A device identity and state certificate joint authentication method and device based on a side-polished multi-mode optical fiber double-channel physical unclonable function

Abstract

The application discloses a device identity and state certificate joint authentication method and device based on a side-polished multimode optical fiber double-channel physical unclonable function, relates to the technical field of optical security authentication, speckle imaging, physical unclonable function, optical fiber sensing and anti-disassembly detection, and the method comprises the following steps: injecting first-waveband identity excitation light from the end face of a target multimode optical fiber in a PUF unit in an axial or near-axial direction, collecting an identity response and determining a device identity determination result; after second-waveband challenge excitation light is modulated by a spatial light modulator or a digital micromirror device loaded with a challenge pattern to be verified, the light is incident on a side-polished random rough area of the target multimode optical fiber in a lateral direction, a state certificate response is collected, and a state certificate determination result is determined; based on the device identity determination result and the state certificate determination result, double-threshold joint decision is performed to obtain a joint authentication result. The application can distinguish normal authentication, the same device state anomaly and device mismatch, and improve the stability and security of authentication.

Description

Technical Field

[0001] This application relates to the fields of optical security authentication, speckle imaging, physical non-clonable functions, fiber optic sensing and tamper detection technologies, and in particular to a method and apparatus for joint authentication of device identity and status credentials based on a dual-channel physical non-clonable function of a side-thrown multimode fiber. Background Technology

[0002] Physically unclonable functions (PUFs) utilize random physical differences in materials, processing, or assembly processes to generate device-specific responses that are difficult to replicate under external stimuli. These PUFs can be used for device authentication, anti-counterfeiting and traceability, key generation, and hardware security. Optical PUFs typically utilize random scattering media, rough surfaces, multimode fibers, or micro / nano structures to generate high-dimensional speckle responses, characterized by high response dimensionality, difficulty in replication, and non-contact readout.

[0003] Optical PUFs based on multimode fiber can generate device-specific responses by utilizing the complex propagation processes formed by mode coupling, scattering, microbending, and stress distribution within the fiber. By loading different challenge patterns using a spatial light modulator, the challenge-response pair space can be expanded. However, a single optical response is often simultaneously affected by device identity, challenge pattern, mechanical mounting state, coupling state, and environmental changes. When a device is disassembled, reinstalled, or subjected to structural disturbances, the original challenge response may become mismatched. However, a single-channel system cannot determine whether this mismatch is caused by device replacement or by a change in the mechanical state of the same device.

[0004] Furthermore, some multi-channel optical authentication methods fuse the responses of different channels into a single authentication feature, failing to independently characterize device identity and mechanical state. Consequently, when authentication fails, it becomes difficult to further distinguish between device replacement and state changes of the same device. Especially when different channels differ in wavelength, incident path, coupling position, and mode excitation conditions, their responses may not have a stable spatial correspondence. Directly fusing or using one channel to correct another may reduce the physical clarity of the authentication criteria. Therefore, an authentication method is still needed that can separately characterize and verify device identity information and state credentials, and make a joint decision based on both. Summary of the Invention

[0005] The purpose of this application is to provide a method and apparatus for joint authentication of device identity and status credentials based on a dual-channel physically unclonable function of side-thrown multimode fiber. This method can distinguish between normal authentication, abnormal status of the same device, and device mismatch, thereby improving the stability and security of authentication.

[0006] To achieve the above objectives, this application provides the following solution: Firstly, this application provides a method for joint authentication of device identity and status credentials based on a dual-channel physically unclonable function of side-thrown multimode fiber, including: The first-band identity excitation light is injected axially or near-axially from the end face of the target multimode fiber within the PUF unit to collect the identity response; Based on the preset identity template, the device identity determination result is determined according to the identity response; The second-band challenge excitation light is modulated by a spatial light modulator or digital micromirror device loaded with a challenge pattern to be verified, and then incident laterally onto the side-thrown random rough region of the target multimode fiber to collect the status certificate response. Based on the preset status credential template, the status credential determination result is determined according to the status credential response; Based on the device identity determination result and the status credential determination result, a dual threshold joint decision is executed to obtain a joint authentication result; the joint authentication result is one of the following: rejection of authentication and status verification process, passing authentication, or rejection of authentication.

