PUF Authentication Protocol Using Masked Challenge-Response Pairs

The patent introduces a secret sharing mechanism as an intermediary between the challenge-response pairs and the database. Instead of storing plain challenge-response pairs, the system splits the authentication credentials into multiple shares and stores them in the database. This intermediary layer ensures that even if the database is breached, the stolen data cannot be used to authenticate without reconstructing all shares, thus resolving the contradiction between maintaining authentication reliability and reducing security risk.

The patent extracts the computationally intensive hashing and verification operations from the resource-constrained queried device and relocates them to the querying device. The queried device only needs to perform simple challenge-response generation using its PUF, while the querying device handles the secret sharing, reconstruction, and verification. This extraction allows strong security against modeling attacks without burdening the hardware resources of the queried device.

The patent replaces the mechanical hashing procedure with a mathematical secret sharing mechanism. Instead of using computationally expensive hash functions that require significant hardware resources, the system uses polynomial-based secret sharing where the queried device simply evaluates a polynomial at a given point (the challenge) to generate the response. This substitution maintains security while dramatically reducing hardware overhead for the queried device.