Introduction
As data communications and applications security is increasingly a requirement for modern system designs, embedded systems architects are coming to realize that identification and authentication are a major component of the systems they are designing. A key technological feature that must be incorporated in these components is the ability to create and protect unique identifiers that serve to prove the identity of connected entities to each other. From a security point of view, it is not sufficient to simply believe a device that asserts a particular identity.
PCI bus identifier strings and Ethernet MAC addresses fall into the category of insecure identifiers. These identifiers may be fine for configuring a device and the system it operates in, but when used to protect systems from unauthorized access, they simply don't provide sufficient security. For example, applications that authenticate network access for a single user using MAC addresses are easily fooled by re-reprogramming the MAC address of gateway routers that are capable of hiding a whole network behind them.
For security applications between automated systems, the gold standard for authenticating access is the use of secure cryptographic protocols that require the systems that are party to a transaction or session to prove their identities using cryptographic techniques. In device identification and authentication schemes, there are typically two similar ways in which to do this：prove knowledge of a secret; or prove possession of a “token” that identifies the device. In most schemes, a token is itself an active device that performs the service of identifying and authenticating itself on behalf of another device in which it is installed. So in most cryptographic protocols, identification and authentication of entities to each other reduces to proof of knowledge of a secret.
The requirements of the particular application dictate how well protected the identifiers must be. A system protecting million dollar financial transactions should probably be better protected than one that protects MP3 files from unauthorized copying. The challenge is to find a solution that trades off security for cost, manufacturing complexity, ease of use and other factors.
This paper discusses those issues and others. The paper begins with a brief overview of techniques for identification and authentication then follows that with a discussion of technical means to implement them in a System-on-Chip（SoC）.
