Physically unclonable function (PUF) authority for identification trust in communications with internet of things (IoT) devices
Physically unclonable function (PUF) enabling secure communications with a PUF enrolled device includes directing a PUF unit to acquire a PUF response to a on optical stimulus upon a physical random medium of the PUF unit for the enrollment, identification and secure communication with a device. The method additionally includes retrieving the PUF response from the PUF unit and generating a secure hash identifier (SHI) from the PUF response, from which a digital certificate may be created with the SHI. Finally, the method includes storing the SHI, digital certificate and PUF response in a record of a registry in connection with the device for use in a subsequent authentication of the device by a communicating client in order to establish a secure tunnel between the communicating client and the device.
1 . A method for physically unclonable function (PUF) enabling secure communications with a PUF enrolled device, the method comprising:
directing a PUF unit to acquire, a PUF response to an optical stimulus by the PUF unit onto a physical random medium of the PUF unit, for establishing secure communications, enrollment and identification of a device;
retrieving the PUF response from the PUF unit and generating a secure hash identifier (SHI) from the PUF response;
creating a digital certificate with the SHI; and,
storing the SHI, digital certificate and PUF response in a record of a registry in connection with the device for use in a subsequent authentication of the device by a communicating client in order to establish a secure tunnel between the communicating client and the device.
2 . The method of claim 1 , wherein the PUF unit is embedded in the device as part of the device.
3 . The method of claim 1 , wherein the PUF unit is separate from the device.
4 . The method of claim 1 , further comprising generating a certified hash identifier (CHI) from a serial number of the certificate, the SHI and a processor identifier of the device and storing the CHI in the registry for use in the subsequent authentication.
5 . The method of claim 1 , further comprising modifying the record with revocation data responsive to a lapse of a threshold period of time without an attempt to validate the device.
6 . A data processing system adapted for physically unclonable function (PUF) enabling secure communications with a PUF enrolled device, the system comprising:
a host computing platform comprising one or more computers, each with memory and one or processing units including one or more processing cores;
fixed storage defining a registry of authentication data for different PUF enrolled devices;
a device selected for PUF enrollment in the registry;
a PUF unit in optical communication with the device and in data communication with the host computing platform; and,
an enrollment module comprising computer program instructions enabled while executing in the memory of at least one of the processing units of the host computing platform to perform:
directing the PUF unit to acquire a PUF response to an optical stimulus by the PUF unit onto a physical random medium portion of the PUF unit, for establishing secure communications, enrollment and identification of a device;
retrieving the PUF response from the PUF unit and generating a secure hash identifier (SHI) from the PUF response;
creating a digital certificate with the SHI; and,
storing the SHI, digital certificate and PUF response in a record of the registry in connection with the device for use in a subsequent authentication of the device by a communicating client in order to establish a secure tunnel between the communicating client and the device.
7 . The system of claim 6 , wherein the PUF unit is embedded in the device as part of the device.
8 . The system of claim 6 , wherein the PUF unit is separate from the device.
9 . The system of claim 6 , wherein the program instructions further perform generating a certified hash identifier (CHI) from a serial number of the certificate, the SHI and a processor identifier of the device and storing the CHI in the registry for use in the subsequent authentication.
10 . The system of claim 6 , wherein the program instructions further perform modifying the record with revocation data responsive to a lapse of a threshold period of time without an attempt to validate the device.
11 . A computing device comprising a non-transitory computer readable storage medium having program instructions stored therein, the instructions being executable by at least one processing core of a processing unit to cause the processing unit to perform a physically unclonable function (PUF) enabling secure communications with a PUF enrolled device, by:
directing a PUF unit to acquire a PUF response to an optical stimulus by the PUF unit onto a physical random medium portion of the PUF unit, for establishing secure communications, enrollment and identification of a device;
retrieving the PUF response from the PUF unit and generating a secure hash identifier (SHI) from the PUF response;
creating a digital certificate with the SHI; and,
storing the SHI, digital certificate and PUF response in a record of a registry in connection with the device for use in a subsequent authentication of the device by a communicating client in order to establish a secure tunnel between the communicating client and the device.
12 . The device of claim 11 , wherein the PUF unit is embedded in the device as part of the device.
13 . The device of claim 11 , wherein the PUF unit is separate from the device.
14 . The device of claim 11 , wherein the instructions cause the processing unit to additionally perform generating a certified hash identifier (CHI) from a serial number of the certificate, the SHI and a processor identifier of the device and storing the CHI in the registry for use in the subsequent authentication.
15 . The device of claim 11 , wherein the instructions cause the processing unit to additionally perform modifying the record with revocation data responsive to a lapse of a threshold period of time without an attempt to validate the device.