Resilient device authentication system with metadata binding
A resilient device authentication system for use with one or more managed devices each including a physical unclonable function (PUF), comprises: one or more verification authorities (VA) each including a processor and a memory loaded with a complete verification set (CVS) that includes hardware part-specific data associated with the managed devices' PUFs and metadata, the processor configured to create a limited verification set (LVS) through one-way algorithmic transformation of hardware part-specific data together with metadata from the loaded CVS so as to create a LVS representing both metadata and hardware part-specific data adequate to redundantly verify all of the hardware parts associated with the LVS; and one or more provisioning entities (PE) each connectable to a VA and including a processor and a memory loaded with a LVS, and configured to select a subset of the LVS so as to create an application limited verification set (ALVS). The system may also comprise one or more device management systems each connectable to a PE and to managed devices and including a memory configured to store an ALVS. The VA may also be configured to create a replacement LVS.
1. A resilient device authentication system for use with a device including a physical unclonable function (“PUF”), the system comprising:
a verification authority (“VA”); and
a provisioning entity (“PE”);
wherein the VA includes:
a VA processor; and
a VA memory;
wherein the VA processor is configured to:
store, in the VA memory, a complete verification set (“CVS”), the CVS including hardware part-specific data associated with physical properties of the PUF, and metadata associated with the device;
generate a limited verification set (“LVS”) for repeated verification of the device, the generating comprising:
generating a binding value by combining the hardware part-specific data with the metadata;
performing a one-way transformation of the binding value; and
including a result of the one-way transformation in the LVS; and
the PE includes:
a PE processor; and
a PE memory;
wherein the PE processor is configured to:
store the generated LVS in the PE memory; and
generate an application limited verification set (“ALVS”), the generating comprising:
selecting a subset of the LVS stored in the PE memory; and
storing the selected subset of the LVS as the ALVS.
2. The system of claim 1 , wherein the VA processor is configured to employ a cryptographic hash function to perform the one-way transformation of the binding value.
3. The system of claim 1 , wherein generating the binding value comprises concatenating a PUF response with the metadata.
4. The system of claim 1 , wherein the VA processor is configured to perform a one-way transformation that employs an iteration count.
5. The system of claim 1 , wherein the VA processor is configured to employ an elliptic curve function to perform the one-way transformation of the binding value.
6. The system of claim 1 , wherein the VA processor is configured to encrypt the LVS.
7. The system of claim 1 , further comprising a device management systems (“DMS”) connected to the PE and the device, the DMS including:
a DMS memory; and
a DMS processor configured to;
receive the ALVS from the PE; and
store the ALVS in the DMS memory.
8. The system of claim 1 , wherein the VA processor is further configured to generate a replacement LVS.
9. The system of claim 1 , wherein the VA processor is configured to perform a one-way transformation that is adapted to a zero knowledge proof authentication protocol.
10. A computer-implemented method for authenticating a device, the method comprising:
storing, by a verification authority (“VA”), a complete verification set (“CVS”), the CVS including hardware part-specific data associated with physical properties of a physical unclonable function (“PUF”) of the device, and metadata associated with the device;
generating, by the VA, a limited verification set (“LVS”) for repeated verification of the device, the generating comprising:
generating a binding value by combining the hardware part-specific data with the metadata;
performing a one-way transformation of the binding value; and
including a result of the one-way transformation in the LVS;
storing, by a provisioning entity (“PE”), the generated LVS in a memory of the PE; and
generating, by the PE, an application limited verification set (“ALVS”), the generating comprising:
selecting a subset of the LVS stored in the memory of the PE; and
storing the selected subset of the LVS as the ALVS.
11. The method of claim 10 , further comprising employing, by the VA, a cryptographic hash function to perform the one-way transformation of the binding value.
12. The method of claim 10 , wherein generating the binding value comprises concatenating a PUF response with the metadata.
13. The method of claim 10 , further comprising performing, by the VA, a one-way transformation that employs an iteration count.
14. The method of claim 10 , further comprising encrypting, by the VA, the generated LVS.
15. The method of claim 10 , further comprising:
receiving, by a device management system (“DMS”), the ALVS from the PE; and
storing the ALVS in a memory of the DMS.
16. The method of claim 10 , further comprising generating, by the VA, a replacement LVS.
17. At least one non-transitory storage medium storing processor executable instructions that, when executed, perform a method comprising:
storing a complete verification set (“CVS”), the CVS including hardware part-specific data associated with physical properties of a physical unclonable function (“PUF”) of a device, and metadata associated with the device;
generating a limited verification set (“LVS”) for repeated verification of the device, the generating comprising:
generating a binding value by combining the hardware part-specific data with the metadata;
performing a one-way transformation of the binding value; and
including a result of the one-way transformation in the LVS;
storing the generated LVS; and
generating an application limited verification set (“ALVS”), the generating comprising:
selecting a subset of the stored LVS; and
storing the selected subset of the LVS as the ALVS.
18. The method of claim 17 , further comprising employing a cryptographic hash function to perform the one-way transformation of the binding value.
19. The method of claim 17 , wherein generating the binding value comprises concatenating a PUF response with the metadata.
20. The method of claim 17 , further comprising encrypting the generated LVS.