PUF Authentication via Substring Matching and Random Bit Injection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication mechanisms using physical unclonable functions (PUFs) are vulnerable to reverse-engineering attacks due to the increasing computational power of attackers, necessitating improved security measures for robust authentication and key exchange.
Innovation Solution
A method involving a prover device that generates a data string by submitting a challenge to a PUF, selecting a substring, and injecting random bits, while keeping the substring's position secret, and a verifier device that uses a computational model to verify authenticity by matching the received substring with the estimated response string, thereby obfuscating the PUF's model from attackers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the prover transmits the full PUF response string to the verifier, then authentication can be verified accurately, but the PUF model becomes vulnerable to reverse-engineering attacks
Solution Approach 1:
The prover extracts only a substring of predetermined length from the full PUF response string and transmits only this substring to the verifier. This extraction principle reduces the information exposed to attackers while maintaining sufficient data for authentication verification, directly resolving the contradiction between verification accuracy and attack vulnerability.
Solution Approach 2:
The PUF response string is segmented into multiple substrings, and only one substring is transmitted for authentication. This segmentation divides the complete response data into smaller units, allowing the system to use a portion of the data for verification while keeping the rest hidden, thus protecting against reverse-engineering while maintaining authentication capability.
2Ease of operation
If the prover reveals the position of the substring within the response string, then the verifier can easily match and verify authentication, but the PUF model becomes easier to model from transmitted data
Solution Approach 1:
Instead of providing the position information directly in the transmitted data, the system uses a separate secure channel or pre-shared knowledge between the prover and verifier to communicate the substring position. This dimensional separation allows the verification process to access position information without exposing it through the public transmission channel, easing verification while preventing model reverse-engineering.
3Reliability
If more authentication information is transmitted to increase security against attacks, then authentication security improves, but the overhead and complexity of the system increases
Solution Approach 1:
The system transmits a substring that is longer than the minimum required for authentication, providing a security margin. This partial action principle allows the system to send more data than strictly necessary, improving security against various attacks while the verification process remains simple by only checking if the transmitted substring matches the corresponding portion of the generated response string.
Data Source
AI summary
Mechanisms for operating a prover device and a verifier device so that the verifier device can verify the authenticity of the prover device. The prover device generates a data string by: (a) submitting a challenge to a physical unclonable function (PUF) to obtain a response string, (b) selecting a substring from the response string, (c) injecting the selected substring into the data string, and (d) injecting random bits into bit positions of the data string not assigned to the selected substring. The verifier: (e) generates an estimated response string by evaluating a computational model of the PUF based on the challenge; (f) performs a search process to identify the selected substring within the data string using the estimated response string; and (g) determines whether the prover device is authentic based on a measure of similarity between the identified substring and a corresponding substring of the estimated response string.