Industrial Control Authentication Using PUF-Based Device Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial automation environments face security vulnerabilities due to counterfeit industrial control products, which can go undetected and compromise the system, as existing authentication solutions rely on secret keys that can be extracted or modified.
Innovation Solution
The use of a physical unclonable function (PUF) to generate a unique secret key based on the device's atomic structure, eliminating the need to store the private key on the device and providing a digital fingerprint for authentication, with a certificate signed by the OEM and verified through cryptographic means.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secret keys are stored on the device for authentication, then authentication can be performed, but the security is compromised because the keys can be extracted or modified
Solution Approach 1:
The patent extracts the secret key from the device entirely, eliminating the security vulnerability of stored keys. Instead of storing private keys on the device, the system uses public key infrastructure where only public keys and certificates are stored on the device, while private keys remain securely on the authentication server.
Solution Approach 2:
The patent introduces certificates and public key infrastructure as intermediaries between the device and authentication server. The device communicates its identity through certificates signed by trusted authorities, eliminating the need for direct secret key storage while maintaining authentication capability.
2Reliability
If physical unclonable functions are used to generate dynamic keys, then security against counterfeiting is improved, but device complexity increases
Solution Approach 1:
The patent replaces traditional mechanical or electronic key storage systems with physical unclonable functions that leverage inherent physical characteristics of the device (such as manufacturing variations in silicon) to generate unique identifiers and cryptographic keys, eliminating the need for complex key management hardware.
3Reliability
If private keys are not stored on the device, then security is enhanced, but the authentication process becomes more complex
Solution Approach 1:
The patent performs preliminary actions during device manufacturing by embedding certificates and public keys into the device before deployment. This preliminary provisioning simplifies the runtime authentication process, as the device only needs to present its pre-configured credentials rather than managing complex key pairs dynamically.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques for authenticating industrial devices in an industrial automation environment are disclosed herein. In at least one implementation, a physical unclonable function response of an industrial device is extracted. The industrial device transmits a security certificate signed by a certificate authority that includes a device public key to a system, wherein the system validates the security certificate, encrypts an authentication challenge using the device public key, and transmits the authentication challenge to the industrial device. The industrial device generates a device private key using the physical unclonable function response and decrypts the authentication challenge using the device private key. The industrial device generates an authentication response based on the authentication challenge, encrypts the authentication response using the device private key, and transmits the authentication response to the system, wherein the system decrypts the authentication response using the device public key and authenticates the industrial device based on the authentication response.