Deterrence of device counterfeiting, cloning, and subversion by substitution using hardware fingerprinting

• US 8,848,905 B1
• Filed: 07/28/2010
• Issued: 09/30/2014
• Est. Priority Date: 07/28/2010
• Status: Active Grant

• Current Assignee: National Technology & Engineering Solutions Of Sandia LLC (Honeywell International Inc.), UT-Battelle LLC
• Original Assignee: Sandia Corporation (Martin Marietta Corporation)
• Inventors: Hamlet, Jason R., Bauer, Todd M., Pierson, Lyndon G.
• Primary Examiner(s): Vostal, Ondrej
• Application Number:
  US12/844,860
• Time in Patent Office: 1,525 Days
• Field of Search: 380/35, 380/255, 726/20, 713/176
• US Class Current: 380/35
• CPC Class Codes: H04K 1/04 by frequency scrambling, i.e. by transposing or inverting parts of the frequency band or by inverting the whole band
• CPC Class Codes: H04K 1/06 by transmitting the information or elements thereof at unnatural speeds or in jumbled order or backwards
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/3278 using physically unclonable functions [PUF]

Abstract

Deterrence of device subversion by substitution may be achieved by including a cryptographic fingerprint unit within a computing device for authenticating a hardware platform of the computing device. The cryptographic fingerprint unit includes a physically unclonable function (“PUF”) circuit disposed in or on the hardware platform. The PUF circuit is used to generate a PUF value. A key generator is coupled to generate a private key and a public key based on the PUF value while a decryptor is coupled to receive an authentication challenge posed to the computing device and encrypted with the public key and coupled to output a response to the authentication challenge decrypted with the private key.

Claims

1. A computing device, comprising:

a hardware platform;

device circuitry coupled to perform a primary function of the computing device disposed in or on the hardware platform; and

a cryptographic fingerprint unit coupled to authenticate the hardware platform including;

a physically unclonable function (“

PUF”

) circuit disposed in or on the hardware platform, the PUF circuit coupled to output a PUF value;

a plurality of programmable PUF perturbation devices coupled to one or more signal paths within the PUF circuit or disposed adjacent to the one or more signal paths, wherein the programmable PUF perturbation devices influence delays associated with the one or more signal paths based on a programmed state of the PUF perturbation devices;

a key generator coupled to generate a private key and a public key based on the PUF value; and

a decryptor coupled to receive an authentication challenge posed to the computing device and encrypted with the public key and coupled to output a response to the authentication challenge decrypted with the private key.

2. The computing device of claim 1, wherein the computing device comprises an integrated circuit disposed within a semiconductor die, wherein the device circuitry and the PUF circuit are integrated into the semiconductor die.

3. The computing device of claim 1, further comprising a noise reduction circuit coupled between the PUF circuit and the key generator, the noise reduction circuit coupled to receive the PUF value, to reduce uncertainty in the PUF value, and to output a seed value to the key generator based on the PUF value.

4. The computing device of claim 3, wherein the noise reduction circuit includes a seed generation mode, wherein during the seed generation mode the noise reduction circuit comprises:

an encoder coupled to the PUF circuit to receive a first portion of the PUF value and to generate an error correcting codeword (“

ECC”

) based on the first portion of the PUF value, the ECC for reducing the uncertainty in the PUF value; and

a hash unit coupled to the PUF circuit to receive a second portion of the PUF value and to generate the seed value for coupling to the key generator.

5. The computing device of claim 3, wherein the noise reduction circuit includes a seed recovery mode, wherein during the seed recovery mode the noise reduction circuit comprises:

a first logic circuit coupled to combine the PUF value with helper data according to a logic function to generate a first codeword;

a decoder coupled to decode the first codeword;

an encoder coupled to the decoder to re-encode the first codeword to generate a second codeword;

a second logic circuit coupled to combine the second codeword with the helper data according to the logic function to re-create a second portion of the PUF value; and

a hash unit coupled to the second logic circuit to re-create the seed value based on the second portion of the PUF value re-created by the second logic circuit.

6. The computing device of claim 1, wherein the hardware platform comprises a field programmable gate array (“

FPGA”

) and the PUF circuit comprises a plurality of cross-coupled inverters disposed within the FPGA.

7. The computing device of claim 1, wherein the programmable PUF perturbation devices comprise anti-fuses.

8. The computing device of claim 1, wherein the hardware platform comprises at least one of a semiconductor die, an application specific integrated circuit, a field programmable gate array, or a printed circuit board.

9. The computing device of claim 1, wherein the programmable PUF perturbation devices are reprogrammable PUF perturbation devices.

