JP2016018257A - Authentication device and authentication method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication device and an authentication method using both password and PUF, configured to prevent an off-line attack, while enhancing safety.SOLUTION: An authentication device 10 includes: condition generation means 20 for generating conditions for generating unique information on the basis of an input password; unique information generation means 30 for generating unique information according to hardware characteristics, on the basis of the generated conditions; and encryption/authentication means 40 which uses the generated unique information as confidential information.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an authentication device and an authentication method, and more particularly to an authentication device and an authentication method for performing authentication using a password and a PUF in combination.

  In order to realize a system that is safe with respect to information security, an authentication unit that verifies that a user accessing the system is legitimate is necessary. Password authentication based on ID and password is still the main user authentication means because of its high availability and ease of introduction, but due to the evolution of cyber attacks, higher security is required for password authentication.

  In password authentication, usually, a measure is taken to limit access to the ID when the password authentication fails a certain number of times. Also, instead of holding the password itself, measures are taken to hold the hash value and hash function. Here, the hash value is calculated using a cryptographically secure hash function that is difficult to obtain an inverse image, such as SHA256 recommended by NIST (National Institute of Standards and Technology). It is common.

  However, if a terminal device or server is hacked by an attacker and both the processing method for generating a hash value from a password and the hash value of the password are leaked, an off-line attack is possible. One method for preventing offline attacks is two-factor authentication that combines password authentication with other authentication methods.

  As one of the two-factor authentication, there is a technology called PUF (Physically Unclonable Function) that uses, together with a password, unique information that is difficult to predict due to fluctuations during hardware manufacturing. For example, Patent Documents 1 and 2 disclose a technique for improving the security of a system by using a password and a PUF in combination when accessing a server from a specific terminal. Patent Document 1 and Non-Patent Document 1 disclose a technique for generating unique information by using randomness of wiring delay.

Special table 2012-503814 gazette Special table 2012-510210 gazette Special table 2009-524998

G. E. Shu and S. Devadas, “Physically Unclonable Functions for Device Generation and Secret Key Generation,” Proc. 44th Design Automation Conference, pp.9-14.

  However, both of the technologies disclosed in Patent Documents 1 and 2 are technologies that reinforce the security of an authentication method using a PUF by using password authentication as an auxiliary. Since the validity of the password can be verified independently of the device physical information generation in the PUF, the attacker can obtain the password at high speed offline.

  The present invention has been made in view of the above problems, and provides an authentication device and an authentication method that are difficult to attack by off-line processing and have higher security in an authentication device and an authentication method that use both a password and a PUF. For the purpose.

  In order to achieve the above object, an authentication device according to the present invention includes a condition generation unit that generates a condition for generating unique information based on an input password, and hardware characteristics based on the generated condition. Specific information generating means for generating the corresponding specific information, and encryption / authentication means for using the specific information as secret information.

  In order to achieve the above object, the authentication method according to the present invention generates a condition for generating unique information based on the input password, and the unique information according to the hardware characteristics based on the generated condition. And the unique information is used as confidential information.

  According to the above-described aspect of the present invention, it is possible to provide an authentication device and an authentication method that are difficult to attack by offline processing and have higher security in an authentication device and an authentication method that use a password and a PUF together.

It is a block block diagram of the authentication device 10 which concerns on 1st Embodiment. It is a block block diagram of the password and PUF authentication system 100 which concerns on 2nd Embodiment. It is an operation | movement flowchart in the registration phase of the password and PUF authentication system 100 which concerns on 2nd Embodiment. It is an operation | movement flowchart in the authentication phase of the password and PUF authentication system 100 which concerns on 2nd Embodiment. It is a block block diagram of the password and PUF authentication system 100B which concerns on 3rd Embodiment. It is an operation | movement flowchart in the registration phase of the password and PUF authentication system 100B which concerns on 3rd Embodiment. It is an operation | movement flowchart in the authentication phase of the password and PUF authentication system 100B which concerns on 3rd Embodiment. It is a circuit block diagram of the device physical information generation circuit 310C which concerns on 4th Embodiment. It is a circuit block diagram of the device physical information generation circuit 310D and the physical information determination circuit 330D which concern on the modification of 4th Embodiment. It is a circuit block diagram of the device physical information generation circuit 310E and the physical information determination circuit 330E which concern on 5th Embodiment.

