Computational Fuzzy Extractor Using LWE for PUF Entropy Preservation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional fuzzy extractors fail to preserve the full entropy of physical unclonable functions (PUFs), resulting in insufficient key lengths for secure device authentication, particularly in scenarios requiring at least 128 bits of entropy, and are vulnerable to both passive eavesdroppers and active attackers.
Innovation Solution
The method employs a robust computational fuzzy extractor leveraging Learning with Errors (LWE) to derive longer cryptographic keys by using a random linear code, where the PUF response 'encrypts' the key, allowing decryption with a sufficiently similar PUF response, and includes a message authentication code (MAC) for secure authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional information-theoretic fuzzy extractors are used to remove noise from PUF responses, then the noise is successfully removed, but the full entropy of the PUF response is not preserved, resulting in shorter key lengths
Solution Approach 1:
The patent changes the fundamental parameters of the fuzzy extractor by replacing traditional error-correcting codes with Learning With Errors (LWE) based computational fuzzy extraction. This parameter change allows the system to preserve full entropy while maintaining noise removal capability, as LWE-based extraction does not require the same redundancy and entropy loss as traditional methods.
Solution Approach 2:
The patent substitutes the information-theoretic mechanical approach of traditional fuzzy extractors with a computational approach based on LWE cryptographic assumptions. This substitution enables entropy preservation by using computational hardness rather than information-theoretic redundancy to achieve the same noise removal function.
2Reliability
If traditional fuzzy extractors with error correcting codes are used, then noise removal is achieved, but the key length is insufficient for secure authentication requiring at least 128 bits
Solution Approach 1:
The patent changes the extraction mechanism from traditional error-correcting codes to LWE-based computational extraction, which preserves the full entropy of the PUF response. This parameter change directly enables generation of sufficiently long cryptographic keys (at least 128 bits) while maintaining authentication reliability.
3Ease of operation
If helper data is made publicly available for noise removal, then noise correction is enabled, but the system becomes vulnerable to passive eavesdroppers and active attackers
Solution Approach 1:
The patent substitutes the information-theoretic helper data model with a computational fuzzy extraction model based on LWE. This substitution maintains ease of operation by allowing public helper data while reducing security vulnerabilities through computational hardness assumptions that protect against both passive eavesdropping and active attacks.
Solution Approach 2:
The patent applies beforehand cushioning by using LWE-based extraction that anticipates and protects against future attacks on the helper data. The computational hardness of LWE provides a cushion of security that prevents attackers from exploiting the publicly available helper data, even before such attacks are attempted.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method and system for authenticating a device is disclosed. The method includes the steps of: receiving a helper bit string and a first MAC; measuring a first response bit string of a physical unclonable function of the device with respect to a challenge bit string; subtracting the first response bit string from the helper bit string; decoding a result of the subtraction using a uniformly distributed random matrix, the shared secret bit string being provided from the decoding if the helper bit string was encoded using a previously measured second response bit string that is within a threshold level of similarity to the first response bit string, the decoding outputting an error value otherwise; determining a second MAC based on the shared secret bit string, the uniformly distributed random matrix, and the helper bit string; and determining whether the second MAC matches the first MAC.