Multi-level security authentication method and system

Abstract

The invention discloses a multi-level security authentication method and system, and relates to the technical field of the Internet of Things, and the method comprises the steps: enabling a new node to verify the anti-quantum signature legality and behavior feature trust score of an identity certificate through a neighbor node according to a dynamic authentication path, and outputting a device layer authentication result; according to the equipment layer authentication result, selecting a verification node in an authentication path to carry out identity recheck and trust score weighted updating on a new node to obtain a neighbor layer authentication result and a whole network trust score; based on the neighbor layer authentication result, the core node verifies the whole network trust score and anti-quantum signature legality of the new node through the dynamic authentication atlas, and performs updating and anomaly detection on the dynamic atlas; through anti-quantum signature verification and behavior feature trust scoring, the ability of new node authentication to resist quantum computing attack and malicious node disguise is enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and in particular to a multi-level security authentication method and system. Background Art

[0002] With the rapid development of Internet of Things technology, more and more devices are connected to the network, and the scale and complexity of the network are increasing. However, the security risks brought by the access of new nodes have also become prominent. The traditional single-level authentication method has shown many shortcomings when facing the increase in the number of devices, malicious node disguise and network attacks. In current research, physical layer characteristics (such as channel state information and received signal strength) are widely used in device authentication because they are difficult to forge. In addition, dynamic authentication graphs, as a graph structured representation method, can reflect the trust relationship between nodes in real time, and have gradually become an important tool for solving dynamic network security problems.

[0003] The existing authentication systems mainly face the following shortcomings: First, for the authentication of new nodes, most methods rely on static authentication mechanisms and cannot dynamically adapt to changes in network topology and node behavior, resulting in reduced authentication efficiency and accuracy. Second, the existing technology is usually based on only a single level of node relationships in the trust score calculation, which is difficult to fully reflect the global trust of the node and is easily affected by malicious nodes. Finally, in the face of quantum computing threats, the security of traditional signature algorithms has gradually decreased, but the application of existing systems to counter quantum signatures is still imperfect. Summary of the invention

[0004] In view of the above existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides a multi-level security authentication method to solve the problems of dynamically generating authentication paths, verifying the legitimacy of quantum-resistant signatures, and calculating the trust score of the entire network when a new node accesses the network.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In a first aspect, the present invention provides a multi-level security authentication method, which comprises:

[0008] When a new node accesses the network, the neighboring node extracts the physical layer characteristics of the new node by receiving wireless signals, generates a physical layer fingerprint and performs preliminary authentication;

[0009] Based on the preliminary authentication results of the physical layer fingerprint, the authentication map is dynamically updated to generate a dynamic authentication path;

[0010] Based on the dynamic authentication path, the new node verifies the legitimacy of the quantum-resistant signature and the trust score of the behavioral characteristics of the identity credential through the neighboring nodes, and outputs the device-level authentication result;

[0011] According to the device-level authentication result, select the verification node in the authentication path to conduct identity review and weighted update of the trust score of the new node, and obtain the neighbor-level authentication result and the trust score of the entire network;

[0012] Based on the neighbor layer authentication results, the core node verifies the new node's network-wide trust score and the legitimacy of the quantum-resistant signature through a dynamic authentication graph, and updates and detects anomalies in the dynamic graph.

[0013] As a preferred solution of the multi-level security authentication method of the present invention, when a new node accesses the network, the neighboring node extracts the physical layer characteristics of the new node by receiving wireless signals, generates a physical layer fingerprint and performs preliminary authentication, including the following steps:

[0014] The new node broadcasts access request information to neighboring nodes through wireless communication;

[0015] The neighboring node extracts the channel state information and measures the received signal strength of the new node’s wireless signal by sampling the wireless signal sent by the new node;

[0016] The extracted channel state information and received signal strength are combined to generate the physical layer fingerprint of the new node;

[0017] The neighboring node matches the generated physical layer fingerprint of the new node with the physical layer fingerprint library of the legal node stored locally. The expression is:

[0018] ;

[0019] in, Indicates the new node fingerprint and the The similarity score of fingerprints, represents the new node fingerprint, Indicates the first fingerprints, Represents the fingerprint index in the fingerprint library, represents the eigenvalue index, represents the number of eigenvalues, The first eigenvalues, Indicates the fingerprint database The fingerprint eigenvalues;

[0020] Set a similarity threshold, compare the similarity score with the similarity threshold, and determine whether the fingerprint match is successful.

