KR101882289B1 - Apparatus and method for processing authentication information - Google Patents

Abstract

There is provided an information processing apparatus comprising a PUF for generating a unique key using a process deviation in a semiconductor manufacturing process, and an encryption unit for encrypting the password and / or bio information received from the user using the unique key.

Description

[0001] APPARATUS AND METHOD FOR PROCESSING AUTHENTICATION INFORMATION [0002]

Relates to the field of digital security, and more particularly to devices and methods for storing and processing biometric information. In addition, the bioinformation and / or the user password can be securely stored and processed to provide an embedded system, a system on chip (SoC), a smart card, and a Universal Subscriber Identity Module (USIM) Lt; RTI ID = 0.0 > security / authentication < / RTI >

As the information society becomes more sophisticated, the need for personal privacy protection is increasing, and the safety of authentication means is an important technical issue.

In particular, the security reliability of the authentication key for identifying a user or a device is required to be high in electronic finance, smart card, and M2M (machine to machine) technology. Hereinafter, the authentication key will be referred to as an identification key or simply a key.

Possession-based authentication and knowledge-based authentication are possible for authentication. It can be understood that the former carries out authentication by owning a specific object, and the latter carries out authentication by a password or the like.

Since both of the above methods have advantages and disadvantages, techniques for performing both of the ownership-based authentication and the knowledge-based authentication are introduced for the authentication security.

On the other hand, a Physically Unclonable Function (PUF) can provide an unpredictable digital value. Although the individual PUFs are given an exact manufacturing process and are manufactured in the same process, the digital values provided by the individual PUFs are different.

Therefore, it may be referred to as a physical one-way function practically impossible to duplicated (POWF), which is not possible to reproduce.

Such a PUF may be used to generate a cryptographic key for security and / or authentication. For example, a PUF can be used to provide a unique key to distinguish devices from one another.

However, when the key itself generated by the PUF is used for authentication, it is sometimes difficult for the user to memorize the identification key. On the other hand, when the user input password and / or the user's bio information are used as the authentication key, the security of the authentication key must be assured to a high level when stored in the terminal.

According to one aspect, a PUF for generating at least one unique key using process variations in a semiconductor manufacturing process; And an encryption unit encrypting the password received from the user using the unique key to generate an identification key.

According to one embodiment, the PUF may generate the unique key using whether the interlayer contact formed between the conductive layers of the semiconductor shorts the conductive layer.

In this case, the inter-layer contact formed between the conductive layers of the semiconductor may be configured to be smaller than a size according to a design rule provided in the semiconductor manufacturing process.

According to an embodiment, the PUF may be configured to allow the inter-layer contact formed between the conductive layers of the semiconductor to have a difference between a probability of short-circuiting the conductive layer and a short- You can have the size of the layer contact.

According to one embodiment, the PUF has N unit structures for generating a 1-bit digital value using a pair of conductive layers and one inter-layer contact connecting them, where N is natural The N-bit unique key can be generated through the N unit structures.

In this case, the PUF generates an N-bit digital value, and the information processing apparatus groups the digital values included in the N-bit unique key in units of k, where k is a natural number, Comparing the first group and the second group among the groups and comparing the value of k digital bits included in the first group with the value of k digital bits included in the second group, And a digital value representative of the second group may be set to one.

Here, the information processing apparatus may be configured to selectively output, in accordance with the setting, a value of k digital bits included in the first group and a value of k digital bits included in the second group, The representative digital value of the second group may be determined to be either 1 or 0, or the representative digital value of the first group and the second group may not be determined.
That is, the bit sequences included in the N-bit digital values are grouped into k groups, k is a natural number, and digital logic processing is performed on each of the k groups to generate representative bits Quot; 1 " or " 0 ", the unique key can be provided as a value of k bits. The bit sequence means a unit structure for generating digital values of bits, and the digital logic operation processing means an arithmetic processing for comparing values composed of digital bits of the first group and the second group among the k groups.

According to an embodiment, the encryption unit may generate the identification key by encrypting the password N times - N using a natural number - using the unique key as a round key.

In this case, the encryption unit may encrypt the password using the AES method or the T-DES method to generate the identification key.