[0007] Secondly, this application provides a device identity and status credential joint authentication device based on a side-throw multimode fiber dual-channel physically unclonable function, including a first identity excitation module, a second status credential excitation module, a PUF unit, an image acquisition component, and a controller. The first identity excitation module is used to inject first-band identity excitation light axially or near-axially from the end face of the target multimode fiber in the PUF unit to form an identity response; The second state credential excitation module is used to modulate the second-band challenge excitation light through a spatial light modulator or digital micromirror device loaded with a challenge pattern to be verified, and then laterally incident it onto the side-thrown random rough region of the target multimode fiber to form a state credential response. The image acquisition component is used to acquire the identity response and the status credential response; The controller is configured to: based on the identity response and the status credential response, execute a joint authentication method for device identity and status credentials based on a side-thrown multimode fiber dual-channel physically unclonable function to obtain a joint authentication result; the joint authentication result is one of the following: rejection of authentication and proceeding with the status verification process, passing authentication, or rejection of authentication.

[0008] According to the specific embodiments provided in this application, the following technical effects are disclosed: This application employs end-face identity excitation and side-projection region spatial modulation challenge excitation to form two optical channels with different functions. The first-band identity excitation light is injected axially or near-axially from the end face of the multimode fiber, forming a relatively stable identity response with device specificity; the second-band challenge excitation light, after being loaded with a challenge pattern by a spatial light modulator or digital micromirror device, is incident non-axially from the side-projection random rough region, forming a state credential response jointly affected by the challenge pattern, the side-projection random structure, and the mechanical state. The two channels obtain judgment results respectively, and the obtained judgment results are then jointly processed to obtain a joint authentication result, which is one of the following: authentication rejection and state verification process, authentication pass, or authentication rejection.

[0009] This application achieves decoupling of identity and state through two channels, and improves the security and interpretability of authentication results by distinguishing between various authentication results such as device replacement and state abnormality through joint authentication. Attached Figure Description

[0010] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a flowchart illustrating a method for joint authentication of device identity and status credentials based on a dual-channel physically unclonable function of side-thrown multimode fiber in one embodiment of this application.

[0012] Figure 2 This is a schematic diagram of the lifecycle of state credential revocation and controlled update driven by mechanical reconfiguration in one embodiment of this application.

[0013] Figure 3 This is a schematic diagram illustrating the joint decision-making based on dual thresholds of red light identity and green status credentials in one embodiment of this application.

[0014] Figure 4 This is a schematic diagram of the registration, authentication, and status credential update process in one embodiment of this application.

[0015] Figure 5 This is a schematic diagram of a device identity and status credential joint authentication device based on a dual-channel physically unclonable function of side-thrown multimode fiber in one embodiment of this application.

[0016] Figure 6 This is a schematic diagram of the dual template library and controller functional modules in one embodiment of this application. Detailed Implementation

[0017] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0018] To address the issues mentioned in the background, this application provides a joint authentication method for the identity and status credentials of side-thrown multimode fiber physically non-clonable function devices, utilizing a red light identity channel and a green programmable status credential channel for independent matching and joint decision-making. Specifically, it constructs a dual-channel non-redundant authentication architecture, using a relatively stable and device-specific channel to confirm the device identity, and using a channel sensitive to programmable challenges and mechanical states to verify the status credentials, thereby distinguishing between different situations such as normal authentication, abnormal status of the same device, and device mismatch, and realizing controlled revocation and updating of status credentials under the conditions of identity confirmation, status verification, and authorization.

[0019] This application aims to address the problems in existing optical physical non-cloning functions, such as the coupling of device identity, challenge response, and mechanical state, the difficulty in distinguishing between device mismatch and abnormal state of the same device after authentication failure, and the lack of controlled revocation and update mechanisms for state credentials. The application proposes to register and match device identity information and mechanical state credential information separately and perform dual-threshold joint judgment, thereby realizing the authentication of side-throw multimode fiber physical non-cloning functions.

[0020] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0021] In one exemplary embodiment, such as Figure 1 As shown, a joint authentication method for device identity and status credentials based on a dual-channel physically unclonable function of side-thrown multimode fiber is provided, including the following steps 100-500.

[0022] In a specific application, the identity response and status credential response are collected separately according to a preset timing sequence. The preset timing sequence is as follows: first, the first band identity stimulus light is turned on and the identity response is collected; after the first band identity stimulus light is turned off, the second band challenge stimulus light is turned on, the challenge pattern to be verified is loaded, and the status credential response is collected.

[0023] Step 100: The first-band identity excitation light is injected axially or near-axially from the end face of the target multimode fiber in the PUF unit, and the identity response is collected at the output end of the target multimode fiber.

[0024] Step 200: Based on the preset identity template, determine the device identity determination result according to the identity response.

[0025] In one application, the identity response is matched with a preset identity template to obtain a first matching degree; when the first matching degree meets the first authentication threshold condition, the device identity determination result is marked as passed. At this time, the device identity number corresponding to the identity template that matches the identity response can be determined as the identity number of the device to be verified; when the first matching degree does not meet the first authentication threshold condition, the device identity determination result is marked as failed.

