Physical Unclonable Function Authentication Without Storing Passwords
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authentication systems are vulnerable to attacks when an attacker gains access to lookup tables or databases storing user authentication information, as they can decrypt or decode the information using computational methods, especially when hashing functions are well-known.
Innovation Solution
The use of physical unclonable function (PUF) devices in a computing system to generate and store challenge responses, where message digests are used to address PUF devices, ensuring that neither passwords nor hashes are stored, making it impossible for attackers to guess valid passwords without accessing the PUF devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conventional authentication systems store user credentials in lookup tables or databases, then authentication can be performed efficiently, but the system becomes vulnerable to attacks when attackers gain access to the stored information
Solution Approach 1:
The patent extracts the secret information from stored credentials by using PUF devices to generate authentication data on-demand rather than storing pre-computed credentials. The system only stores authentication challenges and algorithms, while the responses are generated dynamically by the PUF device during authentication, removing the vulnerability of storing password hashes or encrypted credentials.
Solution Approach 2:
The PUF device acts as an intermediary between the user's knowledge (password) and the authentication system. Instead of directly storing or transmitting password information, the system uses the PUF device to translate the password into unique physical characteristics that generate authentication tokens, creating a secure intermediate layer that prevents direct access to credential information.
2Object-affected harmful factors
If encryption or hashing functions are applied to user information, then security is improved against unauthorized access, but well-known hashing functions can still be compromised by computational methods
Solution Approach 1:
The patent replaces computational cryptographic functions (hashing, encryption) with physical unclonable functions. Instead of using mathematical algorithms that can be computed and broken, the system uses the unique physical characteristics of hardware components (timing variations, manufacturing defects) to generate authentication data, substituting computational security with physical security that is inherently resistant to computational attacks.
Solution Approach 2:
The system changes the fundamental parameter from computational complexity to physical uniqueness. Rather than relying on the computational difficulty of reversing hash functions, the system relies on the physical unclonability of hardware parameters such as transistor timing variations and manufacturing tolerances, making the authentication data impossible to replicate through computation alone.
3Object-affected harmful factors
If the system generates challenge responses using PUF devices, then security against password guessing attacks is enhanced, but the system complexity increases due to the need for PUF device management
Solution Approach 1:
The PUF device serves multiple functions: it acts as a secure random number generator, a cryptographic key storage, an authentication token generator, and a device fingerprinting mechanism. This multi-functionality reduces the need for separate security components and simplifies the overall system architecture despite the added security capabilities.
Solution Approach 2:
The PUF device automatically generates unique authentication data based on its inherent physical characteristics without requiring manual configuration or key management. The device self-identifies through its challenge-response behavior, eliminating the need for traditional key distribution and management infrastructure.
Data Source
AI summary
Systems and methods for improving security in computer-based authentication systems by using physical unclonable functions are presented. A computing device used to provide authentication includes an array of physical unclonable function devices. Rather than storing user passwords or message digests of passwords, the computing device generates a message digest based on a combination of a user ID and corresponding password. This message digest forms part of challenge (together with instructions for responding to the challenge). A challenge response generated by measuring physical parameters of set of physical unclonable function devices specified by the message digest. This allows the computing device to provide authentication without storing information which could be used by an attacker to compromise user credentials.