<First Embodiment>
A first embodiment according to the present invention will be described. FIG. 1 shows a block diagram of the authentication device according to this embodiment. In FIG. 1, the authentication device 10 includes a condition generation unit 20, a unique information generation unit 30, and an encryption / authentication unit 40.

  The condition generation unit 20 generates a condition for generating unique information according to hardware characteristics based on the input password, and outputs the condition to the unique information generation unit 30. In the present embodiment, the condition generation unit 20 acquires a sequence using the input password as a seed, and generates a condition based on the acquired sequence.

  The unique information generating unit 30 has hardware as a component, and generates unique information according to hardware characteristics according to the input conditions. Here, the unique information corresponding to the hardware characteristics is a characteristic of the hardware unit due to fluctuations during the manufacture of the hardware. For example, in LSI (Large Scale Integration) produced in the same lot, even if the wiring is the same, variations in signal propagation occur if the devices are different. This variation is difficult for manufacturers to guess. Therefore, it is possible to designate an arbitrary wiring of hardware based on the condition input from the condition generation means 20, and use the measurement result of the delay in the designated wiring as unique information.

  The encryption / authentication unit 40 uses the unique information generated by the unique information generation unit 30 as secret information, and realizes the security function of the apparatus holding the authentication device. This security function includes storage encryption or authentication / key exchange with the server, and directly uses unique information as a secret key for such encryption or authentication / key exchange.

  The authentication device 10 configured as described above acquires a sequence using the input password as a seed, and generates a condition based on the acquired sequence. Then, specific information corresponding to the hardware characteristics is generated based on the generated conditions, and the specific information is used as secret information.

  As described above, the authentication device 10 according to the present embodiment determines the condition based on the password input by the user, and uses the unique information generated using hardware according to the condition for authentication. In this case, even if the device is hacked, the unique information is not obtained, and the attacker needs to obtain the output of the unique information generating means 30 for the password. Therefore, the password is broken by dictionary attack or brute force offline attack. This can be suppressed, and a more secure authentication system can be constructed.

<Second Embodiment>
A second embodiment will be described. FIG. 2 shows a block diagram of the password / PUF authentication system according to the present embodiment. In FIG. 2, the password / PUF authentication system 100 includes a PUF challenge generation unit 200, unique information generation unit 300, and encryption / authentication unit 400.

  The password entered by the user is input to the PUF challenge generation means 200. The PUF challenge generation unit 200 generates a PUF challenge based on the input password, and outputs the generated PUF challenge to the unique information generation unit 300. As shown in FIG. 2, the PUF challenge generation unit 200 according to this embodiment includes a pseudo random number generation circuit 210 and an output control circuit 220.

  The pseudo random number generation circuit 210 generates a sequence using the password input by the user as a seed and outputs the sequence to the output control circuit 220. As a seed, not only the password input by the user but also the ID of the user or device can be used. Thereby, safety can be further improved.

  The output control circuit 220 generates PUF challenge data according to the input sequence, and matches the index of the generated PUF challenge data with the format of the device physical information generated by the device physical information generation circuit 310 of the specific information generation means 300. Then, the PUF challenge data with the adjusted index is output to the unique information generating means 300 as a PUF challenge. The output control circuit 220 can be realized by a counter, for example.

  The unique information generation unit 300 generates device specific information using the PUF challenge input from the PUF challenge generation unit 200 and outputs the device specific information to the encryption / authentication unit 400. As shown in FIG. 2, the specific information generating unit 300 according to this embodiment includes a device physical information generating circuit 310 and a physical information processing circuit 320.

  The device physical information generation circuit 310 generates device physical information using the input PUF challenge. The device physical information generation circuit 310 can be configured by, for example, a plurality of identical circuits or memories (SRAM) for measuring delay.

