Method and system for authenticating fiber optic keys - Patents.com

Abstract

To provide a computer-implemented method for authenticating an optical fiber key, a program and a system.SOLUTION: A method using an authentication system comprises: selecting at least partially randomized challenge pulse parameters; generating a first optical challenge pulse based on the challenge pulse parameters; determining an optical response signal based on a reflected signal of the first optical challenge pulse from an optical fiber key; applying a comparing algorithm to the optical response signal and an expected response based on previously recorded optical response signals of the optical fiber key to a reference optical challenge pulse for determining a similarity metric; and authenticating the optical fiber key based on the similarity metric.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention is in the field of authentication via physically hard-to-clone keys, more specifically the invention relates to the authentication of physically hard-to-clone keys that are optically interrogated for authentication purposes. [Background technology]

[0002] In many applications, it is important to authenticate a user or device, e.g., to enable access to digitized information, share encryption keys, mediate payments, grant access to physical objects such as vehicles, homes, etc. Such authentication builds on existing data channels for exchanging information and typically involves a "challenge" to provide proof of identity and a "response" based on which the user or device can be authenticated, e.g., to allow or deny access.

[0003] Encryption and user authentication commonly rely on one-way functions that are easy to compute but difficult to reverse. Such authentication addresses the general need that it should be easy for legitimate users to authenticate themselves, but virtually impossible for an adversary to masquerade as a legitimate user.

[0004] One class of such one-way functions is the physical one-way function, where a physical object, a so-called "key", is probed with a stimulus (challenge) to generate a response that should be characteristic of the physical key. In general, the principle that a physical object is physically hard to replicate, for example down to the microstructure or atomic structure of the object, relies on probing the object such that the hard-to-replicate properties result in characteristic responses that should be different to individual challenges. These responses should also be unique, reproducible, and identifiable so that individual physical objects can be reliably distinguished. Furthermore, the focus of the art is on unpredictable responses that are mathematically hard to replicate when tampering is evident.

[0005] For example, US Patent No. 5,999,633 discloses an optical chip in which light is scattered in a light scattering element that includes randomly distributed light scattering particles that scatter incident light such that a random speckle pattern is created and spread over a light detecting element to define a response. The challenge can be rectified by an image element in the device.

[0006] US Patent No. 5,399,633 proposes the use of composite transmission in optical materials, such as coiled sections of large-core fibers, to achieve the distribution of encryption keys. The challenge is transmitted as an ultrashort pulse with a shaped wavefront. The pulse is split into different channels by the optical medium based on the internal microscopic scattering structure determined by the wavefront. The signal obtained in one of these channels can then be transmitted to the issuer of the challenge to authenticate the user. By reducing the amplitude of the pulses, only a person in possession of the optical medium can actually distinguish the individual challenge pulses.

[0007] US Patent No. 5,999,333 discloses monitoring of optical fiber connections using optical time domain reflectometry (OTDR). Reflectance data of a target fiber connection is repeatedly recorded to identify whether an eavesdropper is connected to the target fiber. Based on changes in the reflectance data, signal losses occurring at additional couplers along the connection can be observed, which can be identified by the presence of an eavesdropper. [Prior art documents] [Patent documents]

[0008] [Patent Document 1] US Patent Application Publication No. 2008 / 00237506 [Patent Document 2] International Publication No. 2021 / 148222 [Patent Document 3] US Patent Application Publication No. 2018 / 0259737 Summary of the Invention [Problem to be solved by the invention]

[0009] However, known methods for performing authentication often rely on the creation of composite devices or on accurate analysis of challenges and responses. In particular, reliance on interference, e.g., as part of a speckle pattern, generally limits the applicability to local authentication applications, e.g., due to physical limitations of common optical links and optical coherence.

[0010] In view of the state of the art, it is an object of the present invention to provide a simple and robust method for authenticating a device or user via a physically difficult to duplicate key. [Means for solving the problem]

[0011] This object is solved by a method, a computer program and a system according to the independent claims. The dependent claims relate to preferred embodiments.

[0012] According to a first aspect, the present invention relates to a computer-implemented method of authenticating a fiber optic key, the method including selecting at least partially randomized challenge pulse parameters and generating a first optical challenge pulse based on the challenge pulse parameters. The method further includes determining an optical response signal based on a reflection signal of the first optical challenge pulse from the fiber optic key, and applying a comparison algorithm to the optical response signal and an expected response based on previously recorded optical response signals of the fiber optic key to a reference optical challenge pulse to determine a similarity metric. The method then includes authenticating the fiber optic key based on the similarity metric.

[0013] A fiber optic key typically comprises an optical fiber capable of transmitting an optical signal over a distance of at least 100 m, typically several kilometers. In some examples, the length of the fiber optic key may reach tens or hundreds of kilometers. A fiber optic key may be defined as a section of an optical fiber, such as a section of an optical fiber connection proximate the receiver end of a communication channel. In some examples, the entire optical connection may be considered as a set of fiber optic keys. An optical fiber typically comprises a silica core surrounded by a cladding, which has a higher refractive index than the cladding to guide light along its length. To achieve this higher refractive index, the core of the optical fiber is typically doped with atoms such as Al, P, N, Ge, etc., which further enhances scattering due to internal structural inhomogeneities (e.g., density variations).

