On-Demand Device Authentication using Zero-Knowledge Proofs for Smart Systems

Abstract

Due to the exponential growth of IoT devices across diverse applications, it has become essential to secure edge devices against various hardware attacks, such as tampering and cloning. A tampered device with a hardware Trojan can bypass the security measures implemented through the software layers. One of the primary ways to verify the authenticity of a device is by using physically unclonable functions (PUFs) as a unique device fingerprint. During authentication, the PUF response from the edge device is transferred securely and compared with the stored response. This requires a secure communication setup between the edge device and the central server. The fingerprint must also be stored on a server for response matching. However, the potential compromise of the central server will result in the leak of all secret information of the edge devices, and adversaries can exploit it to gain unauthorized access to the IoT network. In this paper, we propose an efficient, secure, and on-demand communication protocol using zero-knowledge proofs (ZKPs) that allow the prover to provide evidence of its secret without revealing that to the verifier. The edge device, acting as the prover, convinces the central server, the verifier, of the unique PUF response stored inside the device without needing the actual storage of PUF responses on the server. The non-interactive characteristic of zk-SNARK, a widely used ZKP protocol in many popular cryptocurrencies such as Zcash, offers better optimization to authentication frequency, communication bandwidth between device and server, and protection of device-specific secret, all of which contribute to constructing our proposed device authentication framework.