Devices and methods for authentication

Patent metadata

Field	Value
Publication number	US-12238090-B2
Application number	US-202117186450-A
Country	US
Kind code	B2
Filing date	Feb 26, 2021
Priority date	Feb 27, 2020
Publication date	Feb 25, 2025
Grant date	Feb 25, 2025

Abstract

A device comprises a receive device which is designed to receive a data packet from a communication partner. The device comprises a data processing device which is configured to process the data packet in order to obtain a secret (e.g. predetermined) value. The device further comprises a transmit device which is designed to transmit a transmit message comprising information based on the secret value to the communication partner. The device further comprises an authentication device which is designed to receive a challenge message and to use the secret value to create a response message. The transmit device is designed to create the transmit message in such a way that it comprises the response message.

First claim

What is claimed is:

1. A device, comprising:
a receiver configured to receive a data packet from a communication partner;
a data processor configured to process the data packet to obtain a predetermined value;
an authenticator configured to receive a challenge message and to use the predetermined value to generate a response message; and
a transmitter configured to transmit a transmit message comprising the response message, which is used by the communication partner to authenticate the device,
wherein the predetermined value is obtained directly via the data processor processing the data packet to extract the predetermined value therefrom without the data processor additionally storing the predetermined value in a memory accessible by the device that is separate from the data processor.

2. The device as claimed in claim 1 , wherein the data processor is configured to obtain the predetermined value via (i) executing a predetermined function associated with the predetermined value, (ii) executing an encryption function using a key, or (iii) executing an decryption function using the key.

3. The device as claimed in claim 1 , wherein the predetermined value comprises an initial value for generating a private key of an authentication operation, and
wherein the device is configured to use the private key to generate at least a part of the transmit message.

4. The device as claimed in claim 3 , wherein the authentication operation comprises an asymmetric encryption operation or a signature operation.

5. The device as claimed in claim 1 , wherein the device further comprises:
a non-volatile memory having memory cells that are permanently programmed such that contents of the non-volatile memory cannot be altered.

6. The device as claimed in claim 1 , further comprising:
a data memory configured to provide a key for the data processor,
wherein the receiver is configured to receive a selection message, and
wherein the device is configured to modify the key in response to the selection message.

7. The device as claimed in claim 1 , wherein the receiver is configured to receive a selection message, and further comprising:
one or more processing logic circuits configured to provide a plurality of variants of a logic function for processing the data packet; and
a selector configured to end the use of a first variant of the logic function for processing and to begin the use of a second variant of the logic function for processing in response to the reception of the selection message.

8. The device as claimed in claim 1 , wherein the receiver is configured to receive a selection message, and further comprising:
one or more authentication logic circuits configured to provide a plurality of variants of a logic function for authenticating the communication partner; and
a selector configured to end the use of a first variant of the logic function and to begin the use of a second variant of the logic function in response to the reception of the selection message.

9. The device as claimed in claim 8 , wherein the selector is configured to receive, evaluate, and verify the selection message, and to end the use of the first variant of the logic function and to begin the use of the second variant of the logic function only if the authentication of the communication partner is successful.

10. The device as claimed in claim 9 , wherein the selector is configured to determine a hash value based on the selection message using a hash function, and (i) classify the authentication of the communication partner as successful if the hash value corresponds to a predetermined hash value and/or lies within a predetermined hash value range, or (ii) classify the authentication of the communication partner as unsuccessful if the hash value does not correspond to the predetermined hash value.

11. The device as claimed in claim 1 , wherein the receiver, the data processor, the authenticator, and the transmitter are configured in accordance with a hardware obfuscation technique to impede reverse engineering attempts.

12. The device as claimed in claim 1 , wherein the data packet comprises an encrypted data packet, and
wherein the data processor is configured to process the data packet by decrypting the encrypted data packet to obtain the predetermined value such that the predetermined value is not transmitted in unencrypted form between the device and the communication partner.

13. The device as claimed in claim 1 , wherein the authenticator is configured to generate the response message directly from the predetermined value obtained from the data packet without storing the predetermined value in a memory accessible by the device that is separate from the data processor.

14. A device for authenticating a communication partner, comprising:
a data memory configured to separately store a data packet and a key;
a data interface configured to exchange messages with the communication partner;
a control device configured to read the data packet from the data memory and to transmit the data packet via the data interface to the communication partner; and
an authenticator configured to receive, from the communication partner via the data interface, a message comprising authentication information and being generated by the communication partner using a predetermined value contained in the data packet, and to verify a validity of the authentication information with reference to the data packet using the key to obtain an authentication result,
wherein the device is configured to perform a further interaction with the communication partner depending on the authentication result, and
wherein the predetermined value is obtained directly by the communication partner via processing the data packet to extract the predetermined value therefrom without a data processor of the communication partner additionally storing the predetermined value in a memory accessible by the communication partner that is separate from the data processor.

15. The device as claimed in claim 14 , wherein the key comprises a public key of an authentication operation, and
wherein the device is configured to verify the authentication information without utilizing information associated with a private key of the authentication operation.

16. The device as claimed in claim 14 , wherein the authenticator is configured to transmit a challenge message to the communication partner via the data interface, and to receive the message as a response message that is associated with the challenge message that is generated using a private key of an authentication operation, and
wherein the key is a public key of the authentication operation associated with the private key.

17. The device as claimed in claim 16 , wherein the private key is generated using the predetermined value that is obtained from the data packet.

18. The device as claimed in claim 14 , wherein the data interface is configured to transmit a selection message containing an instruction to the communication partner to perform at least one of (i) modifying a key for processing the data packet in response to the selection message, (ii) ending the use of a first variant of a logic function for processing the data packet and beginning the use of a second variant of the logic function for processing the data packet in response to the reception of the selection message, or (iii) ending the use of a first variant of a logic function for authentication and beginning the use of a second variant of the logic function for authentication in response to the reception of the select

Assignees

• Infineon Technologies Ag

Inventors

• Poeppelmann Thomas

Classifications

• H04L63/0442

  wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30) · CPC title

• H04L9/3236

  using cryptographic hash functions · CPC title

• H04L2463/062

  applying encryption of the keys · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• H04L63/126

  the source of the received data · CPC title