[0014] For example, the internal chemical structure of an optical fiber made from an amorphous silica structure can be considered unique and difficult to replicate. With today's technology, it is virtually impossible to make an exact copy of a long, thin piece of fiber. Moreover, the location of the doping atoms in the core is random.

[0015] The present invention proposes to use the light backscattering pattern due to local variations in the refractive index that may arise from the inherent internal structure of the fiber optic key by recording a time-varying reflected signal to a challenge pulse, which may be used to authenticate the fiber optic key based on reference data, since it depends on the refractive index variations along the length of the optical fiber, e.g. due to the Rayleigh backscattering effect.

[0016] In a preferred embodiment, the optical response signal is based on the average variation of the backscattered optical signal due to fiber core refractive index variations of the optical fiber key.

[0017] The optical response signal should be sensitive to refractive index variations of the fiber core due to variations in the internal structure (e.g., mesoscopic, nano, doped, and / or crystalline / covalent structures, etc.) along the fiber core in order to make the method dependent on the substantially hard-to-replicate properties of the optical fiber. Preferably, the variations in the optical response signal caused by the optical fiber key depend on random structural variations induced by the fabrication of the internal structure of the optical fiber core, including, for example, the distribution of dopant atoms along the core or the amorphous silica structure of the fiber. Such variations in the backscattered light signal can be measured in the reflected signal, for example as variations in the detected backscattered light intensity.

[0018] The reflected signal generally depends on the waveform of the challenge pulse and is typically recorded as a reflected pulse resulting from backscattering along the optical fiber. The reflected signal may be recorded in the time domain, for example using a photodiode, to record the profile of the backscattering power resulting from the first challenge pulse in the optical fiber key. The reflected signal may be processed to obtain an optical response signal, which may be independent of other parts of the optical fiber connection, such as the profile of the backscattering power of the optical fiber key as a function of spatial position.

[0019] The resulting trace obtained by processing the reflected signal may be similar to an optical time domain reflectometry (OTDR) type measurement of the fiber section, and the expected response may therefore be based on a previously recorded optical response signal of the fiber optic key to a reference optical challenge pulse as part of an OTDR measurement of the fiber optic key.

[0020] However, the time trace of the reflected signal obtained in a conventional OTDR measurement is in principle a deterministic result, which can be effectively forged by modulating the signal according to a mathematical model of the optical fiber key, such as the distribution of the average backscattering power. Therefore, since the response signal of the OTDR format to a fixed stimulus may not in principle be mathematically difficult to copy, the corresponding scheme using a physical optical fiber key has not been considered previously as a basis for authentication.

[0021] To make the method tamper-resistant for practical purposes, we propose to at least pseudo-randomly modulate the characteristics of the challenge pulse used in probing the optical fiber key. The pulse of light may be shaped in several parameters such as phase, wavelength, amplitude, pulse width, or modulated with a high rate modulation pattern.

[0022] The pseudo-random challenge pulse may be generated by generating a pseudo-random number, selecting pseudo-random pulse parameters based on the random number, and generating the optical challenge pulse using the pseudo-random pulse parameters.

[0023] In a preferred embodiment, the challenge pulse parameters include one or more of pulse duration, pulse amplitude, pulse wavelength, phase, polarization, pulse shape, separation time from preceding or following challenge pulses, and a modulation pattern, where the modulation pattern specifically divides the challenge pulse into multiple sub-pulses.

[0024] The resulting reflected signal depends largely on the pulse parameters: if the pulse parameters were selected substantially randomly, an eavesdropper would have to measure all the characteristics of the pulse in order to generate a matching reflected signal, introducing a detectable time delay between detection of the challenge pulse and signal generation.

[0025] Furthermore, a first challenge pulse train may be transmitted to probe the fiber optic key such that the correct reflected signal may be a sequence or convolution of several backscattered signals. The sequence or convolution may be nonlinear due to the generally nonlinear dependence of attenuation, dispersion and Rayleigh scattering on frequency / wavelength. An eavesdropper may then be prevented for all practical purposes from capturing the challenge signal and generating a corresponding valid (nonlinear) response without introducing a significant and detectable delay, e.g., to regenerate the challenge signal, calculate the response and reconfigure the multivariate pulse generator accordingly. For example, the separation interval between challenge pulses may be less than 10 ms, less than 1 ms, less than 100 μs, or less than 10 μs to implement a separation time less than the round trip time of each pulse passing through the fiber optic key and / or the optical connection to the fiber optic key. For example, (sub)pulse trains may be generated at intervals of less than microseconds, e.g., about 0.1 ns to about 100 ns or about 1 ns to about 10 ns, by generating pulses according to a modulation pattern.

[0026] The separation time between subsequent challenge pulses may be varied so that an eavesdropper encounters challenge pulses at unpredictable times in the challenge pulse train.

[0027] In some embodiments, the method includes generating a plurality of first challenge pulses, receiving a plurality of reflected signals for the plurality of first challenge pulses, and determining an optical response signal based on the plurality of reflected signals, for example by averaging.

[0028] This allows widely available, pre-installed fiber optic connections to be used as fiber optic keys, with only a few requirements needing to be met by the challenge pulse and pulse generation system, yet the resulting response can be used to authenticate the fiber optic key in a robust and substantially tamper-proof manner.