According to another aspect, a PUF for generating at least one unique key using a process variation in a semiconductor manufacturing process; And an encryption unit encrypting the bio information input using the unique key to generate an identification key.

According to one embodiment, the PUF may generate the unique key using whether the interlayer contact formed between the conductive layers of the semiconductor shorts the conductive layer.

According to an embodiment, the inter-layer contact formed between the conductive layers of the semiconductor may be configured to be smaller than a size according to a design rule provided in the semiconductor manufacturing process.

The PUF may include a size of the inter-layer contact which is formed between the conductive layers of the semiconductor so that the difference between the probability that the inter-layer contact is short-circuited with the conductive layer and the short- Lt; / RTI >

According to another aspect of the invention there is provided a lithographic apparatus comprising at least one PUF for generating a unique key composed of at least one digital value using a process variation in a semiconductor manufacturing process, And an encryption unit for encrypting at least one of the password or bio information received from the user using the key to generate an identification key.

According to one embodiment, the encryption unit may generate the identification key by encrypting at least one of the password or the bio information using the at least one unique key as a round key, and N times-N is a natural number.

According to one embodiment, the encryption unit may generate the identification key by encrypting at least one of the password or the bio-information using the AES method or the T-DES method.

According to one embodiment, each of the at least one PUF may generate the unique key using whether the inter-layer contact formed between the conductive layers of the semiconductor shorts between the conductive layers.

In this case, the inter-layer contact may be configured to be smaller than a size according to a design rule provided in the semiconductor manufacturing process.

Here, the PUF may be a PUF, such that the inter-layer contact formed between the conductive layers of the semiconductor makes the difference between the probability of short-circuiting the conductive layer and the short- Size.

According to one embodiment, the information processing apparatus may further include a PUF selection unit for selecting, among the at least one PUF, the PUF to be used for the encryption by the encryption unit.

According to another aspect, there is provided a PUF included in an information processing apparatus, the method comprising: generating at least one unique key using a process variation in a semiconductor manufacturing process; And an encryption unit of the information processing apparatus encrypts at least one of a first user input password or first user biometric information input to the information processing apparatus using the unique key to generate at least one of encrypted password or encrypted biometric information And generating one of the plurality of information processing methods.

According to an embodiment, the information processing method may further include, when at least one of a second user input password or second user bio information is input from the user to the information processing apparatus, the second user input password or the second user bio- Encrypting at least one of the information; And an authentication unit of the information processing apparatus compares at least one of the encrypted second user input password or the encrypted second user biometric information with at least one of the encrypted password or the encrypted biometric information to perform authentication Step < / RTI >

According to another embodiment, in the case where at least one of the second user input password or the second user bio information is input from the user to the information processing apparatus, the encryption unit of the information processing apparatus transmits the encrypted password Or decrypting at least one of the encrypted bio information to generate at least one of the first user input password or the first user bio information; And an authentication unit of the information processing apparatus compares at least one of the decrypted first user password or the first user bio information with at least one of the second user input password or the second user bio information to perform authentication The method comprising the steps of:

1 shows an information processing apparatus according to an embodiment.
2 is a conceptual diagram illustrating a configuration of a PUF according to an embodiment.
3 is a graph for explaining the PUF according to the embodiment of FIG.
4 is a conceptual diagram for explaining a configuration of a PUF according to another embodiment.
FIG. 5 illustrates an inter-layer contact array that enables the generation of a unique key in a PUF according to an embodiment.
FIG. 6 is a diagram for explaining a process of recognizing a unique key generated by a PUF according to an embodiment.
7 is a conceptual diagram for explaining a balancing process of a unique key generated by the PUF according to an embodiment.
8 shows an information processing apparatus according to another embodiment.
9 illustrates an exemplary configuration in which PUFs are located within an encryption unit according to one embodiment.
FIG. 10 is a flowchart illustrating a process of encrypting and storing password and / or bio information according to an information processing method according to an embodiment.
11 is a flowchart illustrating a process of encrypting and storing password and / or bio information by the information processing apparatus according to the embodiment of FIG.
12 is a flowchart illustrating a process of authenticating a user input password and / or bio information in an information processing apparatus according to an embodiment.
FIG. 13 is a flowchart illustrating a process of authenticating user input password and / or biometric information in an information processing apparatus according to another embodiment.