[0021] As a preferred solution of the multi-level security authentication method of the present invention, wherein: based on the preliminary authentication result of the physical layer fingerprint, dynamically updating the authentication map and generating a dynamic authentication path include the following steps:

[0022] After receiving the new node sent by the neighbor node, the network control center adds the new node to the node set in the dynamic graph;

[0023] According to the neighbor node set of the new node, add edges between the new node and the neighbor nodes, and calculate the weight of each edge;

[0024] ;

[0025] in, Indicates the starting node and the terminal node The weight between represents the starting node, Represents the termination node, Indicates the starting node and the terminal node The certification cost between represents the weight factor of the authentication cost, represents the weight factor of the trust score, Indicates the starting node and the terminal node Trust score between

[0026] According to the dynamic graph and the calculated edge weights, the shortest path algorithm is used to generate the authentication path from the new node to the core nodes of the entire network. The expression is:

[0027] ;

[0028] in, represents the initial authentication path of the new node, Represents a path in the dynamic authentication graph.

[0029] As a preferred solution of the multi-level security authentication method of the present invention, wherein: according to the dynamic authentication path, the new node verifies the legitimacy of the anti-quantum signature and the trust score of the behavioral characteristics of the identity certificate through the neighbor node, and outputs the device layer authentication result, including the following steps:

[0030] The new node sends an authentication request message to its neighbor nodes based on the authentication path information provided in the dynamic authentication graph;

[0031] After receiving the authentication request message from the new node, the neighboring node uses the public key of the network control center to verify the identity certificate and quantum-resistant signature of the new node;

[0032] Based on the verification results of quantum-resistant signatures, the behavior of new nodes is monitored in real time;

[0033] Neighboring nodes compare these behaviors with historical normal behavior models and calculate behavior deviation scores;

[0034] The neighboring node updates the trust score of the new node based on the authentication result and the behavior deviation score;

[0035] Set a trust threshold, compare the trust score of the updated new node with the trust threshold, and output the device-level authentication result.

[0036] As a preferred solution of the multi-level security authentication method of the present invention, wherein: according to the device layer authentication result, the verification node in the authentication path is selected to perform identity review and trust score weighted update on the new node, and the neighbor layer authentication result and the whole network trust score are obtained, including the following steps:

[0037] The network control center obtains the connection relationship and edge weight between the new node and the neighboring nodes based on the dynamic authentication graph;

[0038] Based on the shortest path algorithm of the dynamic graph, the neighbor node set with the lowest authentication cost is selected as the verification node set;

[0039] The new node sends an authentication request message to each verification node based on the information of the verification node set;

[0040] Each verification node re-checks the legitimacy of the new node’s identity credentials and quantum-resistant signature;

[0041] Based on the review results and the trust score of the device layer, combined with its own trust score, the trust score of the new node is weighted and updated to obtain the trust score of the entire network;

[0042] Set the trust threshold of the network layer, compare the trust score of the entire network with the trust threshold of the network layer, and obtain the neighbor layer authentication result.

[0043] As a preferred solution of the multi-level security authentication method of the present invention, based on the neighbor layer authentication result, the core node verifies the network-wide trust score and quantum-resistant signature legitimacy of the new node through a dynamic authentication graph, including the following steps:

[0044] The network control center broadcasts the neighbor layer verification results to the network layer core node set;

[0045] The core node obtains the network-wide connection relationship and network-wide trust score of the new node from the dynamic authentication graph;

[0046] According to the security policy of the network layer, the core node determines whether the network-wide trust score of the new node meets the security threshold of the network layer;

[0047] When the network-wide trust score of a new node is less than the security threshold, the core node triggers a high-intensity quantum-resistant authentication and requires the new node to submit a multi-factor signature.

[0048] The core node verifies the first factor signature and the second factor signature submitted by the new node respectively;

[0049] The core node queries the physical layer fingerprint in the dynamic authentication map and compares it with the fingerprint data submitted by the new node in the device layer and neighbor layer authentication to obtain the physical layer fingerprint verification result;

[0050] The core node verifies the integrity and consistency of the dynamic authentication path of the neighbor layer;

[0051] The core node combines the results of the whole network trust score, multi-factor signature verification, physical layer fingerprint review and dynamic authentication path verification to determine whether the network layer authentication has passed.

