each channel of the TIADC system with sampling time adaptation are sampled to obtain the digital output signals of each channel at the first / second time point. A reference signal for the digital output signal of each channel at the first / second time step is determined, the digital output signal of each channel at the first / second time step is corrected, and the error of the digital output signal of each channel is extracted based on the Taylor expansion formula to form the first output sequence / second output sequence.

6. A method for device registration and authentication requests, applied on a server side, characterized in that, The method includes: After sending a registration permission signal to the authenticated device, receive and save the device ID, unique identifier R, and shared key K sent by the authenticated device; Receive an authentication request sent by the device being authenticated, generate a random number R3 based on the authentication request, and send the random number R3 to the device being authenticated; Receive ciphertext A and device ID sent by the device being authenticated to authenticate the device being authenticated; Authentication of the certified device includes: Query the unique identifier R corresponding to the device ID based on the device ID; Ciphertext A′ is constructed using a hash algorithm based on the unique identifier R, the shared key K, and the random number R3. Compare ciphertext A with ciphertext A′ and send the corresponding authentication result information to the authenticated device. The unique identifier R′ is obtained by retrieving the output of the noisy TIADC-PUF at the second time step as the second output sequence, and is generated by the fuzz extractor based on the generated random number R2, auxiliary data S and the second output sequence; the ciphertext A is obtained by the authenticated device through a hash algorithm based on the unique identifier R′, the shared key K and the random number R3.

7. A system for device registration and authentication requests, applied to the device being authenticated, characterized in that, include: The first sending module is used to retrieve the output of the noisy TIADC-PUF at the first moment from the first processing module as the first output sequence, generate a unique identifier R and an auxiliary dataset by using the first output sequence as input through a fuzz extractor, and then send the device ID, the unique identifier R and the shared key K to the server, and send the auxiliary dataset to the storage module. The first receiving module is used to receive the registration permission signal sent by the server, and to receive the random number R3 generated by the server based on the authentication request; The first processing module is used to retrieve the output of the noisy TIADC-PUF at the first time step as the first output sequence, and use the first output sequence as input to generate a unique identifier R and an auxiliary dataset through a fuzz extractor. as well as The output sequence of the noisy TIADC-PUF at the second time step is retrieved as the second output sequence. A unique identifier R′ is generated by the fuzz extractor based on the random number R2, the auxiliary data S and the second output sequence. The ciphertext A is calculated by a hash algorithm based on the unique identifier R′, the shared key K and the random number R3. The first sending module is also used to send the ciphertext A and the device ID to the server for authentication by the server; The first receiving module is also used to receive authentication result information sent by the server; The auxiliary dataset includes auxiliary data S and random number R2. After receiving the output of TIADC-PUF at the first moment, the fuzz extractor generates random numbers R1 and R2, and generates auxiliary data S based on random number R1 and the output of TIADC-PUF at the first moment.

8. A system for device registration and authentication requests, applied on a server side, characterized in that, include: The second receiving module is used to receive and save the device ID, unique identifier R and shared key K sent by the authenticated device. And receive authentication requests sent by the device being authenticated; The second processing module is used to generate a random number R3 based on the authentication request; The second sending module is used to send the random number R3 to the authenticated device. The second processing module is further configured to receive ciphertext A and device ID sent by the authenticated device to authenticate the authenticated device; The second processing module includes: The query unit is used to query the unique identifier R corresponding to the device ID based on the device ID; The ciphertext construction unit is used to construct ciphertext A′ based on a unique identifier R, a shared key K, and a random number R3 using a hash algorithm. The comparison unit is used to compare ciphertext A with ciphertext A′; The second sending module is also used to send the corresponding authentication result information to the authenticated device. The unique identifier R′ is obtained by retrieving the output of the noisy TIADC-PUF at the second time step as the second output sequence, and is generated by the fuzz extractor based on the generated random number R2, auxiliary data S and the second output sequence; the ciphertext A is obtained by the authenticated device through a hash algorithm based on the unique identifier R′, the shared key K and the random number R3.

9. An electronic device, characterized in that, The device includes a memory and a processor, which are communicatively connected. The memory is used to store computer instructions, and the processor is used to load and execute the computer instructions to implement a device request registration and authentication method as described in any one of claims 1-5 or claim 6.

10. A storage medium, characterized in that, The computer-readable storage medium stores readable computer instructions, which, when loaded and run by a processor, execute a method for requesting device registration and authentication as described in any one of claims 1-5 or claim 6.

Images