Secure identity card using unclonable functions
Various systems and methods for securely sharing private information are described herein. A user device includes a memory device; and a processor subsystem, which when configured by instructions stored on the memory device, is operable to perform the operations comprising: receiving, at a verifier device, an indication of supported unclonable functions and a challenge value; identifying an unclonable function from the supported unclonable functions, to obtain a selected unclonable function; executing the selected unclonable function based on the challenge value, to obtain a result; and transmitting the indication of supported unclonable functions, the selected unclonable function, and the result to the verifier device to authenticate the user device.
1 . A machine-readable medium including instructions for securing data on a user device having a manufactured physically unclonable function (PUF) provided to the user device in the form of a credential or identity card by an issuer, which when executed by the user device during a transaction when a user with the user device is asked to present the user device to a verifier device, cause the user device to perform operations comprising:
receiving, from the verifier device, a challenge message including a list of identifiers of supported unclonable functions and a challenge value, wherein the verifier device selects a challenge from known challenge/response pairs and transmits it to the user device as part of the challenge message, wherein the known challenge/response pairs are stored in a secure storage;
identifying an unclonable function from the list of identifiers of supported unclonable functions, to obtain an identifier of a selected unclonable function and selecting, by the user device the identifier of the selected unclonable function to provide an indication to the verifier device of which unclonable function will be used;
executing the selected unclonable function based on the challenge value, to obtain a result; and
transmitting, a reply message in response to the challenge message, the reply message including the list of identifiers of supported unclonable functions, the identifier of the selected unclonable function, and the result to the verifier device to authenticate the user device, wherein the verifier device is then able to check and ensure that the response is correct by comparing the result of the challenge/response pair corresponding with the challenge sent in the challenge message with that provided by the user device to authenticate the credential or the identity card.
2 . The machine-readable medium of claim 1 , wherein the list of identifiers of supported unclonable functions is included in a field of a message structure.
3 . The machine-readable medium of claim 1 , wherein the challenge value is a random value.
4 . The machine-readable medium of claim 1 , wherein the selected unclonable function is a physically unclonable function (PUF).
5 . The machine-readable medium of claim 4 , wherein executing the unclonable function based on the challenge value comprises:
executing the PUF with the challenge value as an input bit value for the PUF.
6 . The machine-readable medium of claim 1 , wherein the selected unclonable function is a software-based unclonable function.
7 . The machine-readable medium of claim 6 , wherein executing the unclonable function based on the challenge value comprises:
executing the software-based unclonable function with the challenge value as an input value to the software-based unclonable function.
8 . The machine-readable medium of claim 1 , wherein a credential is stored in a memory device of the user device and the selected unclonable function is used to secure the credential.
9 . The machine-readable medium of claim 8 , wherein the instructions cause the user device to perform operations comprising:
receiving the challenge message from the verifier device to access the credential, the challenge message including the list of identifiers of supported unclonable functions and the challenge value, and the challenge message having a corresponding response message format defined by a protocol; and
transmitting the list of identifiers of supported unclonable functions, the identifier of the selected unclonable function, and the result to the verifier device to authenticate the user device using the corresponding response message format.
10 . A verifier device comprising:
a memory device; and
a processor subsystem, which when configured by instructions stored on the memory device, is operable to perform the operations comprising:
transmitting, to a user device during a transaction when a user with the user device is asked to present the user device to the verifier device, a message including a list of identifiers of supported unclonable functions and a challenge value, the user device having a manufactured physically unclonable function (PUF) provided to the user device in the form of a credential or identity card by an issuer, wherein the verifier device selects a challenge from known challenge/response pairs and transmits it to the user device as part of the message, wherein the known challenge/response pairs are stored in a secure storage of the verifier device;
receiving, from the user device, a response message including the list of identifiers of supported unclonable functions, an identifier of a selected unclonable function, and a result, the identifier of the selected unclonable function selected from the list of identifiers of supported unclonable functions and the identifier of the selected unclonable function is selected by the user device to provide an indication to the verifier device of which unclonable function will be used, and the result being derived from an output of the selected unclonable function with the challenge value used as input to the selected unclonable function, wherein the verifier device is then able to check and ensure that the response is correct by comparing the result of the challenge/response pair corresponding with the challenge sent in the message with the result provided by the user device to authenticate the credential or the identity card;
obtaining an expected result of the selected unclonable function with the challenge value as input; and
authenticating the user device based on a comparison between the expected result and the result received from the user device.
11 . The verifier device of claim 10 , wherein the challenge value is a random value.
12 . The verifier device of claim 10 , wherein the selected unclonable function is a physically unclonable function (PUF).
13 . The verifier device of claim 10 , wherein the selected unclonable function is a software-based unclonable function.
14 . The verifier device of claim 10 , wherein obtaining the expected result of the selected unclonable function with the challenge value as input comprises:
accessing a secure storage device having challenge/response pairs for the supported unclonable functions for the user device; and
obtaining the expected result by performing a lookup on the challenge/response pairs using the challenge value and the selected unclonable function.
15 . A machine-readable medium including instructions for authenticating a user device at a verifier device, which when executed by the verifier device, cause the verifier device to perform operations comprising:
transmitting, to the user device during a transaction when a user with the user device is asked to present the user device to the verifier device, a message including a list of identifiers of supported unclonable functions and a challenge value, the user device having a manufactured physically unclonable function (PUF) provided to the user device in the form of a credential or identity card by an issuer, wherein the verifier device selects a challenge from known challenge/response pairs and transmits it to the user device as part of the message, wherein the known challenge/response pairs are stored in a secure storage of the verifier device;
receiving, from the user device, a response message including the list of identifiers of supported unclonable functions, an identifier of a selected unclonable function, and a result, the identifier of the selected unclonable function selected from the list of identifiers of supported unclonable functions and the identifier of the selected unclonable function is selected by the user device to provide an indication to the verifier device of which unclonable function will be used, and the result being derived from an output of the selected unclonable function with the challenge value used as input to the selected unclonable function, wherein the verifier device is then able to check and ensure that the response is correct by comparing the result of the challenge/response pair corresponding with the challenge sent in the message with the result provided by the user device to authenticate the credential or the identity card;
obtaining an expected result of the selected unclonable function with the challenge value as input; and
authenticating the user device based on a comparison between the expected result and the result received from the user device.
16 . The machine-readable medium of claim 15 , wherein the list of identifiers of supported unclonable functions is included in a field of a message structure.
17 . The machine-readable medium of claim 15 , wherein the challenge value is a random value.
18 . The machine-readable medium of claim 15 , wherein the selected unclonable function is a physically unclonable function (PUF).
19 . The machine-readable medium of claim 15 , wherein the selected unclonable function is a software-based unclonable function.
20 . The machine-readable medium of claim 15 , wherein obtaining the expected result of the selected unclonable function with the challenge value as input comprises:
accessing a secure storage device having challenge/response pairs for the supported unclonable functions for the user device; and
obtaining the expected result by performing a lookup on the challenge/response pairs using the challenge value and the selected unclonable function.