[0052] As a preferred solution of the multi-level security authentication method of the present invention, the updating and anomaly detection of the dynamic graph based on the network-wide trust score of the new node and the legitimacy verification result of the anti-quantum signature includes the following steps:

[0053] After the network layer authentication is passed, the network control center broadcasts the authentication result and trust score of the new node to the entire network, informs all nodes of the authentication result, and formally adds the new node to the dynamic authentication map for update;

[0054] Extract the trust score change rate, communication frequency, edge weight change rate and authentication path change rate associated with the node from the updated dynamic authentication graph;

[0055] Based on the extracted data, define the anomaly detection threshold of the trust score change rate, the anomaly detection threshold of the communication frequency, the anomaly detection threshold of the edge weight change rate, and the anomaly detection threshold of the authentication path change rate;

[0056] Compare the extracted data with the corresponding anomaly detection threshold. When a node meets any abnormal condition, it is determined to be an abnormal node.

[0057] For detected abnormal nodes, the nodes and their related edges are temporarily isolated from the authentication graph, and the re-authentication process is triggered;

[0058] When no abnormal nodes are detected, the authentication process ends and the dynamic authentication graph enters a stable operating state.

[0059] In a second aspect, the present invention provides a multi-level security authentication system, comprising:

[0060] Initial authentication module: When a new node accesses the network, the neighboring node extracts the physical layer characteristics of the new node by receiving wireless signals, generates a physical layer fingerprint and performs initial authentication;

[0061] The map update module dynamically updates the authentication map and generates a dynamic authentication path based on the preliminary authentication results of the physical layer;

[0062] Device authentication module: Based on the dynamic authentication path, the new node verifies the legitimacy of the quantum-resistant signature and the trust score of the behavioral characteristics of the identity credential through the neighboring nodes, and outputs the device-level authentication result;

[0063] The neighbor authentication module selects the verification node in the authentication path to perform identity review and weighted update of the trust score of the new node based on the device layer authentication result, and obtains the neighbor layer authentication result and the trust score of the whole network;

[0064] Anomaly detection module, based on the neighbor layer authentication results, the core node verifies the new node's full network trust score and the legitimacy of the quantum-resistant signature through a dynamic authentication graph, and updates and detects anomalies in the dynamic graph.

[0065] In a third aspect, the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, any step of the multi-level security authentication method as described in the first aspect of the present invention is implemented.

[0066] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the multi-level security authentication method as described in the first aspect of the present invention.

[0067] The beneficial effects of the present invention are as follows: by extracting the physical layer fingerprint of the new node through the neighbor node and performing preliminary authentication, the security risks caused by forged identity information in traditional identity authentication are effectively avoided, and the reliability of authentication is improved by utilizing the physical layer characteristics; the authentication path is generated based on the dynamic authentication graph, so that the authentication process can adapt in real time with the changes in network topology, significantly improving the authentication efficiency and reducing the authentication cost; the dynamic authentication graph also ensures the optimality of the authentication path by dynamically adjusting the edge weights and comprehensively considering the authentication cost and trust score; through anti-quantum signature verification and behavioral feature trust score, the resistance of new node authentication to quantum computing attacks and malicious node disguise is enhanced; the anomaly detection mechanism of the dynamic authentication graph can monitor node behavior in real time, quickly isolate abnormal nodes and trigger the re-authentication process, thereby improving the robustness of the authentication system and the overall security of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0069] Figure 1 This is a flow chart of the multi-level security authentication method in Example 1.

[0070] Figure 2 This is a schematic diagram of multi-layer authentication in Example 1. DETAILED DESCRIPTION

[0071] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0072] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0073] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0074] Example 1, reference Figure 1 and Figure 2 , is the first embodiment of the present invention, which provides a multi-level security authentication method, comprising the following steps:

[0075] S1. When a new node accesses the network, the neighboring node extracts the physical layer characteristics of the new node by receiving wireless signals, generates a physical layer fingerprint and performs preliminary authentication.

[0076] S1.1. The new node broadcasts access request information to neighboring nodes via wireless communication.

