CN120223084B - PUF structure and identity authentication method based on delay difference quantization - Google Patents

Abstract

The invention discloses a PUF structure based on delay difference quantization, which comprises a PUF circuit, a multi-layer differential tap circuit TDC, a decoder connected with each layer of differential tap circuit TDC, a delay data quantization unit connected with the multi-layer decoder, and a delay data confusion structure connected with the multi-layer differential tap circuit TDC, wherein the two delay circuits are connected with the multi-layer differential tap circuit TDC through a signal selection structure, delay signals of the two delay circuits which respond first and then are input to the start end and the stop end of each layer of differential tap circuit TDC through the signal selection structure, the decoder determines the delay time of the two delay circuits under corresponding delay resolutions, the delay data quantization unit averages the delay time under different delay resolutions to be used as final confusion data, and the final response R is output after the confusion of the LFSR structure. Signals of the two symmetrical delay paths are respectively input into the architecture of the multi-layer TDC quantization circuit, so that delay difference digital code quantization is realized.

Description

PUF structure based on delay difference quantification and identity verification method

Technical Field

The invention belongs to the technical field of identity authentication, and particularly relates to a PUF structure based on delay difference quantification and an identity authentication method.

Background

The innovation of the emerging technologies such as great computing power, 6G communication, edge computing and the like drives the world to enter a new era of everything interconnection. The internet of things (IoT) is a core technology for realizing the internet of things, and sensitive data in various information devices are uploaded to the cloud through communication and gateway protocols to exchange information and communicate, but with the rapid development of the internet of things, the number of devices at the internet of things and a control end of the internet of things is caused to show an explosion-level increasing trend, and a large amount of sensitive data carried in the internet of things inevitably faces a great information security challenge. Meanwhile, with the rapid innovation of technologies such as AI, large models and the like, more advanced attack means are promoted, a protection barrier of the traditional safety protection technology is broken through, and the safety of the Internet of things is subject to various serious tests including equipment authentication, authorization, information leakage, data encryption and decryption and the like. Conventionally, a conventional cryptographic primitive is generally adopted to provide security guarantee for a key in the internet of things device, but a conventional encryption strategy often adopts a complex encryption algorithm, and a great amount of hardware resource overhead is brought, for example ：Advanced Encryption Standard(AES)、Elliptic Curve Cryptography(ECC)、Hash-based Message Authentication Code(HMAC), does not meet the design requirement of the lightweight of the internet of things device. Meanwhile, a key relied by the traditional encryption algorithm is stored in a nonvolatile Memory (NVM) of a chip in a digital form, and an attacker can acquire the key through physical attack means (such as side channel attack, invasive attack, semi-invasive attack and the like), so that the security of the processes of identity authentication, data encryption and decryption and the like under the operation system of the Internet of things is threatened.

To solve this problem, a physical unclonable function (Physical Unclonable Function, PUF) has gradually become a new paradigm of security protection as a new integrated circuit security design means based on hardware security primitives, which uses the random physical deviation inherent in the process manufacturing of a chip to form a unique digital feature fingerprint, namely Challenge-response (Challenge-response Pairs, CRPs), which is equivalent to a unique key of a device chip, ensures the credibility, integrity and authenticity of the system from the hardware bottom layer, and provides a lightweight design scheme for the security of the internet of things. The PUFs can be classified into weak PUFs and strong PUFs according to CRPs number of PUFs (1) typical structures are RO-PUFs, SRAM PUFs, TERO PUF, etc., and are generally applied to key generation due to the limited number of the weak PUFs CRPs, and (2) typical structures are APUF, XOR PUFs, MPUF, etc., and are generally applied to asymmetric encryption in a security authentication protocol due to the huge CRPs number of the weak PUFs. The traditional APUF is formed based on an entropy source linear accumulation type time delay model, so that significant linear correlation exists among a large number of CRPs of APUF, and after CRPs of the PUF is obtained, an attacker can model an internal circuit of the PUF through the internal correlation, so that other CRPs is predicted, and the security of an identity authentication protocol based on APUF and variant structures thereof is threatened.

To eliminate the characteristic of the linear accumulated integration present in a delay-like strong PUF, the challenge can be converted into such a nonlinear entropy source by extracting and quantifying the delay path difference, thereby greatly reducing the linear mapping between challenge and response. For example, a delay differential quantization PUF based on APUF is proposed, by adding a plurality of configurable delay units on APUF two symmetric paths, collecting APUF output responses under different delay configurations, indicating that the acquired responses contain delay difference information of APUF two symmetric paths, discussing the relationship between quantization information and reliability, adopting a tolerance threshold in an authentication protocol, so that the reliability reaches 99.95% without CRPs dropping rate, providing theoretical basis for application of the PUF in the authentication protocol, but DDQ-APUF is quantized by adopting a delay unit, and since the delay amount of the delay unit is unknown, quantized data can only represent information containing delay difference, and realizing real delay difference digital code quantization.

Disclosure of Invention

The invention provides a PUF structure based on delay difference and an identity authentication method, aiming at improving the problems.

The invention is realized in that a PUF structure based on delay difference quantization comprises:

the PUF circuit comprises two delay circuits connected in parallel, and the two delay circuits respectively output delay signals;

the device comprises a multi-layer differential tap circuit TDC, a decoder connected with each layer of differential tap circuit TDC, a delay data quantization unit connected with the multi-layer decoder, and an LFSR confusion structure connected with the delay data quantization unit;

The two delay circuits are connected with the differential tap circuit TDC through a signal selection structure, delay signals of response and then response in the two delay circuits are input into a start end and a stop end of each layer of differential tap circuit TDC respectively through the signal selection structure, wherein the delay time of the start end is required to be higher than that of the stop end, a decoder determines the delay time of the two delay circuits under corresponding delay resolution based on output signals of the corresponding differential tap circuit TDC, a delay data quantization unit averages the delay times under different delay resolutions to serve as final delay data, and the final delay data is mixed through an LFSR confusion structure and then the final response R is output.

The delay circuit is formed by connecting multiple stages of delay units in series, each stage of delay unit comprises a fourth-stage MUX and a fourth-stage DEMUX connected with the output end of the MUX, two output ends of the DEMUX are connected with a first exclusive-OR gate, the other two output ends of the DEMUX are connected with a second exclusive-OR gate, the first exclusive-OR gate and the second exclusive-OR gate are connected with a third exclusive-OR gate, and the output of the third exclusive-OR gate is connected with the fourth-stage MUX of each stage of delay unit of the next stage.

