# A Lightweight and Practical Anonymous Authentication Protocol Based on Bit-Self-Test PUF
## 5 Implementation and Analysis
### Implementation and Analysis of the Protocol  
It is important to note that this paper focuses on the PUF-related part of the authentication protocol and the secure communication between the server and the device. During the interaction phase between the user and the device, we connect the interaction interface to the backend database, and the user uses the interaction interface to perform the corresponding authentication while the backend database makes the corresponding query. To use the system, users need to register first, storing their ID and key in the database. When we need to authenticate the user with the device, the key entered by the user is checked in the  
Figure 6: Structure of the BST Arbiter PUF. Figure 7: Performance test results of BST-APUF with different numbers of delay modules. database for the match, and only if the key entered is identical to the key corresponding to the ID in the database can the system be used. For establishing a secure channel in the setup phase of the proposed protocol, we first use Cookie+Session for the front-end login. HTTP is a stateless protocol; each time the client sends a request, it should first establish a connection with the server, and after the request is completed, the connection will be disconnected again. This method can save the connection resources occupied during the transmission. The Cookie is a special piece of information (the password set by the user) that the server sends to the client, which is stored in text form on the client side. Each time the client sends a request to the server, it will send this special information together. With the Cookie, the server can access the information transmitted by the client, but if it needs to authenticate the information, the Session is required. The client requests the server, which opens up memory space for the request, which is the Session object. Once we have the Cookie and Session, we will be able to log in and perform authentication. In the secure communication phase, we can use covert timing channels to transmit secret information from one process to another. Moreover, we refer to the hierarchical entropy algorithm proposed by [PERSON] et al. [37; 38] for the efficient and accurate detection of covert timing channels. In Section 3.1, we introduced a novel HDA based on BST-PUF. In this paper, the \(KEY.Ext\)\(/KEY.Rec\) model is implemented according to the principles described in Figure 4, and the \(KEY.Ext\)\(/KEY.Rec\) execution process of this paper is shown in Figure 8. In the \(KEY.Ext\) phase, a string of random numbers generated by the TRNG is input to the LFSR as the original challenge of the PUF to generate the 64-group (because we use a 64-level cascade switch in the BST-APUF) N-bit challenge collection \(c_{i}\). Inputting \(c_{i}\) to the BST-PUF can generate the N-bit original response \(r_{m}\) and the N-bit helper data \(h_{i}\). Because the device uses \(c_{i}\) and \(h_{i}\) for key recovery during authentication, \(c_{i}\) and \(h_{i}\) are stored in the device's NVM. The \(r_{m1}\) and \(h_{i}\) are input to the robust response extractor to output the highly reliable response \(r_{c}\). To increase the entropy value of the key while ensuring low overhead, we choose the SPONGENT [39] lightweight hash as the entropy extractor to generate the high-entropy key \(k\). In the \(KEY.Rec\) phase, the \(c_{i}\) and \(h_{i}\), which are stored in the NVM in the \(KEY.Rec\) phase, is input into the BST-PUF and the robust response extractor, respectively. Although the collection of challenges used for key recovery is the same as that of the key generation phase, the output of the PUF may be biased due to environmental factors, so the original response \(r_{m2}\) of the key recovery phase is extracted using \(h_{i}\) to generate the robust response \(r_{c2}\). Since the BER of the response is tested in Section 5.1 to be below \(10^{-9}\) when the PUF has three delay gates, the key \(k\) can be recovered from the response \(r_{c2}\) after entropy extraction.