[0026] When matching the identity response with the preset identity template, the matching method is as follows: at least one of the following is used for matching: normalized cross-correlation coefficient, cosine similarity, Euclidean distance, Mahalanobis distance, structural similarity index, and feature vector distance; or, the identity response is converted into a binary response and then matched using normalized Hamming distance.

[0027] Step 300: The second-band challenge excitation light is modulated by a spatial light modulator or digital micromirror device loaded with a challenge pattern to be verified, and then incident laterally onto the side-thrown random rough region of the target multimode fiber. The status certificate response is collected at the output end of the target multimode fiber.

[0028] Step 400: Based on the preset status credential template, determine the status credential determination result according to the status credential response.

[0029] In a specific application, the status credential response is matched with a preset status credential template to obtain a second matching degree; when the second matching degree meets the second authentication threshold condition, the status credential determination result is marked as passed; when the second matching degree does not meet the second authentication threshold condition, the status credential determination result is marked as failed.

[0030] The matching method used in this step can be the same as that used in step 200 above. Specifically, for two consecutive speckle images A and B, the normalized cross-correlation coefficient NCC(A,B) can be used to measure their correlation: first, the average intensity of the two images is subtracted, and then the inner product of the two mean-reduced images is divided by the square root of their energy product. The closer the NCC is to 1, the higher the similarity. For binary responses a and b of length M, the normalized Hamming distance HD(a,b) can be used, which is the number of bits with a value of 1 in the corresponding bit XOR result divided by M. The closer the HD is to 0, the more similar the responses.

[0031] The red light identity threshold (i.e., the first authentication threshold) can be determined based on the similarity distribution of the same device across time or across allowed states and the similarity distribution of different devices; the green state credential threshold (i.e., the second authentication threshold) can be determined based on the repeated response distribution of the same device, state, and challenge, and the response distribution when changing challenges, changing devices, and crossing states. The two thresholds are trained or calibrated independently.

[0032] Step 500: Based on the device identity determination result and the status certificate determination result, perform a dual threshold joint decision to obtain a joint authentication result; the joint authentication result is one of the following: refuse authentication and proceed with the status verification process, pass authentication, or refuse authentication.

[0033] In a specific application, step 500 includes the following steps (51)-(54).

[0034] (51) When both the device identity determination result and the status certificate determination result are passed, the joint authentication result is successful authentication.

[0035] (52) When the device identity determination result is passed and the status certificate determination result is failed, the joint authentication result is to refuse authentication and proceed with the status verification process.

[0036] The status verification process within the authentication rejection and status verification procedure includes: 1) Replace the challenge pattern to be verified and perform at least one of the following: joint authentication of device identity and status credentials, multiple repeated response collection, mechanical status check, maintenance verification or authorized operator confirmation, to obtain the verification result.

[0037] 2) When the verification result indicates a change in mechanical status, the status certificate response corresponding to the registered mechanical status before the change in the preset status certificate template is marked as frozen, invalid, or revoked, and then the status certificate response corresponding to the registered mechanical status after the change is updated. Specifically, after reconfirming the device identity and receiving a valid authorization instruction, the second status certificate response under the new mechanical status is collected, a status certificate corresponding to the new mechanical status is established, and the update is achieved.

[0038] In an application, such as Figure 2 As shown, when the PUF unit is disassembled, reinstalled, its orientation is changed, its lateral coupling state is changed, or its local bending or stress state is changed, the effective mode subspace and propagation path excited by the green channel change, and the query green response mismatches with the template under the original registered state s0. If the red light identity response still meets the identity threshold, it is confirmed that the tested object still has the identity continuity of the registered device, but the current state credential response is inconsistent with the original registered state template, and it is marked as an abnormal state pending verification.

[0039] The state verification step is: verifying the abnormal state through at least one of the following manners: repeated verification by replacing challenge patterns, multiple repeated collection, authentication device state check, maintenance verification, or authorized operator confirmation. After verification confirms that the mechanical state has changed, the state management module marks the state credential corresponding to state s0 as frozen, invalidated, or revoked, and records the state abnormality and the verification result. The present application does not allow direct re-registration in the case of only a green response, so as to prevent an attacker from replacing a template or using an unauthorized state to overwrite the original credential.

[0040] After the management terminal completes on-site verification, maintenance authorization, or trusted operator confirmation, the red light identity authentication is performed again. Only when the red light identity authentication is passed and the authorization instruction is valid, the registration process for the new state s1 is entered: the green response is re-collected for a set of challenges, Greg(i,s1,k) is established, and it is associated with the device identity number and the new state number. The old state s0 template may be retained as a revocation record, or may be deleted according to a security policy.