Further, the challenge signal C is subjected to segmentation processing to obtain a first challenge signal C ₁ and a second challenge signal C ₂ with the same length, the 4 n-th bit to 4 (n+1) th bit of the first challenge signal C ₁ are sequentially configured to two selection ends of the MUX and the DEMUX in the n+1-th order delay time unit, the MUX selects one of four paths of input signals based on two-bit control signals, the DEMUX selects one of four paths of output signals based on two-bit control signals to output, the 4 n-th bit to (4n+2) of the second challenge signal C ₂ are configured to two irrelevant bit ends of the first exclusive or gate and the second exclusive or gate in the n+1-th order delay time unit, the (4n+2) th bit to 4 (n+1) th bit is configured to two irrelevant bit ends of the third exclusive or gate in the n+1-th order delay time unit, and the first exclusive or gate, the second exclusive or gate and the third exclusive or gate determine time delay duration applied to the corresponding exclusive or gate based on the two-bit control signals.

Further, the signal selection circuit is composed of two buffers and two second-order MUXs, the signal Start and the signal Stop output by the two delay paths are respectively input into the two buffers through the input of the signal selection circuit, the two buffers respectively output corresponding signals to the input ends of the two second-order MUXs, meanwhile, the response signal R is configured to the selection ends of the two second-order MUXs, when the signal Up is output before the signal Down, the signal Up is used as the signal Start through the second-order MUXs, the signal Down is used as the signal Stop, when the signal Down is output before the signal Up, the response S=0, the signal Down is used as the signal Start through the second-order MUXs, and the signal Up is used as the signal Stop.

Further, each layer of differential tap type circuit TDC consists of m stages, each stage of delayer comprises IDELAYE2 with different delay time t ₁、t₂ and an arbiter connected with the two IDELAYE, signals Start and Stop are respectively input into IDELAYE2 with delay time t ₁ and IDELAYE with delay time t ₂ in the stage of delayer, and delay time t ₁ is larger than delay time t ₂.

Furthermore, the arbiter in the i-stage delayer consists of a fourth-stage MUX and a second-stage MUX, the delay T _i and the delay D _i output by IDELAYE with the delay time of T ₁、t₂ in the i-stage delayer are input into two selection ends of the corresponding fourth-stage MUX, one path of input is selected for output by the fourth-stage MUX based on the selection signal input by the selection end, the output end is connected with the end of the second-stage MUX, the other input end is connected with the corresponding input end of the fourth-stage MUX, the ith bit of the signal is output by the output end, and the selection end of the second-stage MUX is connected with the enabling end.

Further, a decoder connected with the T, j-layer differential tap type circuit TDC calculates a delay time T _j between two delay paths tested by the j-layer differential tap type circuit TDC, and the calculation formula is specifically as follows:

T_j＝N_j×(t_1j-t_2j);

Wherein N _j is the number of high levels in the output signal of the j-th layer differential tap type circuit TDC, and t _1j、t_2j is the delay time of the delay device in the j-th layer differential tap type circuit TDC.

Further, the reference clock frequency f of each layer of differential tap type circuit TDC in each layer of differential tap type circuit TDC is the same, the reference clock frequencies f among different layers of differential tap type circuit TDCs are different, delay signals generated under the same challenge signals are sent into differential tap type circuit TDC decoding with different resolutions of each layer of delayers to quantize delay time, and a delay data quantizing unit averages all quantized delay time to be used as final delay time among two delay circuits.

The invention is realized in such a way that the identity authentication method based on the PUF structure based on delay difference quantification is as follows:

(21) The equipment end generates a random number N ₁ for encrypting a key, encrypts an ID _i and a random number N ₁ of the equipment end based on a symmetric key k _i, and encrypts Sending the data to a server side;

(22) When the server receives the transmission from the equipment end Decrypting by adopting a symmetric key k _i, extracting initial information ID _i、N₁ of the equipment end, and storing the equipment information pair through the equipment endIf the verification is successful, extracting the locally stored challenge C ₁ and response R _i according to the ID _i, generating a random number N ₂ by the server, encrypting the challenge C ₁, the response R _i and the random number N ₂ by using the random number N ₂ and the symmetric key k _i, and encrypting the encrypted challengeResponse toRandom numberSending the data to a device end;

(23) When the device receives the encrypted challenge Response toRandom numberThen, calculating decryption to extract a random number N ₂, decrypting by using the obtained random number N ₂ to obtain a challenge C ₁ and a response R _i, verifying whether the challenge C ₁ is the stored C ₁ of the device end, if the verification fails, taking the locally stored challenge C ₁ of the previous round as the currently round of challenge C ₁, if the verification passes, the device end generating the response R '_i＝PUF(C₁||C₂ by using the PUF structure built in the device end, detecting whether the Hamming distance between the response R _i and the response R' _i is within a Hamming distance threshold T _h, if the Hamming distance is within the Hamming distance threshold T _h, regenerating the device end into a random number N ₃, and recalculating the challenge of the front section of the PUFResponse R _i+1,R_i+1＝PUF(C′₁||C₂ of the reconstructed PUF structure), encrypts the reconstructed response R _i+1 based on the random number N ₃, calculates and uses the message authentication code, encrypts the reconstructed challenge C '₁, and encrypts the parameters C' ₁ ^*, M,AndSending the data to a server;

(24) When the server receives the parameters C' ₁ ^*, M, AndThen, the random number N ₃, the response R _i+1 and the challenge C '₁ are decrypted in sequence, the integrity of the message is checked by verifying the MAC, and if the MAC verification is successful, the response R _i+1 and the challenge C' ₁ are updated and restored.

(25) After the authentication is passed, the device updates the locally stored challenge C ₁ of the previous round to the currently reconstructed challenge C '₁,C₁←C′₁, and at the same time, the server updates the locally stored challenge C ₁ of the previous round to the currently reconstructed challenge C' ₁ and the challenge C ₁←C′₁, and updates the locally stored response R _i of the previous round to the currently reconstructed response R _i+1 and the response R _i←R_i+1.