  Here, the device physical information is unique information resulting from fluctuations during hardware manufacture. For example, in a plurality of LSIs produced as the same lot, even if the wiring is the same, variation in signal propagation delay occurs if the devices are different. A PUF that uses a delay performs circuit selection using a PUF challenge, and uses a delay measurement result as device physical information. In addition, in the PUF using the SRAM, the element value at the start-up is used. The generation of device physical information using the randomness of wiring delay is disclosed in Patent Document 1 and Non-Patent Document 1 described in the background art.

  The physical information processing circuit 320 converts the input device physical information into device specific information and outputs it to the encryption / authentication unit 400. The physical information processing circuit 320 applies error correction encoding (during registration) / decoding (during authentication) to generate a stable output against thermal noise and environmental changes. The physical information processing circuit 320 performs a process of compressing into a random secret key having a certain length that is difficult to guess in consideration of redundancy and the amount of information leaked from the parity of the error correction code.

  The encryption / authentication unit 400 performs message authentication and encryption by using the input device-specific information as a secret key and secret auxiliary information. Typically, the target security function is realized by, for example, challenge / response authentication with an external server or generation of a secret key encryption key for encryption of storage in the terminal device.

  The password / PUF authentication system 100 configured as described above performs a registration phase executed when a user is first set in a device and user authentication, as in general password authentication or PUF authentication. And the authentication phase executed in Hereinafter, the processing flow in each phase will be described.

  First, the registration phase will be described with reference to FIG. In FIG. 3, when the user inputs a password to the terminal device (S101), the pseudo random number generation circuit 210 of the PUF challenge generation unit 200 generates a sequence using the input password as a seed, and the generated sequence is output to the output control circuit 220. (S102).

  The output control circuit 220 generates PUF challenge data according to the input sequence. The output control circuit 220 further processes the index of the generated PUF challenge data so as to match the format of the device physical information generated by the device physical information generation circuit 310, and outputs the processed PUF challenge data to the unique information generation means 300 as a PUF challenge ( S103).

  The device physical information generation circuit 310 of the specific information generation unit 300 generates device physical information using the input PUF challenge (S104). The device physical information generation circuit 310 outputs the generated device physical information to the physical information processing circuit 320 when device physical information sufficient for generating device specific information is generated (YES in S105). If device physical information sufficient for generating device specific information has not been generated (NO in S105), device physical information is generated based on the next PUF challenge. That is, S103 to S105 are repeated until a data amount sufficient for generating device specific information is obtained. The number of repetitions is determined depending on the entropy of one output of device physical information and the target security level.

  The physical information processing circuit 320 performs various processes on the input device physical information and outputs the device specific information to the encryption / authentication unit 400 (S106). For example, the physical information processing circuit 320 generates device-specific information by executing parity generation / holding and compression processing by error correction coding on the input device physical information. Here, a cryptographic hash function can be used for the compression process.

  The encryption / authentication unit 400 generates authentication data from the input device-specific information, and registers the generated authentication data in the system (S107). The authentication data is typically a secret key for common key encryption or message authentication. This secret key is used for encryption of storage in the terminal device and authentication with the server in the authentication phase. In addition, registration of authentication data to the system is realized by encrypting and holding the system secret key using this secret key in the terminal device and creating registration data for performing challenge-response authentication with the server. Is done.

  Next, the authentication phase will be described with reference to FIG. Since S201 to S205 in FIG. 4 are the same as S101 to S105 in FIG. 3 described in the registration phase, detailed description is omitted. That is, in S201, the user inputs a password to the terminal device when starting to use the terminal device. And device physical information is produced | generated using the PUF challenge produced | generated based on the input password (S202-S205).

  The physical information processing circuit 320 performs the same processing as that performed in S106 on the input device physical information, and outputs it to the encryption / authentication unit 400 as authentication device specific information (S206). For example, the physical information processing circuit 320 executes decoding of the error correction code for the device physical information by the parity of the registration phase used in S106 of FIG. 3, and executes the same compression processing as S106 of FIG. To do.

  The encryption / authentication unit 400 authenticates the input device-specific information for authentication using the authentication data registered in the system in S107 of FIG. 3 in the registration phase (S207). If they match, the encryption / authentication unit 400 determines that the input password is valid.