[0077] The request message includes the node's identification information, current timestamp, public key and encrypted signature; the current timestamp is used to prevent replay attacks; the public key is used for subsequent quantum-resistant signature verification; the encrypted signature is generated by the quantum-resistant signature of the new node's private key pair.

[0078] S1.2, the neighboring node extracts the channel state information and measures the received signal strength of the wireless signal of the new node by sampling the wireless signal sent by the new node;

[0079] Specifically, the expression of received signal strength is:

[0080] ;

[0081] in, Indicates the received signal strength, which is used to infer the authenticity of the physical location of the new node. Indicates that the new node is at time The transmission power, Indicates the physical distance between the new node and its neighboring nodes. The farther the distance, the greater the signal attenuation. It represents the channel path loss, which is the power attenuation caused by distance and environmental factors when the signal propagates from the new node to the neighboring node. It is calculated based on the distance and path loss index, and the expression is:

[0082] ;

[0083] in, Represents the path loss index, which describes the attenuation rate of the signal in a specific environment. Typical values ​​are 2 (free space) and 3-5 (indoor environment). Represents the random fading component, which is the random signal strength fluctuation caused by multipath effects (signal reflection, scattering) and environmental noise.

[0084] S1.3. Combine the extracted channel state information and the received signal strength to generate the physical layer fingerprint of the new node; the neighboring node matches the generated physical layer fingerprint of the new node with the locally stored physical layer fingerprint library of legal nodes, and the expression is:

[0085] ;

[0086] in, Indicates the new node fingerprint and the The similarity score of fingerprints, represents the new node fingerprint, Indicates the first fingerprints, Represents the fingerprint index in the fingerprint library, represents the eigenvalue index, represents the number of eigenvalues, The first eigenvalues, Indicates the fingerprint database The fingerprint eigenvalues;

[0087] A similarity threshold is set. When the similarity score exceeds the similarity threshold, the fingerprint match is successful. The neighbor node binds the physical layer fingerprint of the new node with its access request information and sends the matching result to the network control center. When the similarity score is lower than the similarity threshold, the access request is rejected and the process ends.

[0088] S2. Based on the preliminary authentication result of the physical layer fingerprint, dynamically update the authentication map and generate a dynamic authentication path.

[0089] S2.1. After receiving the new node sent by the neighbor node, the network control center adds the new node to the node set in the dynamic graph; according to the neighbor node set of the new node, the network control center adds edges with the neighbor nodes for the new node and calculates the weight of each edge;

[0090] ;

[0091] in, Indicates the starting node and the terminal node The weight between represents the starting node, Represents the termination node, Indicates the starting node and the terminal node The certification cost between represents the weight factor of the authentication cost, represents the weight factor of the trust score, Indicates the starting node and the terminal node Trust score between

[0092] Specifically, the expression of authentication cost is:

[0093] ;

[0094] in, Indicates the starting node and the terminal node The communication delay between Indicates the starting node and the terminal node The computational consumption between

[0095] The expression of trust score is:

[0096] ;

[0097] in, Indicates the starting node and the terminal node The trust score between represents the weight factor of the trust score feedback, It represents the trust score of the neighboring node on the new node, and provides the subjective evaluation of the neighboring node on the trust of the new node. Indicates the default initial trust score of a new node, ensuring that the new node can still obtain a basic trust value when there is no neighbor score feedback.

[0098] S2.2. Based on the dynamic graph and the calculated edge weights, the shortest path algorithm is used to generate the authentication path from the new node to the core node of the entire network. The expression is:

[0099] ;

[0100] in, represents the initial authentication path of the new node, Represents a path in the dynamic authentication graph.

[0101] S3. Based on the dynamic authentication path, the new node verifies the legitimacy of the quantum-resistant signature and the behavioral feature trust score of the identity credential through the neighboring nodes, and outputs the device-level authentication result.

[0102] S3.1. The new node sends an authentication request message to its neighbor node according to the authentication path information provided in the dynamic authentication graph. After receiving the authentication request message from the new node, the neighbor node uses the public key of the network control center to verify the identity credentials of the new node. When the verification fails, it means that the identity credentials are invalid, and the neighbor node rejects the authentication request. When the verification succeeds, the neighbor node uses the public key of the new node to verify the quantum-resistant signature in the authentication message. Based on the verification result of the quantum-resistant signature, the behavior of the new node is monitored in real time. The neighbor node compares these behaviors with the historical normal behavior model and calculates the behavior deviation score.