Further, the method for determining the hamming distance threshold T _h specifically includes:

(1) Building a plurality of PUF structure models, and enumerating a plurality of challenge signals;

(2) Inputting the mth challenge into the nth PUF structure model at normal temperature and normal pressure, outputting a corresponding time delay difference B _mn by the PUF structure model, and outputting a response R _mn by the time delay difference B _mn through an LFSR confusion structure;

(3) Traversing all challenges and all PUF pattern models;

(4) Changing the environment temperature and/or the voltage of a PUF structure model for the t time, wherein the t is 1 to c, inputting the mth challenge into the nth PUF structure model, outputting a corresponding time delay difference B '_mn by the PUF structure model, outputting a response R' _mn by the time delay difference B '_mn through an LFSR confusion structure, calculating the Hamming distance between the response R' _mn and the response R _mn, and storing the Hamming distance into a matrix N _t;

(5) Traversing all challenges and all PUF pattern models;

(6) The maximum hamming distance in the matrix is taken as the hamming distance threshold, where N matrix n= (N ₁、...、N_t、...、N_c).

The PUF structure based on delay difference quantization has the following beneficial technical effects:

(1) The design target of low resources and high nonlinearity is achieved by providing a PUF circuit based on multipath configuration and dynamic delay difference of a DEMUX, the MUX and the DEMUX are used for cascading to form the front end of the PUF unit, three XOR gates with irrelevant bits are used for forming an XOR gate tree to form the rear end of the PUF unit, the front end and the rear end are cascaded to form a delay unit, the multipath selection configuration of the front section of the delay unit improves the nonlinearity degree, and the delay amount is dynamically adjusted by the irrelevant bits of the XOR gates at the rear section, so that the delay difference of two symmetrical paths is dynamically changed;

(2) The multi-layer differential type tapped TDC circuit architecture is adopted, a response mechanism of a PUF is changed, and the model attack resistance of the entropy source linear accumulation type APUF and the variant structure thereof is improved integrally. Signals of two symmetrical paths of the PUF are respectively input into a framework of a multi-layer TDC quantization circuit, delay difference digital code quantization is realized, quantized data directly represent information of delay differences of the two symmetrical paths of the PUF, so that response of the PUF contains more unique and dynamic information when the PUF faces challenge input, and the framework can be applied to any delay PUF, and model attack resistance of the PUF is improved.

Drawings

Fig. 1 is a schematic diagram of a PUF circuit according to an embodiment of the present invention;

FIG. 2 is a schematic diagram of a signal selection structure according to an embodiment of the present invention;

Fig. 3 is a schematic diagram of a structure among a differential tap circuit TDC, a decoder and a delay data quantization unit according to an embodiment of the present invention;

FIG. 4 is a schematic diagram of an LFSR confusion structure according to an embodiment of the present invention;

fig. 5 is a schematic structural diagram of a differential tap circuit TDC according to an embodiment of the present invention;

FIG. 6 is a schematic diagram of an arbiter according to an embodiment of the present invention;

FIG. 7 is a diagram of a registration phase data interaction provided by an embodiment of the present invention;

FIG. 8 is a data interaction diagram of an identity authentication phase according to an embodiment of the present invention;

Fig. 9 shows experimental results of PUF circuit against different model attacks according to an embodiment of the present invention, where (a) is against CMA-ES model attacks, (b) is against LR model attacks, (c) is against ANN model attacks, (d) is against DNN model attacks, (e) is against CNN model attacks, and (f) is against SVM model attacks.

Detailed Description

The following detailed description of the embodiments of the invention, given by way of example only, is presented in the accompanying drawings to aid in a more complete, accurate, and thorough understanding of the inventive concepts and aspects of the invention by those skilled in the art.

The invention provides a new PUF response mechanism, which can integrally improve the model attack resistance of entropy source linear accumulation APUF and variants thereof. Since the conventional APUF and its variant structures mostly use the arbiter to respond to the arbitration result of the signal on two symmetric paths, an important entropy source, i.e. the delay difference of the symmetric paths, is ignored. The difference in delay between the two symmetric paths is random, reproducible in the face of different challenge signal inputs, and the difference in delay of the symmetric paths in APUF and its variants can be extracted and converted by the TDC architecture instead of the conventional arbiter, and a response is generated to improve the nonlinearity of the PUF. Therefore, the present invention proposes a APUF variant structure with low resource overhead and high nonlinearity based on DEMUX, and then uses a multi-layer differential TDC circuit architecture to perform digital code quantization on a delay difference entropy source, and sends quantized data into an LFSR register to perform confusion output response, which shows excellent model attack resistance, and the PUF structure based on delay difference quantization includes:

the PUF circuit comprises two delay circuits connected in parallel, and the two delay circuits respectively output delay signals;

the device comprises a multi-layer differential tap circuit TDC, a decoder connected with each layer of differential tap circuit TDC, a delay data quantization unit connected with the multi-layer decoder, and an LFSR confusion structure connected with the delay data quantization unit;

The two delay circuits are connected with the differential tap circuit TDC through a signal selection structure, delay signals of response and then response in the two delay circuits are input into a start end and a stop end of each layer of differential tap circuit TDC respectively through the signal selection structure, wherein the delay time of the start end is required to be higher than that of the stop end, a decoder determines the delay time of the two delay circuits under corresponding delay resolution based on output signals of the corresponding differential tap circuit TDC, a delay data quantization unit averages the delay times under different delay resolutions to serve as final delay data, and the final delay data is mixed through an LFSR confusion structure and then the final response R is output. The connection relationship among the differential tap circuit TDC, the decoder and the delay data quantization unit is shown in fig. 3.

Fig. 1 is a schematic structural diagram of a PUF circuit provided in an embodiment of the present invention, for convenience of explanation, only showing a portion related to the embodiment of the present invention, where the PUF circuit includes two delay circuits connected in parallel, input ends of the two delay circuits are connected to an input end of an EN signal, the two delay circuits are symmetrical structures and each are formed by serially connecting multiple delay units, each delay unit includes a fourth-order MUX, and a fourth-order DEMUX connected to an output end of the MUX, two output ends of the DEMUX are connected to a first exclusive-or gate, the other two output ends are connected to a second exclusive-or gate, the first exclusive-or gate and the second exclusive-or gate are connected to a third exclusive-or gate, and an output of the third exclusive-or gate is connected to a fourth-order MUX of each delay unit of a next order;