[0029] In a preferred embodiment, the fiber optic key comprises an optical fiber having a length of at least 100m, in particular at least 1000m.

[0030] Methods based on time-domain reflectometry are able to obtain traces of relatively long sections of fiber. It is virtually impossible to replicate a physical object on the scale of hundreds of meters, or to replicate the expected response to a multivariate challenge pulse.

[0031] In a preferred embodiment, the similarity metric is based on an optical response signal corresponding to a time domain reflectance signal from an optical fiber section spaced at least 100 m, in particular at least 1000 m, along the optical fiber connection from the emitter of the first optical challenge pulse.

[0032] Different approaches may be used as comparison algorithms to provide techniques for determining whether the received response is similar to the expected response, i.e., whether the received signal is a matching reflected signal from the optical fiber key. The approaches may be, for example, neural network based algorithms, other AI algorithms, statistical based approaches with pattern recognition and similarity measurements, or different correlation metrics to determine a similarity metric between the optical response signal and the expected response. For example, the similarity metric may be the Pearson correlation coefficient between the optical response signal and the expected response.

[0033] Time domain reflectometry can be applied over long fiber sections located several kilometers away from the pulse generator along the communications link, so that the method can be advantageously applied for long distance (remote) authentication, although the method may also be adapted for local authentication schemes.

[0034] In a preferred embodiment, the method includes receiving a reflected signal from the fiber optic key with an optical receiver adjusted based on the challenge pulse parameters.

[0035] For example, the reflected signal may be multiplied with a reference signal based on the first challenge pulse to extract the reflected signal from a noisy background and / or to select responses having expected signaling delays and / or resulting from the first challenge pulse, etc. As another example, the time and / or frequency windows of the receiver may be adjusted based on the challenge pulse parameters. Thus, the method may be implemented similarly to a coherent reflectometry method, which may further increase tamper resistance.

[0036] In a preferred embodiment, the expected response is further based on challenge pulse parameters.

[0037] For example, the reflected signal of the optical fiber key for each challenge pulse may have been previously characterized for different sets or classes of challenge pulse parameters, using an OTDR as an example, and predicted responses may be generated according to the challenge pulse parameters such as the wavelength modulation of the pulse, the phase of the pulse, the polarization of the pulse, or the pulse shape of the pulse.

[0038] In a preferred embodiment, the method further includes selecting an at least partially randomized second challenge pulse parameter, the second challenge pulse parameter being different from the challenge pulse parameter, and generating a second optical challenge pulse based on the second challenge pulse parameter. The method further includes determining a second optical response signal to the second optical challenge pulse based on a reflected signal from the fiber optic key, and a similarity metric is further determined based on the second optical response signal.

[0039] For example, the first optical response signal and the second optical response signal may be averaged and a similarity metric determined based on the averaging result and the expected response.

[0040] As discussed above, the method may transmit pulse trains with different pulse parameters such that the expected response may be a convolution of the responses to the individual challenge pulses. By varying the challenge pulse parameters in a pseudo-random manner, the method may be substantially tamper-proof for practical purposes. The challenge pulse parameters may be varied after a certain number of challenge pulses in the challenge pulse train, such as by transmitting a first number of first challenge pulse trains followed by a second number of second challenge pulse trains. However, the challenge pulse parameters may be varied in a similar manner after each challenge pulse in the challenge pulse train.

[0041] Those skilled in the art will also appreciate that in some embodiments, multiple different challenge pulse parameters may be generated, e.g., for the third, fourth, and fifth challenge pulses, and authentication may be performed based on multiple received reflected signals to recover an optical response signal corresponding to the optical fiber key.

[0042] Those skilled in the art will further appreciate that the challenge pulse parameters can be generated by modulating a base pulse of the challenge pulse train, e.g., a substantially square base pulse spaced at regular intervals, and then the base pulse can be effectively constructed from the first and second challenge pulses by signal modulation. For example, the base pulse may be modulated to effectively be constructed from multiple challenge pulses that may differ from each other or may have partially randomized intervals based on the randomized challenge pulse parameters. Such modulation of the base pulse in the challenge pulse train may increase the resolution of the optical response signal and may also complicate the generation of a matching reflected signal for an eavesdropper.

[0043] Additionally or alternatively, the method may average or convolve the reflected signals of the first and second challenge pulses as part of generating the optical response signal, for example as part of a lock-in technique, such that the optical response signal may be recovered from several low amplitude reflected signals that may have different challenge pulse parameters.

[0044] In a preferred embodiment, the first optical response signal and the second optical response signal are averaged or convolved, and the fiber optic key is authenticated based on the averaged or convolved result.

[0045] In some embodiments, the method further includes applying a comparison algorithm to the second optical response signal and an expected response based on previously recorded responses of the fiber optic key to the reference optical challenge pulse to determine a second similarity metric. Authenticating the fiber optic key further includes authenticating the fiber optic key based on the second similarity metric.

[0046] In some embodiments, the first similarity metric and the second optical similarity metric are averaged and the fiber optic key is authenticated based on the averaging result.

[0047] In practical applications, regenerating the reflected signal from a pseudorandom challenge pulse typically introduces a delay in the response that can be detected by monitoring the arrival time of the reflected signal.

