Resilient device authentication system
View Patent ↗A resilient device authentication system and method comprising: one or more verification authorities (VAs) including a memory loaded with a complete verification set that includes hardware part-specific data, and configured to create a limited verification set (LVS) therefrom; one or more provisioning entities (PEs) each connectable to at least one of the VAs, including a memory loaded with a LVS, and configured to select a subset of data therefrom so as to create an application limited verification set (ALVS). Also disclosed is a device comprising a controller, device memory, input/output capable of communicating with the authentication system, and a physically-unclonable function associated with hardware part-specific information corresponding to hardware part-specific data in the loaded CVS. Further disclosed is an authentication system including hardware security modules.
1. A method of providing resilient authentication of managed devices, comprising:
a. establishing one or more verification authorities (“VAs”) each having a processor and a VA memory;
b. loading one or more VA memories with a complete verification set (“loaded CVS”) that includes hardware part-specific data associated with one or more managed devices;
c. creating one or more limited verification sets (“LVSs”) from said loaded CVS through one-way algorithmic transformation of hardware part-specific data in said loaded CVS;
d. establishing one or more provisioning entities (“PEs”) each connectable to at least one of said one or more VAs, and each having a processor and a PE memory;
e. loading each PE memory with a LVS (“loaded LVS”);
f. selecting a subset of data from said loaded LVS so as to create an application limited verification set (“ALVS”); and
g. creating one or more replacement LVSs from said loaded CVS through one-way algorithmic transformation of hardware part-specific data in said loaded CVS.
2. The method of claim 1 , further comprising the steps of connecting a PE to a VA, and conveying a replacement LVS from the VA to the PE.
3. The method of claim 2 , further comprising the step of a VA storing a LVS record containing the content of each LVS provided by it to PEs and an identification of the recipient PEs.
4. The method of claim 3 , further comprising the step of a VA, in response to an authorized entity's request for tracing, providing part of its LVS record to the authorized entity.
5. The method of claim 1 , further comprising the steps of: connecting, to a specified PE, one or more device management systems (“DMSs”) each including a DMS memory; and conveying an ALVS from said specified PE to a connected DMS.
6. The method of claim 5 , further comprising the step of said connected DMS managing one or more managed devices associated with hardware part-specific data in said loaded CVS.
7. The method of claim 6 , further comprising the step of each DMS storing in its DMS memory a record of interactions with managed devices.
8. The method of claim 5 , wherein at least one of said one or more DMSs is configured to perform supply chain risk management or to manage device authentication.
9. The method of claim 5 , wherein at least one of said one or more DMSs is configured to govern networked communications among managed devices with a communications protocol in which network addresses are based on managed devices' hardware part-specific data.
10. The method of claim 5 , further comprising the step of said specified PE storing an ALVS record containing the content of each ALVS provided by it to connected DMSs and an identification of the recipient DMSs.
11. The method of claim 10 , further comprising the step of a PE, in response to an authorized entity's request for tracing, providing part of its ALVS record to the authorized entity.
12. The method of claim 5 , further comprising the step of a PE constructing a replacement ALVS.
13. The method of claim 12 , further comprising the step of a PE excluding, from said replacement ALVS, data that was included in a loaded ALVS.
14. The method of claim 13 , further comprising the step of the PE constructing said replacement ALVS without employing a one-way algorithmic transformation.
15. The method of claim 1 , wherein the one-way transformation of step g is different than the one-way transformation of step c.
16. The method of claim 1 , wherein one or more of the managed devices includes a physically-unclonable function (“PUF”).
17. The method of claim 5 , wherein one or more of the managed devices includes a physically-unclonable function (“PUF”).
18. The method of claim 1 , further comprising the steps of a PE conveying information regarding any device-level security compromise to a connected VA, and that VA creating or updating a blacklist of CVS elements.
19. A resilient device authentication system for use with one or more managed devices each having hardware part-specific information, comprising:
a. one or more verification authorities (“VAs”) including a VA memory loaded with a complete verification set (“loaded CVS”) that includes hardware part-specific data associated with corresponding hardware part-specific information of the one or more managed devices, said VA configured to create a data set from a subset of said loaded CVS;
b. one or more provisioning entities (“PEs”) each connectable to at least one of said one or more VAs, each including a PE memory loaded with said data set created by said VA and a hardware security module, and each configured to create a DMS data set from a subset of said data set created by said VA; and
c. one or more device management systems (“DMSs”) each including a memory loaded with a DMS data set and a hardware security module,
wherein said hardware security modules in said PEs and DMSs are configured to permit only a selected portion or portions of hardware part-specific CVS data to be useable by the PEs and DMSs in which that hardware part-specific CVS data is stored.
20. The system of claim 19 , wherein at least one VA is configured to create a data set from a subset of said loaded CVS without performing one-way algorithmic transformation of hardware part-specific data in said loaded CVS.
21. The system of claim 20 , wherein said VA is configured to create a replacement data set from a subset of said loaded CVS.
22. The system of claim 20 , wherein at least one PE is configured to create a replacement DMS data set.
23. The system of claim 19 , wherein at least one VA is configured to perform one-way algorithmic transformation of hardware part-specific data in said loaded CVS, and wherein said data set created from a subset of said loaded CVS by said VA is a limited verification set (“LVS”).
24. The system of claim 23 , wherein at least one PE is configured to create a replacement DMS data set.
25. The system of claim 23 , wherein said VA is configured to create a replacement LVS.
26. The system of claim 19 , wherein each VA is configured to store in its VA memory a record of data conveyed by it to a PE.
27. The system of claim 26 , wherein each VA is configured to, in response to an authorized entity's request for tracing, provide one or more records to the authorized entity.
28. The system of claim 19 , wherein each DMS is configured to manage supply chain risk management, device authentication, or the governing of networked communications among managed devices.
29. The system of claim 28 , wherein each DMS is configured to store in its DMS memory a record of device interactions.
30. The system of claim 20 , wherein the hardware part-specific data characterizes one or more physically-unclonable functions residing in the managed devices.
31. The system of claim 23 , wherein the hardware part-specific data characterizes one or more physically-unclonable functions residing in the managed devices.
32. A resilient device authentication system for use with one or more managed devices each including hardware part-specific information, comprising:
a. one or more verification authorities (“VAs”) including a processor and a VA memory loaded with a complete verification set of data (“loaded CVS”) that includes means for uniquely identifying each of the one or more managed devices, each VA configured to create a limited verification set (“LVS”) from said loaded CVS and configured to create a replacement LVS from said loaded CVS; and
b. one or more provisioning entities (“PEs”) each connectable to at least one of said one or more VAs, including a processor and a PE memory loaded with a LVS (“loaded LVS”), each PE configured to select a subset of said loaded LVS loaded to create an application limited verification set (“ALVS”) and configured to create a replacement ALVS from said loaded LVS.
33. The system of claim 32 , wherein said VA is configured to create said LVS through a one-way algorithmic transformation of data in said CVS.
34. The system of claim 32 , further comprising one or more hardware security modules employed to protect CVS data from exposure.
35. The system of claim 32 , wherein the means for uniquely identifying each of the one or more managed devices comprises data associated with physical unclonable functions in one or more managed devices.
36. The system of claim 32 , further comprising one or more device management system means for managing the one or more managed devices.