[0103] Specifically, the expression of behavioral deviation score is:

[0104] ;

[0105] in, represents the behavioral deviation score, Indicates the currently monitored Behavioral characteristic values, The normal behavior model feature values.

[0106] S3.2. The neighboring node updates the trust score of the new node based on the identity authentication result and the behavior deviation score; sets a trust threshold, compares the updated trust score of the new node with the trust threshold, and determines the device layer authentication result; when the trust score of the updated new node is greater than the trust threshold, the device layer authentication passes, and the neighboring node submits the result to the network control center; when the trust score of the updated new node is less than the trust threshold, the device layer authentication fails, the authentication request is rejected, and the abnormal behavior is recorded.

[0107] Specifically, based on the identity verification result and the behavior deviation score, the expression for updating the trust score of the new node is:

[0108] ;

[0109] in, Indicates the updated trust score of the new node, Indicates the starting node and the terminal node The weight parameter of the trust score between represents the identity verification score, represents the weight parameter of the identity verification score, Represents the weight parameter of the behavioral deviation score.

[0110] S4. According to the device-layer authentication result, select the verification node in the authentication path to conduct identity review and weighted update of the trust score of the new node to obtain the neighbor-layer authentication result and the trust score of the entire network.

[0111] S4.1. The network control center obtains the connection relationship and edge weight between the new node and the neighboring nodes according to the dynamic authentication graph; based on the shortest path algorithm of the dynamic graph, the neighboring node set with the lowest authentication cost is selected as the verification node set; the new node sends an authentication request message to each verification node according to the information of the verification node set; each verification node re-verifies the legitimacy of the identity credentials and quantum-resistant signature of the new node; based on the review result and the trust score of the device layer, combined with its own trust score, the trust score of the new node is weighted updated to obtain the trust score of the entire network; the trust threshold of the network layer is set, and the trust score of the entire network is compared with the trust threshold of the network layer to obtain the authentication result of the neighbor layer.

[0112] Specifically, when the network-wide trust score is greater than the network layer trust threshold, the neighbor layer authentication is successful; when the network-wide trust score is less than the network layer trust threshold, the neighbor layer authentication fails, the authentication request is rejected, and the abnormal behavior is recorded.

[0113] S5. Based on the neighbor layer authentication results, the core node verifies the network-wide trust score and quantum-resistant signature legitimacy of the new node through the dynamic authentication graph, and updates and detects anomalies in the dynamic graph.

[0114] S5.1. After the neighbor layer verification is completed, the network control center broadcasts the neighbor layer verification results to the network layer core node set; the core node obtains the full network connection relationship and full network trust score of the new node from the dynamic authentication graph; according to the security policy of the network layer, the core node determines whether the full network trust score of the new node meets the security threshold of the network layer.

[0115] Specifically, when the network-wide trust score of the new node is greater than the security threshold, the network-wide trust score verification is passed; when the network-wide trust score of the new node is less than the security threshold, the core node triggers high-intensity anti-quantum authentication and requires the new node to submit a multi-factor signature.

[0116] S5.2. The core node verifies the first factor signature and the second factor signature submitted by the new node respectively;

[0117] The core node queries the physical layer fingerprint in the dynamic authentication map, and compares it with the fingerprint data submitted by the new node in the device layer and neighbor layer authentication to obtain the physical layer fingerprint review result; the core node verifies the integrity and consistency of the neighbor layer dynamic authentication path; the core node combines the results of the full network trust score, multi-factor signature verification, physical layer fingerprint review and dynamic authentication path verification to determine whether the network layer authentication is passed; when all verifications are passed, the network layer authentication is successful; when any verification fails, the network layer authentication fails and the new node is denied access.

[0118] S5.3. Based on the network-wide trust score of the new node and the legitimacy verification results of the quantum-resistant signature, the dynamic graph is updated and anomaly detected.

[0119] S5.3.1. After the network layer authentication is passed, the network control center broadcasts the authentication result and trust score of the new node to the entire network, informs all nodes of the authentication result, and formally adds the new node to the dynamic authentication graph for update; extracts the trust score change rate, communication frequency, edge weight change rate and authentication path change rate related to the node from the updated dynamic authentication graph.