[0048] In a preferred embodiment, the method further includes comparing the arrival time of the reflected signal with an expected arrival time for emitting the first optical challenge pulse, and authenticating the optical fiber key also based on the result of the comparison.

[0049] For example, by coupling the internal clocks of the challenge pulse emitter and the reflected signal receiver, the time delay occurring between the emission of the first challenge pulse and the receipt of the reflected signal can be monitored to prevent potential tampering, for example by multiplying the recorded reflected signal with a reference signal based on the first challenge pulse. Thus, monitoring the arrival time may be incorporated into the measurement of the reflected signal, and any discrepancy in the arrival times may result in a decrease in the optical response signal and / or the similarity metric.

[0050] In some embodiments, the method includes recording the time of arrival of the reflected signal relative to emitting the first optical challenge pulse.

[0051] In some embodiments, authenticating the fiber optic key may form part of initiating a communications protocol between nodes of the fiber optic connection, and properly authenticating the fiber optic key properly authenticates the node associated with the fiber optic key to initiate the communications protocol, such that a first node may generate a first challenge pulse to authenticate a fiber optic key associated with a second node on the other side of the fiber optic connection.

[0052] The fiber optic key may be implemented by a fiber section of the fiber optic connection between nodes that is characteristic of a node, for example at the receiver end or along the fiber optic connection between the nodes that needs to be authenticated. The fiber optic key may form part of an existing standard fiber optic connection and the method may be implemented based on an existing section of optical fiber that serves as the fiber optic key. However, the method may further include providing an authentication fiber, such as a coiled section of optical fiber, to serve as a dedicated fiber optic key. The fiber optic key may be selectively coupled to the fiber optic network for authentication purposes, such as to minimize the possibility of an eavesdropper broadly characterizing the fiber optic key or re-routing a signal to that fiber optic key, and / or may be located at the receiver end proximate to the signal termination / detector.

[0053] When a dedicated fiber optic key is provided for authentication purposes, it may be possible to further tailor the fiber optic key for use in the authentication scheme, for example by increasing the dispersion of the refractive index profile along the propagation direction of the fiber optic key caused by structural inhomogeneities. For example, the optical fiber may be made excluding compounds that prevent dopant clustering, so that the resulting fiber optic key may have stronger dopant clustering, resulting in more significant backscattering in the associated fiber section. Additionally or alternatively, the fiber optic key may be treated, for example with thermal radiation, mechanical strain, or additional doping, to increase the scattering of light within the fiber optic key.

[0054] In a preferred embodiment, the variance of the backscattered power associated with the optical fiber key is at least 20% greater than the variance of the backscattered power associated with other continuous sections of optical fiber along the communication path over which the first challenge signal is transmitted, preferably at least 50% greater, and most preferably 100% greater.

[0055] Those skilled in the art will appreciate in this regard that joints of different fibers may be associated with the occurrence of significant signal losses, while amplifiers along the optical path may likewise result in significant signal variations, however such events in the time domain traces are not considered to result from an extended continuous section of optical fiber in the above sense, and therefore do not typically constitute another continuous section of optical fiber as described above.

[0056] In some embodiments, the method further includes generating scattering clusters within the optical fiber key to induce localized scattering sites to increase the dispersion of the response signal. Such clusters may be created by doping the optical fiber with a polymer to form hollow microstructures or bubbles within the fiber, or by other methods known in the art.

[0057] The method according to the first aspect may be implemented in a processing system. The processing system may comprise a single processing unit or may comprise multiple processing units that may be functionally connected. The processing unit may comprise a microcontroller, an ASIC, a PLA (CPLA), an FPGA, or other processing device including a processing device operating based on software, hardware, firmware, or a combination thereof. The processing device may include an on-board memory or communicate with an external memory, or both, and may further comprise an interface for connecting to a sensor, device, instrument, integrated logic circuit, other controller, etc., which may be configured to receive or transmit signals, such as electrical signals, optical signals, radio signals, acoustic signals, etc. For example, the processing system may be connected to a pulse generation system and / or an optical receiver via a data interface for transmitting instructions associated with the challenge pulse parameters.

[0058] According to a second aspect, the present invention relates to a non-transitory medium comprising machine-readable instructions which, when executed by a processing system, perform the method according to the first aspect.

[0059] According to a third aspect, the present invention relates to a system for authenticating a fiber optic key, comprising a control system configured to select at least partially randomized challenge pulse parameters and generate machine-readable instructions for emitting, by a challenge emitter, a first optical challenge pulse based on the challenge pulse parameters, the control system further configured to determine an optical response signal based on a reflection signal of the first optical challenge pulse from the fiber optic key, and to apply a comparison algorithm to the optical response signal and an expected response based on previously recorded optical response signals of the fiber optic key to a reference optical challenge pulse to determine a similarity metric.

[0060] The system may implement a method according to the first aspect or any combination of its embodiments. The system may authenticate the fiber optic key depending on the similarity metric or transmit the similarity metric to an external authentication system.

[0061] In a preferred embodiment, the system further comprises an optical receiver adapted to receive the reflected signal.

[0062] The system may further record the time of arrival of the reflected signal relative to the emission time of the first challenge pulse.

[0063] In a preferred embodiment, the optical receiver is adjusted based on the challenge pulse parameters to receive a reflected signal from the fiber optic key.

[0064] In a preferred embodiment, the expected response is further based on challenge pulse parameters.

