IoT device authenticated based on dynamically reconfigurable PUF and server and method for authenticating the same
View Patent ↗An Internet of Thing (IoT) device generates a first response value corresponding to a previously registered first challenge value by using a WPUF, generates a current session key based on the first response value, transmits the current session key to an authentication server by encrypting the current session key into a first random number, receives, from the authentication server, some of a previously registered CRP transmitted by the authentication server as the authentication server authenticates the IoT device based on the first random number and the session key and a second random number, generates a second response value corresponding to a second challenge value, among the some of the CRP, by using an RPUF, authenticates the authentication server by comparing the second response value with the some of the CRP, and then updates the session key, the second challenge value, and the second response value for a next session.
1 . An Internet of Thing (IoT) device, comprising:
memory in which at least one instruction is stored; and
a processor functionally connected to the memory,
wherein, by executing the at least one instruction, the processor
generates a first response value corresponding to a first challenge value that has been previously registered by using a weak physical unclonable function (WPUF),
generates a current session key based on the first response value and transmits the current session key to an authentication server by encrypting the current session key into a first random number,
when the authentication server authenticates the IoT device based on the first random number and the session key, receives, from the authentication server, some of a challenge-response pair (CRP) being previously registered and a second random number,
generates a second response value corresponding to a second challenge value, among the some of the CRP, by using a reconfigurable physical unclonable function (RPUF), and
authenticates the authentication server by comparing the second response value with the some of the CRP and then updates the session key, the second challenge value, and the second response value for a next session.
2 . The IoT device of claim 1 , wherein the RPUF is a dynamically reconfigurable PUF.
3 . The IoT device of claim 1 , wherein the WPUF is a PUF in which entropy cells are independent from each other and which supports a low bit error rate.
4 . The IoT device of claim 1 , wherein the processor
checks whether a hamming distance between portions corresponding to the generated second response value in the some of the CRP and the second response value is within a specified distance, and
authenticates the authentication server when the hamming distance is within the specified distance.
5 . The IoT device of claim 1 , wherein the processor generates the session key by applying a hash function to a pre-registered private key and the first response value.
6 . The IoT device of claim 5 , wherein the processor
previously registers PUF-based authentication information in the authentication server, and
then stores the private key and the first response value in ROM-BIOS of the WPUF.
7 . The IoT device of claim 5 , wherein the processor designates the private key as the session key for the next session when the authentication server is authenticated.
8 . The IoT device of claim 1 , wherein the processor
masks the first random number by applying exclusive OR to the first random number and the session key, and
transmits the masked first random number.
9 . The IoT device of claim 1 , wherein the processor
generates a first message authentication code by applying a hash function to results of a connection of the session key and the first random number, and
transmits the first message authentication code to a database of the authentication server in relation to a pseudo identity pre-registered so that the authentication server authenticates the IoT device based on the pseudo identity.
10 . The IoT device of claim 9 , wherein the processor updates the pseudo identity for the next session by applying a hash function to the updated second response value and the pseudo identity.
11 . The IoT device of claim 1 , wherein the processor
updates the second challenge value for the next session by applying a hash function to the first random number, the second random number, and the second challenge value, and
updates the second response value for the next session by inputting the updated second challenge value to the RPUF.
12 . An authentication server for authenticating an Internet of Thing (IoT) device, comprising:
a database in which authentication-related data about at least one IoT device being pre-registered is stored; and
a processor functionally connected to the database, wherein the processor
receives, from a first IoT device, a first response value, a pseudo identity, and a first random number, wherein the first response value is generated and encrypted from a first challenge value being selected through a weak physical unclonable function (WPUF) of the first IoT device for an authentication request,
obtains a first response value, a second challenge value, a second response value, and a session key corresponding to the received pseudo identity, among the authentication-related data,
authenticates the first IoT device by comparing the obtained first response value with the received first response value based on the obtained session key, and
updates authentication-related data comprising the second challenge value and the second response value for a next session by using a reconfigurable physical unclonable function (RPUF) of the first IoT device.
13 . The authentication server of claim 12 , wherein the processor
generates a second random number, masks the second random number by performing exclusive OR on the obtained session key and the generated second random number, and further transmits the masked second random number to the first IoT device, and
updates the second challenge value for the next session based on the first random number, the second random number, and the second challenge value.
14 . The authentication server of claim 13 , wherein when receiving the second response value for the next session, being masked based on the session key, from the first IoT device, the processor
releases the masking of the second response value for the next session by using the session key, and
then updates the database with the received second response value.
15 . The authentication server of claim 12 , wherein the processor
receives encrypted some of the second response value from the first IoT device, and
restores the some of the second response value by using the obtained session key, authenticates the first IoT device based on a hamming distance between some of the restored second response value and some of the obtained second response value, and updates the authentication-related data of the first IoT device.
16 . The authentication server of claim 12 , wherein the processor updates the pseudo identity for the next session based on the second response value for the next session.
17 . The authentication server of claim 12 , wherein the processor updates the session key for the next session by applying a hash function to the session key and the first response value.
18 . An Internet of Thing (IoT) authentication method based on a physical unclonable function (PUF) by an IoT device, comprising:
generating a first response value corresponding to a first challenge value by using a weak physical unclonable function (WPUF);
generating a current session key based on the first response value and then transmitting the current session key to an authentication server in relation to a first random number;
receiving some of a pre-registered challenge-response pair (CRP), and a second random number from the authentication server, wherein the some of the CRP and the second random number are transmitted as a result of authentication based on the first random number and the session key by the authentication server;
authenticating the authentication server based on the session key, the some of the CRP, and the second random number;
generating a second response value corresponding to a second challenge value, among the some of the CRP, using a reconfigurable physical unclonable function (RPUF); and
authenticating the authentication server by comparing the second response value with the some of the CRP and then updating the session key and the CRP for a next session.
19 . The IoT authentication method of claim 18 , wherein the transmitting of the current session key comprises masking the first random number by applying exclusive OR to the first random number with the session key; and
transmitting the masked first random number.
20 . The IoT authentication method of claim 18 , wherein the updating of the session key and the CRP comprises:
updating the second challenge value for the next session by applying a hash function to the first random number, the second random number, and the second challenge value, and
updating the second response value for the next session by inputting the updated second challenge value to the RPUF.