Methods and apparatus to derive and verify virtual physical unclonable keys
Methods, apparatus, systems, and articles of manufacture are disclosed. An example apparatus includes: instructions; and processor circuitry to execute the instructions to: retrieve a random number and a physical unclonable function (PUF) from a trusted environment; generate a virtual PUF (vPUF) based on a trusted operation including the random number and the PUF; and store the vPUF and the random number in a persistent storage.
1 . An apparatus comprising:
physical unclonable function (PUF) circuitry to provide a PUF;
number generation circuitry;
instructions; and
at least one programmable circuit to be programmed based on the instructions to:
generate a first virtual PUF (vPUF) based on a first message from a first client device, the first vPUF based on a trusted operation performed with a first number from the number generation circuitry and the PUF;
generate a second vPUF based on a second message from a second client device, the second vPUF based on the trusted operation performed with a second number from the number generation circuitry and the PUF;
cause transmission of the first vPUF to the first client device and cause transmission of the second vPUF to the second client device;
cause storage of the first vPUF, the first number, the second vPUF and the second number in a persistent storage; and
in response to a verification request from a third client device, the verification request including a third vPUF, use the third vPUF to look up a third number in the persistent storage, generate a fourth vPUF based on the trusted operation performed with the third number and the PUF, compare the fourth vPUF to the third vPUF to determine a verification result, and provide the verification result to the third client device.
2 . The apparatus of claim 1 , wherein the first number is a random number.
3 . The apparatus of claim 1 , wherein one or more of the at least one programmable circuit is to generate a third vPUF based on a third message from a third client device, the third vPUF based on the PUF and a third number from the number generation circuitry.
4 . The apparatus of claim 1 , wherein the first vPUF is associated with a microservice.
5 . The apparatus of claim 1 , wherein the trusted operation includes an involutory function.
6 . The apparatus of claim 5 , wherein the involutory function is an XOR operation.
7 . The apparatus of claim 1 , wherein one or more of the at least one programmable circuit is to:
determine the third vPUF is valid based on the third vPUF matching the fourth vPUF; and
determine the third vPUF is invalid based on the third vPUF not matching the fourth vPUF.
8 . The apparatus of claim 1 , wherein the first message is a request from the first client device for a session key to access a microservice, and one or more of the at least one programmable circuit is to cause the transmission of the first vPUF to the first client device to occur as a response to the request.
9 . A non-transitory computer readable medium comprising instructions to cause at least one programmable circuit to at least:
retrieve a physical unclonable function (PUF) from PUF circuitry:
generate a first virtual PUF (vPUF) based on a first message from a first client device, the first vPUF based on a trusted operation performed with a first number from number generation circuitry and the PUF;
generate a second vPUF based on a second message from a second client device, the second vPUF based on the trusted operation performed with a second number from the number generation circuitry and the PUF;
cause transmission of the first vPUF to the first client device and cause transmission of the second vPUF to the second client device;
cause storage of the first vPUF, the first number, the second vPUF and the second number in a persistent storage; and
in response to a verification request from a third client device, the verification request including a third vPUF, use the third vPUF to look up a third number in the persistent storage, generate a fourth vPUF based on the trusted operation performed with the third number and the PUF, compare the fourth vPUF to the third vPUF to determine a verification result, and provide the verification result to the third client device.
10 . The non-transitory computer readable medium of claim 9 , wherein the instructions are to cause one or more of the at least one programmable circuit to generate a third vPUF based on a third message from a third client device, the third vPUF based on the PUF and a third number from the number generation circuitry.
11 . The non-transitory computer readable medium of claim 9 , wherein the first vPUF is associated with a microservice.
12 . The non-transitory computer readable medium of claim 9 , wherein the trusted operation includes an involutory function.
13 . The non-transitory computer readable medium of claim 12 , wherein the involutory function is an XOR operation.
14 . A method comprising:
retrieving a physical unclonable function (PUF) from PUF circuitry:
generating a first virtual PUF (vPUF) based on a first message from a first client device, the first vPUF based on a trusted operation performed with a first number from number generation circuitry and the PUF;
generating a second vPUF based on a second message from a second client device, the second vPUF based on the trusted operation performed with a second number from the number generation circuitry and the PUF;
transmitting the first vPUF to the first client device and transmitting the second vPUF to the second client device;
storing the first vPUF, the first number, the second vPUF and the second number in a persistent storage; and
in response to a verification request from a third client device, the verification request including a third vPUF, using the third vPUF to look up a third number in the persistent storage, generating a fourth vPUF based on the trusted operation performed with the third number and the PUF, comparing the fourth vPUF to the third vPUF to determine a verification result, and providing the verification result to the third client device.
15 . The method of claim 14 , including generating a third vPUF based on a third message from a third client device, the third vPUF based on the PUF and a third number from the number generation circuitry.
16 . The method of claim 14 , wherein the first vPUF is associated with a microservice.
17 . The method of claim 16 , wherein the trusted operation includes an involutory function.
18 . The method of claim 17 , wherein the involutory function is an XOR operation.