The method comprises the steps of carrying out segmentation processing on a challenge signal C to obtain a first challenge signal C ₁ and a second challenge signal C ₂ with the same length, sequentially configuring 4 n-th bit to 4 (n+1) th bit of the first challenge signal C ₁ to two independent bit ends of a MUX and a DEMUX in an n+1 th order delay time period element, wherein the MUX selects one path of four paths of input signals based on two-bit control signals, the DEMUX selects one path of four paths of output signals based on two-bit control signals to be output, 4 n-th bit to (4n+2) of the second challenge signal C ₂ are respectively configured to two independent bit ends of the first exclusive OR gate and the second exclusive OR gate in the n+1 th order delay time period element, the (4n+2) th bit to 4 (n+1) th bit is respectively configured to two independent bit ends of a third exclusive OR gate in the n+1 th order delay time period element, the first exclusive OR gate and the third exclusive OR gate determine the time delay applied to the corresponding exclusive OR gate based on the two-bit control signals, the length of the challenge signal C is generally 64 bits or 64 bits, the length of the challenge signal C is the challenge signal C, the length of the first challenge signal C is the length of the 4-th bit control signal C is the length of one-64, the challenge signal C is the length of the challenge signal C is equal to the length of the C32, and the challenge signal C is the length of the first challenge signal C is the C32, and the challenge signal C is the length is equal to the length of the first challenge signal C and the challenge signal C is the signal and the signal C is the time and the signal is 35 and the time and the challenge signal is 32 and the time and the result and the challenge is 32 and the are each is separated.

Two uncertainty factors of different nonlinear paths and nonlinear delay time are introduced into two symmetrical delay paths through a first challenge signal C ₁ and a second challenge signal C ₂, so that a signal Up and a signal Down with uncertain delay are output by the two delay paths.

In the embodiment of the invention, the signal Start and the signal Stop required to be input by the differential type tap type circuit TDC are required to meet the requirement that the signal Start enters the differential type tap type circuit TDC before the signal Stop, and because the delay path configuration of the PUF circuit and the influence of process manufacturing factors, the sequence of the signal Up and the signal Down output by the upper two delay paths is random, a signal selection circuit is required to be provided for reconfiguration so as to meet the requirement of the tap type circuit TDC, thereby ensuring that the tap type circuit TDC can work normally. As shown in fig. 2, the signal selection circuit is composed of two buffers and two second-order muxes, the signal Start and the signal Stop output by the two delay paths are respectively input into the two buffers through the input of the signal selection circuit, the two buffers respectively output corresponding signals to the input ends of the two second-order muxes, the response signal R is configured to the selection ends of the two second-order muxes, when the signal Up is output before the signal Down, the response signal up=1, in order to meet the requirement of the TDC input end of the differential tap circuit, the signal Up is used as the signal Start through the second-order MUX, and when the signal Down is output before the signal Up, the signal Down is used as the signal Stop, and when the signal Down is output before the signal Up, the response signal s=0, the signal Down is used as the signal Start, and the signal Up is used as the signal Stop.

If the signal Up and the signal Down reach the second-order MUX before the response signal R, the simulation after the implementation of the time sequence can observe that the original nanosecond delay difference is directly reduced to tens of picoseconds, almost 0, and the experimental result is seriously affected. Therefore, in order to ensure the accuracy of the delay difference of the subsequent differential tap circuit TDC quantization, a buffer with high delay is connected between two second-order MUX input ends to ensure that the signal Up and the signal Down reach the second-order MUX end later than the response signal R, where the buffer with high delay is configured by a LUT with 6 inputs, where A1 is the input end, (A2, A3, A4, A5, A6) =11111, i.e. the delay path of the input signal is the highest in the LUT, so as to achieve the design goal of low-resource high delay.

Fig. 5 is a schematic structural diagram of a differential tap circuit TDC according to an embodiment of the present invention, which is convenient for illustration, and only shows the relevant part of the embodiment of the present invention, where the multi-layer differential tap circuit TDC is a three-layer differential tap circuit TDC, each layer of differential tap circuit TDC is composed of m stages (m is less than or equal to 25), each stage of delayer includes IDELAYE2 with two different delay times t ₁、t₂ (delay time t ₁、t₂) and an arbiter connected with two IDELAYE2, and the signal Start and the signal Stop are respectively input to IDELAYE2 with delay time t ₁ and IDELAYE with delay time t ₂ in the stage of delayer, and the delay time t ₁ is greater than the delay time t ₂;

The arbiter in the i-stage (i takes 1 to m) delay device consists of a fourth-order MUX and a second-order MUX, the delay T _i and the delay D _i output by IDELAYE with the delay time of T ₁、t₂ in the i-stage delay device are input into two selection ends of the corresponding fourth-order MUX, one input is selected by the fourth-order MUX to output based on the selection signal input at the selection end, the output end is connected with the end of the second-order MUX, the other input end is connected with the corresponding input end of the fourth-order MUX, the output end outputs the ith bit of the signal, and the selection end of the second-order MUX is connected with the enabling end, as shown in fig. 6.

The reference clock frequency f of each layer of differential tap type circuit TDC in the three layers of differential tap type circuit TDCs is the same, the reference clock frequencies f among different layers of differential tap type circuit TDCs are different, and the delay time t ₁、t₂ in each layer of differential tap type circuit TDCs is obtained by adjusting a tap. The core of the multi-layer differential tap type circuit TDC is a configurable delayer, the configuration of delay is realized mainly through IDELAYE, and the delay time t of the delayer is set by adjusting the reference clock frequency and the tap number of IDELAYE 2:

Where f is the reference clock FREQUENCY (REFCLK_frequency), typically 200MHz, 300MHz, 400MHz, tap is the tap number (IDELAY_VALUE), typically 0-31, 600ps is the inherent delay of IDELAYE 2. Thus, a delay has minimum delay times of 678ps, 652ps, 639ps at the three different reference frequencies. Due to the inherent delay of IDELAYE and the delay introduction of layout and wiring, the resolution of the differential tap type circuit TDC is lower, the quantized delay difference error is larger, and good uniqueness and model attack resistance are difficult to characterize. Therefore, the invention adopts a differential type tapped TDC circuit and a differential type tapped TDC circuit to counteract the inherent delay of IDELAYE self and improve the quantized resolution, and at the moment, the delay difference T of a delay path can be expressed as:

T=N×(t₁-t₂) (2)

In addition, since the delay difference is in nanosecond level, in order to improve the resolution, a plurality of delay units are needed, and in the differential tap circuit TDC, a plurality of D flip-flops are needed to arbitrate the delayed signals, and the D flip-flops are greatly affected by the environment and the temperature, so that the TDC quantized data is unstable, thereby affecting the reliability of the response. Therefore, the present invention proposes an improved arbitration unit based on a lookup table, such as the arbiter in fig. 6, a multiplexer configured as a four-way multiplexer through a 6-input lookup table, the delay T _i and the delay D _i after passing through the delay are taken as the selection terminals of the four-way MUX according to the time sequence waveform under the EN enable signal, the delay difference of the four-way MUX is output as a pulse signal with a high level, then the number of the pulse signals is recorded through high level triggering in the decoder, and then the delay difference entropy source is quantized according to the resolution T ₁-t₂ of the delay.