[0120] Specifically, the expression of the trust score change rate is:

[0121] ;

[0122] in, represents the trust score change rate, Indicates the current node Trust score, Representation Node The trust score of the last moment indicates a node in the dynamic authentication graph, which represents a device or entity in the network;

[0123] The expression of communication frequency is:

[0124] ;

[0125] in, Representation Node The communication frequency, Indicates the time interval, Representation Node The total number of messages sent;

[0126] The expression of the edge weight change rate is:

[0127] ;

[0128] in, Indicates the starting node and the terminal node The weight change rate between Indicates the starting node and the terminal node The weight of the current moment between Indicates the starting node and the terminal node The weight of the previous moment between ;

[0129] The expression of the authentication path change rate is:

[0130] ;

[0131] Representation Node The certification path change rate, Representation Node The current set of certification paths, Representation Node The set of authentication paths at the previous moment.

[0132] S5.3.2. Based on the extracted data, define the anomaly detection threshold of the trust score change rate, the anomaly detection threshold of the communication frequency, the anomaly detection threshold of the edge weight change rate, and the anomaly detection threshold of the authentication path change rate; compare the extracted data with the corresponding anomaly detection threshold, and when the node meets any abnormal condition, it is determined to be an abnormal node; for the detected abnormal node, temporarily isolate the node and its related edges from the authentication graph, and trigger the re-authentication process; when no abnormal node is detected, the authentication process ends, and the dynamic authentication graph enters a stable operation state.

[0133] Specifically, the anomaly detection threshold of the trust score change rate is set as , the abnormal detection threshold of communication frequency is , the anomaly detection threshold of the edge weight change rate is , the abnormal detection threshold of the authentication path change rate is ;

[0134] Detection of a sharp drop in trust score: When ≤ When , the trust score of node 𝑣 is considered abnormal;

[0135] Communication frequency abnormality detection: When ≥ When , the communication frequency of node 𝑣 is considered abnormal;

[0136] Edge weight fluctuation detection: When ≥ When abnormal;

[0137] Certification path change anomaly detection: When ≤ When , it is considered that the authentication path of node 𝑣 is abnormal.

[0138] The abnormal node resubmits the authentication request and re-verifies according to the authentication process of the device layer, neighbor layer and network layer;

[0139] If re-authentication fails, the node will be permanently isolated;

[0140] If the re-authentication is successful, the node is restored to the authentication graph and the relevant edge weights are updated.

[0141] This embodiment also provides a multi-level security authentication system, including: a preliminary authentication module, when a new node accesses the network, the neighbor node extracts the physical layer characteristics of the new node by receiving wireless signals, generates a physical layer fingerprint and performs preliminary authentication; a spectrum update module, based on the physical layer preliminary authentication result, dynamically updates the authentication spectrum and generates a dynamic authentication path; a device authentication module, according to the dynamic authentication path, the new node verifies the legitimacy of the anti-quantum signature and the trust score of the behavior characteristics of the identity credential through the neighbor node, and outputs the device layer authentication result; the neighbor authentication module, according to the device layer authentication result, selects the verification node in the authentication path to perform identity review and weighted update of the trust score of the new node, and obtains the neighbor layer authentication result and the whole network trust score; anomaly detection module, based on the neighbor layer authentication result, the core node verifies the whole network trust score and the legitimacy of the anti-quantum signature of the new node through the dynamic authentication spectrum, and updates the dynamic spectrum and performs anomaly detection.

[0142] This embodiment also provides a computer device suitable for a multi-level security authentication method, comprising: a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement the multi-level security authentication method proposed in the above embodiment.

[0143] The computer device may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covered on the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0144] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the multi-level security authentication method proposed in the above embodiment is implemented; the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read Only Memory, referred to as EPROM), programmable read-only memory (Programmable Red-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0145] In summary, the present invention effectively avoids the security risks caused by forged identity information in traditional identity authentication by: extracting the physical layer fingerprint of the new node through the neighbor node and performing preliminary authentication, while improving the reliability of authentication by utilizing the physical layer characteristics; generating an authentication path based on the dynamic authentication graph, so that the authentication process can adapt in real time with the changes in the network topology, significantly improving the authentication efficiency and reducing the authentication cost; the dynamic authentication graph also ensures the optimality of the authentication path by dynamically adjusting the edge weights, comprehensively considering the authentication cost and trust score; through anti-quantum signature verification and behavioral feature trust scoring, the new node authentication is enhanced to resist quantum computing attacks and malicious node disguise; the anomaly detection mechanism of the dynamic authentication graph can monitor node behavior in real time, quickly isolate abnormal nodes and trigger the re-authentication process, thereby improving the robustness of the authentication system and the overall security of the network.

