Patent ID: 12238227

DETAILED DESCRIPTION

Throughout this document, unless otherwise indicated to the contrary, the terms “comprising”, “consisting of”, “having” and the like, are to be construed as non-exhaustive, or in other words, as meaning “including, but not limited to”.

Furthermore, throughout the specification, unless the context requires otherwise, the word “include” or variations such as “includes” or “including” will be understood to imply the inclusion of a stated integer or group of integers but not the exclusion of any other integer or group of integers.

Throughout the description, the term ‘cryptography’ refers broadly to various methods, including but not limited to, encryption, signature, hash function, random number generation, key exchange, etc.

Throughout the description, the term ‘hash function’ is understood to include the secure hash algorithm family of standards which are based on the sponge construction for providing flexibility.

Throughout the description, the term ‘node(s)’ refers broadly to computer devices capable of performing computations, devices capable of being accessed by computer devices, or devices/objects capable of transmitting data to computer devices. A computer device may include a server, a laptop computer, a portable or hand-held computer such as a tablet PC or a smart-phone.

Throughout the description, the term ‘network’ includes communication network, such as, but not limited to, wired and wireless networks, fiber-based, free-space and quantum network.

FIG.1shows a network10comprising a plurality of nodes, such as a first node12and a second node14. The terms ‘first’ and ‘second’ are introduced for clarity to differentiate the first node12and the second node14, and it is to be appreciated that these terms do not indicate precedence or importance of one node over another.

The network10may be a secured network. The secured network may be a public network or a private network. The network10may also comprise distributed and non-distributed sub-systems. In some embodiments, the network10may include a distributed ledger system16, such as a blockchain. The blockchain may include a centralized or decentralized network architecture. The blockchain may be an open blockchain or a proprietary blockchain.

In some embodiments, the network10may include an artificial intelligence (AI) system18. The AI system18comprises one or more AI engines operable to provide security support to the overall network10. In some embodiments the AI system18may be configured as a removal tool, the AI based removal tool operable to remove the first node12if the first node12fails a security test sent remotely by a verifier node. The security test may be in the form of an attestation request.

In some embodiments, the network10may further include an IoT system20for transmitting and receiving data from one or more sensors.

It is appreciable that in various alternative embodiments, the network10may instead form part of the distributed ledger system16, the AI system18, and the IoT system20.

The first node12may include a key generator120configured to generate at least one physical unclonable function (PUF). Embodiments of the PUF may include electronic chips and/or naturally occurring objects such as diamonds, or biological DNA embossed with data capable of being accessed or read by a computer device which functions as a security device. The security device may include a controller having input/output interface. Such data may include a machine-readable code. An example of such a biological DNA embosses with the machine-readable code may be a crab shell embossed with a quick response (QR) code. Other examples of machine-readable code may include barcodes, matrix barcodes etc.

Once the PUF is generated, it may be interrogated using a challenge-response authentication protocol. A PUF preferably exhibits as many of the following properties as possible.

(a.) Reproducible (only by itself), a highly reproducible response to the same input challenge indicates determinism and low system noise;

(b) Unique—Different PUF designs should be unique, such that the same challenge given to two different devices produces vastly different responses;

(c) Unclonable—The PUF should be unclonable such that it is infeasible for an adversary with complete knowledge of a legitimate device's design to produce a copy that behaves identically to an authentic device;

(d) One-way—The underlying PUF operation itself should be sufficiently complex such that it is infeasible to invert its behavior;

(e) Unpredictable—Infeasible to predict a response to some arbitrary input; and

(f) Tamper evident—If an adversary tampers with a legitimate PUF, it should be evident through inspection or interrogation.

In the selection of a suitable PUF, it is to be appreciated that the duality between signal and noise may be considered. A predominantly high noise state serves as a good random number generator for cryptographic use. A predominantly low noise (high signal) state serves as a good communicator.FIG.6is a table showing the various possibilities of PUF. As shown, the PUF may be broadly classified as silicon-based PUF (Si PUF), optical PUF, nanotech PUF, and biological PUF.