  As described above, the password / PUF authentication system 100 according to the present embodiment generates a sequence using the password input by the user as a seed, and generates a PUF challenge based on the generated sequence. In this case, in order to break the password, the attacker needs to obtain a PUF output for each password. Since it is difficult to duplicate the PUF, it is possible to prevent the password from being broken in the offline processing. That is, since the password estimation is limited by the output generation speed of the PUF, it is possible to greatly limit the number of passwords that can be tried per unit time. Therefore, when the password and the PUF are used in combination, the password / PUF authentication system 100 that is difficult to attack by off-line processing and has higher security can be constructed.

<Third Embodiment>
A third embodiment will be described. FIG. 5 shows a block diagram of the password / PUF authentication system according to the present embodiment. In FIG. 5, the password / PUF authentication system 100B includes a PUF challenge generation unit 200B, a unique information generation unit 300B, a PUF challenge index storage unit 500B, and an encryption / authentication unit 400B.

  The PUF challenge generation unit 200B includes a pseudo random number generation circuit 210B and an output control circuit 220B, generates a PUF challenge based on the input password, and outputs the PUF challenge to the unique information generation unit 300B.

  The pseudo random number generation circuit 210B generates a sequence using the input password as a seed, and outputs the generated sequence to the output control circuit 220B.

  The output control circuit 220B generates PUF challenge data according to the input sequence, and generates a PUF challenge by matching the index with the device physical information format generated by the device physical information generation circuit 310B of the unique information generation means 300B. To do.

  In the registration phase, the output control circuit 220B according to the present embodiment outputs the generated PUF challenge as it is to the unique information generating unit 300B. On the other hand, the output control circuit 220B refers to the PUF challenge index storage unit 500B every time a PUF challenge is generated in the authentication phase, and confirms whether or not the generated PUF challenge matches the skip challenge. If the generated PUF challenge does not match the skip challenge, it is output to the unique information generating means 300B. If the generated PUF challenge matches the skip challenge, the PUF challenge is not output to the unique information generating means 300B. , Start generating the next PUF challenge according to the sequence entered.

  The unique information generating unit 300B includes a device physical information generating circuit 310B, a physical information determining circuit 330B, and a physical information processing circuit 320B. The unique information generating unit 300B generates device specific information using the input PUF challenge, and encrypts / authenticates 400B. Output to.

  The device physical information generation circuit 310B generates device physical information using the input PUF challenge and outputs the device physical information to the physical information determination circuit 330B.

  In the registration phase, the physical information determination circuit 330B determines the reliability of the input device physical information by using an optimal determination method according to the processing content in the device physical information generation circuit 310B. When the physical information determination circuit 330B determines that the reliability of the device physical information is low, the physical information determination circuit 330B registers the PUF challenge index used to generate the device physical information in the PUF challenge index storage unit 500B as a skip challenge. On the other hand, the physical information determination circuit 330B outputs the input device physical information as it is to the physical information processing circuit 320B in the authentication phase.

  The physical information processing circuit 320B converts the device physical information input from the device physical information generation circuit 310B via the physical information determination circuit 330B into device specific information, and outputs the device specific information to the encryption / authentication unit 400B.

  In the PUF challenge index storage unit 500B, an index of a PUF challenge corresponding to device physical information determined to have low reliability by the physical information determination circuit 330B is registered as a skip challenge.

  The encryption / authentication unit 400B executes message authentication and encryption by using the input device-specific information as a secret key and secret auxiliary information.

  The processing flow of the registration phase and the authentication phase of the password / PUF authentication system 100B configured as described above will be described. First, the registration phase will be described with reference to FIG. S301 to S304 in FIG. 6 are the same as S101 to S104 in FIG. 3 (processing flow in the registration phase of the password / PUF authentication system 100 according to the second embodiment), and thus detailed description thereof is omitted. That is, device physical information is generated by a PUF challenge generated using a password input by the user as a seed.

  In the present embodiment, the physical information determination circuit 330B of the unique information generation unit 300B determines the reliability of the device physical information in the registration phase (S305). When it is determined that the reliability of the input device physical information is low (low in S305), the physical information determination circuit 330B discards the generated device physical information and uses the PUF challenge used to generate the device physical information. Are registered in the PUF challenge index storage means 500B as a skip challenge (S306).