Hereinafter, some embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, the present invention is not limited to or limited by the embodiments. Like reference symbols in the drawings denote like elements.

1 shows an information processing apparatus 100 according to an embodiment.

The information processing apparatus 100 according to an embodiment can encrypt and securely store password and / or bio information received from a user, and perform security authentication.

According to one embodiment, the receiving unit 110 of the information processing apparatus 100 may receive a password input by a user.

It is possible to register the password inputted by the user and authenticate the user and / or the device by using the registered password in response to the knowledge-based authentication. However, if a user-entered password is leaked by a security attack, this knowledge-based authentication becomes unreliable.

Therefore, it is required to register and manage the password inputted by the user by a high level security processing.

According to one embodiment, the information processing apparatus 100 encrypts and stores (registers) the user input password received by the receiving unit 110. [ The received password may be plain text.

According to one embodiment, the information processing apparatus 100 includes a PUF 120 that generates a unique key that is a random digital value that does not change with time using a process deviation in a semiconductor process.

The digital value generated by the PUF 120 may be, for example, N bits (where N is a natural number).

The unique key generated by the PUF 120 may be used as an identification key for ownership based authentication. However, according to an exemplary embodiment, by encrypting the user input password using the unique key, Both can be provided.

In this case, the unique key generated by the PUF 120 is not leaked to the outside, so that a high level of reliability and safety can be assured. The implementation of the PUF 120 will be described in more detail below.

According to one embodiment, a unique key generated by the PUF 120 is used as a round key used in an Advanced Encryption Standard (AES) or the like, and a password received from a user is transmitted k times (where k is a natural number) The encrypted and encrypted value can be used as an identification key for authentication.

According to one embodiment, as described above, the encryption unit 130 uses the unique key generated by the PUF 120 as a seed, and transmits the password received by the receiving unit 110 to the AES method or the T-DES (Triple Data Encryption Standard) method to generate an identification key to be used for authentication.

However, the AES method or the T-DES method is only a partial example, and various other embodiments such as DES (Data Encryption Standard) are also possible.

According to one embodiment, the generated identification key may be stored in the storage unit 140.

The storage unit 140 may be various types of non-volatile memory such as an OTP (One Time Programmable) memory and a flash memory.

The identification key stored in the storage unit 140 can be used to perform authentication of a user and / or a device on-line. Even if the password is leaked, generation of the same identification key is prevented .

Also, in another embodiment, the stored identification key may serve as a gating for blocking external access to a device or a chip requiring a security authentication such as a smart card.

Therefore, the present invention is not limited to the use of the generated and stored identification key for authentication / security purposes.

On the other hand, according to another embodiment, the information processing apparatus 100 may be used to safely encrypt and store not only the user input password but also information related to the user's biometric information, such as fingerprints and iris.

In this embodiment, when bio information is received in the receiving unit 110, the encryption unit 130 encrypts the bio information using the unique key generated by the PUF 120 using the AES method or the Triple Data Encryption Standard (T-DES) ) Method, and so on.

When the identification key generated by the encryption is stored in the storage unit 140, the identification key can not be decoded into the bio information without the unique key generated by the PUF 120, so that a high level of reliability and safety is provided .

The above process can be understood as a process of registering user input and / or bio information as an identification key used for authentication. According to one embodiment, the information processing apparatus 100 may further include an authentication unit 150 that authenticates a user and / or a device using the thus-registered identification key.

In the embodiment in which the user password is registered and used for authentication, the authentication unit 150 can authenticate whether or not the user password input for performing authentication matches the registered password.

The encryption unit 130 encrypts the input password using the unique key generated by the PUF 120 and encrypts the encrypted password using the unique key generated by the PUF 120. [ And transmits the password to the authentication unit 150. Then, the authentication unit 150 may determine whether the password is successfully authenticated or failed to authenticate by determining whether or not the encrypted password matches the registered identification key stored in advance in the storage unit 140.

