HELP PUF Authentication Protocol for Token Privacy and Resource Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing PUF-based authentication protocols lack privacy for authenticating tokens, are susceptible to denial-of-service attacks, and require non-volatile memory and cryptographic primitives, which are resource-intensive and vulnerable to model-building attacks.
Innovation Solution
A PUF-based, end-to-end privacy-preserving mutual authentication protocol using Hardware-Embedded Delay PUF (HELP) that stores path delay information instead of response bitstrings, generating a large exponential set of response bitstrings from a fixed set of path delays without requiring non-volatile memory or cryptographic primitives on the token, and employs configuration parameters like Path-Select-Mask and Dual Helper Data to enhance security and reliability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If PUF-based authentication protocols use conventional response bitstring storage, then authentication functionality is achieved, but token privacy is compromised and the system becomes susceptible to denial-of-service attacks
Solution Approach 1:
The patent extracts the essential authentication information from response bitstrings to a minimal set of path delay parameters. Instead of storing complete response bitstrings that reveal token identity, the system stores only the fundamental path delay measurements in the verifier, which can generate any number of response bitstrings through parameter variation without exposing the underlying token identity.
Solution Approach 2:
The system changes parameters (such as challenge inputs and path selection masks) to generate different response bitstrings from the same underlying path delay information. This allows the verifier to produce diverse authentication responses without storing multiple response bitstrings, thereby maintaining token privacy while preventing denial-of-service attacks through parameter diversification.
2Reliability
If PUF-based authentication protocols store response bitstrings, then authentication is enabled, but the system requires non-volatile memory and cryptographic primitives that increase resource overhead
Solution Approach 1:
The verifier uses the stored path delay information to self-generate response bitstrings on-demand without requiring pre-stored response bitstrings or complex cryptographic primitives on the token side. The system serves its own authentication needs by computationally deriving responses from the minimal stored parameters, eliminating the need for resource-intensive non-volatile memory and cryptographic hardware on constrained devices.
Solution Approach 2:
Instead of storing response bitstrings and verifying them against challenges, the system inverts the approach by storing path delay parameters and generating response bitstrings during verification. This inversion shifts the computational burden from the token to the verifier, allowing resource-constrained tokens to operate with minimal memory and cryptographic capabilities while maintaining strong authentication security.
3Speed
If PUF-based authentication protocols use fixed response bitstrings, then authentication speed is maintained, but the system becomes vulnerable to model-building attacks
Solution Approach 1:
The system makes the authentication responses dynamic by generating different response bitstrings from the same path delay parameters through variation of challenges and path selection masks. This dynamic generation ensures that each authentication interaction produces unique responses, preventing adversaries from building accurate models of the PUF behavior while maintaining fast authentication speeds through efficient parameter-based generation rather than storing multiple fixed responses.
Data Source
Figure 1~2
Figure 3
Figure 4A~4C
AI summary
An authentication protocol using a Hardware-Embedded Delay PUF ("HELP"), which derives randomness from within-die path delay variations that occur along the paths within a hardware implementation of a cryptographic primitive, for example, the Advanced Encryption Standard ("AES") algorithm or Secure Hash Algorithm 3 ("SHA-3"). The digitized timing values which represent the path delays are stored in a database on a secure server (verifier) as an alternative to storing PUF response bitstrings thereby enabling the development of an efficient authentication protocol that provides both privacy and mutual authentication.