Computational Fuzzy Extractor for PUF Entropy Preservation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional fuzzy extractors fail to preserve the full entropy of physical unclonable functions (PUFs), resulting in insufficient key lengths for secure device authentication, particularly in lightweight PUF-enabled devices with limited memory capacity.
Innovation Solution
A method using computational fuzzy extractors with seeded pseudo-random matrix generation, which leverages Learning with Errors (LWE) to derive longer cryptographic keys by encrypting and decrypting PUF responses, ensuring full entropy preservation and efficient authentication in devices with limited resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional fuzzy extractors with error correcting codes are used to remove noise from PUF responses, then authentication reliability is improved, but the full entropy of the PUF response is lost resulting in shorter cryptographic keys
Solution Approach 1:
The patent changes the fundamental parameters of the fuzzy extractor by replacing traditional error correcting codes with a lattice-based cryptographic approach using Learning With Errors (LWE). This involves changing the mathematical structure from code-based to lattice-based, allowing the system to work with the raw PUF response directly without entropy-reducing post-processing. The LWE problem provides both error tolerance and full entropy preservation through its unique mathematical properties.
Solution Approach 2:
The patent substitutes the mechanical/error-correcting-code-based fuzzy extractor system with a computational cryptography system based on lattice problems. Instead of using helper data and error correcting codes to correct noise, the system uses the hardness of the LWE problem to provide both noise tolerance and full entropy preservation, replacing the traditional mechanism with a computationally secure alternative.
2Reliability
If longer cryptographic keys are derived to enhance security, then security strength is improved, but device complexity and memory requirements increase
Solution Approach 1:
The patent enables lightweight devices to generate and use long cryptographic keys without requiring complex key management infrastructure. The PUF-based LWE fuzzy extractor allows the device to self-generate secure keys from its physical characteristics, and the helper data stored in the cloud enables key recovery without requiring the device to store complex backup information or participate in complex key management protocols.
Solution Approach 2:
The patent introduces cloud-based helper data as an intermediary that enables lightweight devices to use long cryptographic keys without managing the complexity themselves. The helper data stored externally in the cloud acts as a mediator that facilitates key recovery and authentication, allowing the device to benefit from strong security without bearing the burden of complex key management.
3Loss of information
If full entropy preservation is achieved to maximize key length, then cryptographic key length is improved, but traditional fuzzy extractor structures must be abandoned
Solution Approach 1:
The patent fundamentally changes the parameters and structure of the fuzzy extractor by adopting lattice-based cryptography. Instead of using traditional error correcting codes with helper data that reduce entropy, the system uses LWE-based encryption where the PUF response itself serves as the secret, and the helper data is encrypted form of this response. This structural change enables full entropy preservation while maintaining fuzzy extractor functionality.
4Weight of moving object
If lightweight PUF-enabled devices with minimal memory capacity are targeted, then device portability is improved, but capacity to store authentication data is reduced
Solution Approach 1:
The patent uses cloud-based helper data as an intermediary to overcome the memory limitation of lightweight devices. The helper data, which is essential for authentication, is stored externally in the cloud rather than in the device's limited memory. This allows the device to remain lightweight and portable while still having access to the necessary authentication data through the cloud intermediary.
Solution Approach 2:
The patent extracts the heavy authentication data storage requirement from the lightweight device and places it in the cloud. The device only retains minimal local information (PUF characteristics and encrypted shared secret), while the bulk of authentication data (helper data) is extracted and stored externally, enabling the device to be lightweight while maintaining full authentication capability.
Data Source
AI summary
A method for authenticating a first device is disclosed. In one embodiment, the method includes the steps of: receiving a helper bit string from a second device that is remote from the first device; measuring a first response bit string of a physical unclonable function of the first device with respect to a challenge bit string; subtracting the first response bit string from the helper bit string; reconstructing a random matrix using a pseudo-random number generator initialized with a seed; and decoding a result of the subtraction using the random matrix, the shared secret bit string being provided from the decoding if the helper bit string was encoded using a previously measured second response bit string that is within a threshold level of similarity to the first response bit string, the decoding outputting an error value otherwise.