According to another embodiment, when the password input by the user for authentication is input to the receiving unit 110, the receiving unit 110 transmits the inputted password to the authentication unit 150. [ The encryption unit 130 may decrypt the identification key stored in advance in the storage unit 140 using the unique key generated by the PUF 120 and may transmit the decrypted identification key to the authentication unit 150. [ Then, the authentication unit 150 determines whether the user input password transmitted from the receiving unit 110 matches the decrypted identification key transmitted from the encryption unit 130 and determines whether the password is successfully authenticated or failed to authenticate .

On the other hand, in the embodiment where the bio information is registered and used for authentication, the authentication unit 150 can authenticate whether or not the bio information input for performing authentication matches the registered bio information.

According to one embodiment, when the bioinformation for performing authentication is input to the receiving unit 110, the encrypting unit 130 encrypts the input bioinformation using the unique key generated by the PUF 120, Information to the authentication unit 150. [ The authentication unit 150 may determine whether the authentication of the password is successful or failed by determining whether the encrypted biometric information matches the registered identification key stored in the storage unit 140 in advance.

According to another embodiment, when the bioinformation for performing authentication is input to the receiving unit 110, the receiving unit 110 transmits the inputted bioinformation to the authentication unit 150. [ The encryption unit 130 may decrypt the identification key stored in advance in the storage unit 140 using the unique key generated by the PUF 120 and may transmit the decrypted identification key to the authentication unit 150. [ Then, the authentication unit 150 determines whether the authentication of the password is successful or failed by judging whether or not the biometric information transmitted from the receiving unit 110 and the decrypted identification key transmitted from the encryption unit 130 coincide with each other have.

This embodiment may be useful for processing bio information. The bio information, such as the fingerprint or the iris pattern, may have an identification error at the time of input. Even if the bio information of the same object used at the time of registration is input again at the time of authentication, the identified bio information may not completely match . Therefore, the authentication process of the conventional bio information also determines the degree of matching between the inputted bio information and the previously registered bio information.

In this embodiment, the authentication information is input to the authentication unit 150 without being encrypted, and the authentication unit 150 compares the decrypted identification key with the transmitted bio information, The authentication success or authentication failure can be determined.

Hereinafter, an exemplary configuration of the PUF 120 according to one embodiment will be described.

The PUF 120 according to one embodiment is implemented by a configuration in which it is possible to stably determine whether or not a short between nodes generated on a semiconductor element in a semiconductor manufacturing process can be determined.

For example, the PUF 120 may use a process-variation that occurs in the same semiconductor manufacturing process to determine whether an inter-layer contact between conductive layers shorts between the conductive layers Thereby generating an N-bit digital value. The inter-layer contact may be, for example, a via, and, although not mentioned below, it should be understood that the inter-layer contact includes various conductive elements capable of electrically shorting between the conductive layers of the semiconductor .

Inter-layer contacts, such as vias, are designed to connect between conductive layers, so that an inter-layer contact or via size is typically determined to short circuit between the conductive layers. And, in a typical design rule, the minimum via size is determined to ensure shorting between the conductive layers.

However, in the implementation of the PUF 120 according to the present embodiment, the inter-layer contact, such as the size of the via, may be intentionally smaller than that specified in the design rule, so that the vias of some of the N vias may be between the conductive layers And a part of the vias can not short-circuit between the conductive layers, so that whether or not each node is short-circuited is determined stochastically.

In conventional semiconductor processes, if the inter-layer contact does not short-circuit between the conductive layers, it will be a process failure, but embodiments will use it to generate a random digital value, a unique key.

The inter-layer contact, such as the size of the via, according to the above embodiment, will be described in more detail below with reference to FIGS.

Meanwhile, according to another embodiment of the implementation of the PUF 120, the PUF 120 may intentionally make the spacing between the conductive lines smaller than the design rules in the semiconductor fabrication process so that a short circuit between the conductive lines So that a unique key is generated.

This embodiment also creates a unique key by the PUF 120 by making a gap in the conventional semiconductor manufacturing process below the minimum spacing between the conductive layers, which is a design rule that ensures open between the conductive lines.

The conductive layer interval setting according to the above embodiment will be described later in detail with reference to FIG.

Meanwhile, the unique key generated by the PUF 120 can be obtained by identifying whether the inter-layer contact is short-circuited between the conductive layers using a read transistor. An exemplary implementation of the read transistor will be described in more detail below with reference to FIG.