[0065] In a preferred embodiment, the challenge pulse parameters include one or more of pulse duration, pulse amplitude, pulse wavelength, phase, polarization, pulse shape, separation time from preceding or following challenge pulses, and a modulation pattern, where the modulation pattern specifically divides the challenge pulse into multiple sub-pulses.

[0066] In a preferred embodiment, the control system is further configured to select an at least partially randomized second challenge pulse parameter, the second challenge pulse parameter being different from the challenge pulse parameter, and to generate machine readable instructions for firing a second optical challenge pulse based on the second challenge pulse parameter. The control system is further configured to determine a second optical response signal to the second optical challenge pulse based on a reflected signal from the fiber optic key, and a similarity metric is further determined based on the second optical response signal. [Brief description of the drawings]

[0067] The features and many of the advantages of the method and system of the present invention will be best understood from the following detailed description of the preferred embodiment when read in conjunction with the accompanying drawings. [Figure 1A] FIG. 1 is a diagram illustrating an example of an authentication system. [Figure 1B] FIG. 1 is a diagram illustrating an example of the internal structure of an optical fiber. [Diagram 2] FIG. 1 is a diagram illustrating an example of an authentication method. [Diagram 3] FIG. 1 shows an example of an OTDR trace from an optical fiber section, typical of an optical fiber key. [Figure 4] FIG. 4 shows an example of a trace of backscattered power fluctuations based on the same measurement data as in FIG. 3. [Diagram 5] FIG. 1 shows an example of a matrix of correlation metrics of 11 consecutive measurements of the same fiber section. [Figure 6]FIG. 6 shows an example correlation result between multiple backscatter power variation traces for different fiber sections, similar to the example of FIG. 5. [Figure 7] FIG. 7 shows a further example of a correlation matrix for another optical fiber, the correlation matrix being obtained in a similar manner to the diagram of FIG. 6 . DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0068] 1A is a schematic diagram of an example of a system 10 for authenticating a fiber optic key 12. The system includes a control system 14 coupled to an optical interface 16. The optical interface 16 is coupled to an optical fiber connection 18 via which the control system 14 can be commanded to emit an optical challenge pulse 20 to the fiber optic key 12.

[0069] The challenge pulse 20 may be partially scattered by inhomogeneities in the internal fiber structure along the optical fiber connection 18 and the optical fiber key 12, which generates a reflected signal 22. The reflected signal 22 propagates along the optical fiber connection 18 in the opposite direction to the optical challenge pulse 20, and its time-dependent amplitude may depend on the spatial distribution of refractive index variations along the optical fiber connection 18. Thus, the reflected signal 22 may be a convolution of the pulse shape of the challenge pulse 20 and the spatial dependence of the backscattering coefficients of the optical fiber connection 18 and the optical fiber key 12. The reflected signal 22 may be recorded at the optical interface 16, for example using a photodiode coupled to the optical interface 16, and may be processed by the control system 14 to obtain an optical response signal indicative of the spatially dependent backscattering of the optical fiber key 12.

[0070] For a uniform optical fiber, reflectometry principles predict, in principle, a linear drop in optical power level along the optical fiber connection 18 and the optical fiber key 12 .

[0071] However, as can be seen from the schematic example of FIG. 1B, the internal structure 23 of the optical fiber connection is generally not uniform but characterized by irregularities, which may cause local scattering of light. For example, dopant atoms 24 or clusters 26 of dopant atoms can act as scattering centers for the incident light. Furthermore, inhomogeneities 28 of the underlying internal structure 23 may equally contribute to backscattering in the optical fiber connection 18 and the optical fiber key 12. Because doping is an integral process in optical fiber fabrication and the spatial configuration of the doping atoms 26, 28 is generally random, the optical fibers 12, 18 exhibit significant variations in the effective refractive index. This variation can be measured based on the backscattered light intensity pattern, for example, using measurements similar to optical time domain reflectometry (OTDR).

[0072] The present inventors propose to use the dispersion of the backscatter of a fiber optic key 12 to authenticate the fiber optic key 12 over an optical interface.

[0073] 2 illustrates a computer-implemented method for authenticating a fiber optic key 12. The method includes selecting at least partially randomized challenge pulse parameters (S10) and generating a first optical challenge pulse 20 based on the challenge pulse parameters (S12). The method further includes determining an optical response signal based on a time-domain recorded reflected signal 22 of the first optical challenge pulse 20 from the fiber optic key 12 (S14) and applying a comparison algorithm to the optical response signal and an expected response based on previously recorded optical response signals of the fiber optic key 12 to a reference optical challenge pulse to determine a similarity metric (S16). The method then includes authenticating the fiber optic key 12 based on the similarity metric (S18).

[0074] The expected response may be based on a previously measured reflected signal 22 in response to the optical challenge pulse 20, or may be based on reference data of the optical fiber key 12, such as a previously measured OTDR trace, for example, the expected response may be a simulated optical response based on a previously measured OTDR trace that can be directly compared to the reflected signal 22.

[0075] However, the method can also determine an OTDR trace from the reflected signal 22, or from multiple reflected signals 22 acquired sequentially, as an optical response signal that can be directly compared to a previously measured OTDR trace of the optical fiber key 12.

