IoT Device Authentication Using PUF and White-Box Cryptography
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current IoT device authentication methods relying on software-based security are vulnerable to hacking and key exposure, especially in lightweight systems, and existing PUF-based methods face challenges in managing challenge-response pairs (CRPs) efficiently, leading to increased security threats and server load.
Innovation Solution
Implementing a method that uses white-box cryptography to authenticate IoT devices by generating and updating challenge-response pairs using a Physical Unclonable Function (PUF), minimizing the need for storing multiple CRPs and reducing server load, while preventing key exposure through continuous encryption and decryption processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software-based security is applied to IoT devices, then security measures can be implemented, but the system becomes vulnerable to hacking and key exposure
Solution Approach 1:
The patent replaces software-based security mechanisms with hardware-based PUF (Physical Unclonable Function) mechanisms. The PUF generates unique cryptographic keys based on physical characteristics of the device hardware, making key extraction through software attacks ineffective. This substitution fundamentally changes the security model from software-dependent to hardware-intrinsic security.
Solution Approach 2:
The patent changes the security parameter from software-stored keys to physically-bound keys generated by PUF. The challenge-response pair mechanism transforms the security verification process, where the response is dynamically generated based on physical characteristics rather than static software credentials, preventing replay attacks and key exposure.
2Reliability
If multiple challenge-response pairs are stored in the authentication server for PUF-based authentication, then device authentication can be performed, but the server load increases and security threats arise from CRP exposure
Solution Approach 1:
The patent extracts the cryptographic key generation function from the authentication server and places it locally in the IoT device through PUF. Instead of storing multiple CRPs on the server, the device generates responses locally using its unique physical characteristics. This extraction reduces server storage requirements and eliminates the security risk of CRP database exposure.
Solution Approach 2:
The IoT device performs self-authentication by using its internal PUF to generate cryptographic responses to challenges from the server. The device serves itself by generating unique keys based on its physical characteristics, eliminating the need for the server to store and manage multiple CRPs for each device. This self-service approach significantly reduces server load and complexity.
Data Source
AI summary
Disclosed herein are an apparatus and method for authenticating an IoT device. The method, performed by the IoT device authentication apparatus, includes transmitting, by the IoT device authentication apparatus, a random number to the IoT device and encrypting, by the IoT device authentication apparatus, the random number using a previously registered first white-box cryptography value through a white-box cryptography method; generating, by the IoT device, a first device response value from a previously registered first device challenge value using a Physical Unclonable Function (PUF) and encrypting, by the IoT device, the random number, received from the IoT device authentication apparatus, using the first device response value; and performing, by the IoT device authentication apparatus, authentication of the IoT device by checking whether the random number encrypted using the white-box cryptography method matches the random number encrypted using the PUF, which is received from the IoT device.