Different PUF materials may be utilized for the reason that they are capable of interfacing with a security device having a controller to generate and/or interact with the PUF material and access the PUF information.

In some embodiments, memory units, such as static random-access memory (SRAM) or dynamic random-access memory (DRAM) may be used as the PUF materials.

In some embodiments, the PUF may include one or more field-programmable gate array (FGPA) capable of being configured to generate one or more PUF.

In some embodiments, nanotechnology-based material(s) may be used as PUF materials. In particular, a memristor or resistive RAM (ReRAM) may be suitable as it is relatively more energy and space efficient than other types of PUF. In addition, the ReRAM may be implemented as part of a neuromorphic computing platform suitable for implementing one or more artificial intelligence-based applications, as the neuromorphic computing platform can also fulfil a dual role as the AI platform18.

The memristor advantageously provides both computational and memory functions on the same device. The ReRAM may be arranged in the form of a crossbar array format, the ReRAM arranged to perform the function of one or more synapses, the same analogous to biological synapses and serves as a memory unit.

In various embodiments, the array of memristors may be implemented as ferroelectric RAM (FeRAM), magnetic RAM (MRAM), phase change memory (PCM) or other arrangements. They have different desirable characteristics, suitable for neuromorphic computing.

To implement self-sufficiency, neuromorphic computing may be a preferred choice as it supports artificial intelligence implementation, i.e. with or without extensive neural network training. Thus, system autonomy may be maintained even in the absence of network connectivity. The present system provides a scalable platform for neuromorphic computing. Deep learning can be subsumed under this framework.

In some embodiments, diamonds may be used as an optical-based PUF. The nitrogen-vacancy (NV) defect in diamond is well-studied among the colour centers. The NV center has found application in diamond-based single photon sources and detectors, diamond-based quantum communication and to some extent, quantum computing. There is fidelity, owing to the long coherence time. Moreover, the spin state of NV defects may be efficiently be accessed by a controller, i.e. read out (Read) and coupled to photons through spin-dependent transitions. There is also coherent manipulation and laser writing (Write) of NV centers. These properties may be utilized when diamond is used as a PUF or used to generate a PUF.

In addition to or as alternatives to diamonds, other solid-state materials, such as silicon carbide and boron nitride, may be used.

Advantageously, diamond-based systems can operate at room temperature, rather than in an ultra-low temperature environment, and is useful for quantum cryptography and quantum computing and is relatively energy efficient. With precision laser writing, an encrypted code may be marked on the diamond directly as one or more new NV centers. This is similar to the use of quick response (QR) code for a crab shell example use case. Once laser-marked, any attempt to tamper with the mark may be evident against the immutable record in the network10(when implemented as a blockchain or as part of a blockchain).

In some embodiments involving biological based PUF, it is possible for the first node to interact with an encrypted QR Code.

As an exemplary embodiment, the key generator120may include a neuromorphic computing platform700. The neuromorphic computing platform700includes an array of resistive random-access memory (ReRAM), wherein the array of ReRAM can be arranged in a crossbar array format. The key generator120may include at least one of a silicon-based PUF, an electronic PUF, an optical PUF, and a biological PUF.FIG.3shows a controller300suitable for being used as part of a network node, or as the network node, in the provision of security to the network10. It is to be appreciated that any combinations of software and hardware, including a microkernel which is secured and resistant to virus, hacking, malware etc. may be suitable to form part of the controller. In one specific embodiment, the controller300includes a microkernel302, such as, but not limited to, a seL4 microkernel on a processor board, such as a Sabre Lite™ chipset board. Other types of microkernel may be suitable in so far as the microkernel is rigorously verified by formal methods, such as mathematically proven to be correct.

In some embodiments, the ReRAM chip may be in the form of an 8-pin integrated circuit (IC) chip308.

Referring toFIG.2,FIG.3, andFIG.4, the controller300may be deployed as the first node12and/or the second node14in the network10. In some embodiments, the method of providing security to the network10comprises the steps of:—

(a.) generating, via a key generator120on the first node12, at least one physical unclonable function (PUF); (step s202)

(b.) sending remotely, via the second node14, an attestation request to the first node12; (step s204) and

(c.) responding to the attestation request by the first node12(step s206).

