A Privacy-Preserving, Mutual PUF-Based Authentication Protocol

Che, Wenjie; Martin, Mitchell T.; Pocklassery, Goutham; Kajuluri, Venkata K.; Saqib, Fareena; Plusquellic, Jim

doi:10.3390/cryptography1010003

Cited by 45 publications

(59 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The scheme is identical to traditional triple-modular-redundancy (TMR) methods used in fault tolerance designs. We extend this technique here to allow additional copies, e.g., 5 MR, 7 MR, 9 MR, etc., and combine it with a second reliability-enhancing method, called margining [9,11]. We call the combined method secure-key-encoding (SKE), because the helper data does not leak any information about the secret key.…”

Section: Discussionmentioning

confidence: 99%

“…Reference [11] describes several other features of the HELP algorithm. For example, HELP processes sets of 4096 PN into a multi-bit key, in contrast to other PUFs, which generate key bits one at a time.…”

Section: Discussionmentioning

confidence: 99%

“…The adversary may attempt to reverse-engineer the helper data to derive the secret key. As discussed in [11], the PUF used by BulletProoF uses a helper data scheme that does not leak information about the key.…”

mentioning

confidence: 99%

“…Inter-chip Hamming Distance (left), probability of failure (middle), and smallest bitstring size (right) statistics obtained from physical unclonable function numbers (PN) generated from a set of 30 Xilinx Zynq 7020 chips across extended industrial temperature-voltage specifications (−40 • C to 100 • C, +/−5% supply voltage). Statistical results are reported for multiple values of the HELP algorithm parameter margins and moduli, averaged across 400 LFSR seed-pairing combinations (mean values are used the reference mean and range parameters, see[11] for details).…”

mentioning

confidence: 99%

See 3 more Smart Citations

An Autonomous, Self-Authenticating, and Self-Contained Secure Boot Process for Field-Programmable Gate Arrays

et al. 2018

Self Cite

View full text Add to dashboard Cite

Secure booting within a field-programmable gate array (FPGA) environment is traditionally implemented using hardwired embedded cryptographic primitives and non-volatile memory (NVM)-based keys, whereby an encrypted bitstream is decrypted as it is loaded from an external storage medium, e.g., Flash memory. A novel technique is proposed in this paper that self-authenticates an unencrypted FPGA configuration bitstream loaded into the FPGA during the start-up. The internal configuration access port (ICAP) interface is accessed to read out configuration information of the unencrypted bitstream, which is then used as input to a secure hash function SHA-3 to generate a digest. In contrast to conventional authentication, where the digest is computed and compared with a second pre-computed value, we use the digest as a challenge to a hardware-embedded delay physical unclonable function (PUF) called HELP. The delays of the paths sensitized by the challenges are used to generate a decryption key using the HELP algorithm. The decryption key is used in the second stage of the boot process to decrypt the operating system (OS) and applications. It follows that any type of malicious tampering with the unencrypted bitstream changes the challenges and the corresponding decryption key, resulting in key regeneration failure. A ring oscillator is used as a clock to make the process autonomous (and unstoppable), and a novel on-chip time-to-digital-converter is used to measure path delays, making the proposed boot process completely self-contained, i.e., implemented entirely within the re-configurable fabric and without utilizing any vendor-specific FPGA features. Cryptography 2018, 2, 15 2 of 17Modern FPGAs provide on-chip battery-backed random-access memory (RAM) or E-Fuses for the storage of a decryption key, which is used by vendor-embedded encryption hardware functions, e.g., the Advanced Encryption Standard (AES), within the FPGA in order to decrypt the bitstream as it is read from the external NVM during the boot process [1]. Recent attack mechanisms have been shown to read out embedded keys, and therefore on-chip key storage threatens the security of the boot process [2].In this paper, we propose a physical unclonable function (PUF)-based key generation strategy that addresses the vulnerability of on-chip key storage. Moreover, the proposed secure boot technique is self-contained, in that none of the FPGA-embedded security primitives or FPGA clocking resources are utilized. We refer to the system as Bullet-Proof Boot for FPGAs (BulletProoF). BulletProoF uses a PUF implemented in the programmable logic (PL) side of an FPGA to generate the decryption key at boot time, and then uses the key for decrypting an off-chip NVM-stored second stage boot image. The second stage boot image contains PL components as well as software components, such as an operating system and applications. BulletProoF decrypts and programs the PL components directly into those portions of the PL side that are not occupied by BulletProoF using dynamic partial...