[0146] Example 2, referring to Table 1, is the second example of the present invention. To further verify the technical solution of the present invention, experimental simulation data of a multi-level security authentication method is provided.

[0147] A small IoT network experimental environment was built. The experimental network contains 1 core node, 10 neighbor nodes, and 10 new access nodes. The core node is responsible for the management and update of the dynamic authentication map, the neighbor node is responsible for physical layer fingerprint collection and device layer authentication, and the new access node simulates the terminal device in the actual environment. The experiment uses a real wireless signal transmission environment, in which the channel state information (CSI) and received signal strength (RSSI) are used as feature data of the physical layer fingerprint. The quantum-resistant signature adopts a lattice cryptography-based scheme, and the behavioral feature trust score is calculated based on the historical communication behavior data of the device.

[0148] The experimental process includes the following steps:

[0149] Physical layer fingerprint extraction and preliminary authentication:

[0150] Each new access node broadcasts wireless signals to neighboring nodes. The neighboring nodes sample the received signals, extract CSI and RSSI data, and combine them to generate physical layer fingerprints. Subsequently, the neighboring nodes match the physical layer fingerprints with the stored legal fingerprint library for similarity, setting the similarity threshold to 0.9. The nodes that successfully match pass the preliminary authentication.

[0151] Dynamic authentication graph update and path generation:

[0152] After the initial authentication is successful, the core node adds the new node to the dynamic graph node set and generates edge weights based on the authentication results of neighboring nodes, which are calculated based on the feedback of neighboring nodes. The core node uses the shortest path algorithm to generate the optimal authentication path from each new node to the core node.

[0153] Device layer authentication:

[0154] The new node sends an authentication request through the neighboring nodes in the authentication path. The neighboring nodes verify its quantum-resistant signature and monitor its behavioral characteristics. The behavioral deviation score is calculated by comparing the current behavior of the new node with the historical normal behavior model. If the trust score is higher than the set threshold (0.75), the device layer authentication is passed.

[0155] Neighborhood-level authentication and trust score updates:

[0156] The core node selects a set of verification nodes based on the device layer authentication results. The verification node reviews the identity credentials of the new node and updates the results with its own weighted trust score to calculate the trust score of the entire network.

[0157] Network layer authentication and anomaly detection:

[0158] The core node evaluates the network-wide trust score of the new node. If the score is lower than 0.7, a high-intensity authentication is triggered, including multi-factor signature verification and physical layer fingerprint review. After the authentication is completed, the core node updates the dynamic map and monitors abnormal nodes in real time.

[0159] Assumptions:

[0160] New access node :5;

[0161] Legal fingerprint database : =1, 2, 3;

[0162] Similarity threshold: 0.9;

[0163] Each fingerprint feature value: 4 (i.e. m=4).

[0164] The details are shown in Table 1 below:

[0165] Table 1 New access nodes and legal fingerprint database data table

[0166] Calculate the similarity between each new access node and the fingerprint in the legal fingerprint library, as shown in Table 2 below:

[0167] Table 2 Similarity calculation results

[0168] The similarity calculation formula is:

[0169] ;

[0170] The following are the similarity calculation results between each new access node and the fingerprint in the legal fingerprint library:

[0171] Example calculation (with _1 and P_1 as examples):

[0172] molecular:

[0173] ;

[0174] Denominator:

[0175] ;

[0176] ;

[0177] Similarity:

[0178] ;

[0179] Other data are calculated according to the above method.