  On the other hand, when it is determined that the reliability of the input device physical information is high (high in S305), the physical information determination circuit 330B further determines whether or not device physical information sufficient for generating device specific information has been generated. (S307). When device physical information sufficient for generating device specific information is generated (YES in S307), the device physical information is output to the physical information processing circuit 320B. If device physical information sufficient for generating device specific information is not generated (NO in S307), S303 to S307 are repeated until a data amount sufficient for generating device specific information is obtained.

  The physical information processing circuit 320B performs parity generation / holding and compression processing by error correction coding on the input device physical information, and outputs the device specific information to the encryption / authentication unit 400B (S308).

  The encryption / authentication unit 400B generates authentication data from the input device specific information, and registers the generated authentication data in the system (S309).

  Next, the authentication phase will be described with reference to FIG. The user inputs a password to the terminal device when starting to use the terminal device (S401). The pseudo random number generation circuit 210B of the PUF challenge generation means 200B generates a sequence using the input password as a seed, and outputs the generated sequence to the output control circuit 220B (S402).

  The output control circuit 220B generates PUF challenge data according to the input sequence, and generates a PUF challenge by processing the index so as to match the format of the device physical information generated in the device physical information generation circuit 310B (S403). ). Then, every time the PUF challenge is generated, the output control circuit 220B refers to the PUF challenge index storage unit 500B and verifies whether or not the generated PUF challenge is a skip challenge (S404).

  When the generated PUF challenge matches the skip challenge (YES in S404), the output control circuit 220B discards the PUF challenge and proceeds to generate the next PUF challenge according to the sequence input from the pseudo-random number generation circuit 210B. . On the other hand, when the generated PUF challenge is not a skip challenge (NO in S404), the output control circuit 220B outputs the PUF challenge to the unique information generating unit 300B (S405).

  The processing flow (S406 to S409 in FIG. 7) of the unique information generating unit 300B and the encryption / authentication unit 400B is the processing flow in the authentication phase of the password / PUF authentication system 100 described in the second embodiment (S204 in FIG. 4). To S207), detailed description thereof is omitted.

  As described above, the password / PUF authentication system 100B according to the present embodiment generates a PUF challenge according to a sequence generated using a password as a seed in the registration phase, and determines the reliability of the generated PUF challenge. . When it is determined that the reliability is low, the index of the PUF challenge is registered in the PUF challenge index storage unit 500B as a skip challenge. In the PUF, a process for generating a stable output is necessary regardless of environmental changes such as temperature. However, in the sequence generation that is input to the device physical information generation unit 310B in the authentication phase, a PUF challenge with low reliability is used. By skipping, authentication based on device-specific information with high stability and reliability can be performed.

<Fourth Embodiment>
A fourth embodiment will be described. The password / PUF authentication system according to this embodiment is configured in the same manner as the password / PUF authentication system 100 of FIG. 2 described in the second embodiment. In the present embodiment, a ring oscillator circuit is applied as the device physical information generation circuit 310. Hereinafter, each element of the password / PUF authentication system according to the present embodiment will be described with “C” appended to the end of each element of the password / PUF authentication system 100 of FIG. 2.

  The pseudo random number generation circuit 210C of the PUF challenge generation unit 200C generates a sequence using the password input by the user as a seed and outputs the sequence to the output control circuit 220C.

  The output control circuit 220C generates a PUF challenge based on the input sequence, and outputs the generated PUF challenge to the selector 312C of the device physical information generation circuit 310C. The output control circuit 220C according to the present embodiment generates PUF challenge data based on the input sequence, and adjusts the index of the PUF challenge data to the format of the index of the pair of the ring oscillator circuit 311C. Generate.

  The device physical information generation circuit 310C generates device physical information using the input PUF challenge and outputs the device physical information to the physical information processing circuit 320C. FIG. 8 shows a circuit configuration diagram of the device physical information generation circuit 310C according to the present embodiment. In FIG. 8, the device physical information generation circuit 310C includes a plurality of ring oscillator circuits 311C, a selector 312C, two counters 313C and 314C, and a comparison unit 315C. 100 to several hundred ring oscillator circuits 311C are arranged in the device physical information generation circuit 310C according to the present embodiment.

