## 4 Flexible Physical Layer Authentication Mechanism  
To ensure the security of quantum device access to the network, this paper proposes FPLA against spoofing attacks by malicious UEs. FPLA exploits the characteristics of the wireless channel to perform physical layer authentication, which is more robust and efficient than traditional cryptography-based methods. Specifically designed for quantum UEs in MU-MIMO systems with different number of antennas, FPLA can make policy adjustments based on the feature dimension.  
Figure 2 illustrates the flow of FPLA. The flow is divided into training and authentication sessions. When the UE is first connected to the QKD network, the CSI values of all UEs are obtained by channel estimation and feature extraction is performed, which is divided into training and test sets. The training data are sent to the DTRN network for training and model convergence marks the completion of model training. In the authentication phase, only the D-Res network needs to be embedded in the base station. After the UE first accesses the QKD network, it first performs an initial network authentication according to the cryptography-based higher-layer authentication protocol specified by QKD. Similar to the training process, the CSI values are obtained by channel estimation and dimensional features are extracted, and fed into the well-trained D-Res network, while updating the CSI training database. It is determined whether the authentication exceeds the preset threshold, so as to distinguish between legitimate and malicious UEs. If it is a malicious UE, Alice terminates the network access process of the UE. If it is a legitimate UE, Alice will perform the following operations: allow the legitimate UE to access the network to perform QKD services, and at the same time change the SRS reporting method to increase spectral efficiency. After the initial authentication of network entry is completed, the features will be extracted from the CSI carried by the SRS reported by the UE to complete the physical layer authentication based on the wireless channel.  
The implementation of the training algorithm is shown in Algorithm 1, and Algorithm 2 shows how to classify legitimate and malicious UEs with the pre-trained DTRN model.  
```
Input: CSI of legitimate UE \(x_{real}\) with label \(y_{real}\), csi of malicious UE \(x_{fake}\) with label \(y_{fake}\) Output: parameter \(D_{\theta}\) of DTRN
1 Initialize the network parameter; \(\theta\)
2 Get CSI of all UEs;
3 Feature extraction, and divide the training dataset and validation dataset;
4 repeat
5\(L=\frac{1}{N}\sum_{i}[-y_{i}\cdot\log(p_{i})+(1-y_{i})\cdot\log(1-p_{i})]\)
6 Update the value of \(\theta\) untilDTRN convergence;
```  
**Algorithm 1**Train DTRN model  
Figure 2: FPLA workflows. The workflow consists of two sessions: training and authentication. In the training session, the CSI values and features of all UEs are obtained and used to train the DTRN network. In the authentication session, the CSI values and features of new UEs are fed into the D-Res network to verify their legitimacy. Then, the network outputs a score that indicates the similarity between the new UE and the legitimate UE, and compares it with a threshold to determine whether to accept or reject the new UE.