PUF File Access Using Split Digests and Ternary States
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption schemes using physical unclonable functions (PUFs) are vulnerable to attacks in untrusted environments, as attackers can intercept challenges and generate matching encryption keys, compromising security.
Innovation Solution
A challenge is divided into two message digests, with neither digest alone revealing the encryption key, requiring possession of both and additional information like a shared password to generate the key, and using masking data to exclude erratic devices, enhancing security against unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single message digest is used to generate the encryption key from the PUF challenge, then the key generation process is simple and fast, but the system becomes vulnerable to attacks where attackers can intercept the challenge and generate matching keys
Solution Approach 1:
The challenge information is segmented into two separate message digests: the first message digest contains a superset of PUF device addresses, and the second message digest contains masking information. This segmentation ensures that neither digest alone can be used to generate the encryption key, as both components are required to select the correct subset of responses from the PUF device
Solution Approach 2:
The masking information acts as an intermediary element that bridges the superset of addresses and the final subset selection. The masking data selectively masks addresses in the superset to produce the final subset of addresses used for key generation, adding an additional layer of security without requiring complex cryptographic protocols
2Reliability
If all PUF device addresses are included in the challenge response, then the key generation is straightforward, but erratic devices can compromise the reliability of the generated key
Solution Approach 1:
Different addresses in the PUF device array are treated differently through selective masking. The masking information identifies which specific addresses should be included or excluded from the final subset, allowing erratic devices to be locally masked out while maintaining the overall key generation process. This enables targeted quality control at the address level rather than requiring uniform treatment of all devices
Solution Approach 2:
The server performs preliminary identification of erratic PUF devices during the enrollment phase and pre-computes the masking information to exclude these unreliable addresses. This preliminary action ensures that only reliable devices are included in the final subset before the actual key generation occurs, preventing erratic devices from compromising key reliability
Data Source
AI summary
Methods and systems for managing access to encrypted digital files are proposed. A remote or client device including an array of physical unclonable function (PUF) devices is provided. A server device has an image of the PUF, with previously measured responses. The server device randomly selects a set of responses from a first list PUF devices in its image. The server device then generates masking data to select among the first list to generate response bitstream. The response bitstream is used to encrypt a file, which sent to the client for storage. The random number is also sent. Later, the server generates an encrypted message digest from which the client can retrieve the masking data, which is used with the random number to generate a response bitstream from the client PUF to decrypt the file.