Physically unclonable function (PUF) authority for identification trust in communications with internet of things (IoT) devices

1 . A method for physically unclonable function (PUF) enabling secure communications with a PUF enrolled device, the method comprising:

directing a PUF unit to acquire, a PUF response to an optical stimulus by the PUF unit onto a physical random medium of the PUF unit, for establishing secure communications, enrollment and identification of a device;

retrieving the PUF response from the PUF unit and generating a secure hash identifier (SHI) from the PUF response;

creating a digital certificate with the SHI; and,

storing the SHI, digital certificate and PUF response in a record of a registry in connection with the device for use in a subsequent authentication of the device by a communicating client in order to establish a secure tunnel between the communicating client and the device.

2 . The method of claim 1 , wherein the PUF unit is embedded in the device as part of the device.

3 . The method of claim 1 , wherein the PUF unit is separate from the device.

4 . The method of claim 1 , further comprising generating a certified hash identifier (CHI) from a serial number of the certificate, the SHI and a processor identifier of the device and storing the CHI in the registry for use in the subsequent authentication.

5 . The method of claim 1 , further comprising modifying the record with revocation data responsive to a lapse of a threshold period of time without an attempt to validate the device.

6 . A data processing system adapted for physically unclonable function (PUF) enabling secure communications with a PUF enrolled device, the system comprising:

a host computing platform comprising one or more computers, each with memory and one or processing units including one or more processing cores;

fixed storage defining a registry of authentication data for different PUF enrolled devices;

a device selected for PUF enrollment in the registry;

a PUF unit in optical communication with the device and in data communication with the host computing platform; and,

an enrollment module comprising computer program instructions enabled while executing in the memory of at least one of the processing units of the host computing platform to perform:

directing the PUF unit to acquire a PUF response to an optical stimulus by the PUF unit onto a physical random medium portion of the PUF unit, for establishing secure communications, enrollment and identification of a device;

retrieving the PUF response from the PUF unit and generating a secure hash identifier (SHI) from the PUF response;

creating a digital certificate with the SHI; and,

storing the SHI, digital certificate and PUF response in a record of the registry in connection with the device for use in a subsequent authentication of the device by a communicating client in order to establish a secure tunnel between the communicating client and the device.

7 . The system of claim 6 , wherein the PUF unit is embedded in the device as part of the device.

8 . The system of claim 6 , wherein the PUF unit is separate from the device.

9 . The system of claim 6 , wherein the program instructions further perform generating a certified hash identifier (CHI) from a serial number of the certificate, the SHI and a processor identifier of the device and storing the CHI in the registry for use in the subsequent authentication.

10 . The system of claim 6 , wherein the program instructions further perform modifying the record with revocation data responsive to a lapse of a threshold period of time without an attempt to validate the device.

11 . A computing device comprising a non-transitory computer readable storage medium having program instructions stored therein, the instructions being executable by at least one processing core of a processing unit to cause the processing unit to perform a physically unclonable function (PUF) enabling secure communications with a PUF enrolled device, by:

directing a PUF unit to acquire a PUF response to an optical stimulus by the PUF unit onto a physical random medium portion of the PUF unit, for establishing secure communications, enrollment and identification of a device;

retrieving the PUF response from the PUF unit and generating a secure hash identifier (SHI) from the PUF response;

creating a digital certificate with the SHI; and,

storing the SHI, digital certificate and PUF response in a record of a registry in connection with the device for use in a subsequent authentication of the device by a communicating client in order to establish a secure tunnel between the communicating client and the device.

12 . The device of claim 11 , wherein the PUF unit is embedded in the device as part of the device.

13 . The device of claim 11 , wherein the PUF unit is separate from the device.

14 . The device of claim 11 , wherein the instructions cause the processing unit to additionally perform generating a certified hash identifier (CHI) from a serial number of the certificate, the SHI and a processor identifier of the device and storing the CHI in the registry for use in the subsequent authentication.

15 . The device of claim 11 , wherein the instructions cause the processing unit to additionally perform modifying the record with revocation data responsive to a lapse of a threshold period of time without an attempt to validate the device.