[0076] The control system 14 can then apply a comparison algorithm (e.g., calculating a correlation metric) to the reference optical response signal and the expected response signal to determine whether the reflected signal 22 was backscattered from the fiber optic key 12 to authenticate the fiber optic key 12.

[0077] On the other hand, in contrast to standard OTDR measurements, the properties of the optical challenge pulses 20, and preferably the sequence of the optical challenge pulses 20, are at least partially randomized, e.g. with respect to pulse wavelength / frequency, phase, or modulation envelope.

[0078] Replication of the internal structure 23 of the fiber optic key 12 is virtually impossible even with the state of the art. Thus, an eavesdropper wishing to imitate the fiber optic key 12 must generate a reflected signal 22 corresponding to a randomized challenge pulse 20 with an emitter tuned based on, for example, the average backscattered power profile of the fiber optic key 12. However, he or she must typically introduce significant processing delays to analyze the pulse parameters, reconfigure the pulse generator, and launch a pulse that imitates the true reflected signal 22.

[0079] The reflected signal 22 propagates at the speed of light in the medium such that the true response to the challenge pulse 20 is substantially instantaneous. Furthermore, the spatially varying backscattering coefficient in the fiber optic key 12 may depend nonlinearly on the parameters of the modulated pulse, such as wavelength / frequency. Therefore, it is usually necessary to perform a multivariate analysis of the challenge pulse 20 before generating a matched signal that mimics the true reflected signal 22. Thus, an eavesdropper attempting to replicate the reflected signal 22 of a true fiber optic key 12 is usually faced with a virtually infeasible task without introducing a significant and detectable delay.

[0080] Thus, the method may be used as a convenient yet substantially tamper-proof way of authenticating a physical fiber optic key 12 associated with a fiber optic connection 18 .

[0081] Furthermore, since the inventors have found that the optical fiber keys 12 of interest can be reliably distinguished in measurements even from different sections of the same fiber, the proposed method is expected to be robust across a variety of applications.

[0082] 3 shows an OTDR trace from an optical fiber section as a typical example of the optical response of the optical fiber key 12. The optical fiber section under test is a 1 km long section of standard single mode telecommunications fiber, in a total optical fiber length of about 25 km. The measurement was performed using an OTDR with a challenge pulse 20 having a pulse duration of 1 μs and a wavelength of λ=1550 nm. The horizontal axis shows the distance along the fiber section and the vertical axis shows the backscattered power in decibels (dB).

[0083] An optical time domain reflectometry (OTDR) instrument probes a section of optical fiber with a train of laser-generated light pulses 20 and records the reflected signal 22 in the time domain using a photodiode to reconstruct the spatial profile of the backscattered power.

[0084] As can be seen from Fig. 3, the optical reflectance data of an optical fiber obtained using an OTDR instrument approximates a straight line that descends with distance plus a randomly varying power level. The latter variations can be at least partially attributed to structural inhomogeneities characteristic of optical fibers and can be used as a fingerprint of the optical fiber key 12. The randomly varying power variations can be extracted from the measurements, for example by removing a linear fit of the backscattered power signal, in order to correlate with reference data.

[0085] It should be taken into account that the typical reflectance data shown in FIG. 3 is obtained from averaging measurements corresponding to a set of challenge pulses with identical pulse parameters. Such averaging is performed to reduce noise in technical devices operating with OTDR technology. On the other hand, with proper averaging, in the process of accumulating the responses to be further averaged, each identical challenge pulse transmitted through the optical fiber may be created with a complex structure, so that it does not provide a significant advantage to an eavesdropper. For example, in a challenge pulse train, each pulse may be modulated with a complex modulation pattern, as an example, so that it is effectively composed of multiple sub-pulses with different characteristics. An eavesdropper would still need to measure all the characteristics of the identical complex pulses in the challenge pulse train in order to generate a matching reflected signal, so that he would not reliably measure all the characteristics of the challenge pulse and adjust the corresponding emitter without introducing a detectable time delay between pulse detection and signal generation. Additionally or alternatively, the characteristics of the challenge pulses can be further varied at predetermined or pseudorandom intervals, for example by providing different challenge pulse parameters for the subsequent train of challenge pulses, which may also include different sub-pulse (modulation) patterns.

[0086] Figure 4 is an example of a trace of backscatter power variation based on the same measurement data as Figure 3, with the linear contribution removed by subtracting a linear fit by least squares method (LSM). The resulting trace may be considered as the optical response signal of the fiber optic key 12, which may be compared to future optical response signals to authenticate the fiber optic key 12, for example based on a similarity metric.

[0087] 5 shows an example of a matrix of correlation metrics of 11 consecutive measurements of the same fiber section as an example of a similarity metric. The correlation metric corresponds to the Pearson correlation coefficient for each backscattering power fluctuation trace associated with each row and column as described in relation to FIG. 4. The measurements were made using an OTDR instrument operating at a wavelength of λ=1550 nm with a pulse duration of 500 ns.

[0088] The figure shows the correlation metric of each pair of traces of backscattering power fluctuations as a matrix of numbers, which are further coded in gray scale for better visual identification. As can be seen, the correlation metric between different measurements is always greater than 0.9, indicating that the measurements are stable over time. Our long-term measurements show that the autocorrelation of measurements of the same fiber section remains greater than 0.5 even after several hours, indicating that the optical fiber key 12 can be reliably identified according to the profile of its average backscattering power fluctuations.

