Instant Key Pair Generation for DPA Attack Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing public-key cryptosystem-based authentication methods are vulnerable to side channel attacks, particularly differential power analysis (DPA) attacks, due to the exposure of private keys, which can be targeted and compromised.
Innovation Solution
An authentication apparatus and method that dynamically generates instant public and private key pairs using a physically unclonable function (PUF) as a hardware fingerprint, preventing the need for storing fixed private keys and making DPA attacks impossible by using temporarily generated keys for each authentication process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a fixed private key is stored in the device for public-key cryptosystem authentication, then authentication functionality is enabled, but the device becomes vulnerable to side channel attacks such as differential power analysis (DPA) attacks
Solution Approach 1:
The patent applies dynamics by transitioning from static fixed private keys to dynamic instant key pairs that are generated temporarily for each authentication process. The key generator creates a new public-private key pair on-demand, uses it for authentication, and then discards it, ensuring that no fixed private key remains stored in the device that could be targeted by DPA attacks.
Solution Approach 2:
The patent applies preliminary action by pre-provisioning the device with a master secret key during manufacturing, which is then used to generate instant key pairs when needed. This master secret key is never exposed or stored in a form that could be attacked, but enables the dynamic generation of secure key pairs on-demand before authentication operations.
2Object-affected harmful factors
If instant key pairs are generated dynamically for each authentication process, then resistance to DPA attacks is achieved, but key management complexity increases
Solution Approach 1:
The patent applies the intermediary principle by introducing a key generator as a dedicated component that mediates between the master secret key storage and the authentication operations. This key generator automatically handles the complex tasks of instant key pair generation, selection, and disposal, shielding the rest of the system from key management complexity while enabling DPA attack resistance.
Solution Approach 2:
The patent applies self-service by designing the key generator to autonomously manage the entire instant key lifecycle - generating key pairs on-demand, selecting appropriate keys for authentication operations, and securely disposing of used keys without external intervention. This automation reduces operational complexity despite the dynamic key management approach.
3Adaptability or versatility
If a master secret key is pre-stored in the device, then instant key pairs can be generated securely, but the device must protect this master key from physical attacks
Solution Approach 1:
The patent applies the extraction principle by removing the master secret key from the operational key usage cycle. The master key is extracted from the authentication process and kept isolated in secure storage, never exposed to external interfaces or processing operations. Only derived instant key pairs are used for authentication, so even if physical attacks occur, the master key remains protected and can generate new instant keys.
Solution Approach 2:
The patent applies beforehand cushioning by preparing multiple instant key pairs in advance through the key generator, so that if one key is compromised or becomes unusable due to physical attacks, other pre-generated instant keys remain available for authentication. This creates a buffer that protects the system's authentication capability even when the master key is under threat.
Data Source
AI summary
Disclosed is an authentication apparatus using a public key encryption algorithm. An apparatus according to an embodiment generates a first instant public key through a random number generation process in response to an electronic signature generation request corresponding to a message. Further, the apparatus calculates and uses a first instant private key making a pair with the first instant public key, using the first instant public key.