Resilient password management system using an array of addressable physical unclonable functions

A method of providing authentication and securely storing authentication data in a computing system provided with two or more arrays of physical unclonable function devices (PUF arrays), the method comprising causing processing circuitry of the computing system to:

• receive user credentials, each user credential including a user identifier and a password associated with the user identifier;
• generate challenge messages, each challenge message corresponding to a respective user credential;
• generate and store initial challenge responses associated with the first PUF array by measuring physical parameters of PUF devices belonging to portions of the first PUF array identified by a first subset of the challenge messages;
• generate and store initial challenge responses associated with the second PUF array by measuring physical parameters of PUF devices belonging to portions of the second PUF array identified by a second subset of the challenge messages;
• perform a first authentication by:
• receiving a first user credential associated with a first user;
• generating a first challenge message corresponding to the first user credential;
• generating a first challenge response by measuring physical parameters of PUF devices belonging to a portion of the first PUF array identified by the first challenge message;
• and
• comparing the first challenge response to an initial challenge response corresponding to the first user credential;
• and
• perform a second authentication by:
• receiving a second user credential associated with a second user;
• generating a second challenge message corresponding to the second user credential;
• generating a second challenge response by measuring physical parameters of PUF devices belonging to a portion of the second PUF array identified by the second challenge message;
• and
• comparing the second challenge response to an initial challenge response corresponding to the second user credential.

A method of authenticating users of a computer system, the method comprising causing processing circuitry of the computing system to execute an enrollment process comprising the steps of:

• receiving enrollment credentials of a user including a user identifier of the user and an enrollment password;
• generating a first challenge message associated with the user identifier on the basis of the password, the first challenge message identifying first devices in a first array of physical unclonable function devices (a first PUF array);
• measuring physical parameters of the identified first devices, resulting in a first enrollment challenge response;
• and storing the first enrollment challenge response in memory of the system at a first address determined using the user identifier and the password;
• deriving a backdoor password associated with the user from the enrollment password that omits information in the enrollment password necessary to determine the enrollment password;
• encrypting the backdoor password with a system password to produce an encrypted backdoor password;
• generating a second challenge message associated with the user on the basis of the at least the backdoor password, the second challenge message identifying second devices in the first PUF array;
• measuring physical parameters of the identified second devices, resulting in a second enrollment challenge response;
• and storing the second enrollment challenge response in memory of the system at a second address determined at least in part by the enrollment credentials of the user and the system password.

An authentication system for authenticating users of a computer system, the system comprising processing circuitry, memory coupled to the processing circuitry, and at least a first addressable physical unclonable function generator (APG) including a first array of physical unclonable function devices (a first PUF array) coupled to the processing circuitry, the processing circuitry and the memory configured to perform an enrollment process that includes:

• receiving enrollment credentials of a user including a user identifier of the user and an enrollment password;
• generating a first challenge message associated with the user identifier on the basis of the password, the first challenge message identifying first devices in the first PUF array;
• measuring physical parameters of the identified first devices, resulting in a first enrollment challenge response;
• and storing the first enrollment challenge response in the memory at a first address determined using the user identifier and the password;
• deriving a backdoor password associated with the user from the enrollment password that omits information in the enrollment password necessary to determine the enrollment password;
• encrypting the backdoor password with a system password to produce an encrypted backdoor password;
• generating a second challenge message associated with the user on the basis of the at least the backdoor password, the second challenge message identifying second devices in the first PUF array;
• measuring physical parameters of the identified second devices, resulting in a second enrollment challenge response;
• and storing the second enrollment challenge response in the memory at a second address determined at least in part by the enrollment credentials of the user and the system password.