Abstract: To enable scalable IoT systems, edge computing, as a new decentralized model, is introduced into IoT scenarios. Zero trust architecture (ZTA) is wellsuited for cloudedgeend systems with blurred boundaries, offering continuous dynamic authentication and improved security. Due to their lightweight and unclonable properties, physical unclonable functions (PUFs) are often used to generate hardware fingerprint identities for devices. PUFs exploit inherent randomness introduced during hardware fabrication processes to generate unique and nonpredictable challengeresponse pairs. If an attacker collects many plaintext CRPs during continuous authentication, he may model and predict future responses, enabling machine learning attacks. This paper proposes a PUFbased authentication solution (PAMLCA). It enhances privacy protection against machine learning attacks by leveraging oblivious pseudorandom function techniques to obfuscate CRP transmission. The solution combines static and continuous multilayer dynamic verification protocols, limiting implicit trust domains within a session. Security analysis and performance comparisons demonstrate that PAMLCA offers better security, functionality, communication, and computational efficiency compared to other related solutions.

Key words: Internet of things, zero trust, identity authentication, physical unclonable function, privacy preservation

摘要： 为构建高扩展物联网系统，边缘计算作为一种新兴的去中心化计算模式被引入物联网场景.零信任架构可以很好契合模糊边界的云边端系统，满足持续的动态认证并提升安全性.在频繁的认证需求下，物理不可克隆函数因其轻量化和不可克隆的特点常被用作生成设备的硬件指纹身份.物理不可克隆函数利用硬件工艺的随机因素，生成唯一且不可预测的挑战响应对.如果攻击者在持续的认证中收集到大量的明文挑战响应对，就能建模预测接下来的响应输出而完成机器学习攻击.提出了一种基于物理不可克隆函数的认证解决方案(PAMLCA)，针对抗机器学习攻击进行隐私保护增强，通过不经意伪随机函数技术实现挑战响应对盲化传输.方案整体结构为静态与持续结合的多层动态验证方案，能够在会话中控制隐含信任域.通过安全性分析和性能对比，证明了PAMLCA较其他相关方案能够提供更好的安全性、功能、通信和计算成本.

关键词: 物联网, 零信任, 身份认证, 物理不可克隆函数, 隐私保护