With developments of mobile devices and information and communication technology, a common authentication provided through a secure element, hereinafter, also referred to as SE, such as a universal subscriber identity module (USIM), and a secure digital (SD) card, are increasingly being applied to an electronic payment.
However, the common SE may manage authentication means such as certificate authentications in a form of a file and thus, may a risk of accidents caused through replication of the certificate authentication or leakage of personal information. To minimize the risk, a one-time password (OTP) authentication may be performed using an existing OTP providing device of a user irrespective of a presence of the SE.
In general, an OTP providing apparatus may be provided in a form of, for example, an OTP token, a card type OTP terminal, and a USIM software-based OTP providing application.
However, the OTP providing device may be subject to be exposed to a security attack such as a debugging port and an internal memory attack. Also, the OTP providing device may also be vulnerable to software hacking on a terminal operating system (OS) and OTP applications.
Furthermore, when a security accident occurs in a certification authority or a service provider that provides electronic payment and mobile banking services, an issue that financial institutions being unable to avoid responsibility for illegal transactions based on leaked information may arise.
Conversely, a physically unclonable function (PUF) may provide an unpredictable digital value. Each PUF may provide a different digital value although the PUF is produced through the exactly same manufacturing process.
The PUF may also be referred to as, for example, a physical one-way function (POWF) practically impossible to be duplicated.
Due to the impossibility of replication, the PUF may be used as an identifier of a device for security and/or authentication. For example, the PUF may be used to provide a unique key for distinguishing a device from other devices.
The method of implementing a PUF, Korea Patent No. 10-1139630, hereinafter, referred to as the '630 patent, may be provided in advance. The '630 patent provides a method of stochastically determining whether a via or an inter-layer contact between conductive layers of a semiconductor based on a process variation of the semiconductor.