Hardware device binding and mutual authentication

A computing device, comprising:

• a hardware platform;
• a cryptographic unit, disposed in or on the hardware platform for binding and mutually authenticating the computing device to a second computing device, the cryptographic unit comprising:
• a first physically unclonable function (“PUF”) circuit disposed in or on the hardware platform, the first PUF circuit coupled to output a first binding PUF value,
• wherein the cryptographic unit is configured to send the first binding PUF value to the second computing device over a communication channel, and to receive helper data over the communication channel from the second computing device to bind the computing device and the second computing device, wherein the helper data is generated by the second computing device using the first binding PUF value and a second binding PUF value generated using a second PUF circuit disposed on or within the second computing device, and wherein the cryptographic unit comprises an encryptor coupled to encrypt the first binding PUF value with a public key of the second computing device before sending the first binding PUF value to the second computing device;
• and
• a noise reduction circuit coupled between the first PUF circuit and the encryptor, the noise reduction circuit coupled to receive the first binding PUF value, to reduce uncertainty in the first binding PUF value, and to output a seed value to the encryptor based on the first binding PUF value, and wherein the noise reduction circuit includes a seed generation mode to generate the seed value, and a seed recovery mode to re-create the seed value.

A computing device, comprising:

• a hardware platform;
• and
• a cryptographic unit for binding and mutually authenticating the computing device to a second computing device, the cryptographic unit comprising:
• one or more PUF circuits disposed in or on the hardware platform, wherein the one or more PUF circuits coupled to output a first binding PUF value, and wherein the one or more PUF circuits are coupled to output a fingerprint PUF value;
• a combining circuit coupled to receive the first binding PUF value and a second binding PUF value, received from the second computing device, and to generate helper data using the first and second binding PUF values, and wherein the combining circuit is coupled to output the helper data for mutual authentication of the binding of the computing device and the second computing device;
• a key generator coupled to generate a private key of a public-private key pair based on the fingerprint PUF value;
• a decryptor coupled to receive a message, including a second binding PUF value encrypted with a public key of the public-private key pair, from the second computing device, and coupled to output the second binding PUF value decrypted with the private key;
• and
• a noise reduction circuit coupled between the second PUF circuit and the key generator, the noise reduction circuit coupled to receive the fingerprint PUF value, to reduce uncertainty in the fingerprint PUF value, and to output a seed value to the key generator based on the fingerprint PUF value.