Apparatus and method for authentication between devices based on PUF over machine-to-machine communications

• US 9,787,670 B2
• Filed: 08/16/2012
• Issued: 10/10/2017
• Est. Priority Date: 08/16/2011
• Status: Active Grant

• Current Assignee: ICTK Holdings Co., Ltd.
• Original Assignee: ICTK Co., Ltd. (Bureau Veritas SA)
• Inventors: Kim, Dong Kyue, Choi, Byong Deok, Kim, Dong Hyun, Park, Sang Seon, Jee, Kwang Hyun, Jin, Bong Jae
• Primary Examiner(s): Brown, Anthony
• Assistant Examiner(s): Corum, Jr., William
• Application Number:
  US14/238,946
• Publication Number:
  US 20140310515A1
• Time in Patent Office: 1,881 Days
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G09C 1/00 Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system cryptographic typewriters G09C3/00
• CPC Class Codes: H04L 2209/12 Details relating to cryptographic hardware or logic circuitry
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3278 using physically unclonable functions [PUF]
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

Terminal devices that perform machine-to-machine (M2M) communication may autonomously perform password authentication by autonomously generating a personal identity number (PIN) value, which is not exposed externally, using a physical unclonable function (PUF). A terminal apparatus that performs M2M communication may include a PUF embedded in the terminal apparatus to generate an authentication key for password authentication associated with the terminal apparatus, and an authentication unit to perform the password authentication associated with the terminal apparatus using the authentication key generated by the PUF.

Claims

1. A terminal device that performs machine-to-machine (M2M) communication, the terminal device comprising:

a secret key module to provide a secret key for transferring a public key, using a secret key encryption scheme, the public key being used for communication of the terminal device using a public key encryption scheme;

a private key module to provide a private key for generating the public key, wherein at least one of the secret key module and the private key

module includes a physical unclonable function (PUF); and

a fuse unit configured to block a path via which the secret key is

extracted, wherein the PUF includes at least one via disposed between two metal layers, the via having a first size smaller than a second size specified by a design rule.

2. The terminal device of claim 1, wherein the fuse unit blocks the path after the secret key is initially extracted from the terminal device.

3. The terminal device of claim 1, further comprising:

a serial number storage to store a serial number of the terminal device, wherein the fuse unit is configured to block a path via which the secret key is extracted,

after the serial number is stored in the serial number storage and the secret key is extracted.

4. The terminal device of claim 1, further comprising:

a public key generator to generate the public key using the private key.

5. The terminal device of claim 1, wherein:

the terminal device stores a public key of an external device used for communication of the external device using the public key encryption scheme, and

when a message is received from the external device, the terminal device decrypts the message using the public key of the external device.

6. The terminal device of claim 5, wherein when the message is decrypted, the terminal device verifies the validity of the external device depending on whether the identity of a serial number of the terminal device is acknowledged.

11. The terminal device of claim 1, wherein

the secret key module includes a first physical unclonable function (PUF), and the private key module includes a second PUF different from the first PUF.

7. A method of performing, by a terminal device, security authentication in order to perform machine-to-machine (M2M) communication, the method comprising:

generating, by the terminal device, a private key of the terminal device using a first physical unclonable function (PUF) embedded in the terminal device;

generating, by the terminal device, a public key for performing password authentication using the private key;

generating a secret key for transferring the public key externally using a secret key encryption scheme;

blocking a path via which the secret key is extracted, using a fuse; and

performing the password authentication with an external terminal other than the terminal device or an external certification authority (CA) using the public key,

wherein the first PUF includes at least one via disposed between two metal layers, the via having a first size smaller than a second size specified by a design rule.

8. The method of claim 7, further comprising:

generating the secret key using a second PUF different from the first PUF; and

exchanging the public key with the external CA based on a secret key encryption scheme using the secret key.

9. The method of claim 7, further comprising:

receiving, from the external CA, a message encrypted using a public key encryption scheme;

decrypting the encrypted message using a pre-stored public key of the external CA; and

completing security authentication with the external CA when a serial number of the terminal device is verified from the decrypted message.

10. The method of claim 8, further comprising:

blocking the fuse after a serial number of the terminal device is stored in a serial number storage and the secret key is initially extracted.