[0041] Through the above mechanism, the red light channel undertakes continuous identity confirmation, and the green channel undertakes revocable state credentials. Under the condition that the identity response still meets the first authentication threshold, the change of the mechanical state does not change the judgment on the identity continuity of the registered device, but will cause the state credential corresponding to the original mechanical state to mismatch the current response. Therefore, the present application can retain the device identity record, and support maintenance, redeployment, and life cycle management through the freezing, revocation, and re-registration of state credentials.

[0042] (53) When the device identity judgment result is not passed, the joint authentication result is authentication rejection.

[0043] As Figure 3 shown, when a higher similarity indicates a better match, the joint decision may be executed according to the following rules: when the first matching degree SR ≥ the first authentication threshold TR and the second matching degree SG ≥ the second authentication threshold TG, it indicates that the identity of the tested device is consistent with the registered device, and an effective green response to the specified challenge is generated in the current state, and the authentication is passed. When SR ≥ TR and SG < TG, it indicates that the red light identity continuity is still confirmed, but the old green credential is inconsistent with the current response, it is determined as a suspected mechanical state change, installation abnormality, unauthorized disassembly, collection abnormality, or original state credential mismatch, and the process enters the state verification procedure. When SR < TR, the authentication is rejected.

[0044] When a distance metric is adopted and a smaller distance indicates a better match, the direction of the decision inequality is reversed accordingly. The first authentication threshold and the second authentication threshold may be fixed thresholds, or may be adaptively configured according to the device, environment interval, or security level.

[0045] Before executing the above steps 100 to 500, registration is performed first, as Figure 4 As shown, the registration process for the preset identity template and the preset status credential template includes: (1) Assign a device identification number to each sample PUF unit. Install it according to the registered mechanical condition s0.

[0046] (2) In the registered mechanical state, multiple frames of sample identity response are collected for each sample PUF unit to be authenticated. Specifically, the red light is turned on and the green light is kept off. Multiple frames of red light identity response R(i,n) are collected under fixed light source power, camera exposure and output imaging conditions, where n represents the repeated collection sequence number.

[0047] (3) After performing the first image preprocessing on the sample identity response, a preset identity template indexed by the device identity number is generated. Specifically, the sample identity responses of multiple frames are subjected to dark field subtraction, background subtraction, region of interest cropping, intensity normalization, abnormal pixel removal, multi-frame averaging or feature extraction to generate a red light identity template Rreg(i).

[0048] (4) For any sample PUF unit, generate multiple sample challenge patterns, load the multiple sample challenge patterns respectively, and then collect the corresponding state credential response. Specifically, turn off the red light and turn on the green light. Generate multiple challenge patterns C(k) at the verification end and load each challenge pattern onto the spatial light modulator or digital micromirror device. The modulated green light is incident from the side-projected random rough area, and multiple frames of green challenge response G(i,s0,k,n) are collected under each challenge C(k).

[0049] (5) After performing the second pattern preprocessing on the status certificate response, a preset status certificate template is generated with the device identification number, registered mechanical status, and sample challenge pattern as a joint index. Specifically, the green challenge response G(i,s0,k,n) of multiple frames is preprocessed and fused with the template to generate a green status certificate template Greg(i,s0,k). Red and green lights can use different preprocessing parameters, but they should be consistent during the registration and authentication stages.

[0050] The preset identity template can use an index structure of "device identity number - red light identity template". The preset status credential template can use an index structure of "device identity number - machine status number - challenge pattern number - green response template". When it is not necessary to explicitly manage multiple statuses, the machine status number can be omitted, but the template still corresponds to the actual machine status at the time of registration.

[0051] In summary, in this application, the identity response is independently matched with a preset identity template, and the status credential response is independently matched with a preset status credential template corresponding to the device identity, registered mechanical status, and challenge pattern to be verified. That is, identity features and status credential features are extracted from the identity response and status credential response respectively; the identity features are matched with the preset identity template, and the status credential features are matched with the corresponding preset status credential template. The resulting first and second matching degrees are jointly processed at the decision layer. When both device identity determination and status credential determination pass, joint authentication is output as passed; when device identity determination passes but status credential determination fails, it indicates that the tested object still has the continuity of the registered device identity, but the current status credential response is inconsistent with the registered status template, authentication is rejected, and a status verification request is output; when device identity determination fails, authentication is rejected.