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Discussionmentioning

confidence: 99%

mentioning

confidence: 99%

mentioning

confidence: 99%

See 2 more Smart Citations

An Autonomous, Self-Authenticating, and Self-Contained Secure Boot Process for Field-Programmable Gate Arrays

et al. 2018

Self Cite

View full text Add to dashboard Cite

show abstract

“…Although references describe previous research on HELP [4][5][6][7], no prior work exists that describes the distribution effect presented in this paper. We have found no related work that leverages the membership characteristics of a group of physical elements as a mechanism to increase bit string diversity.…”

Section: Related Workmentioning

confidence: 99%

Leveraging Distributions in Physical Unclonable Functions

et al. 2017

Self Cite

View full text Add to dashboard Cite

A special class of Physical Unclonable Functions (PUFs) referred to as strong PUFs can be used in novel hardware-based authentication protocols. Strong PUFs are required for authentication because the bit strings and helper data are transmitted openly by the token to the verifier, and therefore are revealed to the adversary. This enables the adversary to carry out attacks against the token by systematically applying challenges and obtaining responses in an attempt to machine learn, and later predict, the token's response to an arbitrary challenge. Therefore, strong PUFs must both provide an exponentially large challenge space and be resistant to machine-learning attacks in order to be considered secure. We investigate a transformation called temperature-voltage compensation (TVCOMP), which is used within the Hardware-Embedded Delay PUF (HELP) bit string generation algorithm. TVCOMP increases the diversity and unpredictability of the challenge-response space, and therefore increases resistance to model-building attacks. HELP leverages within-die variations in path delays as a source of random information. TVCOMP is a linear transformation designed specifically for dealing with changes in delay introduced by adverse temperature-voltage (environmental) variations. In this paper, we show that TVCOMP also increases entropy and expands the challenge-response space dramatically.

show abstract

Lightweight privacy‐aware secure authentication scheme for cyber‐physical systems in the edge intelligence era

Deebak

Al‐Turjman²

2021

Concurrency and Computation

View full text Add to dashboard Cite

Internet of Things (IoT) and cyber‐physical systems demand proper real‐time data processing and analysis to fulfill the essential characteristics of seamless computing services such as less processing time, dynamic network management, and location awareness. With the evolution of mobile edge computing, numerous security and privacy issues have been addressed including policy management, authentication, access control, and confidentiality. The technologies such as big‐data, Internet of Things, and cloud have improved the development of modern healthcare systems to improve the quality of medical services. It is nowadays integrating the computing methods and communication technologies such as wireless sensor networks, radio frequency identification, smartphones, and location awareness to collect and analyze the physiological data of the patient. The e‐Health entities such as medical device, client, and server rely on analytical models to carry out early diagnosis and remote monitoring. As it is based on e‐Health applications, a real‐time healthcare system is preferred to integrate with mobile cloud computing. Since the medical data are hugely exposed to vulnerabilities, a lightweight privacy‐aware secure authentication (LPASA) scheme is presented. To achieve better secure efficiencies, this article is preferable to use lightweight cryptographic operations, namely, one‐way hashing function and bitwise exclusive‐OR. Moreover, the formal and informal security analysis shows that the proposed LPASA can withstand the possible active and passive attacks such as replay, man‐in‐the‐middle, privileged‐insider, online‐guessing, and so forth. The experimental analysis demonstrates that the proposed LPASA scheme achieves a better quality of services in terms of packet delivery ratio, energy consumption per data delivery bit, and percentage of packets with low latency to adopt in resource‐constrained environments.

show abstract

A Privacy-Preserving, Mutual PUF-Based Authentication Protocol

Cited by 45 publications

References 30 publications

An Autonomous, Self-Authenticating, and Self-Contained Secure Boot Process for Field-Programmable Gate Arrays

An Autonomous, Self-Authenticating, and Self-Contained Secure Boot Process for Field-Programmable Gate Arrays

Leveraging Distributions in Physical Unclonable Functions

Lightweight privacy‐aware secure authentication scheme for cyber‐physical systems in the edge intelligence era

Contact Info

Product

Resources

About