Systems and methods for authentication based on physically unclonable functions
Presented are systems, devices, and methods for reliably authenticating asymmetric cryptography-based ICs based on Physically Unclonable Functions (PUFs) that are immune to reverse engineering. Various embodiments of the invention enhance the level of security in IC architectures without the need to connect to a remote certification authority, thereby, eliminating shortfalls associated with online authentication. Certain embodiments accomplish this by using a PUF-generated secure private key that need never be output by or exported from the PUF.
1. An integrated circuit for authenticating an electronic device without connecting to a remote certification authority, the integrated circuit comprising:
a physically unclonable function (PUF) element that generates a random number; and
a processor configured to:
receive the random number and determine whether the random number is non-zero;
in response to determining that the random number is non-zero, accept a device private key that is based on the random number;
compute a device public key associated with the random number;
receive during a manufacturing process a public key certificate that is based on a computed public key, the public key certificate being signed with an external private key;
receive a challenge from a host;
sign the challenge with the device private key; and
communicate the signed challenge to the host.
2. The integrated circuit according to claim 1 , wherein the challenge is a random number that is not stored in a nonvolatile memory.
3. The integrated circuit according to claim 1 , wherein the public key certificate comprises a data field comprising a value that is representative of the device public key.
4. The integrated circuit according to claim 1 , wherein the external private key is provided by an external certification authority.
5. The integrated circuit according to claim 1 , wherein the processor is external to the integrated circuit.
6. The integrated circuit according to claim 1 , wherein the signed public key certificate is stored in a nonvolatile memory.
7. The integrated circuit according to claim 6 , wherein the nonvolatile memory is external to the integrated circuit.
8. A method for authenticating an electronic device without connecting to a remote certification authority, the method comprising:
a physically unclonable function (PUF) element that generates a random number; and
a processor configured to:
receive the random number and determine whether the random number is non-zero;
in response to determining that the random number is non-zero, accept a device private key that is based on the random number;
compute a device public key associated with the random number;
receive during a manufacturing process a public key certificate that is based on a computed public key, the public key certificate being signed with an external private key;
receive a challenge from a host;
sign the challenge with the device private key; and
communicate the signed challenge to the host.
9. The method according to claim 8 , wherein generating the random number is performed during a manufacturing process.
10. The method according to claim 8 , wherein computing the device public key comprises performing an elliptic curve multiplication.
11. The method according to claim 8 , further comprising, in response to determining that the random number equals zero, rejecting the electronic device.
12. The method according to claim 8 , further comprising receiving the external private key from an external certification authority.
13. A system for authenticating an electronic device without connecting to a remote certification authority, the system comprising:
a non-volatile memory to store a public key certificate;
a circuit comprising a physically unclonable function (PUF) element that generates a random number; and
a processor configured to:
use the random number as a device private key in response to determining whether the random number is non-zero;
compute the device public key associated with the random number; and
receive the public key certificate associated with the random number; and sign the public key certificate with an external private key; and
communicate the signed challenge to a host to enable the host to authenticate the electronic device.
14. The system according to claim 13 , wherein authentication comprises verifying the signed challenge with the device public key to validate a physical condition of the electronic device comprising the PUF.
15. The system according to claim 13 , wherein the signed public key certificate is stored in the nonvolatile memory.
16. The system according to claim 15 , wherein the host reads the public key certificate, from the nonvolatile memory.
17. The system according to claim 13 , further comprising an external certification authority that provides the external private key.
18. The system according to claim 13 , further comprising a certification authority that pre-calculates a system public key.
19. The system according to claim 17 , wherein the host verifies the public key certificate with the system public key.
20. The system according to claim 13 , further comprising a cryptographic engine designed to perform an elliptic curve point multiplication.