Generating an identity for a computing device using a physical unclonable function
Generating, by a computing device, a device secret, the generating comprising: providing, by at least one physical unclonable function (PUF), at least one value; and generating, using a key derivative function (KDF), the device secret, wherein the at least one value provided by the at least one PUF is an input to the KDF; and storing, in memory of the computing device, the generated device secret.
1 . A computing device comprising:
memory; and
at least one processor configured to:
receive a command and a user pattern from a host device, wherein the user pattern is received by the host device via an user input and/or a sensor;
in response to receiving the command, generate a device secret using the user pattern;
store the device secret in the memory;
generate an identifier, a certificate, and a key, the identifier being associated with the device secret and unique to the computing device, the certificate being generated using the command, and the key being generated from an initial key present at manufacture of the computing device;
send the identifier, the certificate, and the key to the host device in which the user pattern was received, wherein the identifier, the certificate, and the key are configured for the host device that originally received the user pattern to verify the computing device; and
provide, to the host device based on verification of the computing device by the host device, read access to the device secret.
2 . The computing device of claim 1 , wherein the at least one processor is further configured to store a secret key used to communicate with the host device, wherein:
a message authentication code (MAC) is used to generate the device secret,
at least one value provided by at least one physical unclonable function (PUF) is a first input to the MAC, and
the secret key is a second input to the MAC.
3 . The computing device of claim 1 , wherein the at least one processor is further configured to:
receive a host public key from the host device; and
encrypt the generated device secret using the host public key;
wherein the encrypted device secret is sent to the host device.
4 . The computing device of claim 1 , wherein;
the at least one processor is further configured to store a secret key in the memory,
the command is authenticated using a message authentication code (MAC), and
the secret key is used as an input to the MAC.
5 . The computing device of claim 1 , wherein the host device implemented by a processor, sends a signature for authenticating the command, the signature is generated using a message authentication code (MAC), a freshness is generated by the host device, and the freshness is used as an input to the MAC.
6 . The computing device of claim 1 , wherein: the read access is limited to a predetermined number of read operations.
7 . The computing device of claim 6 , wherein the at least one processor is further configured to:
determine that the predetermined number of read operations has been performed; and
in response to determining that the predetermined number of read operations has been performed, disable the read access.
8 . The computing device of claim 1 , further comprising: an identity component implemented by a processor and configured to generate the identifier, the certificate, and the key.
9 . The computing device of claim 8 , wherein the identity component implemented by the processor and includes an asymmetric identification generator configured to use the device secret as an input.
10 . The computing device of claim 9 , wherein:
the asymmetric identification generator is further configured to output a public identifier and a private identifier; and
the public identifier is the identifier sent to the host device.
11 . The computing device of claim 8 , wherein the identity component implemented by the processor and includes an asymmetric key generator configured to use the initial key as an input, and to output a public key and a private key, wherein the public key is the key sent to the host device.
12 . The computing device of claim 8 , wherein: the identity component implemented by the processor and includes a first encryptor and a second encryptor; the first encryptor is configured to use a private identifier from the host device, a public key from the host device, and the command from the host device as inputs, and to output a result key; and the second encryptor is configured to use a private key and the result key as inputs, and to output the certificate sent to the host device.
13 . A computing device comprising:
memory configured to store a device secret;
an asymmetric key generator implemented by a logic circuitry and configured to use the device secret and an initial key as inputs, and to output a public key, wherein the initial key is present at manufacture of the computing device; and
at least one processor configured to:
receive a command and a user pattern from a host device, wherein the user pattern is received by the host device via an user input and/or a sensor;
in response to receiving the command, generate the device secret using the user pattern;
generate a public identifier, a certificate, and the public key, the public identifier being associated with the device secret, the certificate being generated using the command, and the public key being generated using the asymmetric key generator;
send the public identifier, the certificate, and the public key to the host device for the host device that originally received the user pattern to verify the computing device; and
provide, to the host device based on verification of the computing device by the host device, read access to the device secret.
14 . The computing device of claim 13 , wherein generating the device secret comprises:
providing, by at least one physical unclonable function (PUF), at least one value; and
generating, using a key derivative function (KDF), the device secret, wherein the at least one value provided by the at least one PUF is an input to the KDF.
15 . The computing device of claim 14 , wherein a hash of the user pattern is an additional input to the KDF.
16 . The computing device of claim 14 , wherein the memory is further configured to store a unique identifier of the computing device, and wherein the unique identifier is an additional input to the KDF.
17 . The computing device of claim 13 , wherein the device secret is generated using a value provided by a physical unclonable function (PUF).
18 . The computing device of claim 13 , wherein the at least one processor is further configured to authenticate the command prior to generating the device secret.
19 . The computing device of claim 13 , wherein the device secret is generated further in response to an event, and the event is detection of usage of a computing system.
20 . The computing device of claim 19 , wherein the usage is execution of an application by the computing system.
21 . The computing device of claim 13 , wherein the device secret is generated further in response to an event, and the event is a time-scheduled event.
22 . A method comprising:
receiving, by a computing device, a command and a user pattern from a host device, wherein the user pattern is received by the host device via an user input and/or a sensor;
in response to receiving the command, generating a device secret using the user pattern;
storing, in memory, the device secret;
generating an identifier, a certificate, and a key, the identifier being associated with the device secret and unique to the computing device, the certificate being generated using the command, and the key being generated from an initial key;
sending the identifier, the certificate, and the key to the host device, wherein the host device that originally received the user pattern is configured to verify the computing device; and
providing, to the host device based on verification of the computing device by the host device, read access to the device secret.
23 . The method of claim 22 , further comprising: obfuscating the device secret when reading the device secret from the memory.
24 . The method of claim 22 , wherein storing the device secret comprises: replacing a previously-stored device secret in the memory with the generated device secret.
25 . A computing device comprising:
a memory; and
at least one processor configured to:
receive a command and a user pattern from a host device;
in response to receiving the command, generate a device secret using the user pattern;
store the device secret in the memory;
generate, by an identity component implemented by the at least one processor, an identifier, a certificate, and a key, the identifier being associated with the device secret and unique to the computing device, the certificate being generated using the command, and the key being generated from an initial key present at manufacture of the computing device; and
send the identifier, the certificate, and the key to the host device in which the user pattern was received, wherein the identifier, the certificate, and the key are configured for the host device that originally received the user pattern to verify the computing device, wherein:
the identity component implemented by the at least one processor includes a first encryptor and a second encryptor;
the first encryptor is configured to use a private identifier from the host device, a public key from the host device, and the command from the host device as inputs, and to output a result key; and
the second encryptor is configured to use a private key and the result key as inputs, and to output the certificate sent to the host device.