APPARATUS AND METHOD FOR AUTHENTICATION BETWEEN DEVICES BASED ON PUF OVER MACHINE-TO-MACHINE COMMUNICATIONS

• US 20140310515A1
• Filed: 08/16/2012
• Published: 10/16/2014
• Est. Priority Date: 08/16/2011
• Status: Active Grant

• Current Assignee: ICTK Holdings Co., Ltd.
• Original Assignee: Bong Jae Jin, Byong Deok Choi, Dong Kyue Kim, Kwang Hyun Jee, Sang Seon Park
• Inventors: Kim, Dong Kyue, Choi, Byong Deok, Park, Sang Seon, Jee, Kwang Hyun, Jin, Bong Jae
• Granted Patent: US 9,787,670 B2
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G09C 1/00 Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system cryptographic typewriters G09C3/00
• CPC Class Codes: H04L 2209/12 Details relating to cryptographic hardware or logic circuitry
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3278 using physically unclonable functions [PUF]
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

Terminal devices that perform machine-to-machine (M2M) communication may autonomously perform password authentication by autonomously generating a personal identity number (PIN) value, which is not exposed externally, using a physical unclonable function (PUF). A terminal apparatus that performs M2M communication may include a PUF embedded in the terminal apparatus to generate an authentication key for password authentication associated with the terminal apparatus, and an authentication unit to perform the password authentication associated with the terminal apparatus using the authentication key generated by the PUF.

Claims

1. A terminal device that performs machine-to-machine (M2M) communication, the terminal device comprising:

a physical unclonable function (PUF) embedded in the terminal device to generate an authentication key for password authentication associated with the terminal device; and

an authentication unit to perform the password authentication associated with the terminal device using the authentication key generated by the PUF.

2. The terminal device of claim 1, wherein the PUF is physically isolated from an external environment to prevent the authentication key from being exposed to the outside.

3. A terminal device that performs machine-to-machine (M2M) communication, the terminal device comprising:

a secret key module to provide a secret key for transferring, using a secret key encryption scheme, a public key used for communication of the terminal device using a public key encryption scheme; and

a private key module to provide a private key for generating the public key,

wherein at least one of the secret key module and the private key module includes a physical unclonable function (PUF).

4. The terminal device of claim 3, further comprising:

a fuse unit blocked in response to applying of overcurrent to block a path via which the secret key is extracted.

5. The terminal device of claim 4, wherein the fuse unit blocks the path after the secret key is initially extracted from the terminal device.

6. The terminal device of claim 3, further comprising:

a serial number storage to store a serial number of the terminal device; and

a fuse unit to block a path via which the secret key is extracted, after the serial number is stored in the serial number storage and the secret key is extracted.

7. The terminal device of claim 3, further comprising:

a public key generator to generate the public key using the private key.

8. The terminal device of claim 3, wherein:

the terminal device stores a public key of an external device used for communication of the external device using the public key encryption scheme, and

when a message is received from the external device, the terminal device decrypts the message using the public key of the external device.

9. The terminal device of claim 8, wherein when the message is decrypted, the terminal device verifies the validity of the external device depending on whether the identity of a serial number of the terminal device is acknowledged.

10. A certification authority (CA) device for managing a terminal device that performs machine-to-machine (M2M) communication, the CA device comprising:

a personal identity number (PIN) list to store a secret key of the terminal device and a serial number of the terminal device,

wherein when a message, in which a public key used for communication using a public key encryption scheme and the serial number of the terminal device are encrypted using the secret key, is transmitted from the terminal device, the CA device decrypts the message using the secret key, and

when the message is decrypted, the CA device verifies the validity of the external device depending on whether the identity of a serial number of the terminal device is acknowledged.

11. A method of performing, by a terminal device, security authentication in order to perform machine-to-machine (M2M) communication, the method comprising:

generating, by the terminal device, a private key of the terminal device using a first physical unclonable function (PUF) embedded in the terminal device;

generating, by the terminal device, a public key for performing password authentication using the private key; and

performing the password authentication with an external terminal other than the terminal device or an external certification authority (CA) using the public key.

12. The method of claim 11, further comprising:

generating a secret key for transferring the public key externally using a secret key encryption scheme, using a second PUF different from the first PUF; and

exchanging the public key with the external CA based on a secret key encryption scheme using the secret key.

13. The method of claim 11, further comprising:

receiving, from the external CA, a message encrypted using a public key encryption scheme;

decrypting the encrypted message using a pre-stored public key of the external CA; and

completing security authentication with the external CA when a serial number of the terminal device is verified from the decrypted message.

14. The method of claim 12, further comprising:

blocking a fuse present in a path via which the secret key is extracted, after a serial number of the terminal device is stored in a serial number storage and the secret key is initially extracted.

19. A non-transitory computer-readable recording medium storing a program to implement the method according to any one of claims 11 through 18.

15. A method of relaying, by a certification authority (CA) device, public key exchange for machine-to-machine (M2M) communication between a first terminal device and a second terminal device, the method comprising:

receiving, from the second terminal device, a request for a public key of the first terminal device;

generating a first encryption message by encrypting the public key of the first terminal device and a serial number of the second terminal device using a private key of the CA device; and

transmitting the first encryption message to the second terminal device.

16. The method of claim 15, further comprising:

generating a second encryption message by encrypting a public key of the second terminal device and a serial number of the first terminal device using the private key of the CA device; and

transmitting the second encryption message to the first terminal device.

17. The method of claim 15, wherein the second terminal device decrypts the first message using a public key of the CA device corresponding to the private key of the CA device, and trusts the transmitted public key of the first terminal device when the serial number of the second terminal device is verified from the decrypted first message.

18. The method of claim 16, wherein the first terminal device decrypts the second message using a public key of the CA device corresponding to the private key of the CA device, and trusts the transmitted public key of the second terminal device when the serial number of the first terminal device is verified from the decrypted second message.