  Each of the ring oscillator circuits 311C includes an odd number of inverters.

  The selector 312C selects two ring oscillator circuits 311C from among a plurality of ring oscillator circuits 311C arranged in the device physical information generation circuit 310C based on the PUF challenge input from the PUF challenge generation unit 200C. Then, the output value of the selected ring oscillator circuit 311C is output to the counters 313C and 314C.

  Each of the counters 313C and 314C measures 0 and 1 inversion number (frequency) of the output value in a certain time for the output value input from the selector 312C, and outputs the measurement result to the comparison unit 315C.

  The comparison unit 315C compares the measurement results input from the counters 313C and 314C, and outputs 0 or 1 depending on the magnitude. Here, the array of 0 and 1 output from the comparison unit 315C is device physical information. The frequency of the ring oscillator circuit 311C varies greatly depending on environmental factors such as temperature. By using the magnitude relationship between the output values from the two ring oscillator circuits 311C as device physical information, the environmental factor is suppressed. Highly reliable device physical information can be generated. The generation of unique information using the ring oscillator circuit 311C is disclosed in Non-Patent Document 1 described in the background art.

  The physical information processing circuit 320C converts the input device physical information into device specific information and outputs it to the encryption / authentication unit 400C.

  The encryption / authentication unit 400C executes message authentication and encryption by using the input device-specific information as a secret key and secret auxiliary information.

  Here, if the number of ring oscillator circuits 311C is n, a pair of different integers (8 bits in the case of n = 256) from 0 to n−1 is output, so that the ring oscillator circuit 311C Pairs can be specified. Furthermore, when the ring oscillator circuit 311C is selected, the index of the pair of the selected ring oscillator circuit 311C is held in the memory, so that the process of not using the pair of the ring oscillator circuit 311C selected once is realized. can do. In this case, it is possible to prevent a decrease in entropy of the unique information.

  In the generation of device physical information using the ring oscillator circuit 311C, 1-bit information is obtained for a PUF challenge. Therefore, in order to generate k-bit device-specific information, for k or more PUF challenges, Device physical information must be generated. Let f be the entropy per bit of device physical information. Although f is ideally 1, it is actually often less than 1 because the frequency is biased depending on the position of the ring oscillator circuit 311C in the device. When the coding rate of the error correction code of the physical information processing circuit 320C is represented by r, device physical information of N bits or more is generated by PUF challenge of N = (k / (f · r)) times or more, and k bits The device specific information is compressed using a hash function.

  Also, block codes such as BCH codes and Reed-Solomon codes are typically applied as error correction codes used in the physical information processing circuit 320C according to the present embodiment. For example, the parity generation is performed by using the input sequence as an information sequence to obtain parity by encoding processing, or by obtaining a syndrome that is a product of the input sequence and the parity check matrix. In the latter, at the time of decoding, processing for obtaining a sequence having the shortest Hamming distance from the input sequence among sequences generating the syndrome is executed. As a hash function for output generation, a cryptographically secure hash function such as SHA2256 recommended by NIST can be applied.

<Modification of Fourth Embodiment>
A modification of the fourth embodiment will be described. In this embodiment, the device physical information generation circuit 310C of FIG. 8 described in the fourth embodiment is applied to the password / PUF authentication system 100B of FIG. 5 described in the third embodiment. Hereinafter, each element of the password / PUF authentication system according to the present embodiment is represented by “B” at the end of each element of the password / PUF authentication system 100B of FIG. 3 and the end of each element of the device physical information generation circuit 310C of FIG. In the description, “C” is replaced with “D”. FIG. 9 shows a circuit configuration diagram of the device physical information generation circuit 310D and the physical information determination circuit 330D according to the present embodiment.

  In FIG. 9, the device physical information generation circuit 310D includes a plurality of ring oscillator circuits 311D, a selector 312D, and two counters 313D and 314D. The selector 312D selects the two ring oscillator circuits 311D based on the PUF challenge input from the PUF challenge generation means 200D, and outputs the output values from the selected ring oscillator circuit 311D to the counters 313D and 314D. The counters 313D and 314D measure 0 and 1 inversion number (frequency) of the output value in a certain time for the output value input from the selector 312D, and determine the physical information by using the measured 0 and 1 array as device physical information. Output to the circuit 330D.