On the other hand, in the embodiment using the size adjustment of the above-described inter-layer contacts, the inter-layer contacts are inter-layered so that the ratio of inter-layer contacts shorting between conductive layers and non- Even if the size of the layer contact is resized, it may not be guaranteed that the ratio of a short circuit (for example, digital value 0) to an otherwise (for example, digital value 1) is completely stochastically the same.

That is, the greater the probability that the inter-layer contacts, such as vias, are closer to the values specified in the design rule, the more the conductive layers are short-circuited, and vice versa. However, if either one of the short-circuiting probability and the short-circuiting probability increases, the randomness of the generated unique key is degraded.

This problem is also true in the embodiment in which the spacing between the conductive lines is adjusted.

Therefore, according to one embodiment, raw digital values generated by the PUF 120 are grouped, and digital values between the groups are compared to determine a unique key generated by the PUF 120. This can be understood as a process of performing balancing between the digital value '0' and the digital value '1' with respect to the generated digital value.

This balancing process will be described in more detail below with reference to FIG.

FIG. 2 is a conceptual diagram for explaining a configuration of the PUF 120 according to an embodiment.

A structure in which vias, which are an example of an inter-layer contact, are formed between a metal 1 layer 202 and a metal 2 layer 201 in a semiconductor manufacturing process.

In the group 210 in which the via size is sufficiently increased according to the design rules, all the vias short-circuit the metal 1 layer 202 and the metal 2 layer 201. If the short circuit is represented by a digital value, .

On the other hand, in the group 230 in which the via size is too small, all the vias can not short-circuit the metal 1 layer 202 and the metal 2 layer 201. Therefore, when the digital value is used to indicate whether a short circuit is present,

In the group 220 that selects the via size between the size in the group 210 and the size in the group 230, some vias short-circuit the metal 1 layer 202 and the metal 2 layer 201, Some of the vias can not short-circuit the metal 1 layer 202 and the metal 2 layer 201.

The PUF 120 according to one embodiment may be formed such that a group of vias shorts the metal 1 layer 202 and the metal 2 layer 201 and the other part of the vias are connected to the metal 1 layer 202, And the metal 2 layer 201 are not short-circuited.

The design rules for via size may vary depending on the semiconductor manufacturing process. For example, if the design rule of a via is set to 0.25 micron in a 0.18 micron (complementary metal-oxide-semiconductor) CMOS process, the via size of the PUF 120 according to the above embodiment is set to 0.19 micron, Allows for stochastic distribution of shorts between layers.

It is ideal to have a short-circuit probability of 50% or less, and the PUF 120 according to an embodiment of the present invention is configured by setting the via size such that the probability distribution is as close to 50% as possible. In such a via size setting, the via size can be determined by the experiment according to the process.

3 is a graph for explaining the configuration of the PUF 120 according to one embodiment.

As the size of the via increases in the graph, it can be seen that the shortness probability between the metal layers is close to 1. The via size according to the design rule is Sd, which is a value at which a short circuit between the metal layers is sufficiently ensured.

And, S _M is theoretically inde a short circuit probability of the metal layer, the via size is 0.5, as described above, by the value of different and each experiment depending on the process to find the most similar values, but, finding the correct S _M it's difficult.

Accordingly, in the PUF 120 according to the embodiment, it is determined that the short-circuit between the metal layers is within the range of Sx1 and Sx2 having a predetermined tolerance at 0.5 (the Sx1 and Sx2 are not shown separately, Is a region having a certain margin near Sx).

4 is a conceptual diagram for explaining the configuration of the PUF 120 according to another embodiment.

According to the present embodiment, it is possible to stably determine whether the metal lines are open or closed by adjusting the interval between the metal lines.

In group 410 where the spacing between the metal lines was sufficiently small, the metal lines were short-circuited in all cases.

And, in the group 430 with a very large metal line spacing, metal lines were not short-circuited in all cases.

In the PUF 120 according to the present embodiment, as in the group 420, a metal line interval in which a short circuit is stably set is set such that some of the metal lines are short-circuited and some are not short-circuited.

FIG. 5 illustrates an inter-layer contact array that enables the generation of a unique key in a PUF 120 according to one embodiment.

And a total of M * N vias are formed between the metal layers stacked on the semiconductor substrate, that is, M and N (where M and N are natural numbers).

