Secure Remote Re-enrollment of Aging Physical Unclonable Functions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Physically unclonable function (PUF) devices face security risks during re-enrollment due to potential tampering, and conventional systems either compromise security or require manual re-enrollment, which is resource-intensive and limits device longevity.
Innovation Solution
A method for securely and remotely re-enrolling PUF devices using multiple sets of enrollment values, where a first set authenticates the device and a second set verifies its unaltered state, ensuring secure updates without exposing new keys or secrets, even in the presence of tampering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual re-enrollment is performed to update PUF mappings, then authentication accuracy is maintained, but resource consumption increases and device longevity is limited
Solution Approach 1:
The PUF device performs re-enrollment autonomously by generating new enrollment values and communicating them to the authentication device without manual intervention. The device monitors its own state changes and initiates re-enrollment procedures independently, eliminating the need for manual operations while maintaining authentication accuracy.
Solution Approach 2:
The system enables continuous re-enrollment operations that can be performed repeatedly without manual intervention. The PUF device continuously monitors for state changes and can trigger re-enrollment at appropriate intervals, ensuring authentication accuracy is maintained over extended periods without time loss.
2Duration of action of stationary object
If remote re-enrollment is implemented to update PUF mappings, then device longevity is extended, but security risks increase due to potential tampering
Solution Approach 1:
Before performing remote re-enrollment, the system first authenticates the PUF device using existing enrollment values to verify its unaltered state. This preliminary authentication ensures that only trusted devices can perform re-enrollment, preventing tampering while enabling extended device longevity through remote updates.
Solution Approach 2:
The authentication device receives and verifies enrollment values from the PUF device during re-enrollment. The system uses feedback mechanisms to confirm that the PUF device is in an unaltered state before accepting new enrollment values, thereby maintaining security while enabling remote re-enrollment for extended device operation.
3Reliability
If multiple sets of enrollment values are used for authentication, then security is improved, but system complexity increases
Solution Approach 1:
The enrollment values are segmented into multiple distinct sets (first set for authentication, second set for verification) that can be independently managed. This segmentation allows the system to maintain high security through multiple values while reducing complexity by organizing them in clear, separate categories with specific functions.
Solution Approach 2:
The system generates and stores multiple sets of enrollment values in advance during initial enrollment. By preparing these values beforehand, the system avoids the complexity of generating and managing multiple value sets during operation, while still maintaining high security through the use of multiple pre-prepared enrollment values.
Data Source
AI summary
As a PUF device ages, the response characteristics of the device change. Thus, mappings made on the original PUF outputs can drift and become invalid. Re-enrollment or re-mapping of hidden values to PUF response characteristics can resolve the changing nature of the PUF. Unfortunately, an adversary may tamper with the PUF during re-enrollment compromising security of the PUF. Accordingly, techniques of securely and remotely re-enrolling a PUF device are described. During an initial enrollment of the PUF device, multiple sets of enrollment values of the PUF device can be generated. For remote re-enrollment, a first initial set of enrollment values can be used to authenticate the PUF device. Upon authentication using the first initial set, the PUF device can re-enroll the PUF device and account for changes in PUF characteristics. A second set of initial enrollment values can then be used to verify that the PUF device is unaltered.