PUF-Based Enrolment Key Pair Generation for Secure IoT Device Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for device authentication in IoT systems, particularly those using pre-shared keys, face security challenges due to the need for secure key injection and management, which is costly and difficult to maintain, and do not enable proof-of-origin or access control, while the adoption of public key infrastructure (PKI) is hindered by economic and technical reasons.
Innovation Solution
An electronic device equipped with a security module featuring a physical unclonable function (PUF) generates an enrolment key pair based on a challenge and response, allowing for a temporary device certificate to be obtained post-manufacture without embedding a secret key, enabling secure authentication and key management through a secure connection with a server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If pre-shared keys are used for device authentication, then device enrollment is simplified, but security is compromised due to key injection vulnerabilities and inability to provide proof-of-origin
Solution Approach 1:
The patent extracts the secret key generation process from external key injection systems and moves it into the device's secure element, where keys are generated locally using physical unclonable functions. This eliminates the security vulnerability of external key injection while maintaining the simplicity of enrollment procedures.
Solution Approach 2:
The patent introduces a certificate authority as an intermediary that issues digital certificates binding device identities to their public keys. This mediator enables proof-of-origin authentication without requiring direct pre-shared keys between devices and servers, enhancing security while maintaining operational simplicity.
2Reliability
If secure facilities are used to inject secret keys into devices, then key security is improved, but cost and complexity increase significantly
Solution Approach 1:
The patent enables devices to self-generate their own secret keys using physical unclonable functions embedded in their secure elements. This self-service approach eliminates the need for external secure key injection facilities, reducing both cost and complexity while maintaining high key security through hardware-based protection.
Solution Approach 2:
The patent replaces the mechanical/physical key injection system with a cryptographic system based on physical unclonable functions and public key infrastructure. This substitution eliminates the need for physical secure facilities while providing equivalent or superior security through mathematical and physical principles.
3Reliability
If public key infrastructure is adopted for device authentication, then security guarantees such as proof-of-origin are enabled, but cost and technical complexity increase
Solution Approach 1:
The patent merges the benefits of pre-shared key simplicity with public key infrastructure security by having devices generate their own key pairs locally and receive certificates from a trusted authority. This combination maintains the operational simplicity of pre-shared keys while enabling the security guarantees of PKI, without requiring complex external key management infrastructure.
Data Source
AI summary
Methods, apparatuses, devices and computer readable media are provided in relation to enrolment. In one example, an electronic device is provided. The electronic device comprises a security module having a physical unclonable function (PUF). The security module is configured to establish an enrolment key pair (EPK,ESK) based on a first challenge and response to the PUF, the enrolment key pair comprising an enrolment public key (EPK) and an enrolment secret key (ESK). The electronic device further comprises one or more memories. The electronic device further comprises one or more processors configured to, over a secure connection, transmit a certificate signing request (CSR) comprising a device identifier and the EPK to a server for a certificate certifying that the EPK is associated with the device identifier, wherein the CSR is signed using the ESK, and wherein the device identifier is based on a function of the EPK. The one or more processors are further configured to, over the secure connection, receive a temporary enrolment device certificate certifying that the EPK is associated with the device identifier and including a validity period. The one or more processors are further configured to install the temporary enrolment device certificate in memory.