Multi-factor authentication

• US 8,868,923 B1
• Filed: 10/20/2010
• Issued: 10/21/2014
• Est. Priority Date: 07/28/2010
• Status: Active Grant

• Current Assignee: National Technology & Engineering Solutions Of Sandia LLC (Honeywell International Inc.)
• Original Assignee: Sandia Corporation (Martin Marietta Corporation)
• Inventors: Hamlet, Jason R., Pierson, Lyndon G.
• Primary Examiner(s): VOSTAL, ONDREJ C
• Application Number:
  US12/908,414
• Time in Patent Office: 1,462 Days
• Field of Search: 713/186, 326/8, 380/44
• US Class Current: 713/186
• CPC Class Codes: G05B 19/00 Programme-control systems
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: H03K 19/003 Modifications for increasing the reliability for protection
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3278 using physically unclonable functions [PUF]
• CPC Class Codes: H04N 1/442 using a biometric data reading device
• CPC Class Codes: H04N 21/4415 using biometric characteristics of the user, e.g. by voice recognition or fingerprint scanning cryptography using biological data H04L9/3231; authentication in networks using biometric H04L63/0861
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

Detection and deterrence of spoofing of user authentication may be achieved by including a cryptographic fingerprint unit within a hardware device for authenticating a user of the hardware device. The cryptographic fingerprint unit includes an internal physically unclonable function (“PUF”) circuit disposed in or on the hardware device, which generates a PUF value. Combining logic is coupled to receive the PUF value, combines the PUF value with one or more other authentication factors to generate a multi-factor authentication value. A key generator is coupled to generate a private key and a public key based on the multi-factor authentication value while a decryptor is coupled to receive an authentication challenge posed to the hardware device and encrypted with the public key and coupled to output a response to the authentication challenge decrypted with the private key.

Claims

1. A hardware device, comprising:

a hardware platform;

device circuitry coupled to perform a primary function of the hardware device disposed in or on the hardware platform; and

a cryptographic fingerprint unit for authenticating a user of the hardware device, the cryptographic fingerprint unit including;

a physically unclonable function (“

PUF”

) circuit disposed in or on the hardware platform, wherein the PUF circuit is a first authentication factor representing something the user has; and

combining logic coupled to receive at least one other authentication factor and challenge the PUF circuit with the at least one other authentication factor, wherein the at least one other authentication factor is at least one of a second authentication factor representing something the user knows or a third authentication factor representing something the user is, and wherein the PUF circuit is coupled to receive the at least one other authentication factor as a challenge and coupled to output a PUF value in response to being challenged with the at least one other authentication factor, the combining logic coupled to generate a multi-factor authentication value based on the PUF value;

wherein the cryptographic fingerprint unit uses the multi-factor authentication value to allow a challenger to authenticate the user of the hardware device.

2. The hardware device of claim 1, wherein the hardware device is a hardware token.

3. The hardware device of claim 1, wherein the combining logic is coupled to combine the PUF value with the third authentication factor or the second authentication factor to generate the multi-factor authentication value, and wherein the multi-factor authentication value is used to seed a key generation algorithm.

4. The hardware device of claim 1, wherein the combining logic is coupled to combine the second and third authentication factors to generate a first value, wherein the combining logic is coupled to challenge the PUF circuit with the first value, wherein the PUF circuit is coupled to output the PUF value as the multi-factor authentication value in response to being challenged with the first value, and wherein the multi-factor authentication value is used to seed a key generation algorithm, the multi-factor authentication value based on the second PUF value.

5. The hardware device of claim 1, wherein the combining logic is coupled to combine the PUF value with the third authentication factor or the second authentication factor to generate a first value, wherein the combining logic is coupled to challenge a second PUF circuit with the first value, wherein the second PUF is coupled to output a second PUF value, and wherein the second PUF value is used to seed a key generation algorithm.

6. The hardware device of claim 5, wherein the PUF circuit and the second PUF circuit are the same PUF circuit.

7. The hardware device of claim 1, wherein the cryptographic fingerprint unit further comprises:

a key generator coupled to generate a private key and a public key based on the multi-factor authentication value; and

a decryptor coupled to receive an authentication challenge posed to the hardware device, encrypted with the public key, and coupled to output a response to the authentication challenge decrypted with the private key.

8. The hardware device of claim 7, further comprising a noise reduction circuit coupled between the PUF circuit and the combining logic, the noise reduction circuit coupled to receive the PUF value, to reduce uncertainty in the PUF value, and to output a filtered PUF value to the combining logic, and wherein the combining logic is coupled to output a seed value to the key generator based on the filtered PUF value and the at least one other authentication factor.

9. The hardware device of claim 7, wherein the cryptographic unit is to delete the multi-factor authentication value, the PUF value, and the at least one other authentication factor after the key generator generates the private and public keys.

10. The hardware device of claim 7, further comprising a noise reduction circuit coupled between the PUF circuit and the key generator, the noise reduction circuit coupled to receive the PUF value, to reduce uncertainty in the PUF value, and to output a seed value to the key generator based on the PUF value.

