Apparatus and method for authenticating device based on certificate using physical unclonable function

Patent metadata

Field	Value
Publication number	US-2021392004-A1
Application number	US-202117208212-A
Country	US
Kind code	A1
Filing date	Mar 22, 2021
Priority date	Jun 10, 2020
Publication date	Dec 16, 2021
Grant date	—

Abstract

Disclosed herein are an apparatus and method for device authentication. The method for device authentication based on a certificate using a PUF, performed by an apparatus for device authentication based on a certificate using a PUF, includes acquiring previously stored first Challenge-Response-Pair (CRP) information corresponding to identification information received from a device that requests authentication and generating a certificate including a public key generated using the first CRP information; transmitting a message in which the certificate encrypted using the first response value of the first CRP information as a server secret key and the first challenge value of the first CRP information are included to the device; and authenticating the device by verifying an encrypted signature message received from the device through a secure channel.

First claim

What is claimed is:

1 . A method for device authentication based on a certificate using a Physical Unclonable Function (PUF), performed by an apparatus for device authentication based on a certificate using a PUF, the method comprising:
acquiring previously stored first Challenge-Response-Pair (CRP) information corresponding to identification information received from a device that requests authentication and generating a certificate including a public key generated using the first CRP information; transmitting a message in which the certificate encrypted using a first response value of the first CRP information as a server secret key and a first challenge value of the first CRP information are included to the device; and verifying an encrypted signature message received from the device through a secure channel, thereby authenticating the device.

2 . The method of claim 1 , wherein generating the certificate is configured to generate the public key using the first response value as a private key and to generate the certificate including the identification information and the public key.

3 . The method of claim 2 , further comprising:
generating, by the device, a second response value from the first challenge value using a PUF, and decrypting, by the device, the certificate using the second response value as a device secret key.

4 . The method of claim 3 , wherein decrypting the certificate is configured such that the device compares the identification information included in the decrypted certificate with the previously stored identification and thereby verifies validity of the certificate.

5 . The method of claim 3 , wherein authenticating the device is configured to communicate with the device through the secure channel, connected based on a preset security protocol.

6 . The method of claim 5 , wherein the encrypted signature message is acquired in such a way that the device encrypts a signature message on the secure channel using the second response value as a private key.

7 . The method of claim 6 , wherein authenticating the device is configured to decrypt the encrypted signature message using the public key included in the certificate and to authenticate the device by verifying the decrypted signature message.

8 . The method of claim 7 , further comprising:
receiving second CRP information from the device through the secure channel and updating the first CRP information to the second CRP information.

9 . The method of claim 8 , wherein updating the first CRP information is configured such that, when the device is successfully authenticated, the device generates the second CRP information by selecting an update challenge value and generating an update response value from the update challenge value using the PUF.

10 . The method of claim 9 , wherein updating the first CRP information is configured to receive the second CRP information from the device through the secure channel, to update the first CRP information to the second CRP information, and to reply with information about whether the update is completed to the device.

11 . An apparatus for device authentication based on a certificate using a Physical Unclonable Function (PUF), comprising:
one or more processors; and executable memory for storing at least one program executed by the one or more processors, wherein the at least one program is configured to: acquire previously stored first Challenge-Response-Pair (CRP) information corresponding to identification information received from a device that requests authentication and generate a certificate including a public key generated using the first CRP information; transmit a message in which the certificate encrypted using a first response value of the first CRP information as a server secret key and a first challenge value of the first CRP information are included to the device; and verify an encrypted signature message received from the device through a secure channel and thereby authenticate the device.

12 . The apparatus of claim 11 , wherein the at least one program generates the public key using the first response value as a private key and generates the certificate including the identification information and the public key.

13 . The apparatus of claim 12 , wherein the device generates a second response value from the first challenge value using a PUF and decrypts the certificate using the second response value as a device secret key.

14 . The apparatus of claim 13 , wherein the device compares the identification information included in the decrypted certificate with the previously stored identification information and thereby verifies validity of the certificate.

15 . The apparatus of claim 13 , wherein the at least one program communicates with the device through the secure channel connected based on a preset security protocol.

16 . The apparatus of claim 15 , wherein the encrypted signature message is acquired in such a way that the device encrypts a signature message on the secure channel using the second response value as a private key.

17 . The apparatus of claim 16 , wherein the at least one program decrypts the encrypted signature message using the public key included in the certificate and authenticates the device by verifying the decrypted signature message.

18 . The apparatus of claim 17 , wherein the at least one program receives second CRP information from the device through the secure channel and updates the first CRP information to the second CRP information.

19 . The apparatus of claim 18 , wherein, when the device is successfully authenticated, the device generates the second CRP information by generating an update response value from a previously stored update challenge value using the PUF.

20 . The apparatus of claim 19 , wherein the at least one program receives the second CRP information from the device through the secure channel, updates the first CRP information to the second CRP information, and replies with information about whether the update is completed to the device.

Assignees

• Electronics & Telecommunications Res Inst

Inventors

• Kim Byoung-Koo
• Yoon Seung-Yong
• Kang You-Sung
• Choi Doo-Ho
• Kim Ik-Kyun
• Kim Tae-Sung
• Oh Mi-Kyung
• Lee Sang-Jae

Classifications

• H04L9/3247

  involving digital signatures · CPC title

• G06F21/44

  Program or device authentication · CPC title

• H04L9/0825

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title

• G06F21/33

  using certificates · CPC title

• H04L9/3263

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title