PUF Authentication Using Hash-Expanded Challenge-Response Pairs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing PUF technologies face challenges in balancing practicality, cost-efficiency, and security, particularly in expanding challenge-response spaces while maintaining robustness against attacks, especially for weak and strong PUFs.
Innovation Solution
The introduction of an expanded PUF (ePUF) framework that combines a base PUF with a transform function, such as a cryptographic hash, to generate multiple secondary challenge-response pairs from a single primary pair, enhancing the challenge-response space without the complexity of traditional strong PUFs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If a weak PUF is used, then cost and simplicity are improved, but the challenge-response space is limited
Solution Approach 1:
The system segments the challenge-response process into two independent stages: (1) PUF generates a response based on physical characteristics, and (2) a cryptographic hash function processes this response to generate the final challenge-response pair. This segmentation allows the simple weak PUF to achieve the versatility of a strong PUF through the additional hashing layer.
Solution Approach 2:
A cryptographic hash function is introduced as an intermediary between the weak PUF and the challenge-response interface. This intermediary transforms the limited PUF output into a expanded challenge-response space, enabling the system to serve multiple parties while maintaining the simplicity of the underlying weak PUF.
2Adaptability or versatility
If a strong PUF is used, then the challenge-response space is expanded, but device complexity increases
Solution Approach 1:
Instead of using a complex strong PUF, the system creates a computational copy/expansion of the weak PUF's capabilities through cryptographic hashing. The hash function generates multiple derived challenge-response pairs from a single weak PUF, effectively copying and expanding its functionality without physical complexity.
Solution Approach 2:
The patent replaces the physical/mechanical complexity of a strong PUF with a computational approach using cryptographic hash functions. This substitution achieves the same effect of expanding challenge-response space through software-based transformation rather than hardware complexity.
3Ease of operation
If the PUF interface is made widely available, then accessibility is improved, but security is compromised for weak PUFs
Solution Approach 1:
The system performs preliminary action by pre-processing the weak PUF response through a cryptographic hash function before exposing it to multiple parties. This preliminary transformation ensures that even if the interface is widely accessible, the underlying weak PUF remains protected because its raw output cannot be directly reverse-engineered.
Solution Approach 2:
The patent converts the inherent weakness of weak PUFs (limited challenge-response space) into a security benefit. By making the PUF interface widely accessible and using the limited output as a seed for cryptographic hashing, the system creates a secure system where the weakness itself prevents certain types of attacks while enabling broad accessibility.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
A comprising, by target computer equipment of a target party: obtaining a cryptographic key derived from a response generated by PUF module comprising a physically unclonable function, PUF, the response having been generated by the PUF module based on the PUF in response to a corresponding challenge input to the PUF module, wherein key information comprising the cryptographic key or a corresponding public key is also made available to a verifying party; from an issuing party, receiving a computation request specifying the computation to be performed; in response to the computation request, performing the computation in order to generate a computation result; signing a message comprising the computation result with the cryptographic key; and making the signed message available to the verifying party by sending the signed message to be recorded on a blockchain.