10. The computing device of claim 1, wherein the programmable PUF perturbation devices are accessible to be programmed by a user.

11. The computing device of claim 1, wherein the programmable PUF perturbation devices are accessible to be programmed by the cryptographic fingerprint unit.

12. A method for cryptographically fingerprinting a hardware device, the method comprising:

generating a physically unclonable function (“

PUF”

) value using a PUF circuit disposed within the hardware device;

selecting an error correction code (“

ECC”

) codeword for reducing noise in a second portion of the PUF value based upon a first portion of the PUF value;

generating a seed value for seeding the cryptographic function based on the second portion of the PUF value;

seeding a cryptographic with the seed value;

generating a cryptographic key from the cryptographic function; and

storing the cryptographic key associated with an identifier of the hardware device as a device fingerprint for future use by a challenger to authenticate the hardware device using a cryptographic challenge and response.

13. The method of claim 12, wherein storing the cryptographic key associated with the identifier comprises:

storing the cryptographic key associated with the identifier in a device fingerprint list which includes device fingerprints for a plurality of hardware devices, wherein the device fingerprint list is external to the hardware device.

14. The method of claim 13, further comprising certifying the device fingerprint list with a certifying authority.

15. The method of claim 12, wherein generating the cryptographic key comprises:

generating the cryptographic key as a public key of a private-public key pair.

16. The method of claim 12, wherein the identifier of the hardware device comprises a serial number of the hardware device.

17. The method of claim 12, further comprising:

randomly generating the identifier within the hardware device.

18. The method of claim 17, wherein the identifier is generated based upon at least a portion of the PUF value.

19. The method of claim 17, wherein the identifier is generated based upon a second PUF value generated using a second PUF circuit disposed within the hardware device, the method further comprising:

comparing the identifier against a list of previously selected identifiers to determine if a collision occurs; and

if the collision occurs, then programming a perturbation device linked to the second PUF circuit to change the second PUF value.

20. The method of claim 12, wherein generating the PUF value using the PUF circuit disposed within the hardware device comprises generating the PUF value with at least one of an arbiter PUF, ring oscillator PUF, a cross-coupled PUF, or a butterfly PUF.

21. The method of claim 12, further comprising:

programming anti-fuses disposed within the hardware device adjacent or couple to the PUF circuit to influence random delays associated with one or more signal paths of the PUF circuit.

22. The method of claim 12, wherein the PUF value and the seed value are not stored within the hardware device for future use after seeding the cryptographic function.

23. The method of claim 12, wherein generating the seed value comprises:

hashing the second portion of the PUF value to generate the seed value, wherein a relative bit-width between the second portion of the PUF value and the seed value is selected to achieve a desired entropy value per bit of the seed value.

24. The method of claim 12, wherein the second portion of the PUF value is not derived from the first portion of the PUF value.

25. A method for cryptographically authenticating a hardware device, the method comprising:

programming a PUF perturbation device coupled to one or more signal paths within a PUF circuit or disposed adjacent to the PUF circuit, wherein the programming the PUF perturbation device causes the PUF circuit to output a new PUF value different than a previous PUF value of the PUF circuit, the hardware device including the PUF circuit;

generating a cryptographic key from the new PUF value;

storing the cryptographic key associated with a device identifier of the hardware device as a device fingerprint in a memory;

retrieving the device identifier of the hardware device;

using the device identifier to retrieve a device fingerprint for the hardware device from the memory, the device fingerprint including a public key generated by a key generator seeded with a seed value based on the new PUF value;

encrypting a message with the public key to generate an encrypted message;

challenging the hardware device to decrypt the encrypted message, wherein in response to challenging the hardware device to decrypt the encrypted message, the hardware device enables the PUF circuit to regenerate the new PUF value and the key generator uses the regenerated new PUF value to generate a private key and decrypt the encrypted message using the private key; and

determining whether the hardware device has been compromised based upon whether the hardware device is able to decrypt the encrypted message.

26. The method of claim 25, wherein retrieving the device identifier of the hardware device comprises:

querying the hardware device to obtain a device serial number from the hardware device.

27. The method of claim 25, wherein using the device identifier to retrieve the device fingerprint for the hardware device, comprises:

accessing a device fingerprint list maintaining a plurality of device fingerprints indexed to a plurality of device identifiers, wherein the device fingerprint list is stored in the memory;

authenticating a cryptographic signature of the device fingerprint list; and

obtaining the public key.

28. The method of claim 27, wherein the device fingerprint list is maintained by a third party and accessed via a network.

29. The method of claim 25, wherein challenging the hardware device to decrypt the encrypted message comprises providing a cryptographic challenge to a cryptographic fingerprint unit within the hardware device via a test access port.