Expanded PUF Challenge Derivation for Secure Device Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing PUF technologies face challenges in balancing practicality, cost-efficiency, and security, particularly in expanding challenge-response spaces without increasing complexity, and are vulnerable to attacks such as man-in-the-middle and modeling attacks.
Innovation Solution
The introduction of an expanded PUF (ePUF) framework that combines a base PUF with a transform function, such as a cryptographic hash function, to generate multiple secondary challenge-response pairs from a single primary pair, enhancing the challenge-response space while maintaining practicality and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a weak PUF is used with limited challenge-response space, then the device complexity is reduced and ease of manufacture is improved, but the security is worsened due to vulnerability to enumeration and spoofing attacks
Solution Approach 1:
The patent segments the challenge-response space by introducing multiple challenge sets (first set and second set) with different encodings. Each set operates independently with its own encoding scheme, effectively dividing the原本 limited challenge space into multiple secure segments that an attacker cannot enumerate simultaneously.
Solution Approach 2:
The patent adds a new dimension to the challenge space by introducing a second encoding type (e.g., encoded challenges) in addition to the original encoding. This transforms the challenge-response interface from a single-dimensional limited space into a multi-dimensional space, exponentially increasing the effective challenge-response space without increasing physical device complexity.
2Reliability
If the challenge-response space is expanded to improve security, then resistance to attacks is improved, but the device complexity increases
Solution Approach 1:
The patent introduces an encoding/decoding intermediary layer between the challenge input and the PUF core. This intermediary transforms challenges into different encodings without requiring changes to the physical PUF structure, thereby expanding the functional challenge space while keeping the physical device complexity unchanged.
Solution Approach 2:
The patent makes the existing PUF device multi-functional by enabling it to handle multiple encoding types through software/firmware intermediaries. The same physical PUF can respond to both originally-encoded challenges and newly-encoded challenges, effectively serving multiple functions without additional hardware complexity.
3Reliability
If multiple challenge-response pairs are stored to expand the challenge-response space, then the security against enumeration attacks is improved, but the loss of information increases due to storage requirements
Solution Approach 1:
The patent creates virtual copies of the challenge-response space through encoding transformations rather than physically storing multiple complete CRP sets. The encoding intermediaries generate derived challenges on-demand, eliminating the need to store exhaustive CRP tables while maintaining security against enumeration attacks.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
A method for enabling a verifying party to verify an identity of a target party or device. The method comprises, in a set-up phase: storing, in a data store, a respective piece of response data for each of a set of one or more responses resulting from a setting-up party inputting a respective set of one or more challenges into a PUF module comprising a physically unclonable function, PUF, to generate the one or more responses based on the PUF; and storing an indication of the set of challenges in the data store. The indication does not comprise a value of each of the challenges in the set, but rather a master challenge from which the set of challenges is derivable by applying a derivation function to the master challenge.