  The physical information determination circuit 330D includes a comparison determination circuit 331D. The comparison determination circuit 331D determines the reliability of the output values from the counters 313D and 314D of the device physical information generation circuit 310D in the registration phase. When the frequency difference between the two ring oscillator circuits 311D is smaller than a predetermined threshold, the comparison / determination circuit 331D according to the present embodiment determines that the reliability of the device physical information is low, and corresponds to the device physical information The index of the PUF challenge to be registered is registered in the PUF challenge index storage 500D as a skip challenge.

  That is, when the frequencies output from the counters 313D and 314D are too close, the magnitude relationship is easily reversed depending on the temperature or the like. In the registration phase, an unstable pair can be excluded in the authentication phase by registering a PUF challenge corresponding to a pair whose difference between them is smaller than a predetermined threshold as a skip challenge. Therefore, the reliability of device physical information can be increased in the authentication phase, and the amount of parity of the error correction code can be reduced.

<Fifth Embodiment>
A fifth embodiment will be described. The password / PUF authentication system according to the present embodiment is configured in the same manner as the password / PUF authentication system 100B of FIG. 5 described in the third embodiment. In the present embodiment, an arbiter circuit that detects a delay difference between two wirings is applied as the device physical information generation circuit 310B. Hereinafter, description will be made by replacing “B” at the end of each element of the password / PUF authentication system 100B of FIG. 5 described in the third embodiment with “E”.

  The pseudo random number generation circuit 210E of the PUF challenge generation unit 200E generates a sequence using the password input by the user as a seed, and outputs the sequence to the output control circuit 220E. The output control circuit 220E matches the input sequence with the format of the L-stage select circuit 317E, and outputs an L-bit PUF challenge to the selector 316E of the device physical information generation circuit 310E.

  The device physical information generation circuit 310E generates device physical information using the input L-bit PUF challenge, and outputs the device physical information to the physical information determination circuit 330E. FIG. 10 shows a circuit configuration diagram of the device physical information generation circuit 310E and the physical information determination circuit 330E according to the present embodiment. In FIG. 10, the device physical information generation circuit 310E includes a selector 316E, an L-stage selection circuit 317E, and an arbiter circuit 318E.

  An L-bit PUF challenge is input to the selector 316E from the PUF challenge generating means 200E. The selector 316E sets two paths by sequentially selecting the cross or straight input of the selector of each stage of the L stage select circuit 317E based on the input L-bit PUF challenge. That is, two paths having the same length are set in the L-stage select circuit 317E by the input L-bit PUF challenge. Furthermore, the selector 316E according to the present embodiment writes the PUF challenge being executed to the PUF challenge register 332E in the registration phase.

  The L-stage select circuit 317E includes an L-stage selector pair and straight and cross paths. The L-stage select circuit 317E outputs the output values from the two paths set by the selector 316E (hereinafter referred to as path signals) to the arbiter circuit 318E.

  The arbiter circuit 318E receives two path signals that have passed through two different paths of the same length of the L-stage select circuit 317E. The arbiter circuit 318E determines which of the two input path signals is input earlier, and outputs 0 or 1 device physical information to the physical information determination circuit 330E according to the determination result. As the arbiter circuit 318E, for example, a D-type flip-flop can be applied. Specific information generation using an arbiter is disclosed in Non-Patent Document 1 shown in the background art.

  In the registration phase, the physical information determination circuit 330E extracts a PUF challenge in which device physical information with low reliability is generated, and registers the extracted PUF challenge index in the PUF challenge index storage unit 500E as a skip challenge. As shown in FIG. 10, the physical information determination circuit 330E according to this embodiment includes a PUF challenge register 332E, a device physical information register 333E, and a determination circuit 334E.

  In the PUF challenge register 332E, the PUF challenge being executed in the selector 316E is temporarily stored by the selector 316E in the registration phase.

