PUF-Based Authentication for Counterfeit Industrial Control Products
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial automation environments face security vulnerabilities due to counterfeit industrial control products, which can go undetected and compromise the system, as existing authentication solutions rely on secret keys that can be extracted or modified.
Innovation Solution
The use of physical unclonable functions (PUFs) to generate unique secret keys based on the atomic structure of industrial devices, eliminating the need to store private encryption keys on the device, thereby enhancing security and resistance to counterfeiting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secret keys are stored on industrial devices for authentication, then authentication functionality is achieved, but security is compromised due to key extraction or modification
Solution Approach 1:
The patent extracts the secret key from the device by using the PUF response as a seed to generate the key externally. The device only stores the PUF response (which is physically bound to its hardware), while the actual secret key is derived outside the device through a key generation function, eliminating the need to store sensitive keys on the device itself.
Solution Approach 2:
The PUF response acts as an intermediary between the device's physical characteristics and the cryptographic secret key. Instead of directly storing the secret key, the system uses the PUF response as an intermediate value that can be repeatedly generated by the device to reconstruct the key when needed, providing an additional layer of security.
2Ease of operation
If private encryption keys are stored on industrial devices, then authentication is enabled, but vulnerability to backdoor attacks increases
Solution Approach 1:
The private key is extracted from the device's secure storage by generating it externally from the PUF response. The device maintains authentication capability by being able to regenerate the same private key whenever needed through its unique PUF response, without permanently storing the sensitive key material on the device.
Solution Approach 2:
The private key becomes a transient, disposable object that is generated on-demand from the PUF response rather than being a permanent stored value. Each authentication session can use a freshly generated key derived from the PUF, making the system resistant to attacks targeting stored key material.
3Reliability
If physical unclonable functions are used to generate secret keys, then security against counterfeiting is improved, but device complexity increases
Solution Approach 1:
The PUF leverages the device's own inherent physical characteristics (such as variations in manufacturing processes at the silicon level) to generate its unique secret key. The device serves itself by using its own physical imperfections as the source of cryptographic entropy, eliminating the need for external key provisioning infrastructure.
Solution Approach 2:
The system changes the fundamental parameter of key generation from storing pre-provisioned secrets to dynamically generating keys from physical characteristics. This parameter change transforms the authentication mechanism from one relying on secret storage to one relying on physical unclonability, improving security while keeping the device architecture relatively simple.
4Reliability
If unique private encryption keys are stored on each industrial device, then device authentication is achieved, but physical space requirements increase
Solution Approach 1:
The private key is extracted from permanent storage by generating it dynamically from the PUF response. The device only needs to store the compact PUF response (typically a small binary value), while the full-strength private key is derived externally when needed, significantly reducing the space requirements on the device.
Solution Approach 2:
Instead of storing the large private key and deriving small identifiers from it, the system inverts the approach by storing a small PUF response and deriving the large private key when needed. This inversion allows the device to maintain strong authentication capabilities with minimal storage requirements.
Data Source
AI summary
Techniques for authenticating industrial devices in an industrial automation environment are disclosed herein. In at least one implementation, a physical unclonable function response of an industrial device is extracted. The industrial device transmits a security certificate signed by a certificate authority that includes a device public key to a system, wherein the system validates the security certificate, encrypts an authentication challenge using the device public key, and transmits the authentication challenge to the industrial device. The industrial device generates a device private key using the physical unclonable function response and decrypts the authentication challenge using the device private key. The industrial device generates an authentication response based on the authentication challenge, encrypts the authentication response using the device private key, and transmits the authentication response to the system, wherein the system decrypts the authentication response using the device public key and authenticates the industrial device based on the authentication response.