PUF Enrollment Security via Key Derivation and Mode Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems lack robust security measures to prevent unauthorized access and spoofing during and after challenge-response authentication processes, particularly in physically unclonable function (PUF) systems.
Innovation Solution
A PUF-enabled device generates response values to challenge values using a PUF circuit, derives keys for encryption and authentication, and implements secure modes to limit access and prevent reuse of challenge-response pairs, including initialization, standard, and catch-up modes, along with UID management to prevent spoofing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If challenge-response authentication is implemented using PUF circuits, then device identification and basic security are improved, but the system remains vulnerable to spoofing and unauthorized access during and after authentication
Solution Approach 1:
The system performs preliminary actions by generating multiple cryptographic keys from the PUF response before authentication occurs. These keys are stored securely and used to protect challenge-response pairs and authenticate communications. This preliminary key generation ensures that even if authentication occurs, the system has pre-established security credentials to prevent spoofing and unauthorized access.
Solution Approach 2:
The patent introduces cryptographic keys as intermediary elements between the PUF circuit and the authentication process. These keys mediate the authentication by encrypting challenge-response pairs and verifying device identity, adding a layer of security that prevents direct exploitation of the PUF circuit and mitigates spoofing attacks.
2Reliability
If multiple cryptographic keys are generated from PUF response values, then security against spoofing is improved, but system complexity increases
Solution Approach 1:
The system segments the cryptographic functionality by generating multiple distinct keys from a single PUF response, each key serving a specific security function. This segmentation allows different keys to handle different security tasks (authentication, encryption, integrity verification) independently, managing complexity through functional separation while maintaining strong anti-spoofing security.
Solution Approach 2:
The PUF response serves as a universal source for generating multiple cryptographic keys, each with specialized functions. This multi-functionality approach allows a single PUF circuit to provide the basis for comprehensive security (authentication, encryption, integrity) without requiring multiple separate security mechanisms, thereby managing complexity while enhancing security.
3Reliability
If challenge-response pairs are protected with encryption and authentication, then security during authentication is improved, but processing time and computational overhead increase
Solution Approach 1:
The system performs preliminary encryption and authentication setup by generating cryptographic keys before the authentication process. Challenge-response pairs are pre-protected using these keys, allowing the actual authentication to proceed with verified security without repeated computational overhead during the time-critical authentication moment.
Solution Approach 2:
The patent changes the parameter of security strength by implementing multiple layers of cryptographic protection (encryption, authentication codes) on challenge-response pairs. While this increases processing requirements, the use of pre-generated keys and efficient cryptographic algorithms minimizes the time penalty, achieving strong protection with acceptable performance.
4Adaptability or versatility
If enrollment process continues during challenge-response authentication, then continuous authentication capability is improved, but security vulnerabilities during enrollment increase
Solution Approach 1:
Cryptographic keys serve as intermediary protection during the enrollment process. These keys authenticate communications between the device and server, ensuring that even during enrollment when new challenge-response pairs are being created, the process remains protected from unauthorized access and spoofing attempts.
Solution Approach 2:
The system maintains continuous security protection during enrollment by using cryptographic keys to authenticate and protect communications throughout the entire enrollment process. This allows enrollment to continue uninterrupted while maintaining security, as the key-based authentication runs continuously alongside the enrollment operations.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Aspects of the present disclosure are directed toward a method that includes a physically-unclonable function (PUF) device that receives a communication that includes a first challenge value, a second challenge value and a remote message authenticity value. The method includes the generation of additional challenge-response pairs in a secure manner. The additional challenge-response pairs are securely communicated between the PUF device and an authenticating server or other device for subsequent use in authentication.