In the embodiment of the invention, three layers of differential type tapped circuit TDCs correspond to three decoders, each decoder calculates a corresponding time delay based on an output signal of the corresponding layer of differential type tapped circuit TDCs, and a calculation formula of the time delay T _j of the j-th layer (j=1, 2, 3) of differential type tapped circuit TDCs is specifically as follows:

T_j＝N_j×(t_1j-t_2j) (3)

Wherein N _j is the number of high levels in the output signal of the j-th layer differential tap type circuit TDC, and t _1j、t_2j is the delay time of the delay device in the j-th layer differential tap type circuit TDC.

Further, in order to avoid a phenomenon that data quantized by quantized data is subjected to environmental influence to generate fluctuations at a certain reference frequency, and in order to increase the degree of nonlinearity of quantized data. According to the basic principle of IDELAYE, the three layers of differential tap type circuit TDCs are arranged, the reference clock frequency of each layer of TDC differential tap type circuit TDC is respectively 200MHz, 300MHz and 400MHz, and each layer of TDC differential tap type circuit TDC is provided with 25 delayers. The delay signals generated under the same challenge Signal are respectively input into differential type tap type circuit TDCs with different resolutions of the three layers of delayers for data quantization, 3 m-bit signals [ m-1:0] are output, a decoder encodes according to the resolution set by each layer of differential type tap type circuit TDC to obtain a decimal sequence OUT _j＝T_j, and a delay data quantization unit divides the addition of the 3 OUT _j by 3 to obtain final quantized data. Although the delay addition quantized by the three-layer differential tap type circuit TDC is a linear operation, the real high-precision PUF symmetrical path delay difference quantization is realized, so that nonlinear fine delay difference fluctuation of an entropy source under the influence of external challenge vector configuration and internal technology can be captured by the differential tap type circuit TDC with different precision, the final output is influenced, and the attack resistance and the extraction rate of the delay difference entropy source are improved.

In an embodiment of the invention, the LFSR confusion structure is a fibonacci LFSR with 8 th order, until the final quantized data OUT is divided into two parts, if OUT is 14 bits, the lowest 6 bits are decoded as the shift number of the LFSR, and the highest 8 bits are used as the initial seed of the LFSR, as shown in fig. 4. By correlating the two variables of the initial seed and the shift times which affect the LFSR output with the quantized data and simultaneously the quantized data is derived from the symmetrical path delay difference of the PUF, the nonlinear entropy source in the PUF presents a high nonlinear relation between challenges and responses under the unpredictable state conversion of the LFSR, and the model attack resistance of the final response is improved.

The PUF structure based on delay difference quantization has the following beneficial technical effects:

(1) The design target of low resources and high nonlinearity is achieved by providing a PUF circuit based on multipath configuration and dynamic delay difference of a DEMUX, the MUX and the DEMUX are used for cascading to form the front end of the PUF unit, three XOR gates with irrelevant bits are used for forming an XOR gate tree to form the rear end of the PUF unit, the front end and the rear end are cascaded to form a delay unit, the multipath selection configuration of the front section of the delay unit improves the nonlinearity degree, and the delay amount is dynamically adjusted by the irrelevant bits of the XOR gates at the rear section, so that the delay difference of two symmetrical paths is dynamically changed;

(2) The multi-layer differential type tapped TDC circuit architecture is adopted, a response mechanism of the PUF is changed, and the integrity is improved, and the model attack resistance of the entropy source linear accumulation type APUF and the variant structure thereof is realized. Signals of two symmetrical paths of the PUF are respectively input into a framework of a multi-layer TDC quantization circuit, delay difference digital code quantization is realized, quantized data directly represent information of delay differences of the two symmetrical paths of the PUF, so that response of the PUF contains more unique and dynamic information when the PUF faces challenge input, and the framework can be applied to any delay PUF, and model attack resistance of the PUF is improved.

The core problem faced by most identity authentication methods based on PUF is that under the same challenge, the error rate generated by response can influence the judgment of identity authentication in the face of different equipment environments, thereby leading to the improvement of the misjudgment rate of an identity authentication protocol. At present, most of the technical schemes can adopt two methods to solve the problem, namely (1) a method of using a Fuzzy extract, wherein the Fuzzy extract is actually a post-processing method, the error correction capability of the Fuzzy extract can be designed according to the reliability test result of PUF equipment, but the calculation/communication cost of a protocol and the complexity of the protocol can be increased, meanwhile, auxiliary data generated by the Fuzzy extract can face the risk of leakage, and (2) a method of setting a threshold value is adopted, the required threshold value is generated by collecting error rates among responses in different environments, and the threshold value is stored in the protocol for use, so that the design concept of the lightweight and safety of the protocol is met.

Therefore, in order to reduce the misjudgment rate of the response in the mutual authentication protocol, the invention provides a Hamming distance threshold generating algorithm, the PUF structure model is constructed, and the delay difference between two paths is calculated through the PUF structure model. After confusing the absolute value quantization of the delay difference under all challenge configurations, the generated response is stored, and the hamming distance threshold T _h is determined by obtaining the response under the same challenge configuration under different temperature and voltage conditions. When in an authentication protocol, the hamming distance between two responses is compared to determine if the response is stable and secure, if the hamming distance is within the generated threshold T _h, the other party can be considered to be a legitimate identity, thereby passing the authentication.

