PUF Key Recreation via Time-Based Pool Selection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing PUF-based authentication solutions face challenges in validating their output without compromising security or adding unnecessary logic, and they are prone to security risks from electromagnetic emissions and physical attacks.
Innovation Solution
The described techniques utilize a PUF to generate a pool of random bits for recreating a known good key with high entropy, incorporating time-based variations to provide full obfuscation, thereby reducing the need for entropy validation and minimizing security risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If PUF output is validated for entropy, then authentication reliability is improved, but additional validation circuitry and processing time are required
Solution Approach 1:
The patent pre-generates multiple candidate keys during device provisioning and stores them securely. During authentication, the PUF output is used to select one of these pre-generated keys without requiring entropy validation, as the entropy was already ensured during the secure provisioning phase. This eliminates the need for runtime entropy validation circuitry.
Solution Approach 2:
The system performs key generation and entropy validation in advance during device provisioning, rather than during authentication operations. This preliminary action transfers the computational and validation burden to the provisioning phase, allowing faster authentication without validation circuitry.
2Reliability
If PUF output is repeatedly verified, then authentication reliability is improved, but processing time and logic overhead increase
Solution Approach 1:
Multiple candidate keys are pre-generated and stored during provisioning. During authentication, the system only needs to select a key using the PUF output and verify it against the stored candidate, eliminating repeated PUF invocations and reducing processing time while maintaining reliability.
3Stability of the object's composition
If key material is stored for recreation, then key consistency is improved, but security risks from storage increase
Solution Approach 1:
The patent stores multiple candidate keys that are used once for authentication and then discarded. Each authentication session uses a different key from the pool, and used keys are not reused. This approach maintains key consistency through the candidate pool while minimizing security risks by limiting the exposure window of each key.
Solution Approach 2:
The key material is segmented into multiple candidate keys stored in a pool. Instead of storing a single long-lived key, the system divides the key material into multiple shorter-lived candidate keys, reducing the impact of any single key compromise while maintaining overall system consistency.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A method comprises receiving a first PUF bitstring from a physically unclonable function (PUF) device, generating, during a provisioning process, a series of match bits, wherein each bit in the series of match bits indicates whether a first PUF bit in the first PUF bitstring matches a corresponding encryption key bit in an encryption key, and using at least a portion of the series of match bits to recreate, during an authentication process, the encryption key.