Abstract:

This paper proposes an extended Kerberos protocol based on the physical unclonable function (PUF). In basis of the challenge-response authentication mechanism, this paper employs the PUF challenge-response pairs to substitute the password or the certificate in standard Kerberos protocol, so as to resist the password guessing attack and impersonation attack. The advantages of this extended protocol lie in the following aspects: it provides mutual authentication between the authentication server and the device; the device is not pre-distributed with any password or key, which reduces the storage overhead and the disclosure risk of password or key. The formal analysis based on BAN Logic and comparison with different protocols are both given to prove the security of the PUF-based extended protocol.

Key words: physical unclonable function, Kerberos, authentication, key distribution, BAN logic