As part of the generation of the PUF, a public-private key pair may be generated (step s208). The private key may be generated via the PUF (step s210), and the public key may be separately generated or generated via the PUF (step s212). Once generated, the public key may be registered with the distributed ledger as an entry.

In some embodiments, the public key may include an additional step of encryption (step s214). The encryption may include one or more of the following steps:—an authenticated encryption, a signature, a symmetric encryption, an asymmetric encryption, a hash function, a key exchange, a random number generation.

It is to be appreciated that the second node14, which is used to verify the first node12, is remote relative to the first node12.

FIG.4illustrates a process of remote attestation according with some embodiments. It is appreciable that the first node12and the second node14may have the controller300. In the illustrative example, the first node12may be requesting for verification so as to join the network10.

The process begins when the controller300is initialized (step s402). The initialization may be performed via a bootloader, which verifies and initiates the seL4 microkernel to launch the PUF, which may be part of an operation system or the operation system.

The seL4 microkernel then verifies and passes control to the PUF (step s404). An attestation function PAttestis launched to commence the remote attestation process.

As part of the attestation process, two sub-functions or sub-routines are spawned or generated, the same being P1and P2. The sub-functions or sub-routines P1and/or P2may be part of the PUF generation. In some embodiments, the generation of sub-functions or sub-routines may include corresponding hash functions H1, H2associated with P1and P2(step s406). In some embodiments, in addition to P1and P2, one or more sub-functions or sub-routines may be generated.

Once the second node14detects the presence of the first node12in its vicinity, the remote verifier (second node)14operates to send an attestation request to the first node12via the PAttestfunction as a challenge (step s408). The PAttestfunction performs an attestation and replies to the remote verifier (step s410) via a response to the challenge. The second node14may detect the presence of the first node12via various communication methods and/or communication protocols. As an example, when the first node12is near the vicinity of the network10, the first node12may broadcast, via Bluetooth™ or other wireless communication protocol, a request to join the network10. The second node14may be configured to receive the request to join network10and upon receipt of the same, send the attestation request to the first node12. Generally, the network10can be any communication network. A communication network can, for example, correspond to a fiber-based communication network, a free-space type communication network or a quantum-based communication network. A specific example can be a Radio Frequency (RF) based network (e.g., a Bluetooth™ based network or a wireless communication network) which can be considered to be a subset of the earlier mentioned examples of a fiber-based communication network, a free-space type communication network and/or a quantum-based communication network.

It is appreciable that in addition to a challenge-response authentication protocol, other authentication protocols may be envisaged and used.

The remote verifier14may be part of the distributed ledger system16which supports self-sovereign identities. The controller300of the first node12may communicate with the network10using a secured communication protocol, such as, but not limited to, Secure Sockets Layer (SSL) and/or Transport Layer Security (TLS) protocols. In some embodiments, Hyper Text Transfer Protocol Secure (HTTPS) protocol may be used.

FIG.5illustrates some embodiments where the controller300is capable of supporting multiple-PUF types which is illustrated inFIG.6. Different PUFs, e.g. nanotech based ReRAM chips and optical PUF (e.g. diamonds) may be used to establish security or authentication of electronic data/entries. Other PUFs, e.g. biological fingerprint and face recognition systems may be used for the authentication of humans and other biological entities. It is appreciable that in embodiments having multiple PUF types, secure mechanism to authenticate the various PUFs may be necessary. Such secure mechanism may involve the use of apparatus such as laser cutter, detector, image capturing devices etc. It is appreciable that the device502may be a user device, such as, but not limited to, a mobile smart phone or a tablet PC. The server504shown inFIG.5may be a verifier device or part thereof and the device502may be the first node12. The server504may include hardware and software components for implementation of various functions including a socket application512for creating a communication link514with the device502. The device502may include a client application516configured to interface with a hardware level518. The client application516may include a protocol level/layer522and a system level/layer524. The protocol level522is configured to send and receive data with the server504via the communication link514. The system level/layer524comprises a module532and at least one PUF module driver534operable to interface with at least one PUF. As described, the PUF may include at least one of the PUF type as described inFIG.6.