[0089] FIG. 6 shows an example of a correlation result between multiple traces of backscattering power fluctuations of two different fiber sections F1, F2, similar to the example of FIG. 5. In the figure, the first five matrix elements (numbers 0 to 4) are associated with traces of backscattering power fluctuations of a first fiber section F1 of a standard single mode optical fiber. The five second matrix elements (numbers 5 to 9) are associated with traces of backscattering power fluctuations of a second fiber section F2 of the same optical fiber, which is located at a different position along the optical fiber. From FIG. 6 it can be seen that the traces of the same fiber sections F1, F2 have a high similarity, indicated by a value of the correlation metric exceeding 0.6, while the correlation metric between different fiber sections F1, F2 is close to 0 and less than 0.1.

[0090] Thus, an optical response signal that similarly depends on the spatially varying backscattering of the fiber optic key 12, which can be probed with the reflected signal 22, can be reliably used to authenticate the device or user that is on or in possession of the fiber optic key 12, and may also be used to authenticate the communications channel.

[0091] For further tamper resistance, the fiber optic key 12 may be selectively connected to the fiber optic connection 18, for example, upon request, thereby preventing extended reading of the fiber optic key 12 by a third party.

[0092] Although the above examples are directed to standard single mode optical fibers used in telecommunications, other optical fibers may be considered for fiber optic key 12. For example, fiber optic key 12 may be made to feature increased variation in backscatter power, by, as one example, modifying the distribution of scattering centers within fiber optic key 12.

[0093] The distribution of scattering centers results in a spatially varying Rayleigh backscattering coefficient α,

number

[0094] Since Rayleigh backscattering can be caused by the aforementioned inhomogeneities 24-28 of the internal structure 23, the distribution Δχ(x,y,z) can ultimately determine the complexity of the optical fiber based key 12. Therefore, a property of the optical fiber key 12 that is desirable from a physical point of view can be considered to be the inhomogeneity of the distribution Δχ(x,y,z).

[0095] Thus, the distribution of scattering centers may be altered, for example, by increasing the doping level, by avoiding the use of chemical compounds typically used to prevent clustering of dopants in optical fibers, or by mechanical or radiation treatment of the optical fiber that typically increases the backscattering power variation.

[0096] The dedicated fiber optic key 12 is preferably characterized by a greater variance in backscattered power than other continuous sections of optical fiber in the optical fiber connection 18. For example, the variance in backscattered power in the fiber optic key 12 may be at least 50% greater than the corresponding variance in backscattered power in other optical fiber sections along at least a similar length of the optical connection 18. As a result of the greater variance, the fiber optic key 12 may be probed with fewer challenge pulses 20 or with challenge pulses 20 of lower amplitude.

[0097] Figure 7 shows a further example of a correlation matrix similar to that of Figure 6, but for different sections F1, F2 of polarization-maintaining germanium-doped fibre with stress rods. The fibre sections F1, F2 are each 1200 m long, and the backscattered power as a function of distance was measured using an OTDR instrument operating at a wavelength of λ = 1550 nm and a pulse duration of 100 ns.

[0098] In the figure, four first matrix elements are associated with a first fiber section F1 and four second matrix elements are associated with a second fiber section F2 of the same optical fiber located at a different position along the optical fiber. Again, it can be seen that the backscattering power fluctuation traces of the same fiber sections F1, F2 have a high similarity as indicated by a correlation metric value exceeding 0.8, while the correlation metric between the different fiber sections F1, F2 is close to 0 and less than 0.1.

[0099] The use of polarization-maintaining fiber, such as the example of FIG. 7, can increase the dependence of the backscattered power on the polarization of the challenge pulse 20, and therefore improve authentication of the fiber optic key 12 by the present method.

[0100] Those skilled in the art will appreciate that although the correlation metric used in the above example is a correlation function of the backscattering power variations of the fiber sections F1, F2 of interest after removing the linear contribution, correlation metrics based on other optical response signals may be used in the embodiments. For example, it may not be necessary to reconstruct the complete trace of the backscattering power variations, but the method may use only optical response signals that reflect a particular portion of the optical fiber key 12. The particular portion may be associated with a fiber section F1, F2 that is associated with a larger variance in backscattering power or a characteristic profile of the backscattering power variations. Furthermore, the (average) reflected signal 22 may also be directly compared to an expected reflected signal, which may be generated based on a previously calculated OTDR trace of the optical fiber key 12.

[0101] A correlation metric may be used as an option in the comparison algorithm of the responses received from the optical key and the reference signal. The correlation metric in the example shown in Figures 5-7 is the Pearson correlation coefficient of the two curves, such that perfectly overlapping curves (traces) result in a correlation coefficient value of 1. However, those skilled in the art will appreciate that any correlation metric that attributes a measure of similarity to the two sets of data points may be used in embodiments to implement a correlation metric that can be used to authenticate the fiber optic key 12 based on measurements of the reflected signal 22 to the challenge pulse 20.

[0102] Those skilled in the art will further appreciate that while the detailed embodiments focus on authentication based on an optical response signal similar to an optical time domain reflectometry response of the fiber optic key 12, the method may not be limited to such a scheme, while the fiber optic key 12 may also be probed with other techniques known in the art including, for example, a coherent challenge pulse 20 and detection of a coherent response of the fiber optic key 12.

