PUF Response Segmentation for Virtual Machine Host Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for verifying the possession of virtual machines are vulnerable to attacks such as malware injection, fuzzy extractor hacking, and semantic introspection, which compromise the authenticity of physically unclonable function (PUF) responses, making it difficult to ensure secure remote resource possession.
Innovation Solution
A method that involves challenging a PUF component with multiple values to create a challenge-response database, filtering PUF responses based on specific rules, and combining these responses to validate the correct host device, thereby enhancing the security of PUF-based identification across multiple virtual machines.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single PUF challenge is used to verify virtual machine possession, then the verification process is simple, but the system becomes vulnerable to malware injection, fuzzy extractor hacking, and semantic introspection attacks
Solution Approach 1:
The verification process is segmented into multiple independent PUF challenges, each assigned to different virtual machines. Instead of relying on a single PUF response, the system divides the verification into multiple segments (challenges) that must all be satisfied. This segmentation increases reliability by making it harder for attackers to compromise the entire system through a single point of failure, while keeping each individual challenge relatively simple to implement.
Solution Approach 2:
The system performs preliminary actions by pre-configuring multiple virtual machines with specific filter rules before the actual verification occurs. The filter rules are established in advance to define how PUF responses should be processed and combined. This preliminary setup enables the system to efficiently handle multiple challenges without adding excessive complexity during the actual verification process.
2Reliability
If multiple virtual machines are used to enhance security, then the system becomes more resistant to attacks, but the complexity of managing and verifying PUF responses increases
Solution Approach 1:
Each virtual machine is assigned a specific segment of the overall verification process through unique filter rules. This segmentation allows multiple VMs to operate independently while contributing to the collective security. The filter rules divide the PUF response processing into distinct segments that can be managed separately, reducing the operational complexity despite having multiple VMs.
Solution Approach 2:
The system merges the PUF responses from multiple virtual machines through a combination process defined by the filter rules. Instead of managing each VM's verification separately, the system combines their responses in a coordinated manner. This merging approach simplifies management by treating the multiple VMs as a unified verification system rather than independent entities.
3Reliability
If PUF responses are filtered and combined from multiple virtual machines, then the security against faking responses is significantly hardened, but the processing time and computational overhead increase
Solution Approach 1:
The filter rules are established in advance during system configuration, before the actual PUF verification occurs. This preliminary action pre-defines how responses should be filtered and combined, eliminating the need for complex real-time decision-making during verification. The pre-configured rules enable faster processing by providing clear, predetermined instructions for handling multiple PUF responses.
4Measurement precision
If a challenge-response database is created with multiple PUF challenges, then the system can more reliably validate the correct host device, but the storage and management requirements increase
Solution Approach 1:
The challenge-response database is segmented into multiple discrete challenge entries, each corresponding to a specific PUF challenge. Instead of storing a single large verification record, the system divides the validation data into smaller, manageable segments. This segmentation improves validation accuracy by allowing precise matching of specific challenges while keeping each database entry relatively small and efficient to manage.
Data Source
AI summary
For securing a provable resource possession on a host device having spawned a set of virtual machines providing services to a client device, the client device is able to send a challenge request to each virtual machine, the challenge request containing a physically unclonable function (PUF) challenge and a filter rule; receive a PUF filtered response from each virtual machine, the PUF filtered response being a PUF response that is filtered according to the filter rule and obtained by challenging; combine the PUF filtered responses into a reconstructed PUF according to the filter rule; and if the reconstructed PUF corresponds to an expected response in the challenge-response database, validate that the set of virtual machines is effectively running on the right host device.