FIG.7is an exemplary neuromorphic computing platform700with array(s) of resistive random-access memory (ReRAM) as an embodiment of the key generator120. The neuromorphic computing platform700comprises an input layer702, a synaptic device and parallel architecture704, and an output layer706. Neuromorphic computing system comprises the synaptic device, neuronal circuit, and neuromorphic architecture. With the two-terminal nonvolatile nanoscale memristor as the synaptic device and crossbar as parallel architecture, the memristor provides both compute and memory functions on the same platform700. The neuromorphic computing platform700of the key generator120may be installed with the AI system18.

In some embodiments, the artificial intelligent (AI) system18comprises an AI based tool, the AI based tool operable to remove the first node12if the first node12fails the attestation request. The AI tool may include one or more neural networks for implementation of deep-learning algorithms. In some embodiments, the AI tool may include different domains of AI in increasing complexity, including, but not limited to, assisted intelligence, augmented intelligence, automated intelligence, and autonomous intelligence.

The present system accelerates the multiplication operation and its successive generalizations by parallelization. It generalizes the Dot Product Engine for matrix-vector multiplications (Hu et al., 2016) to operate on the generalized geometric product in geometric algebras.

The geometric algebra component also enables efficient reasoning in the AI system18about events specified by space (geography) and time (history).

Neural networks may be abstractly represented as graphs and concretely as matrices and vectors for the actual computation. For example, Bayesian neural networks are represented as directed acyclic graphs (DAGs).

In some embodiments, the AI system18is operable to implement Generative Adversarial Networks (GAN) for adaptive security and safety.

FIG.8illustrates a neural network for the recognition of handwritten numbers (digits), trained on the MNIST dataset. As an example, the neural network can be trained to recognize specific DNA sequences, delivered to the system by a genetic profiling pipeline. The capability is able to solve many counterfeit issues in the food supply chain, e.g. to identify different closely related species of mud crabs, or to detect the contamination of beef with horse meat (the latter is typically a lower cost product).

In some embodiments, the controller300may be a stand-alone device (i.e. not part of a network10). It is contemplated that the stand-alone device may be utilized as a cryptography device for various information security related applications. For example, the cryptography device may be deployed in various cyber-security context or applications, such as, but not limited to, a verifier device for an autonomous vehicle, supply chain or logistic management, food source tracing. For each application, data may be received from a plurality of sensors (both hardware and software sensors) via an IoT system20and sent to the verifier device. Other sub-systems such as the distributed ledger system16and the AI system18may be used complement and reinforce the security.

In some embodiments, the controller300may be in the form of modular components such as a serial peripheral interface (SPI), Inter-Integrated Circuit (I2C), memory devices such as SD card, micro-SD card, universal serial bus (USB) devices, etc.

In some embodiments, the controller300(as a stand-alone device), with a secured and verified microkernel running on a verified hardware platform (e.g. SabreLite chipset board) be regarded as an IoT component, interfacing with the neuromorphic computing platform including the array of ReRAM. The neuromorphic computing platform therefore integrates the IoT sub-system, AI sub-system, in addition to the PUF generation which is suited for joining a distributed ledger or blockchain.

One or more of the described components and sub-systems may form an overall secure system for enhancing cyber-security. In particular, the overall system comprising the various sub-systems may be form to provide a comprehensive and enhanced solution for cyber-security. In some embodiments, it is also possible for the controller300to interact directly with the DNA, RNA, and protein sequences through pattern recognition algorithms implemented in the ReRAM chip via sequence alignment.

In particular, the IoT component (a verified microkernel running on a verified hardware platform) interfaces securely with the AI component which acts as the root of trust (PUF).

It should be appreciated by the person skilled in the art that the above disclosure is not limited to the embodiment described. It is appreciable that modifications and improvements may be made without departing from the scope of the present disclosure.

It should be further appreciated by the person skilled in the art that one or more of the above modifications or improvements, not being mutually exclusive, may be further combined to form yet further embodiments of the present disclosure.