In the embodiment of the invention, the method for acquiring the hamming distance threshold T _h specifically comprises the following steps:

(1) Building a plurality of PUF structure models, and enumerating a plurality of challenge signals;

(2) Inputting the mth challenge into the nth PUF structure model at normal temperature and normal pressure, outputting a corresponding time delay difference B _mn by the PUF structure model, and outputting a response R _mn by the time delay difference B _mn through an LFSR confusion structure;

(3) Traversing all challenges, traversing all PUF pattern models;

(4) Changing the environment temperature and/or the voltage of a PUF structure model for the t time, wherein the t is 1 to c, inputting the mth challenge into the nth PUF structure model, outputting a corresponding time delay difference B '_mn by the PUF structure model, outputting a response R' _mn by the time delay difference B '_mn through an LFSR confusion structure, calculating the Hamming distance between the response R' _mn and the response R _mn, and storing the Hamming distance into a matrix N _t;

(5) Traversing all challenges, traversing all PUF pattern models;

(6) The maximum hamming distance in the matrix is taken as the hamming distance threshold, where N matrix n= (N ₁、...、N_t、...、N_c).

Before the protocol is realized, the algorithm is utilized to count the Hamming distance in the chip to obtain a Hamming distance threshold T _h under different environmental conditions of the proposed PUF, so that the misjudgment rate in the protocol authentication process is reduced, and the reliability of response generation is ensured.

The identity authentication method provided by the invention comprises three stages, namely a registration stage, an identity authentication stage and a key updating stage. The registration phase is performed in a secure channel before the device leaves the factory, and the authentication and key updating phases are performed in an unsecure channel which is actually full of threats. The invention provides a method for reconstructing a PUF to generate a response key, and the challenge signal is segmented into C ₁ and C ₂ when the mutual authentication of a device end and a server end is completed, wherein C ₁ is used for reconstructing the response of the PUF, C ₂ is used for verifying identity and is always positioned at the device end and is not in a channel, and the response used in registration, authentication and updating stages is the response output by the LFSR structure.

(1) The registration process in the registration phase is shown in fig. 7, and is specifically as follows:

The server sends a sufficient number of challenges and a symmetric key k _i of the corresponding device to the device, after the device receives the challenges and the corresponding key, the challenges are divided into a first challenge signal C ₁ and a second challenge signal C ₂, { C ₁,C₂,k_i } is stored locally, a response R _i is generated through a PUF structure based on delay difference quantization, the response R _i and the device ID _i are sent to the server, and { C ₁,ID_i,R_i,k_i } is stored locally by the server.

(2) The authentication process in the authentication phase is shown in fig. 8, and is specifically as follows:

(21) The device side firstly generates a random number N ₁ for encrypting the key through TRNG, encrypts the ID _i of the device side and the random number N ₁ based on the symmetric key k _i, And after encryptionAnd the identity authentication request is sent to a server side to indicate that the equipment side requests the next identity authentication process.

(22) When the server receives the transmission from the equipment endDecrypting by adopting a symmetric key k _i, extracting initial information ID _i、N₁ of the equipment end, and storing the equipment information pair through the equipment endIf verification is successful, extracting challenge C ₁ and response R _i which are stored according to ID _i, generating a random number N ₂ by the server, encrypting challenge C ₁, response R _i and random number N ₂ by using the random number N ₂ and symmetric key k _i,And challenge after encryptionResponse toRandom numberAnd sending the random number N ₂ to the equipment end, wherein the random number N ₂ is used for guaranteeing the freshness of information in each round of identity authentication process.

(23) When receiving the encrypted challengeResponse toRandom numberThen, the equipment calculates and decrypts to extract the random number N ₂,Decryption is performed using the obtained random number N ₂, challenge C ₁ and response R _i are obtained,Verifying whether the challenge C ₁ is the stored challenge C ₁ at the device end, if the verification fails, indicating that an attacker may be carrying out DOS attack, taking the challenge C ₁ stored at the device end in the previous round as the challenge C ₁ of the current round at the time to ensure the synchronization of the device and the server end, if the verification passes, generating R '_i＝PUF(C₁||C₂ by using the built-in PUF structure at the device end, detecting whether the Hamming distance between the response R _i and the response R' _i is within a Hamming distance threshold T _h, if the Hamming distance is not within the Hamming distance threshold T _h, indicating that the identity verification fails, immediately terminating the process, if the bit Yu Hanming is within the distance threshold T _h, indicating that the identity verification is successful, reconstructing the challenge at the device end, obtaining a new response R _i+1 based on the reconstructed challenge C ₁, regenerating a random number N ₃ by the device end, and recalculating the challenge at the front stageAnd will be stored for the next round of authentication, reconstructing the response R _i+1,R_i+1＝PUF(C′₁||C₂ of the PUF structure), the device end encrypts the reconstructed response R _i+1 based on the random number N ₃ The calculation uses the message authentication code m=mac (N ₂||R_i+1||N₃||k_i), M for confirming the integrity of the exchanged information, encrypting C' ₁ again,Parameters C' ₁ ^*, M,AndAnd sending the data to a server.

(24) When the server receives the parameters C' ₁ ^*, M,AndThen sequentially decrypting the random number N ₃, the response R _i+1 and the challenge C' ₁,The integrity of the message is checked by verifying the MAC, and if the MAC verification is successful, the response R _i+1 and the challenge C' ₁ are updated and restored.

(25) After the authentication is passed, the device side updates the stored challenge C ₁ of the previous round of local storage to the challenge C '₁,C₁←C′₁ of the current round of reconstruction, stores { C ₁,C₂,k_i }, and simultaneously, the server updates the stored challenge C ₁ of the previous round of local storage to the challenge C' ₁ of the current round of reconstruction, the challenge C ₁←C′₁, updates the response R _i of the previous round of local storage to the response R _i+1 of the current round of reconstruction, and responds R _i←R_i+1, stores { C ₁,ID_i,R_i,k_i }, and the parameters stored by both parties before the next round of identity authentication are consistent.

The identity authentication method of the PUF structure based on delay difference has the following beneficial technical effects:

(1) The mutual authentication method based on the reconstructed PUF is provided, and the model attack resistance and the physical attack resistance of an authentication protocol are further improved. The proposed protocol comprises a device end and a server end, and for protecting CRPs information, the protocol fully utilizes the characteristics of a front-section delay unit and a rear-section delay unit based on DEMUX, separates a challenge signal into C ₁ and C ₂, wherein C ₂ is always stored at the device end and does not appear on a communication link, and after each round of mutual authentication is finished, the challenge signal of the PUF is reconstructed to obtain a new reconstruction response key so as to improve the security of the protocol;

(2) Under the condition of environment fluctuation, the delay difference of the response can generate slight fluctuation, the response can be changed, a threshold generation algorithm is provided according to the Hamming distance of the response to reduce the protocol misjudgment rate, and the response in the threshold can pass identity verification.

