Moving target authentication protocols
In one implementation, the disclosure provides systems and methods for generating a secure signature using a device-specific and group-specific moving target authentication protocol. According to one implementation, generating the secure signature entails determining a state of a first device in association with a select time interval. The state of the first device is defined by one or more time-variable characteristics of the first device. The device computes an output for a signing function that depends upon the determined state of the first device associated with the first time interval.
1. A method comprising:
determining a state of a first device in association with a select time interval, the state of the first device being defined by one or more time-variable characteristics, the one or more time-variable characteristics including deterministic errors observed by the first device over the select time interval;
selecting a signing function based, at least in part, on the deterministic errors observed on the first device over the select time interval;
computing, on the first device, an output for the signing function that depends upon the deterministic errors observed by the first device over the select time interval; and
generating a secure signature using the output of the signing function.
2. The method of claim 1 , wherein
deterministic errors include at least one of communication errors occurring in a communication channel of the device and hardware errors of the device.
3. The method of claim 2 , wherein the deterministic errors include hardware errors of the first device and the output of the signing function is the secure signature.
4. The method of claim 3 , wherein the secure signature is verifiable to confirm a unique identity of the first device.
5. The method of claim 2 , wherein the deterministic errors include communication errors detected in a broadcast channel of the first device.
6. The method of claim 5 , wherein the secure signature is a group signature verifiable to confirm that the first device is a member of the group and the method further comprises:
combining the output of the signing function computed on the first device with a signing function output from each other respective device in the group, the signing function output from each other respective device in the group being based on communication errors observed by the respective device in association with the select time interval.
7. The method of claim 1 , wherein the signing function is a member of a key-homomorphic pseudorandom function (KH-PRF) family.
8. The method of claim 1 , further comprising:
receiving, at a second device, a message signed with the secure signature;
computing, at the second device, an error matrix used to generate the secure signature; and
verifying the error matrix is a Learning With Errors (LWE) matrix.
9. One or more tangible computer-readable storage media encoding computer-executable instructions for executing a computer process, the computer process comprising:
determining a state of a first device in association with a select time interval, the state of the first device being defined by one or more time-variable characteristics, the one or more time-variable characteristics including deterministic errors observed by the first device over the select time interval;
selecting a signing function based, at least in part, on the deterministic errors observed on the first device over the select time interval;
computing, on the first device, an output for the signing function that depends upon the deterministic errors observed by the first device over the select time interval; and
generating a secure signature using the output of the signing function.
10. The one or more tangible computer-readable storage media of claim 9 , wherein
the deterministic errors include at least one of communication errors occurring in a communication channel of the device and hardware errors of the device.
11. The one or more tangible computer-readable storage media of claim 9 , wherein determining the state of the first device further comprises:
using a trained linear regression model to compute deterministic errors observed by the first device in association with the select time interval.
12. The one or more tangible computer-readable storage media of claim 10 , wherein the deterministic errors include hardware errors of the first device and the output of the signing function is the secure signature.
13. The one or more tangible computer-readable storage media of claim 10 , wherein the secure signature is verifiable to confirm a unique identity of the first device.
14. The one or more tangible computer-readable storage media of claim 10 , wherein the deterministic errors include communication errors detected in a broadcast channel of the first device.
15. The one or more tangible computer-readable storage media of 14 , wherein the secure signature is a group signature verifiable to confirm that the first device is a member of the group and the method further comprises:
combining the output of the signing function computed on the first device with a signing function output from each other respective device in the group, the signing function output from each other respective device in the group being based on communication errors observed by the respective device in association with the select time interval.
16. The one or more tangible computer-readable storage media of claim 10 , further comprising:
receiving, at a second device, a message signed with the secure signature;
computing, at the second device, an error matrix used to generate the secure signature; and
verifying the error matrix is a Learning With Errors (LWE) matrix.
17. The one or more tangible computer-readable storage media of claim 10 , wherein the signing function is a member of a key-homomorphic pseudorandom function (KH-PRF) family.