PUF-Based Session Key Generation Without Stored Password Hashes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Central organizations face challenges in securing networks against cyberattacks due to asymmetry in verifying server legitimacy, leading to vulnerabilities in password management and authentication systems, especially when servers are mobile or distributed, and insider threats are present.
Innovation Solution
Implementing a system that uses physical unclonable function (PUF) devices to generate session keys through iterative hashing of passwords, where the number of hashing cycles is used as a challenge to PUFs, ensuring secure communication by comparing PUF responses without storing the hashed passwords directly, and using pseudo-homomorphic methods for authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If passwords are stored in a database for authentication, then user authentication can be performed, but the database becomes vulnerable to insider attacks and cyberattacks
Solution Approach 1:
The patent extracts the secret information from the stored password database by using PUF devices to generate passwords on-demand based on challenges. The actual password never resides in storage, only the challenge-response pairs are stored, eliminating the vulnerability of storing sensitive password data.
Solution Approach 2:
The PUF device acts as an intermediary between the challenge input and the password output. Instead of directly accessing stored passwords, the system uses the PUF's physical characteristics to generate passwords through a mediating process that cannot be reversed or replicated without the physical device.
2Reliability
If passwords are hashed using one-way cryptographic functions for secure storage, then password security is improved, but password guessing techniques can still attack the hashed passwords
Solution Approach 1:
Instead of storing and hashing actual passwords, the system creates copies of the authentication process using PUF challenge-response pairs. The PUF device reproduces the password generation process physically rather than computationally, making guessing attacks ineffective since the physical characteristics cannot be replicated through computation.
Solution Approach 2:
The patent replaces the mechanical/computational hashing system with a physical system based on PUF devices. The password generation transitions from a computational hash function to a physical measurement process that exploits inherent variations in semiconductor manufacturing, making the system resistant to computational attacks.
3Adaptability or versatility
If servers are made mobile or distributed to improve network flexibility, then network adaptability increases, but server authentication becomes more difficult and security risks increase
Solution Approach 1:
The PUF device enables servers to self-authenticate through their unique physical characteristics. Each server's PUF device automatically generates unique challenge-response pairs based on its physical manufacturing variations, providing inherent authentication without requiring external verification infrastructure, which is especially valuable for mobile and distributed servers.
Solution Approach 2:
The system changes the authentication parameter from static password verification to dynamic challenge-response verification based on physical characteristics. This allows servers to maintain strong authentication credentials that are inherently tied to their physical identity, enabling secure operation in mobile and distributed environments where traditional authentication infrastructure may be unavailable.
Data Source
AI summary
Systems and methods for the generation and use of session keys supporting secure communications between a client and server device are disclosed. The client device has or receives a password, which it hashes a predetermined first number of times. The hashed password is sent as a message digest to a server. The server applies the hashed password to an array of PUF devices, and receives a response bitstream which is stored. The client later hashes the password a second predetermined number of times, which is less than the first predetermined number, and this second message digest is sent to the server. The server continues to hash the second message digest, generate PUF responses, and compare the result to the initially stored responses. The number of hashes necessary to achieve a match is the session key.