Because the strong PUF has the characteristic of an exponential CRPs, a modeling algorithm based on machine learning can be trained by collecting a large number of CRPs, and the circuit structure of the strong PUF is simulated to obtain an approximate linear relation between challenges and responses, so that the response of the strong PUF is predicted, and the application of the strong PUF in an identity authentication protocol is seriously influenced. Thus, the resistance of a strong PUF to model attacks is an important security indicator. In the evaluation of the capability, six currently mainstream machine learning algorithms are used for testing the model attack resistance of the PUF circuit, and under the ideal condition that the six machine learning algorithms comprise ：Covariance Matrix Adaptation Evolution Strategy(CMA-ES),Logistic Regression(LR),Artificial Neural Networks(ANN),Deep Neural Network(DNN),Convolutional Neural Network(CNN),Support Vector Machines(SVM),, the model attack algorithm has an ideal value of 50% on the prediction precision of the PUF, so that the PUF has excellent model attack resistance. In the evaluation process, APUF-TDC, DEMUX PUF, DEMUX-TDC PUF and 3PXOR DDQ-APUF are taken as test objects, CRPs of 10k-100k (step length is 10 k) is respectively collected as test data, wherein 70% of the test data are used as training sets for training a machine learning model by a model attack algorithm, and 30% of the test data are used as test sets for verifying the model attack resistance of the PUF.

As can be seen intuitively from fig. 9, for the conventional APUF structures, the prediction accuracy of the six machine learning algorithms on APUF reaches 97% -99%, which indicates that the conventional APUF is completely broken through by the model attack. However, the invention improves the model attack resistance of the response generated by the digital code quantization and the confusion processing of the two delay path delay differences of the differential tap type circuit TDC to APUF, the average prediction rate of the APUF-TDC circuit is 58.01 percent and 54.19 percent respectively for CMA-ES and LR, and the model attack resistance is improved by 41 percent and 45 percent respectively compared with the traditional APUF, and the average prediction rate of the APUF-TDC circuit is basically between 80 percent and the model attack resistance is improved by 27 percent for ANN, DNN, CNN and SVM. For the proposed DEMUX PUF structure, the nonlinear vector of path selection is added through the front section of the PUF unit, and the delay time of nonlinearity is dynamically changed through the back section, so that the linearity characteristic between challenges and responses is reduced. From fig. 9, it can be observed that the prediction rate of CMA-ES, LR, CNN, DNN to DEMUX PUF is about 60%, and the prediction rate of ANN and SVM to DEMUX PUF is about 53%, so that the model attack resistance is effectively improved. In addition, the DEMUX-TDC PUF circuit is formed by combining the DEMUX PUF and the TDC quantization circuit, the prediction rate of six model attacks on the structure does not rise along with the increase of the size of the training set, and the prediction rate is always kept at about 50%, so that the model attack resistance is improved by about 10%. Meanwhile, compared with 3PXOR DDQ-APUF, the DEMUX-TDC PUF has a certain improvement on the model attack resistance, and can successfully resist two model attacks of CNN and DNN.

In summary, the present invention highlights that PUF circuits have excellent resistance against the six model attacks described above. In addition, the response generation mechanism of the TDC quantized strong PUF delay difference entropy source can further improve the model attack resistance of the delay class strong PUF, and the nonlinearity degree between challenges and responses is remarkably improved.

While the present invention has been described by way of example, it should be apparent that the practice of the invention is not limited by the foregoing, but rather is intended to cover various insubstantial modifications of the method concepts and teachings of the invention, either as applied to other applications without modification, or as applied directly to other applications, without departing from the scope of the invention.

Claims (10)

1. A PUF pattern based on delay difference quantization, the PUF pattern comprising:

the PUF circuit comprises two delay circuits connected in parallel, and the two delay circuits respectively output delay signals;

the device comprises a multi-layer differential tap circuit TDC, a decoder connected with each layer of differential tap circuit TDC, a delay data quantization unit connected with the multi-layer decoder, and an LFSR confusion structure connected with the delay data quantization unit;

The two delay circuits are connected with the differential tap circuit TDC through a signal selection structure, delay signals of response and response in the two delay circuits are input into a start end and a stop end of each layer of differential tap circuit TDC respectively through the signal selection structure, the delay time of the start end is higher than that of the stop end, a decoder determines the delay time of the two delay circuits under corresponding delay resolution based on output signals of the corresponding differential tap circuit TDC, a delay data quantization unit averages the delay times under different delay resolutions to be used as final delay data, and the final delay data is mixed through an LFSR confusion structure to output final response R.

2. The PUF structure based on delay differential quantization of claim 1, wherein the delay circuit is formed by serially connecting multiple stages of delay units, each stage of delay unit comprises a fourth-stage MUX and a fourth-stage DEMUX connected with the output end of the MUX, two output ends of the DEMUX are connected with a first exclusive-or gate, the other two output ends are connected with a second exclusive-or gate, the first exclusive-or gate and the second exclusive-or gate are connected with a third exclusive-or gate, and the output of the third exclusive-or gate is connected with the fourth-stage MUX of each stage of delay unit of the next stage.

3. The PUF structure of claim 2, wherein the challenge signal C is processed in segments to obtain a first challenge signal C ₁ and a second challenge signal C ₂ with the same length, the 4 n-th bit to 4 (n+1) th bit of the first challenge signal C ₁ are sequentially configured to two select ends of the MUX and the DEMUX in the n+1-th order delay period element, the MUX selects one of four input signals based on the two-bit control signal, the DEMUX selects one of four output signals based on the two-bit control signal to output, the 4 n-th bit to (4n+2) th bit of the second challenge signal C ₂ are configured to two unrelated bit ends of the first and second exclusive-OR gates in the n+1-th order delay period element, the (4n+2) th bit to 4 (n+1) th bit is configured to two unrelated bit ends of the third exclusive-OR gate in the n+1-th order delay unit, and the first, second and third exclusive-OR gate determine the duration of time applied to the corresponding exclusive-OR gate based on the two-bit control signal.