The PUF 120 generates a digital value of M * N bits according to whether each of the M * N vias short-circuits (digital value 0) or short-circuits (digital value 1) between metal layers Create a unique key.

The generated M * N-bit unique key can be used as a seed key for performing encryption in the process of registering user input password and / or bio information by the encryption unit 130.

6 is a diagram illustrating a process of recognizing a unique key generated by the PUF 120 according to an embodiment of the present invention.

According to the present embodiment, at any one node included in the PUF 120, a read transistor between the reference voltage V _DD and the ground detects whether the node is short-circuited.

In the embodiment of FIG. 6, which is comprised of a pull-down circuit, the output value is 0 if one node in the PUF 120, such as a via, shorts between the metal layers, do. Through this process, the unique key generated by the PUF 120 can be read. In the meantime, the description of the pull-down circuit can be extended to an example constituted of a pull-up circuit without any mention in this specification, and this is obvious in the technical field to which this technology belongs. Should not be construed as excluding.

An identification key is also generated in an embodiment using a short between metal lines.

Further, this digital value reading process is only some embodiments, and digital value reading by other embodiments is also possible.

Therefore, if the digital value can be read by checking whether a metal layer or a metal line is short-circuited in the PUF 120, other variations are possible without departing from the spirit of the present invention. It is not excluded from the scope.

7 is a conceptual diagram for explaining a balancing process of a unique key generated by the PUF according to an embodiment.

According to the present embodiment, the M * N bit digital values generated by the PUF 120 can be grouped in a predetermined number.

In the illustrated embodiment, the four digital values are grouped into one group.

When a plurality of groups of digital values are generated in this way, balancing between the digital value '0' and the digital value '1' is performed by comparing the digital values of the individual groups.

For example, the magnitudes of the 4-bit digital values generated by the group 710 and the group 720 are compared. If the 4-bit digital value of the group 710 is larger than the 4-bit digital value of the group 720, the digital value representative of the group 710 and the group 720 is determined as 1. [

Conversely, if the 4-bit digital value of the group 710 is less than the 4-bit digital value of the group 720, the digital value representative of the group 710 and the group 720 is determined to be zero.

Of course, if the 4-bit digital value of group 720 is greater than the 4-bit digital value of group 710, then the representative digital value may be determined to be one.

If the 4-bit digital value of the group 710 is the same as the 4-bit digital value of the group 720, the representative digital value may be determined to be 1 or 0, or the representative value may not be determined.

In each of the plurality of nodes in the PUF 120, the ratio of the short-circuiting between the conductive layers (digital value 0) and the ratio of not short-circuiting (digital value 1) are different from each other and balancing of 0 and 1 is not matched There may be cases.

In one group, the probability of 1 and the probability of 0 may be different for each bit value. However, if a group is compared with another group, the probability of a group having a larger digital value may be 50%. For example, the probability that any one of the two groups 710 and 720 will have a larger digital value than the other group is 50%. Therefore, it can be understood that probabilistic balancing of 0 and 1 is ensured through the above process.

In addition, by comparing group 730 with group 740, another digital value of one bit can be generated, so that at least two or more unique keys can be provided through groups 710-740.

In this way, when balancing the digital values generated by the PUF 120 is performed, the randomness of the unique key, which is a digital value generated by the PUF 120, can be guaranteed to a higher level.

According to the above, if the originally generated digital value was M * N bits, the final digital value generated in the PUF 120 in FIG. 7 may be (M * N / 8) bits. In the embodiment of FIG. 7, a new 1-bit digital value is determined using an 8-bit digital value.

Thus, according to the embodiment, a reliable unique key is generated by the PUF 120 that can simultaneously satisfy both randomness and time invariance.

According to one embodiment, the encryption unit 130 may encrypt user input password and / or bio information using the balancing unique key.

When the unique key is generated by the PUF 120, the manufacturing cost is low and the time invariance is satisfied, and furthermore, the unique key, which is a seed for encrypting the password by the encryption unit 130 such as AES, It does not.

8 shows an information processing apparatus according to another embodiment.

In the present embodiment, N (where N is a natural number) PUFs 830 may be included in the encryption unit 820 of the information processing apparatus 800. [

The N PUFs 830 may be included in the encryption unit 820 and hided during semiconductor manufacturing.

