# US 10,771,267 B2 · Authentication system and device including physical unclonable function and threshold cryptography > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,267 B2 - Document ID: US10771267B2 - Status: Granted - Kind: B2 - Application number: 15/961,082 - Filed: 2018-04-24 - Published: 2018-08-30 - Granted: 2020-09-08 - Earliest claimed: 2014-05-05 - Assignees: Analog Devices, Inc. - Applicants: Analog Devices, Inc. - Inventors: John Ross Wallrabenstein - Web page: https://patentgrep.com/patent/US10771267B2 ## CPC - H04L 9/3278: {using physically unclonable functions [PUF]} - H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes} - H04L 9/3026: {details relating to polynomials generation, e.g. generation of irreducible polynomials} - H04L 9/3066: {involving algebraic varieties, e.g. elliptic or hyper-elliptic curves} - H04L 9/3221: {interactive zero-knowledge proofs} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An authentication system and device including physical unclonable function (PUF) and threshold cryptography comprising: a PUF device having a PUF input and a PUF output and constructed to generate, in response to the input of a challenge, an output value characteristic to the PUF and the challenge; and a processor having a processor input that is connected to the PUF output, and having a processor output connected to the PUF input, the processor configured to: control the issuance of challenges to the PUF input via the processor output, receive output from the PUF output, combine multiple received PUF output values each corresponding to a share of a private key or secret, and perform threshold cryptographic operations. The system and device may be configured so that shares are refreshable, and may be configured to perform staggered share refreshing. ## Claims ### Claim 1 An authentication device, the device comprising: at least one identity circuit constructed to generate values characteristic to physical properties of the identity circuit; at least one processor configured to: manage generation of a first portion of an encrypted identity in a first stage with the identity circuit wherein the first portion is a threshold share of a shared secret; execute a first threshold cryptographic operation on the first portion of the encrypted identity obscuring the first portion; manage generation of at least a second portion of an encrypted identity in a second stage with the identity circuit wherein the second portion is a threshold share of the shared secret; execute a second threshold cryptographic operation on the second portion of the encrypted identity obscuring the second portion; and execute a combination operation on at least the obscured first portion and the obscured second portion to produce an obscured value for execution of a cryptographic operation associated with the encrypted identity; and manage execution of the first and second stage such that only one portion of the encrypted identity is in memory at one time. ### Claim 2 (depends on 1) The device of claim 1, wherein the at least one processor is configured to refresh an encoding of the encrypted identity. ### Claim 3 (depends on 2) The device of claim 2, wherein the at least one processor is configured to trigger refreshing of the encrypted identity responsive to at least one execution of the cryptographic operation associated with the encrypted identity. ### Claim 4 (depends on 1) The device of claim 1, wherein the at least one processor is further configured to perform the first and second cryptographic operations and the cryptographic operation without generating the encrypted identity in memory. ### Claim 5 (depends on 1) The device of claim 1, wherein the at least one processor is further configured to bind the authentication device to the encrypted identity. ### Claim 6 (depends on 5) The device of claim 5, wherein the at least one processor is configured to generate a first mapping between a first value obtained from the at least one identity circuit and the first portion of the encrypted identity. ### Claim 7 (depends on 6) The device of claim 6, wherein the at least one processor is configured to generate at least a second mapping between a second value obtained from the at least one identity circuit and the second portion of the encrypted identity. ### Claim 8 (depends on 6) The device of claim 6, wherein the identity circuit comprises a physical unclonable function (“PUF”) circuit. ### Claim 9 A computer-implemented method for authenticating a device, the method comprising: communicating, by at least one processor, in a first stage with at least one identity circuit to generate a first portion of an encrypted identity, wherein the first portion is a threshold share of a shared secret, wherein the at least one identity circuit is constructed to generate values characteristic to physical properties of the identity circuit; performing a first threshold cryptographic operation on the first portion of the encrypted identity obscuring the first portion in memory; communicating, by the at least one processor, in a second stage with the at least one identity circuit to generate at least a second portion of an encrypted identity wherein the second portion is a threshold share of the shared secret; performing a second threshold cryptographic operation on the second portion of the encrypted identity obscuring the second portion in memory; and executing a combination operation on at least the obscured first portion and the obscured second portion to produce an obscured value for execution of a cryptographic operation associated with the encrypted identity; and managing execution of the first and second stage such that only one portion of the encrypted identity is in memory at one time. ### Claim 10 (depends on 9) The method of claim 9, further comprising an act of refreshing an encoding of the encrypted identity. ### Claim 11 (depends on 10) The method of claim 10, wherein the act of refreshing is triggered responsive to execution of the cryptographic operation associated with the encrypted identity. ### Claim 12 (depends on 9) The method of claim 9, further comprising performing the first and second cryptographic operations and the cryptographic operation without generating the encrypted identity in memory. ### Claim 13 (depends on 9) The method of claim 9, further comprising an act of binding the authentication device to the encrypted identity. ### Claim 14 (depends on 13) The method of claim 13, further comprising an act of generating a first mapping between a first value obtained from the at least one identity circuit and the first portion of the encrypted identity. ### Claim 15 (depends on 14) The method of claim 14, further comprising an act of generating at least a second mapping between a second value obtained from the at least one identity circuit and the second portion of the encrypted identity. ### Claim 16 (depends on 15) The method of claim 15, wherein the identity circuit comprises a physical unclonable function (“PUF”) circuit. ### Claim 17 An authentication device comprising: an identity circuit constructed to generate values characteristic to the physical properties of the identity component; at least one processor configured to: manage generation of a first portion of an encrypted identity in a first stage with the identity circuit, wherein the first portion is a threshold share of a shared secret; manage generation of at least a second portion of an encrypted identity in a second stage with the identity circuit wherein the second portion is a threshold share of the shared secret; and manage execution of the first and second stage such that only one portion of the encrypted identity is in memory at one time means for performing a first threshold cryptographic operation on the first portion of the encrypted identity to obscure the first portion and means for performing a second threshold cryptographic operation on the second portion of the encrypted identity to obscure the second portion; and means for executing a combination operation on at least the obscured first portion and the obscured second portion and enabling execution of a cryptographic operation associated with the encrypted identity.