3
$\begingroup$

I have read that one of the PUF's application is software licensing, but do not know how. I have been reading different articles and forums (such as here), but still not clear for me.

One vague point for me is that PUF is a hardware and I do not think that vendors provide a separate hardware rather than maybe just a CD including the software.

I also want to know what is the functionality of PUF in this application? Key generator (like explained here)? or chip ID (like explained here - minute 16)? I found a protocol explained in here, but it is not very clear if PUF can act as product key, hardware ID, or activation number.

I was wondering if some one can explain it to me or give me some references.

Improve this question
$\endgroup$
9
  • 1
    $\begingroup$ "I do not think that vendors provide a separate hardware", though getting less common, it is not unheard of to get a hardware token with software that is required to run the software. I've seen this in the form of a USB device that must be present or the software won't work and as a parallel port device. $\endgroup$
    – mikeazo
    Commented Apr 24, 2019 at 18:49
  • $\begingroup$ I'm not sure that any dongle device can protect software. There is a small protocol here may help you. A dedicated hacker can hack all since you have the device and software. I've seen hacked famous programs that were need dongles. $\endgroup$
    – kelalaka
    Commented Apr 24, 2019 at 19:00
  • 1
    $\begingroup$ @kelalaka, yep, nothing is 100%, but there are things you can do to raise the bar. $\endgroup$
    – mikeazo
    Commented Apr 24, 2019 at 19:06
  • $\begingroup$ You could also mug users on the street, but there's a much greater air of respectability to casting cryptographic spells to sabotage users' computations remotely until they cough up extortion money in the name of ‘software licensing’. $\endgroup$
    – Squeamish Ossifrage
    Commented Apr 24, 2019 at 19:11
  • 1
    $\begingroup$ Separate hardware: That's what I was referring to with "PUFesque". There's a lot of error correction on a CD disc. That means there are errors. Does that therefore mean the 'errors' are non reproducible? With suitable driver software that might be PUFy. $\endgroup$
    – Paul Uszak
    Commented Apr 25, 2019 at 20:24

2 Answers 2

Reset to default
1
$\begingroup$

You're right about hardware activation devices for desktop applications. Dangling dongles outa your printer port is quite legacy. New applications tend to use some form of on-line activation system. You see this in games and Windows.

But it is becoming more common in the embedded world, where it can act as product key, hardware ID, or activation number. Consider the most fundamental behaviour of a PUF. It allows a challenge–response protocol to generate a non clone-able set of values, each usually (but not necessarily) one bit wide, with some degree of repeat ability. Using fuzzy extraction, secure sketches, error correction and compression, a single number can be produced with very good reliability. The PUF (oscillator based) with multiple challenge-response pairs would live within an FPGA like so:-

pufs

And that's it: a set of bits. Use the set as you will. It could very well simply be the (uncloneable) device ID. PUFKY is a design for a random 128 bit cryptographic key extracted from ring oscillators. Intel have Stratix FPGAs/SoCs that incorporate on-board SRAM PUFs for protection against counterfeiting, cloning or reverse engineering. It can also be the key for cryptographic communications from the chip. You can see where the PUF fits into the Stratix:-

stratix

Circling back to software activation, a PUF is the evolved in-built "dongle" of yesteryear protecting modern software. It's just that the 'software' these days can be intellectual property like IP cores, gate/block configurations, digital signal processing algorithms etc. and communications data within and around embedded devices.

Improve this answer
$\endgroup$
3
  • $\begingroup$ thanks for your explanation. In my mind, I think vendor should have a recorded set of CRPs before sending the dongle, so that it can check the received response. If they start using the built-in hardwares of the user, how do they get the info of CRPs? In other words, how do they validate the received response? $\endgroup$
    – Shannon
    Commented Apr 29, 2019 at 18:14
  • $\begingroup$ The CRPs themselves wouldn't be read as their responses are soft and only probability based. The manufacturer could read the downstream key which is fixed. $\endgroup$
    – Paul Uszak
    Commented Apr 29, 2019 at 21:04
  • 1
    $\begingroup$ I should have made para.1 clearer. Software like CAD/GIS/Windows etc is commonly activated via the internet so a hard dongle isn't required. The PUF is used to protect embedded systems and micro controllers, especially their intellectual property which might be FPGA logic block configuration and it's firmware. If the micro controller wanted to 'call home', the PUFed key(s) can be used for encryption or a secure authentication code. Although this isn't the common use case. $\endgroup$
    – Paul Uszak
    Commented Apr 29, 2019 at 21:20
0
$\begingroup$

PUF is like a hardware-based HMAC with an unextractable key. The commercial softwares collects some information about the user, hash it with the PUF, then store the result.

The software compares the hash with the output of the PUF everytime when the software is started, if the result is different, the software then prompts you to re-activate it again or buy additional license.

That's one way PUF is used in software licensing.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.