Watermarked PUF Model Authentication with Dynamic Challenge Ordering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods based on physical unclonable functions (PUFs) face challenges with replay attacks and data storage requirements, and are vulnerable to machine learning modeling attacks, especially when a malicious third party obtains a copy of the PUF model.
Innovation Solution
The method employs a watermarked PUF model that approximately simulates the behavior of the PUF circuit, using triggering challenges and authentication challenges with a randomized sending order to prevent misuse by malicious actors, and includes obfuscation to protect against model copying.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If a PUF model is used to simulate PUF circuit behavior for authentication, then data storage requirements are reduced, but security is weakened because the model can be copied by malicious third parties
Solution Approach 1:
The patent creates a PUF model that is a simplified copy of the PUF circuit behavior for authentication purposes. This model stores only the essential challenge-response relationships without capturing the full complexity of the physical circuit, reducing storage requirements while maintaining authentication functionality.
Solution Approach 2:
The PUF model is designed as a lightweight, software-based representation that can be easily updated or replaced. Instead of storing large amounts of PUF circuit data, the system uses a compact model that can be regenerated or updated through software updates, making it disposable and replaceable without hardware changes.
2Quantity of substance
If the same CRPs are reused for multiple authentication attempts, then data storage is reduced, but security is compromised due to replay attacks
Solution Approach 1:
The patent implements dynamic challenge selection where the verification equipment randomly chooses between trigger challenges and authentication challenges during each authentication attempt. This dynamic behavior prevents replay attacks because the challenge sequence varies each time, even though the underlying CRP set remains stored efficiently.
Solution Approach 2:
The system periodically alternates between using trigger challenges (for model validation) and authentication challenges (for actual authentication). This periodic structure allows the same CRP database to serve multiple purposes over time while maintaining security through varied challenge presentation.
3Reliability
If trigger challenges are sent before authentication challenges, then model verification is enabled, but authentication delay increases
Solution Approach 1:
The patent makes the challenge sending order dynamic rather than fixed. The verification equipment randomly determines whether to send trigger challenges or authentication challenges first, or to send them in parallel. This dynamic ordering prevents predictable delays while still enabling model verification when needed.
Solution Approach 2:
The system performs model verification using trigger challenges as a preliminary action before authentication, but only when security verification is needed. The randomization means that preliminary model checking is performed selectively rather than every time, reducing average authentication delay while maintaining verification capability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
This disclosure relates to a method (50) for authenticating a device to be authenticated by a verification device, said device to be authenticated comprising a PUF circuit, said method comprising the steps of: - (S501) obtaining a watermarked PUF model, - (S502) obtaining trigger challenges for which the watermarked PUF model provides responses different from the responses provided by the PUF circuit, - (S503) obtaining authentication challenges for which the watermarked PUF model provides the same responses as the PUF circuit, - (S504) selecting a sending order, - (S505) transmitting the trigger challenges and authentication challenges to the device to be authenticated in the selected sending order, - (S506) generating responses by the device to be authenticated for each received challenge, - (S507) transmitting the responses to the verification device, - (S508) verifying, by the verification equipment,of the identity of the device to be authenticated based on the responses received.