Challenge-Response Key Rotation Against Side-Channel Cloning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication protocols are vulnerable to side-channel attacks, which exploit information leakage from devices to retrieve secret encryption keys, making them susceptible to cloning and reverse engineering.
Innovation Solution
Implement a communication device with a key selection algorithm that dynamically selects cryptographic keys from a set for each challenge-response round, using a predefined order based on device identifier, randomization key, and authentication round, to increase resistance against side-channel attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a fixed cryptographic key is used for authentication, then the authentication process is simple and fast, but the device becomes vulnerable to side-channel attacks and cloning
Solution Approach 1:
The patent implements dynamic key selection where the cryptographic key changes based on the authentication round number and device identifier. Instead of using a single static key, the system dynamically selects from multiple keys stored in memory, making side-channel attacks significantly more difficult while maintaining manageable complexity through algorithmic key selection
Solution Approach 2:
The patent segments the cryptographic key space by storing multiple distinct cryptographic keys in memory rather than using one master key. Each key can be used for specific authentication rounds or conditions, dividing the security function into multiple independent key units that can be selectively applied
2Reliability
If multiple cryptographic keys are stored in memory, then resistance against side-channel attacks increases, but the memory requirements and key management complexity increase
Solution Approach 1:
The patent performs preliminary actions by pre-generating and storing multiple cryptographic keys in memory before authentication occurs. This preparation phase allows the device to have ready-to-use keys that can be quickly selected during authentication without requiring complex real-time key generation, balancing security with efficiency
3Productivity
If the same cryptographic key is used for multiple challenge-response rounds, then the authentication process is efficient, but the device becomes susceptible to pattern analysis attacks
Solution Approach 1:
The patent implements periodic key rotation where cryptographic keys are systematically changed according to the authentication round number. The key selection follows a periodic pattern based on modulo operations with the total number of keys, ensuring both efficiency through predictable performance and security through varying key usage across authentication rounds
Data Source
AI summary
In accordance with a first aspect of the present disclosure, a communication device for use in one or more challenge-response rounds is provided, comprising: a response generation unit configured to generate, in each challenge-response round, a response to a challenge received from an external communication device, wherein said response is generated by performing a cryptographic function on said challenge, and wherein the cryptographic function takes said challenge and a cryptographic key as inputs; a key selection unit configured to select said cryptographic key from a set of cryptographic keys by executing a predefined key selection algorithm that has been shared with the external communication device. Further aspects of the present disclosure relate to another communication device for use in one of more challenge-response rounds, corresponding methods of operating communication devices, and computer programs for carrying out said methods.