4. The PUF structure based on delay-differential quantization of claim 1, wherein the signal selection circuit is composed of two buffers and two second-order muxes, the signal Start and the signal Stop outputted by the two delay paths are inputted into the two buffers through the inputs of the signal selection circuit, the two buffers output corresponding signals to the input ends of the two second-order muxes respectively, and simultaneously the response signal R is configured to the selection ends of the two second-order muxes, when the signal Up is outputted before the signal Down, the signal Up is regarded as the signal Start through the second-order MUX, the signal Down is regarded as the signal Stop, when the signal Down is outputted before the signal Up, the response s=0, the signal Down is regarded as the signal Start through the second-order MUX, and the signal Up is regarded as the signal Stop.

5. The PUF structure based on delay differential quantization of claim 1, wherein each layer of differential tap circuit TDC is composed of m stages, each stage of delayer comprises IDELAYE with two different delay times t ₁、t₂ and an arbiter connected with two IDELAYE2, the signal Start and the signal Stop are respectively input into IDELAYE with delay time t ₁ and IDELAYE with delay time t ₂ in the stage of delayer, and the delay time t ₁ is greater than the delay time t ₂.

6. The PUF structure based on delay-differential quantization of claim 5, wherein the arbiter in the i-stage delayer is composed of a fourth-order MUX and a second-order MUX, the delay T _i and the delay D _i output by IDELAYE with the delay time T ₁、t₂ in the i-stage delayer are input to two selection ends of the corresponding fourth-order MUX, one input is selected by the fourth-order MUX to output based on the selection-end input selection signal, the output end is connected with the end of the second-order MUX, the other input end is connected with the corresponding input end of the fourth-order MUX, the output end outputs the i bit of the signal, and the selection end of the second-order MUX is connected with the enabling end.

7. The PUF pattern based on delay-differential quantization of claim 4, wherein a decoder connected to a T, j-th layer differential tap-type circuit TDC calculates a delay time T _j between two delay paths tested by the j-th layer differential tap-type circuit TDC, and the calculation formula is as follows:

T_j＝N_j×(t_1j-t_2j);

Wherein N _j is the number of high levels in the output signal of the j-th layer differential tap type circuit TDC, and t _1j、t_2j is the delay time of the delay device in the j-th layer differential tap type circuit TDC.

8. The PUF structure based on delay-difference quantization of claim 1, wherein the reference clock frequency f of each layer of differential tap circuit TDCs is the same, the reference clock frequencies f between different layers of differential tap circuit TDCs are different, delay signals generated under the same challenge signal are sent to differential tap circuit TDCs with different resolutions of each layer of delay devices for quantization of delay time, and the delay data quantization unit averages all quantized delay times as final delay time between two delay circuits.

9. An identity authentication method based on a PUF structure based on delay difference according to any one of claims 1 to 8, characterized in that the method specifically comprises the following steps:

(21) The equipment end generates a random number N ₁ for encrypting a key, encrypts an ID _i and a random number N ₁ of the equipment end based on a symmetric key k _i, and encrypts Sending the data to a server side;

(22) When the server receives the transmission from the equipment end Decrypting by adopting a symmetric key k _i, extracting initial information ID _i、N₁ of the equipment end, and storing the equipment information pair through the equipment endIf the verification is successful, extracting the locally stored first challenge signal C ₁ and response R _i according to the ID _i, generating a random number N ₂ by the server, encrypting the first challenge signal C ₁, response R _i and random number N ₂ by using the random number N ₂ and symmetric key k _i, and encrypting the encrypted first challenge signalResponse toRandom numberSending the data to a device end;

(23) When the device receives the encrypted first challenge signal Response toRandom numberThen, calculating decryption to extract a random number N ₂, decrypting by using the obtained random number N ₂ to obtain a first challenge signal C ₁ and a response R _i, verifying whether the first challenge signal C ₁ is the first challenge signal C ₁ stored by the device end, if the verification fails, taking the first challenge signal C ₁ of the last round stored locally as the first challenge signal C ₁ of the current round, if the verification passes, generating a response R '_i＝PUF(C₁||C₂ by the device end by using the PUF structure built in the PUF structure, detecting whether the Hamming distance between the response R _i and the response R' _i is within a Hamming distance threshold T _h, if the Hamming distance threshold T _h is within, regenerating a random number N ₃ by the device end, and recalculating the challenge of the front section of the PUFReconstructing response of PUF structure R _i+1,R_i+1＝PUF(C'₁||C₂), encrypting reconstructed response R _i+1 based on random number N ₃, computing and utilizing message authentication code, encrypting reconstructed first challenge signal C' ₁, and parameterizingM、AndSending the data to a server;

(24) When the server receives the parameters M、AndThen, sequentially decrypting the random number N ₃, the response R _i+1 and the first challenge signal C '₁, checking the integrity of the message by verifying the MAC, and if the MAC is successfully verified, updating and restoring the response R _i+1 and the first challenge signal C' ₁;

(25) After the authentication is passed, the device side updates the locally stored first challenge signal C ₁ of the previous round to the first challenge signal C '₁,C₁←C'₁ of the current round reconstruction, and simultaneously, the server updates the locally stored first challenge signal C ₁ of the previous round to the first challenge signal C' ₁ of the current round reconstruction, the first challenge signal C ₁←C'₁ updates the locally stored response R _i of the previous round to the response R _i+1 of the current round reconstruction, and the response R _i←R_i+1;

Where M is a message authentication code for confirming the integrity of the exchanged information, the message authentication code m=mac (N ₂||R_i+1||N₃||k_i).

10. The identity authentication method of PUF structure based on delay difference as set forth in claim 9, wherein the method for determining the hamming distance threshold T _h is as follows:

(1) Building a plurality of PUF structure models, and enumerating a plurality of challenge signals;

(2) Inputting the mth challenge into the nth PUF structure model at normal temperature and normal pressure, outputting a corresponding time delay difference B _mn by the PUF structure model, and outputting a response R _mn by the time delay difference B _mn through an LFSR confusion structure;

(3) Traversing all challenges and all PUF pattern models;

(4) Changing the environment temperature and/or the voltage of a PUF structure model for the t time, wherein the t is 1 to c, inputting the mth challenge into the nth PUF structure model, outputting a corresponding time delay difference B '_mn by the PUF structure model, outputting a response R' _mn by the time delay difference B '_mn through an LFSR confusion structure, calculating the Hamming distance between the response R' _mn and the response R _mn, and storing the Hamming distance into a matrix N _t;

(5) Traversing all challenges and all PUF pattern models;

(6) The maximum hamming distance in the matrix is taken as the hamming distance threshold, where N matrix n= (N ₁、...、N_t、...、N_c).