In-Memory Signing with Physically Unclonable Function
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods for communication endpoints with secure memory devices in service networks lack robustness, as they rely on persisted keys and do not ensure only authorized access, leaving them vulnerable to unauthorized commands and data tampering.
Innovation Solution
Implementing a physically unclonable function (PUF) to generate asymmetric keys uniquely tied to each memory device, combined with a key management system (KMS) and certificate authority, which regenerates keys as needed and ensures only authorized users can issue commands by signing requests with a private key, thereby enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If persisted keys are used for authentication, then authentication can be performed, but security is compromised due to vulnerability to unauthorized access and data tampering
Solution Approach 1:
The patent extracts the key generation and storage functions from the authentication system by implementing a physically unclonable function (PUF) that generates keys on-demand without persisting them. The PUF derives cryptographic keys from physical characteristics of the memory device itself, removing the need to store private keys and eliminating the security vulnerability of persisted authentication credentials.
Solution Approach 2:
The patent introduces a key management system (KMS) as an intermediary between the authentication entity and the service network. The KMS manages the PUF-based key generation process, handles certificate issuance, and coordinates authentication operations without exposing private keys, thereby providing secure authentication while preventing unauthorized access.
2Reliability
If traditional authentication methods are used, then the system is simpler to implement, but it lacks robustness against unauthorized commands
Solution Approach 1:
The patent implements self-service authentication where the memory device itself generates cryptographic keys through its physical characteristics via the PUF mechanism. The device autonomously performs key derivation from its unique physical properties without requiring external key distribution or manual configuration, thereby enhancing robustness while managing complexity through automation.
Solution Approach 2:
The patent changes the fundamental parameter of key persistence from static (persisted keys) to dynamic (on-demand generation). By using the PUF to continuously derive keys from physical characteristics rather than storing fixed keys, the system achieves greater robustness against unauthorized commands while the complexity is offset by the automated nature of the process.
3Speed
If keys are persisted for authentication, then authentication operations are faster, but the system becomes vulnerable to key compromise
Solution Approach 1:
The patent extracts private keys from the authentication process entirely by using the PUF to generate public-private key pairs on-demand. Only public keys and certificates are stored externally, while private keys exist transiently in memory during authentication operations, eliminating the vulnerability of persisted private keys while maintaining authentication speed through efficient PUF-based key derivation.
Solution Approach 2:
The patent changes the temporal parameter of key existence from persistent to transient. Keys are generated in memory when needed for authentication and discarded afterward, with the PUF enabling rapid regeneration. This parameter change eliminates key compromise vulnerability from persistence while maintaining speed through the efficiency of physical-characteristic-based derivation.
Data Source
AI summary
The disclosed embodiments are related to the generation of a personal identifier within a memory device. In one embodiment, a method is disclosed comprising generating an asymmetric key pair from a physically unclonable function (PUF), the asymmetric key pair including a public key and a private key; generating a certificate signing request (CSR) for the public key, the CSR including a user identifier and a customer public key; requesting a digital certificate of the public key from a certificate authority (CA), the certificate authority storing a mapping between the customer public key and the user identifier; receiving a message from a host device; signing the message using the private key; and transmitting the signed message and the digital certificate to a computing device.