Reconfigurable PUF Authentication for IoT Modeling Attack Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional IoT devices using physical unclonable functions (PUF) are vulnerable to machine learning-based modeling attacks due to the storage of challenge-response pairs (CRPs) in authentication servers, which can be exploited by attackers to predict PUFs, leading to illegal duplication and data exposure.
Innovation Solution
Implementing a reconfigurable physical unclonable function (RPUF) and weak PUF (WPUF) in IoT devices, where entropy cells are independent and support low bit error rates, along with a dynamic reconfiguration of CRPs, to enhance security against such attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If CRP is stored in authentication server for PUF-based authentication, then authentication verification is enabled, but security is worsened due to vulnerability to machine learning-based modeling attacks
Solution Approach 1:
The patent implements dynamic reconfiguration of the PUF circuit where challenge-response pairs are not fixed but can be dynamically generated and updated. The PUF circuit structure is reconfigurable to produce different response values for the same challenge value at different times, making the authentication system adaptive and resistant to static modeling attacks.
Solution Approach 2:
The patent changes the parameters of the PUF system by introducing reconfigurability. Instead of fixed PUF characteristics, the system dynamically alters its internal state and configuration parameters, allowing the same PUF circuit to present different behavioral characteristics during authentication, thereby preventing attackers from building accurate models.
2Adaptability or versatility
If conventional PUF is used for authentication, then device uniqueness is provided, but security is compromised due to static CRP storage
Solution Approach 1:
The patent transforms the static PUF system into a dynamic one by enabling reconfiguration of the PUF circuit. This allows the system to maintain device uniqueness while continuously changing its authentication characteristics, preventing the security issues associated with static CRP storage.
Solution Approach 2:
The patent introduces a reconfiguration mechanism as an intermediary between the challenge input and the PUF response output. This intermediary layer dynamically modifies the PUF's internal state based on session information, allowing the system to maintain uniqueness while enhancing security through dynamic transformation.
3Duration of action of stationary object
If encryption keys are stored in non-volatile memory, then key retention is achieved, but security is worsened due to physical attack exposure
Solution Approach 1:
The patent extracts the encryption key from non-volatile memory storage and instead generates it dynamically through the PUF circuit during authentication operations. This eliminates the physical attack surface associated with stored keys while maintaining the ability to retain and use cryptographic material securely.
Solution Approach 2:
The PUF circuit serves itself to generate cryptographic keys on-demand without requiring external storage. The physical characteristics of the PUF circuit inherently provide the key material, eliminating the need for separate key storage infrastructure that would be vulnerable to physical attacks.
Data Source
AI summary
An Internet of Thing (IoT) device generates a first response value corresponding to a previously registered first challenge value by using a WPUF, generates a current session key based on the first response value, transmits the current session key to an authentication server by encrypting the current session key into a first random number, receives, from the authentication server, some of a previously registered CRP transmitted by the authentication server as the authentication server authenticates the IoT device based on the first random number and the session key and a second random number, generates a second response value corresponding to a second challenge value, among the some of the CRP, by using an RPUF, authenticates the authentication server by comparing the second response value with the some of the CRP, and then updates the session key, the second challenge value, and the second response value for a next session.