[0052] During the registration phase, the red identity template library is indexed by the device identity number, while the green status credential template library is indexed at least by the device identity number and the challenge pattern number, and preferably also by the machine status number. When a device identity verification passes but the status credential verification fails, status verification is performed first. After repeated verification with a different challenge, multiple data collections, device checks, or authorization verification confirms a change in the machine status, the status credential corresponding to the original registered machine status is frozen, invalidated, or revoked. Only after the device identity is reconfirmed and valid authorization is obtained is it allowed to collect the status credential response under the new machine status and establish a new status credential.

[0053] Based on the same inventive concept, this application also provides an apparatus. The solution provided by this apparatus is similar to the solution described in the above method. Therefore, the specific limitations of one or more apparatus embodiments provided below can be found in the limitations of the method above, and will not be repeated here.

[0054] In one exemplary embodiment, such as Figure 5 As shown, a device identity and status credential joint authentication device based on a dual-channel physically unclonable function of side-thrown multimode fiber is provided, including a first identity excitation module, a second status credential excitation module, a PUF unit, an image acquisition component, and a controller.

[0055] The PUF unit's installation position, orientation, coupling state, bending state, and stress state within the device constitute one or more of the registered mechanical states of the installation. The identity continuity referred to in this application does not mean that the first identity response remains completely unchanged under any disturbance, but rather that changes in the mechanical state can cause changes in the matching degree of the state credential response. Furthermore, it means that within a preset allowable state range or under predetermined mechanical reconfiguration conditions, the identity response of the same device still meets the first authentication threshold and can be distinguished from the identity responses of different devices.

[0056] The PUF unit includes a target multimode fiber and a packaging assembly; the target multimode fiber is fixed inside the packaging assembly, so that the input end, the side-thrown random rough area and the output end of the target multimode fiber maintain a predetermined relative position.

[0057] The target multimode fiber is at least one of side-thrown multimode polymer fiber, multimode glass fiber with random side roughness regions, or cladding-modified multimode fiber. Specifically, in this application, the side-thrown multimode fiber is not limited to polymer fiber, but can also be multimode glass fiber with random side roughness regions, cladding-modified fiber, partially decladding fiber, or other multimode waveguides with random scattering coupling regions. As long as a response suitable for identity verification can be formed through end-face excitation, and a response suitable for challenge and state verification can be formed through lateral spatial modulation excitation, the independent template and joint decision method of this application can be used.

[0058] The side-thrown multimode fiber PUF unit can employ step-index multimode polymer fiber. Exemplarily, the bare fiber outer diameter is approximately 1000 μm, the numerical aperture is approximately 0.50, and the total fiber length can be determined based on output strength, response stability, and state discrimination capability. Exemplarily, the total length can be from 7 cm to 15 cm; in a preferred embodiment, the total length is approximately 9 cm, with an input segment of approximately 5 cm, a side-thrown random roughening region of approximately 1 cm, and an output segment of approximately 3 cm. The side-thrown depth can be approximately 350 μm from the outer surface of the bare fiber after removing the outer sheath, and the lateral incident angle of green light can be approximately 45°. The above dimensions are merely a preferred embodiment and do not constitute a limitation.

[0059] The side-sprayed random rough region is formed by at least one of mechanical grinding, polishing, scraping, laser processing, plasma treatment or chemical treatment. Its random surface morphology, internal bulk scattering of the optical fiber, microbending and residual stress jointly affect the mode coupling and phase accumulation of green incident light, making the green challenge response of different devices and the same device under different mechanical states distinguishable.

[0060] The first identity excitation module is used to inject first-band identity excitation light axially or near-axially from the end face of the target multimode fiber within the PUF unit to form an identity response. Specifically, the first identity excitation module includes a red light source and an end face coupling component, wherein the first-band identity excitation light generated by the red light source has a wavelength of 600 nm to 700 nm.

[0061] The second state credential excitation module is used to modulate the second-band challenge excitation light through a spatial light modulator or digital micromirror device loaded with a challenge pattern to be verified, and then laterally incident it onto the side-thrown random rough region of the target multimode fiber to form a state credential response. Specifically, the second state credential excitation module includes a green light source, a beam expander and collimator, a spatial light modulator or digital micromirror device, and a focusing component. The wavelength of the second-band challenge excitation light generated by the green light source is 500 nm to 560 nm.

[0062] The first-band identity excitation light and the second-band challenge excitation light can use different wavelength ranges. In a preferred embodiment, the first-band identity excitation light is 650 nm red light, and the second-band challenge excitation light is 532 nm green light; other wavelength combinations can also be used, provided that the functional division of end-face identity excitation and side challenge excitation is satisfied. The two channels can use other different wavelength ranges, but the functional division of end-face identity excitation and side challenge excitation should be maintained.