For example, the encryption unit 820 includes at least one PUFs, such as the PUFs 831, 832, 833, 834, and 835 shown in FIG.

Illustratively, the PUFs 831, 832, 833, 834, and 835 shown in FIG. 9 may independently or correlate each other with the password and / or biometric information received at the receiver 810 into AES or T-DES And generates a seed unique key used for encryption in a manner such as < / RTI >

In some embodiments, only one PUF may be included in encryption unit 820, but in other embodiments, multiple PUFs are included as shown in FIG.

In the embodiment including a plurality of PUFs as described above, the PUF selector 840 may be further included in the encryption unit 820.

The PUF selection unit 840 selects at least one of the plurality of PUFs 831, 832, 833, 834, and 835 and the like so that the encryption unit 820 can be used to encrypt the user input password and / Select at least one actual PUF.

The process in which the identification key generated by the encryption unit 820 can be stored in the storage unit 850 and the implementation of the storage unit 850 are the same as those in the embodiment of FIG.

In addition, the authentication unit 860 compares the user password and / or the bio information input for authentication with the previously registered identification key to perform the authentication as described with reference to FIG.

9 illustrates an exemplary configuration in which PUFs are located within an encryption unit according to one embodiment.

832, 833, 834, and 835 are hidden in the encryption unit 820 in the course of designing and manufacturing the encryption unit 820, and the PUFs 831, 832, 833, 834, and 835, etc.) can not be analyzed. That is, it is difficult to grasp the positions of the PUFs 831, 832, 833, 834, and 835, and can not know which PUF is used as the encryption seed key by the actual encryption unit 820.

Thus, the encryption process of the encryption unit 820 operation via the PUFs 831, 832, 833, 834, and 835, etc. can not be analyzed externally, and the encryption unit 820 can not analyze the bus It is impossible to know the unique key even if it is probing.

As a result, the process of encrypting the password and / or bio information input by the user by the encryption unit 820 can be kept at a high level of security.

FIG. 10 is a flowchart illustrating a process of encrypting and storing (registering) password and / or bio information according to an information processing method according to an embodiment.

Referring to FIG. 1, in step 1010, a user input password and / or bio information is received in the receiving unit 110 of the information processing apparatus 100. The received password and / or biometric information may implement knowledge-based authentication as described above.

In step 1020, in the process of encrypting the password and / or the bio information by a method such as AES or T-DES, an initial value (N) is used for repeated iteration N times (where N is a natural number) I is increased by 1 at i = 0.

In step 1030, a unique key provided by the PUF 120 is read. In step 1040, an i-th occurrence is performed to generate a key ID (i).

Then, in step 1050, the process proceeds until i becomes N. [

In this way, the encryption unit 120 generates the key ID (N), which is the final identification key, and the generated identification key ID (N) is stored in the storage unit 140 in step 1060 .

11 is a flowchart illustrating a process of encrypting and storing password and / or bio information by the information processing apparatus according to the embodiment of FIG.

The process in which the password is received in step 1110 and the initial value of the transaction i is set to 0 is the same as the embodiment of FIG.

Then, the value of i is incremented by one (step 1120), and one of the plurality of PUFs 831, 832, 833, 834, and 835 described with reference to FIGS. 8 and 9 is selected by the PUF selection unit 840, Lt; / RTI >

In some embodiments, this selection may be performed fresh per modification, and in other embodiments, the selection process may be performed only once.

The identification key ID (i) in the i-th event is generated using the digital value provided by the selected PUF (step 1140), and the transaction is repeated N times in step 1150.

When the encryption of the N-number encryption unit 820 is performed, the identification key ID N is generated. In step 1160, the generated key ID N is stored in the storage unit 850.

12 is a flowchart illustrating a process of authenticating a user input password and / or bio information in an information processing apparatus according to an embodiment.

10 to 11 are related to contents in which the information processing apparatus 100 or the information processing apparatus 800 first registers password and / or bio information to be used for authentication, respectively, Fig. 12 shows the password and / Or may be associated with the actual authentication procedure after the biometric information is encrypted and registered.