11. The hardware device of claim 10, wherein the combining logic is part of the noise reduction circuit and is coupled to generate helper data based on the PUF value and the at least one other authentication factor.

12. The hardware device of claim 1, wherein the combining logic is coupled to output the PUF value as the multi-factor authentication value, and wherein the PUF value is used to seed a key generation algorithm.

13. The hardware device of claim 1, wherein the combining logic is coupled to hash the at least one other authentication factor to generate a hashed authentication factor and challenge the PUF circuit with the hashed authentication factor.

14. A method for enrolling a user of a hardware device for subsequent authentication, the method comprising:

challenging a physically unclonable function (“

PUF”

) circuit with a second authentication factor representing a biometric of the user to generate a multi-factor authentication value, wherein the biometric of the user is measured by a biometric reader of the hardware device and the PUF circuit is coupled to receive the second authentication factor as a challenge, and wherein the PUF circuit is a first authentication factor representing something the user has;

seeding a cryptographic function based on the multi-factor authentication value;

generating a cryptographic key from the cryptographic function; and

storing the cryptographic key of the hardware device for future use by a challenger to authenticate the user of the hardware device using a cryptographic challenge and response.

15. The method of claim 14, wherein generating the cryptographic key comprises generating the cryptographic key as a public key of a private-public key pair.

16. The method of claim 14, further comprising deleting all instances of the PUF value and the multi-factor authentication value within the hardware device after seeding the cryptographic function.

17. The method of claim 14, wherein storing the cryptographic key associated with the identifier comprises storing the cryptographic key associated with an identifier of the hardware device as a user-device fingerprint in a user-device fingerprint list for future use by the challenger to authenticate the hardware device using the cryptographic challenge and response, and wherein the user-device fingerprint list is external to the hardware device.

18. The method of claim 17, further comprising certifying the user-device fingerprint list with a certifying authority.

19. The method of claim 14 further comprising combining the multi-factor authentication value with a third authentication factor representing something the user knows to generate a second multi-factor authentication value, wherein the second multi-factor authentication value seeds the cryptographic function.

20. The method of claim 14 further comprising combining a third authentication factor representing something the user knows with biometric data to generated the second authentication factor, wherein the biometric data is generated from the biometric of the user.

21. The method of claim 14 further comprising:

combining the multi-factor authentication value with a third authentication factor representing something the user knows to generate a second multi-factor authentication value; and

challenging a second PUF circuit disposed within the hardware device with the second multi-factor authentication to generate a third multi-factor authentication value for said seeding the cryptographic function.

22. A method for enrolling a user of a hardware device for subsequent authentication, the method comprising:

challenging a physically unclonable function (“

PUF”

) circuit with a second authentication factor representing a biometric of a user, wherein the biometric of the user is measured by a biometric reader of the hardware device and the PUF circuit is coupled to receive the second authentication factor as a challenge, and wherein the PUF circuit is disposed within the hardware device;

generating a PUF value in response to being challenged with the second authentication factor;

wherein the PUF value is a first authentication factor representing something the user has;

generating helper data using the PUF value; and

storing the helper data for future use to recover the PUF value during for a cryptographic challenge and response.

23. The method of claim 22, further comprising:

seeding a cryptographic function based on the PUF value;

generating a cryptographic key from the cryptographic function; and

storing the cryptographic key of the hardware device for future use by a challenger to authenticate the user of the hardware device using the cryptographic challenge and response.

24. The method of claim 22, wherein said generating the helper data comprises:

combining an error correcting codeword with a second portion of the PUF value to generate a first value, wherein the error correcting codeword is based upon a first portion of the PUF value;

combining the first value and the second authentication factor to generate the helper data; and

generating a seed value for seeding the cryptographic function based on the second portion of the PUF value.

25. The method of claim 22, further comprising deleting all instances of the PUF value and the second authentication factor within the hardware device after generating the helper data.

26. A method for cryptographically authenticating a user of a hardware device, the method comprising:

retrieving a device identifier of the hardware device;

using the device identifier to retrieve a user-device fingerprint for the hardware device, the user-device fingerprint including a cryptographic key, wherein the user-device fingerprint is based upon a multi-factor authentication value based on a physically unclonable function (“

PUF”

) value generated in response to challenging a PUF circuit of the hardware device with a second authentication factor representing a biometric of a user, wherein the biometric of the user is measured by a biometric reader of the hardware device and the PUF circuit is coupled to receive the second authentication factor as a challenge, and wherein the PUF value is a first authentication factor representing something the user has; and

authenticating the user of the hardware device using the cryptographic key.

27. The method of claim 26, wherein the multi-factor authentication value is generated in real-time each time the hardware device is challenged.

28. The method of claim 26, wherein the cryptographic key is a public key of a public-private key pair, and wherein said authenticating the user comprises:

encrypting a message with the public key to generate an encrypted message;

challenging the hardware device to decrypt the encrypted message; and

determining whether the user is authenticated based upon whether the hardware device is able to decrypt the encrypted message.