[0063] In practical applications, red light injected axially or near-axially from the end face tends to form relatively stable pattern combinations, with its output speckle serving as the device's identity response. Green light, after spatial modulation, is injected laterally from a side-projected, randomly rough region, making it more likely to form pattern combinations sensitive to challenge patterns, local random structures, and mechanical states, with its output speckle serving as a state credential response. The mode selectivity here is relative; it does not require red light to contain only low-order modes, nor does it require green light to contain only high-order modes.

[0064] The image acquisition component is used to acquire the identity response and the status credential response. Specifically, the image acquisition component is located at the output end of the target multimode optical fiber, and the image acquisition component includes at least one of a color CCD camera, a color CMOS camera, a monochrome camera with a beam splitter and filter assembly, a dual-camera assembly, or a time-division acquisition assembly. Therefore, image acquisition can employ a single color camera for time-division acquisition, dual-camera acquisition after beam splitting, monochrome camera acquisition with a filter wheel, or other methods capable of distinguishing the responses of the two channels.

[0065] The controller is configured to: execute the above-described joint authentication method for device identity and status credentials based on the identity response and the status credential response, and obtain a joint authentication result; the joint authentication result is one of the following: rejection of authentication and status verification process, passing authentication, or rejection of authentication.

[0066] In a specific application, the controller includes an identity matching module, a state credential matching module, a joint decision module, a state verification module and a state management module; the state verification module is configured to perform repeated challenge verification, repeated collection or authorization verification when the device identity determination is passed but the state credential determination is not passed; the state management module is configured to freeze or revoke the state credential corresponding to the original mechanical state after the state verification module confirms that the mechanical state has changed, and register the state credential corresponding to the new mechanical state after the device identity is reconfirmed and a valid authorization instruction is received. When SR<TR occurs, the authentication is rejected. The state management module can record the challenge number, time, two matching degrees and decision results for audit and attack analysis.

[0067] The controller may be implemented by a local computer, an embedded processor, a server or a trusted execution environment; the template library may be stored in a local secure memory, a remote authentication server or an encrypted database.

[0068] In addition, the apparatus may include a template memory, which is configured to store a preset identity template and a preset state credential template indexed by the device identity number, the mechanical state number and the challenge pattern number.

[0069] In a specific application, the verification end may randomly select a challenge from the green state credential template library, or adopt an unused challenge, a rolling challenge, a one-time challenge number, a timestamp or a session random number, so as to reduce the risk of a fixed challenge being replayed. The challenge pattern may be a random binary pattern, a multi-grayscale pattern, a phase pattern, a macro-pixel pattern or a combination thereof.

[0070] As Figure 6 shown, the working process of the apparatus of the present application is as follows: Time-division acquisition is preferably adopted during authentication. First, the red light is turned on and the green light is kept off, and the red light identity response Rqry is collected; then the red light is turned off, the verification end randomly selects the challenge C(k) to be verified, turns on the green light and loads the challenge pattern, and the green challenge response Gqry is collected. Time-division acquisition can reduce spectral crosstalk between the red and green channels, and is compatible with existing color cameras, monochrome cameras plus filter components or dual-camera structures at the same time.

[0071] The controller matches the queried red light identity response with the candidate red light identity template to obtain a first matching degree SR. If a continuous speckle image is used, a normalized cross-correlation coefficient NCC, cosine similarity, structural similarity or learned feature distance may be adopted; if a binary response is used, a normalized Hamming distance may be adopted. The first authentication threshold TR is set according to the distribution of the same device and different devices in the registration set and the verification set, the receiver operating characteristic curve, the equal error rate or a predetermined security level.

[0072] After the device identity candidate is determined, the controller retrieves the corresponding green status certificate template based on the device identity number, machine status number, and challenge number, and matches the queried green challenge response with the template to obtain the second matching degree SG. The second authentication threshold TG is set based on the statistical distribution of repeated responses to the same challenge for the same device and responses to different challenges, different devices, or different statuses.

[0073] The first identity response and the second state credential response are preprocessed, feature extracted, and template matched, respectively. The resulting first and second matching scores are then jointly processed at the decision layer. The two channels respectively represent device identity information and mechanical state credential information to form mutually independent and functionally complementary authentication criteria.