According to one embodiment, at step 1210, the password and / or biometric information entered by the user for performing authentication may be input to the receiver 110 or 810. [

Then, in step 1220, the encryption unit 130 or 820 encrypts the input password and / or bio information using the unique key generated by the PUF, and transmits the encrypted password and / or bio information to the authentication unit 150 Or 860).

Then, the authentication unit 150 or 860 determines whether or not the encrypted password and / or bio information matches the registered identification key stored in advance in the storage unit 140 or 850, and stores the password and / Authentication failure or authentication failure.

13 is a flowchart illustrating a process of authenticating user input password and / or bio information in an information processing apparatus according to another embodiment.

In step 1310, the password and / or biometric information that the user inputs for performing the authentication may be input to the receiving unit 110 or 810. The receiving unit 110 or 810 transmits the input password and / or bio information to the authentication unit 150 or 860.

In step 1320 and the encryption unit 130 or 820 decrypts the identification key ID N stored in advance in the storage unit 140 or 850 and transmits the decrypted identification key to the authentication unit 150 or 860 .

Then, in step 1330, the authentication unit 150 or 860 receives the user input password and / or bio information transmitted from the receiving unit 110 or 810 and the decrypted identification key transmitted from the encryption unit 130 or 820, It is possible to determine whether the authentication of the password and / or the bio information is successful or the authentication failure.

As described above with reference to Fig. 1, the embodiment of Fig. 13 may be useful for processing biometric information. The bio information, such as the fingerprint or the iris pattern, may have an identification error at the time of input. Even if the bio information of the same object used at the time of registration is input again at the time of authentication, the identified bio information may not completely match . Therefore, the authentication process of the conventional bio information also determines the degree of matching between the inputted bio information and the previously registered bio information.

In the embodiment of FIG. 13, instead of comparing the result of encrypting the bio information transmitted to the receiver 110 or 810 for authentication with the previously registered identification key, instead of decoding the previously registered identification key, The authentication success or the authentication failure can be determined according to the degree of matching with the information.

According to the various embodiments described above, the user password and / or bio information used for authentication can be safely encrypted and managed. Further, in performing the authentication, since the unique key of the PUF embedded in the device as well as user input password and / or bio information is used, reliability of authentication can be provided at a high level.

The method according to an embodiment of the present invention can be implemented in the form of a program command which can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

While the invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. This is possible.

Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined by the equivalents of the claims, as well as the claims.

Claims (7)

delete A Physically Unclonable Function (PUF) that generates at least one unique key using a process variation in a semiconductor manufacturing process; And
An encryption unit for encrypting input data using the unique key to provide encrypted data,
Lt; / RTI >
Wherein the PUF generates the unique key according to whether at least one of an inter-layer contact and a via between semiconductor conductive layers is formed so as to short-circuit between the conductive layers. 3. The method of claim 2,
Wherein the at least one of the interlayer contact and the via has a first size smaller than a predetermined size according to a design rule associated with the semiconductor manufacturing process so that the unique key is generated with a value that can not be predicted in advance. The method of claim 3,
Wherein the first size is a size such that the difference between the probability that the at least one of the interlayer contact and the via will short-circuit between the conductive layers and the probability that the at least one will not short-circuit will be within a predetermined error range. A Physically Unclonable Function (PUF) that generates at least one unique key using a process variation in a semiconductor manufacturing process; And
An encryption unit for encrypting input data using the unique key to provide encrypted data,
Lt; / RTI >
Wherein each of the N unit structures provides a digital value of 1 bit so that the unique key generated by the PUF is a digital value of N bits, Information processing apparatus. 6. The method of claim 5,
Wherein the apparatus comprises: k groups of bit sequences included in the N bits of digital values, k being a natural number, and performing digital logic processing on each of the k groups to represent each of the k groups Wherein the unique key is provided as a value of k bits by providing a bit of 1 or 0, A Physically Unclonable Function (PUF) that generates at least one unique key using a process variation in a semiconductor manufacturing process; And
An encryption unit for encrypting input data using the unique key to provide encrypted data,
Lt; / RTI >
The encryption unit encrypts the AES (Advanced Encryption Standard) and the T-DES (Triple Data Encryption Standard) using the unique key. And encrypts the input data in at least one of the following ways.

Images