Multi-factor authentication

A method for enrolling a user of a hardware device for subsequent authentication, the method comprising:

• challenging a physically unclonable function (“PUF”) circuit with a second authentication factor representing a biometric of the user to generate a multi-factor authentication value, wherein the biometric of the user is measured by a biometric reader of the hardware device and the PUF circuit is coupled to receive the second authentication factor as a challenge, and wherein the PUF circuit is a first authentication factor representing something the user has;
• seeding a cryptographic function based on the multi-factor authentication value;
• generating a cryptographic key from the cryptographic function;
• and
• storing the cryptographic key of the hardware device for future use by a challenger to authenticate the user of the hardware device using a cryptographic challenge and response.

A method for enrolling a user of a hardware device for subsequent authentication, the method comprising:

• challenging a physically unclonable function (“PUF”) circuit with a second authentication factor representing a biometric of a user, wherein the biometric of the user is measured by a biometric reader of the hardware device and the PUF circuit is coupled to receive the second authentication factor as a challenge, and wherein the PUF circuit is disposed within the hardware device;
• generating a PUF value in response to being challenged with the second authentication factor;
• wherein the PUF value is a first authentication factor representing something the user has;
• generating helper data using the PUF value;
• and
• storing the helper data for future use to recover the PUF value during for a cryptographic challenge and response.

A method for cryptographically authenticating a user of a hardware device, the method comprising:

• retrieving a device identifier of the hardware device;
• using the device identifier to retrieve a user-device fingerprint for the hardware device, the user-device fingerprint including a cryptographic key, wherein the user-device fingerprint is based upon a multi-factor authentication value based on a physically unclonable function (“PUF”) value generated in response to challenging a PUF circuit of the hardware device with a second authentication factor representing a biometric of a user, wherein the biometric of the user is measured by a biometric reader of the hardware device and the PUF circuit is coupled to receive the second authentication factor as a challenge, and wherein the PUF value is a first authentication factor representing something the user has;
• and
• authenticating the user of the hardware device using the cryptographic key.