[0074] This application injects the first-band identity excitation light axially or near-axially from the end face of the target multimode fiber, collects the identity response, and independently matches it with the identity template to obtain the device identity determination result. The second-band challenge excitation light is modulated by a spatial light modulator or digital micromirror device and laterally incident onto a randomly roughened area, collecting the status credential response, and independently matching it with the status credential template corresponding to the device identity, registered mechanical state, and challenge pattern to be verified. A dual-threshold joint decision is made based on the two matching results: authentication is successful when both are passed; authentication is rejected and a status verification request is output when the identity determination is successful but the status credential determination is unsuccessful; authentication is rejected when the identity determination is unsuccessful. After repeated challenge verification, multiple data collections, device inspection, maintenance verification, or confirmation by a trusted operator that the mechanical state has changed, the original status credential is frozen or revoked, and a new status credential is registered after the device identity is reconfirmed and authorization is obtained. This application can distinguish between normal authentication, abnormal status of the same device, and device mismatch, and achieves controlled revocation and updating of status credentials.

[0075] Compared with the prior art, this application has the following advantages: (1) Decoupling of identity and status. The red channel is used to confirm "whether it is a registered device" and the green channel is used to confirm "whether the registered device has a valid credential corresponding to the specified challenge in the current state". The two channels are responsible for device identity confirmation and status credential verification respectively, which can form a two-layer authentication architecture with clear physical functions and no redundancy between each other.

[0076] (2) It can distinguish between device replacement and abnormal status. By using two independent thresholds and joint decision, it can distinguish between normal authentication, abnormal status of the same device, device mismatch, and suspected replay or template index error, thereby improving the interpretability of authentication results.

[0077] (3) Possess anti-tamper detection and certificate lifecycle management capabilities. When disassembly, reassembly, posture change or structural disturbance causes the original status certificate to mismatch, the authentication will be rejected first and the status verification will be initiated; after confirming that the mechanical status has changed, the old status certificate can be frozen or revoked, and a new status certificate can be established after the device identity is reconfirmed and authorized.

[0078] (4) The challenge-response space is scalable. Spatial light modulators or digital micromirror devices can load a large number of challenge patterns, making green status credentials programmable and with a large challenge-response space.

[0079] (5) The device is low in cost and easy to package. The side-displaced multimode polymer fiber can be formed into a random rough region by mechanical processing of commercial multimode fiber, and then integrated with the packaging components to form an integrated PUF unit.

[0080] The above embodiments are merely preferred embodiments of this application. For those skilled in the art, equivalent substitutions or modifications can be made to the structure, parameters, acquisition sequence, feature form, and decision process without departing from the core concept of this application, and all such substitutions or modifications should fall within the protection scope of this application.

[0081] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0082] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for joint authentication of device identity and status credentials based on a dual-channel physically unclonable function of side-thrown multimode fiber, characterized in that, The method includes: The first-band identity excitation light is injected axially or near-axially from the end face of the target multimode fiber within the PUF unit to collect the identity response; Based on the preset identity template, the device identity determination result is determined according to the identity response; The second-band challenge excitation light is modulated by a spatial light modulator or digital micromirror device loaded with a challenge pattern to be verified, and then incident laterally onto the side-thrown random rough region of the target multimode fiber to collect the status certificate response. Based on the preset status credential template, the status credential determination result is determined according to the status credential response; Based on the device identity determination result and the status credential determination result, a dual threshold joint decision is executed to obtain a joint authentication result; the joint authentication result is one of the following: rejection of authentication and status verification process, passing authentication, or rejection of authentication.

2. The device identity and status credential joint authentication method based on a side-thrown multimode fiber dual-channel physically unclonable function as described in claim 1, characterized in that, Based on a preset identity template, the device identity determination result is determined according to the identity response, including: The identity response is matched with a preset identity template to obtain a first matching degree; when the first matching degree meets the first authentication threshold condition, the device identity determination result is marked as passed; when the first matching degree does not meet the first authentication threshold condition, the device identity determination result is marked as failed. Based on a preset status credential template, the status credential determination result is determined according to the status credential response, including: The status credential response is matched with a preset status credential template to obtain a second matching degree; when the second matching degree meets the second authentication threshold condition, the status credential determination result is marked as passed; when the second matching degree does not meet the second authentication threshold condition, the status credential determination result is marked as failed.

3. The device identity and status credential joint authentication method based on a side-thrown multimode fiber dual-channel physically unclonable function as described in claim 1, characterized in that, Based on the device identity determination result and the status credential determination result, a dual-threshold joint decision is performed to obtain a joint authentication result, including: When both the device identity determination result and the status credential determination result are passed, the joint authentication result is successful. When the device identity determination result is passed and the status certificate determination result is failed, the joint authentication result is authentication rejection and a status verification process is initiated. When the device identity determination result is unsuccessful, the joint authentication result is authentication rejection.

