Oracle Authentication Using Memory PUFs and Blockchain
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Fog and IoT networks face challenges in authenticating oracles due to the inability to implement public key infrastructure (PKI) and scale with large numbers of transport layer security (TLS) connections, leading to difficulties in ensuring message integrity and loyalty/reward apportionment.
Innovation Solution
The use of memory physical unclonable functions (PUFs) for oracle authentication, where each oracle maintains a PUF array and a third-party trust broker manages transaction logging and audit flows using a blockchain database to establish secure communication channels and verify message authenticity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If public key infrastructure (PKI) and transport layer security (TLS) are used for oracle authentication, then message integrity and security are improved, but device complexity and memory requirements increase beyond the capacity of constrained sensor environments
Solution Approach 1:
The patent uses challenge-response authentication where each authentication exchange uses temporary cryptographic values that are discarded after use. The oracle generates a random challenge, the client generates a temporary response using the oracle's public key, and both values are discarded after verification. This avoids the need for persistent private keys and complex PKI infrastructure on the constrained oracle device.
Solution Approach 2:
The patent extracts the heavy cryptographic operations from the constrained oracle device and performs them on the client side. The oracle only needs to store its public key and verify client responses, while the client performs the computationally intensive operations of generating responses and managing session keys, thereby reducing the authentication infrastructure complexity on the oracle.
2Reliability
If TLS connections are established for each subscriber, then secure communication is improved, but the oracle cannot scale to large numbers of subscribers due to memory and processing constraints
Solution Approach 1:
The patent segments the authentication process into independent challenge-response exchanges for each connection. Each subscriber receives a unique challenge from the oracle and provides an independent response verified using the oracle's public key. This allows the oracle to handle multiple subscribers simultaneously without maintaining complex per-connection state, enabling scaling to large numbers of connections with limited memory.
Solution Approach 2:
The oracle uses a single public key that serves all authentication purposes for all subscribers. The same public key is used to verify responses from any subscriber, eliminating the need for multiple certificates or per-subscriber cryptographic materials. This universal authentication mechanism allows the oracle to scale to hundreds or thousands of subscribers without increasing memory requirements.
3Reliability
If conventional authentication methods are used, then message authenticity can be verified, but there is no verifiable or auditable public ledger for loyalty or reward apportionment
Solution Approach 1:
The patent establishes a blockchain ledger in advance that records all authentication events and data exchanges between oracles and subscribers. Each successful challenge-response authentication and each data value transmission is logged on the blockchain, creating an immutable audit trail before any loyalty or reward calculations are performed. This preliminary recording ensures complete transparency for subsequent reward apportionment.
Solution Approach 2:
The blockchain ledger provides continuous feedback to all participants about the state of authentication events and data exchanges. Both the oracle and subscriber can query the blockchain to verify the complete history of their interactions, ensuring that loyalty and reward calculations are based on verifiable, tamper-proof records of actual authenticated communications.
Data Source
AI summary
Systems and methods of oracle authentication in a network using a plurality of memory physical unclonable functions (PUFs). Method starts with oracle receiving initialization vector including initial seed value from client device. Oracle generates template that includes a PUF array. Oracle computes template using a superset of combinations of PUFs included in the oracle and transmits template to client device. Oracle generates first seed value, first key, and first authentication nonce, using pseudorandom number generator and the initial seed value. When oracle has first data to be sent to the client device, oracle generates first token using PUF array and first authentication nonce. Oracle generates first message by encrypting first data and first token using first key. The oracle transmits first message to the client device. Other embodiments are also disclosed.