User device authentication methods using physical unclonable function for cellular communications
A user authentication method performed by a user equipment, UE, in a cellular network includes transmitting to a serving node an attachment request including a user identifier, receiving, form the serving node, SN, an authentication request indicating a physical unclonable function, PUF, challenge, a first random number, and a serving node identifier of the SN, measuring a PUF response as a result of applying the PUF challenge to a universal subscriber identity module, USIM, of the UE, and selectively transmitting an authentication response including the measured PUF response.
1 . A user authentication method performed by a user equipment, UE, in a cellular network, the method comprising:
transmitting, to a serving node, SN, an attachment request including a user identifier;
receiving, from the SN, an authentication request including a result of a hash function applied to (1) a physical unclonable function, PUF, challenge, (2) a first random number, and (3) a serving node identifier of the SN;
verifying, by the UE, that the first random number has not been previously exchanged with the SN;
conditioned upon successful verification of the first random number, measuring a PUF response by applying the PUF challenge to a physical variation of a universal subscriber identity module, USIM, of the UE; and
selectively transmitting an authentication response including the measured PUF response and a second random number generated by the UE, wherein the authentication response is cryptographically bound to the PUF challenge and the serving node identifier via a second hash result,
wherein the selectively transmitting includes verifying that the PUF challenge associated with the authentication request is included in a set of PUF challenges registered with the cellular network.
2 . The user authentication method of claim 1 , wherein
the UE receives the authentication request from the SN, and
the selectively transmitting includes verifying that the first random number has not been previously exchanged with the SN, otherwise the UE declining the authentication request.
3 . The user authentication method of claim 2 , wherein the selectively transmitting includes verifying that a received user identifier indicated via the authentication request corresponds to the user identifier included in the attachment request, otherwise the UE declining the authentication request.
4 . The user authentication method of claim 1 , wherein the authentication response includes a result of the hash function applied to the PUF challenge, a second random number, and the serving node identifier.
5 . The user authentication method of claim 1 , wherein the user identifier is a temporary identifier.
6 . The user authentication method of claim 1 , further comprising:
registering, with the cellular network, the set of PUF challenges and a set of PUF responses generated by the USIM of the user device in response to the set of PUF challenges.
7 . The user authentication method of claim 1 , wherein the cellular network is a Long Term Evolution, LTE, cellular network or a fifth generation, 5G, cellular network.
8 . An authentication method performed by a serving node in a cellular network, the method comprising:
forwarding an attachment request including a user identifier, ID, to a core network device;
generating an authentication request including a result of a hash function applied to:
(1) a physical unclonable function, PUF, challenge received from the core network device in response to the attachment request,
(2) a first random number generated by the serving node, and
(3) a serving node identifier of the serving node; and
transmitting the authentication request, after verifying that the PUF challenge associated with the authentication request is included in a set of PUF challenges registered with the cellular network, to a user equipment, UE, associated with the user ID;
receiving, from the UE, an authentication response including a second random number and a measured PUF response, wherein the authentication response is cryptographically bound to the PUF challenge and the serving node identifier via a second hash result; and
verifying the authentication response by checking the second random number and confirming that the measured PUF response corresponds to the transmitted PUF challenge,
wherein the PUF response is a result of applying the PUF challenge to a physical hardware variation of a universal subscriber identity module, USIM, of the UE.
9 . The method of claim 8 , wherein the selectively transmitting the authentication request includes verifying that a returned user ID received with the PUF challenge matches a user ID stored by the serving node.
10 . The method of claim 8 , wherein verifying that the PUF response associated with the authentication response corresponds to the stored PUF challenge includes:
transmitting the PUF response to the core network device; and
in response to transmitting the PUF response, receiving an indication that the PUF response is included in a set of pre-registered PUF responses associated with the UE.
11 . The method of claim 8 , further comprising:
sending, to the core network device, an indication that the UE is not authenticated when the verifying determines that the PUF response associated with the authentication response received from the UE does not correspond to the PUF challenge.
12 . The method of claim 8 , wherein the authentication response includes a result of applying the hash function to the PUF challenge, a second random number, and the serving node ID.
13 . The method of claim 8 , wherein the cellular network is a Long Term Evolution, LTE, cellular network or a fifth generation, 5G, cellular network.
14 . A user device configured to operate in a cellular network, the user device comprising:
a communication interface configured to exchange wireless communications with a serving node in the cellular network;
a physical unclonable function, PUF, defined by intrinsic physical hardware variations of a universal subscriber identity module (USIM) of the user device, the PUF configured to output unique PUF responses in response to applied PUF challenges; and
a processor configured to control the communication interface and the PUF to:
transmit an attachment request including a user identifier;
receive an authentication request including a result of a hash function applied to (1) a specific PUF challenge, (2) a first random number, and (3) a serving node identifier;
verify that the first random number has not been previously exchanged with the serving node; and
conditioned upon successful verification of the first random number, selectively transmit an authentication response, including a PUF response to the specific PUF challenge and a second random number generated by the processor, wherein the authentication response is cryptographically bound to the specific PUF challenge and the serving node identifier via a second hash result,
wherein the selectively transmit includes verifying that the PUF challenge associated with the authentication request is included in a set of PUF challenges registered with the cellular network.
15 . The user device of claim 14 , wherein the processor is configured to apply the hash function to a second random number, the serving node identifier, and the specific PUF challenge to generate the authentication response.
16 . The user device of claim 15 , wherein the second random number is generated by the processor.