4. The device identity and status credential joint authentication method based on a side-thrown multimode fiber dual-channel physically unclonable function as described in claim 1, characterized in that, The registration process for the preset identity template and the preset status credential template includes: Assign a device identification number to each sample PUF unit and install it according to the registered mechanical condition; In the registered mechanical state, the sample identity response is collected; After performing the first image preprocessing on the sample identity response, a preset identity template indexed by the device identity number is generated; For any given PUF unit, generate multiple sample challenge patterns and collect the corresponding status credential responses; After performing the second pattern preprocessing on the status certificate response, a preset status certificate template is generated with the device identification number, registered mechanical status and sample challenge pattern as joint indexes.

5. The device identity and status credential joint authentication method based on a side-thrown multimode fiber dual-channel physically unclonable function as described in claim 4, characterized in that, The status verification process in the authentication rejection and status verification procedure includes: Replace the challenge pattern to be verified, and perform at least one of the following: joint authentication of device identity and status credentials, multiple repeated response collection, mechanical status check, maintenance verification, or authorized operator confirmation, to obtain the verification result; When the verification result indicates that the mechanical status has changed, the status certificate response corresponding to the registered mechanical status before the change in the preset status certificate template is marked as frozen, invalid, or revoked, and then the status certificate response corresponding to the registered mechanical status after the change is updated.

6. The joint authentication method for device identity and status credentials based on a side-thrown multimode fiber dual-channel physically unclonable function as described in claim 2, characterized in that, When matching the identity response with the preset identity template, the matching method is as follows: Matching is performed using at least one of the following: normalized cross-correlation coefficient, cosine similarity, Euclidean distance, Mahalanobis distance, structural similarity index, and eigenvector distance. Alternatively, the identity response can be converted into a binary response, and then matched using normalized Hamming distance.

7. The joint authentication method for device identity and status credentials based on a dual-channel physically unclonable function of side-thrown multimode fiber according to claim 1, characterized in that, The method further includes: The identity response and the status credential response are collected separately according to a preset time sequence; The preset timing sequence is as follows: first, the first band identity stimulus light is turned on and the identity response is collected; then, the first band identity stimulus light is turned off and the second band challenge stimulus light is turned on, the challenge pattern to be verified is loaded and the status credential response is collected.

8. A device identity and status credential joint authentication device based on a dual-channel physically unclonable function of side-thrown multimode fiber, characterized in that, The device includes a first identity incentive module, a second status credential incentive module, a PUF unit, an image acquisition component, and a controller; The first identity excitation module is used to inject first-band identity excitation light axially or near-axially from the end face of the target multimode fiber in the PUF unit to form an identity response; The second state credential excitation module is used to modulate the second-band challenge excitation light through a spatial light modulator or digital micromirror device loaded with a challenge pattern to be verified, and then laterally incident it onto the side-thrown random rough region of the target multimode fiber to form a state credential response. The image acquisition component is used to acquire the identity response and the status credential response; The controller is configured to: based on the identity response and the status credential response, execute the device identity and status credential joint authentication method according to any one of claims 1-7 based on the side-throw multimode fiber dual-channel physical non-cloning function, and obtain a joint authentication result; the joint authentication result is one of the following: rejection of authentication and status verification process, passing authentication, or rejection of authentication.

9. The device identity and status credential joint authentication device based on a side-thrown multimode fiber dual-channel physically unclonable function according to claim 8, characterized in that, The installation position, orientation, coupling state, bending state, and stress state of the PUF unit in the device constitute one or more of the registered mechanical states of the installation. The PUF unit includes a target multimode fiber and an encapsulation assembly; the target multimode fiber is fixed inside the encapsulation assembly, so that the input end, the side-thrown random rough area, and the output end of the target multimode fiber maintain a predetermined relative position; The target multimode fiber is at least one of side-polished multimode polymer fiber, multimode glass fiber with random side roughness regions, or cladding modified multimode fiber; the side-polished random roughness regions are formed by at least one of mechanical grinding, polishing, scraping, laser processing, plasma treatment, or chemical treatment.

10. The device identity and status credential joint authentication device based on a side-thrown multimode fiber dual-channel physically unclonable function according to claim 8, characterized in that, The first identity activation module includes a red light source and an end-face coupling component; The second state credential excitation module includes a green light source, a beam expander and collimator, a spatial light modulator or a digital micromirror device, and a focusing component; The image acquisition component is located at the output end of the target multimode optical fiber. The image acquisition component includes at least one of a color CCD camera, a color CMOS camera, a monochrome camera with a beam splitting and filtering component, a dual-camera component, or a time-division acquisition component.

Images