[0103] The description of the preferred embodiment and figures merely serves to illustrate the invention and its associated beneficial effects, and should not be understood as implying any limitation. The scope of the present disclosure should be determined solely by the appended claims. [Explanation of symbols]

[0104] 10. System 12 Fiber Optic Key 14 Control System 16 Optical Interface 18 Fiber Optic Connections 20 Challenge Pulse 22 Reflected signal 23 Internal structure 24 Dopant Atoms 26 Clusters of dopant atoms 28 Heterogeneity of internal structure F1 First fiber section F2 Second fiber section

Claims

1. 1. A computer-implemented method for authenticating a fiber optic key (12), the method comprising: selecting at least partially randomized challenge pulse parameters; generating a first optical challenge pulse (20) based on said challenge pulse parameters; determining a first optical response signal based on a reflection signal (22) of the first optical challenge pulse (20) from the optical fiber key (12) comprising a section of an optical fiber connection having a length of at least 100 m; applying a comparison algorithm to the first optical response signal and an expected response based on previously recorded optical response signals of the optical fiber key (12) to a reference optical challenge pulse to determine a similarity metric; authenticating the fiber optic key (12) based on the similarity metric; A method comprising:

2. 2. The method of claim 1, wherein the first optical response signal is based on an average variation in a backscattered optical signal due to core refractive index variations of the optical fiber key (12).

3. 2. The method of claim 1, wherein the challenge pulse parameters include one or more of a pulse duration, a pulse amplitude, a pulse wavelength, a phase, a polarization, a pulse shape, a separation time from a preceding or subsequent challenge pulse, and a modulation pattern, the modulation pattern specifically splitting the challenge pulse (20) into a number of sub-pulses.

4. The method of claim 1, wherein the similarity metric is based on an optical response signal corresponding to a time domain reflectance signal from an optical fiber section (F1, F2) along an optical fiber connection (18) spaced at least 100 m from the emitter of the first optical challenge pulse (20).

5. the method including receiving the reflected signal (22) from the fiber optic key (12) with an optical receiver adjusted based on the challenge pulse parameters; and / or The method of claim 1 , wherein the expected response is further based on the challenge pulse parameters.

6. The method further comprising: selecting at least partially randomized second challenge pulse parameters, the second challenge pulse parameters being different from the challenge pulse parameters; generating a second optical challenge pulse (20) based on said second challenge pulse parameters; determining a second optical response signal to the second optical challenge pulse based on a reflected signal from the optical fiber key; Further comprising: the similarity metric is further determined based on the second optical response signal. The method of claim 1.

7. 7. The method of claim 6, wherein the first optical response signal and the second optical response signal are averaged or convolved, and the fiber optic key (12) is authenticated based on the averaged or convolved result.

8. The method further comprising: comparing the arrival time of the reflected signal (22) with an expected arrival time for emitting the first optical challenge pulse (20); and authenticating the optical fiber key (12) based also on the results of the comparison. The method of claim 1 further comprising:

9. 2. The method of claim 1, wherein the variance of backscattered power associated with the optical fiber key (12) is at least 20% greater than the variance of backscattered power associated with other successive sections of optical fiber along the communication path over which the first optical challenge pulse (20) is transmitted.

10. A non-transitory medium comprising machine-readable instructions that, when executed by a processing system, implements the method of any one of claims 1 to 9.

11. A system (10) for authenticating a fiber optic key (12), the system (10) comprising: Selecting at least partially randomized challenge pulse parameters; generating machine readable instructions for emitting, by a challenge emitter, a first optical challenge pulse (20) based on said challenge pulse parameters; determining an optical response signal based on a reflection signal (22) of the first optical challenge pulse (20) from the optical fiber key (12) comprising a section of an optical fiber connection having a length of at least 100 m; applying a comparison algorithm to the optical response signal and an expected response based on previously recorded optical response signals of the optical fiber key (12) to a reference optical challenge pulse to determine a similarity metric; The system (10) comprises a control system (14) configured to:

12. 12. The system (10) of claim 11, further comprising an optical receiver adapted to receive the reflected signal (22) and record the arrival time of the reflected signal (22) relative to the emission time of the first optical challenge pulse (20).

13. the optical receiver is adjusted based on the challenge pulse parameters to receive the reflected signal (22) from the optical fiber key (12); and / or The system (10) of claim 12, wherein the expected response is further based on the challenge pulse parameters.

14. 12. The system (10) of claim 11, wherein the challenge pulse parameters include one or more of a pulse duration, a pulse amplitude, a pulse wavelength, a phase, a polarization, a pulse shape, a separation time from a preceding or subsequent challenge pulse, and a modulation pattern, the modulation pattern specifically splitting the challenge pulse (20) into a number of sub-pulses.

15. The control system (14) selecting at least partially randomized second challenge pulse parameters, said second challenge pulse parameters being different from said challenge pulse parameters; generating machine readable instructions for emitting a second optical challenge pulse (20) based on the second challenge pulse parameters; determining a second optical response signal to the second optical challenge pulse based on a reflected signal from the optical fiber key; the similarity metric is further determined based on the second optical response signal. The system (10) of any one of claims 11 to 14, further configured to:

Images