  The device physical information register 333E temporarily stores a plurality of device physical information generated using the PUF challenge stored in the PUF challenge register 332E.

  The determination circuit 334E determines the reliability of a plurality of device physical information stored in the device physical information register 333E in the registration phase. For example, the determination circuit 334E determines that the device physical information is stable when a constant output of 1 or 0 is stabilized as the device physical information.

  If the determination circuit 334E determines that the plurality of device physical information stored in the device physical information register 333E is stable, the determination circuit 334E outputs the device physical information to the physical information processing circuit 320E and proceeds to the next PUF challenge. Outputs a signal for transition. With this signal, the selector 316E shifts to generation of device physical information based on the next PUF challenge, and the PUF challenge register 332E and the device physical information register 333E are cleared.

  On the other hand, when determining that the plurality of device physical information stored in the device physical information register 333E is not stable, the determination circuit 334E skips the index of the index of the PUF challenge stored in the PUF challenge register 332E. It registers in the PUF challenge index storage means 500E as a challenge and outputs a signal for shifting to the next PUF challenge.

  In the L stage select circuit 317E, when the delay difference between the two paths set by the L-bit PUF challenge is very small, it is extremely difficult to stably determine which of the two path signals is faster in the arbiter circuit 318E. is there. In this embodiment, by generating device physical information using a PUF challenge a plurality of times in the registration phase, the index of the PUF challenge that makes the determination in the arbiter circuit 318E unstable is registered as a skip challenge. . In the authentication phase, by skipping unstable PUF challenges, only highly reliable device physical information can be used for authentication.

  The present invention is not limited to the above-described embodiment, and design changes and the like within a range not departing from the gist of the present invention are included in the present invention.

DESCRIPTION OF SYMBOLS 10 Authentication device 20 Condition generation means 30 Specific information generation means 40 Encryption / authentication means 100, 100B Password / PUF authentication system 200, 200B PUF challenge generation means 210, 210B Pseudo random number generation circuit 220, 220B Output control circuit 300, 300B Specific Information generation means 310, 310B Device physical information generation circuit 320, 320B Physical information processing circuit 330B Physical information determination circuit 400, 400B Encryption / authentication means 500B PUF challenge index storage means

Claims (10)

Condition generating means for generating a condition for generating unique information based on the input password;
Specific information generating means for generating the specific information according to hardware characteristics based on the generated conditions;
An encryption / authentication unit that uses the generated unique information as secret information;
An authentication device comprising: The authentication device according to claim 1, wherein the condition generation unit acquires a sequence using the input password as a seed, and generates the condition based on the acquired sequence. In the registration phase, it further comprises a reliability determination means for determining the reliability of the generated unique information and registering a condition corresponding to the unique information with low reliability in the storage means,
The authentication device according to claim 1, wherein the condition generation unit does not output a condition that matches a condition registered in the storage unit in the authentication phase. The unique information generating means generates a plurality of unique information under the same conditions in the registration phase,
The reliability determination means determines that the reliability is low when variations in the plurality of unique information generated under the same conditions exceed a predetermined range.
The authentication device according to claim 3. 5. The specific information generation unit acquires two hardware characteristics based on the condition, and outputs a difference between the two acquired hardware characteristics as the specific information. 6. Authentication device. The unique information generating means includes a plurality of ring oscillator circuits,
The condition generating means generates information for designating two ring oscillator circuits from the plurality of ring oscillator circuits as the condition,
The unique information generating means uses the difference between frequencies output from two ring oscillator circuits designated based on the condition as the unique information.
The authentication device according to claim 5. The unique information generating means includes an L-stage select circuit,
The condition generation means generates L-bit information as the condition,
The unique information generation means sets two paths in the L-stage select circuit using the L-bit condition, and sets a difference between passage times of the two paths as the unique information.
The authentication device according to claim 5. The authentication device according to claim 1, wherein the condition is a PUF (Physically Unclonable Function) challenge. The authentication device according to claim 1, further comprising an input unit that receives an input of a password from a user. Generate conditions to generate unique information based on the entered password,
Based on the generated conditions, specific information corresponding to hardware characteristics is generated,
Using the generated unique information as secret information;
Authentication method.

Images