[0180] The new node that successfully matches the similarity is authenticated at the device layer, neighbor layer, and network layer. After the authentication is completed, the core node updates the dynamic map and detects abnormal nodes in real time. The initial state and current state data are shown in Table 3 below:

[0181] Table 3 Initial state and current state data table

[0182] The initial weight and current weight data are shown in Table 4 below:

[0183] Table 4 Initial weight and current weight data table

[0184]

[0185] Based on the above data, the anomaly detection results are obtained, as shown in Table 5 below:

[0186] Table 5 Anomaly detection results

[0187]

[0188] The specific process is as follows:

[0189] by _1 as an example, set the time interval Second,

[0190] The expression of trust score change rate is:

[0191] ;

[0192] ;

[0193] The expression of communication frequency is:

[0194] ;

[0195] ;

[0196] The expression of the edge weight change rate is:

[0197] ;

[0198] ;

[0199] The expression of the authentication path change rate is:

[0200] ;

[0201] ;

[0202] Trust score change rate anomaly detection threshold: =0.1, communication frequency change rate abnormal detection threshold: =0.2, edge weight change rate anomaly detection threshold: =0.15, authentication path change rate abnormal detection threshold: =0.1.

[0203] Compare each calculated data with the anomaly detection threshold to obtain an anomaly result;

[0204] _1 and _5 is determined to be an abnormal node because its authentication path change rate does not reach the threshold. The abnormal node is removed. _1 and _5. Update edge weights and authentication path sets to ensure the security and stability of the network.

[0205] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A multi-level security authentication method, characterized in that: include, When a new node accesses the network, the neighboring node extracts the physical layer characteristics of the new node by receiving wireless signals, generates a physical layer fingerprint and performs preliminary authentication; Based on the preliminary authentication results of the physical layer fingerprint, the authentication map is dynamically updated to generate a dynamic authentication path; Based on the dynamic authentication path, the new node verifies the legitimacy of the quantum-resistant signature and the trust score of the behavioral characteristics of the identity credential through the neighboring nodes, and outputs the device-level authentication result; According to the device-level authentication result, select the verification node in the authentication path to conduct identity review and weighted update of the trust score of the new node, and obtain the neighbor-level authentication result and the trust score of the entire network; Based on the neighbor layer authentication results, the core node verifies the new node's network-wide trust score and the legitimacy of the quantum-resistant signature through a dynamic authentication graph, and updates and detects anomalies in the dynamic graph.

2. The multi-level security authentication method according to claim 1, wherein: When a new node accesses the network, the neighboring node extracts the physical layer characteristics of the new node by receiving wireless signals, generates a physical layer fingerprint and performs preliminary authentication, including the following steps: The new node broadcasts access request information to neighboring nodes through wireless communication; The neighboring node extracts the channel state information and measures the received signal strength of the new node’s wireless signal by sampling the wireless signal sent by the new node; The extracted channel state information and received signal strength are combined to generate the physical layer fingerprint of the new node; The neighboring node matches the generated physical layer fingerprint of the new node with the physical layer fingerprint library of the legal node stored locally. The expression is: ； in, Indicates the new node fingerprint and the first The similarity score of fingerprints, represents the new node fingerprint, Indicates the first fingerprints, Represents the fingerprint index in the fingerprint library, represents the eigenvalue index, represents the number of eigenvalues, The first eigenvalues, Indicates the fingerprint database The fingerprint eigenvalues; Set a similarity threshold, compare the similarity score with the similarity threshold, and determine whether the fingerprint match is successful.

3. The multi-level security authentication method as claimed in claim 2, characterized in that: Based on the preliminary authentication result of the physical layer fingerprint, the authentication map is dynamically updated and the dynamic authentication path is generated, which includes the following steps: After receiving the new node sent by the neighbor node, the network control center adds the new node to the node set in the dynamic graph; According to the neighbor node set of the new node, add edges between the new node and the neighbor nodes, and calculate the weight of each edge; ； in, Indicates the starting node and the terminal node The weight between represents the starting node, Represents the termination node, Indicates the starting node and the terminal node The certification cost between represents the weight factor of the authentication cost, represents the weight factor of the trust score, Indicates the starting node and the terminal node Trust score between According to the dynamic graph and the calculated edge weights, the shortest path algorithm is used to generate the authentication path from the new node to the core nodes of the entire network. The expression is: ； in, represents the initial authentication path of the new node, Represents a path in the dynamic authentication graph.

4. The multi-level security authentication method as claimed in claim 3, characterized in that: According to the dynamic authentication path, the new node verifies the legitimacy of the quantum-resistant signature and the trust score of the behavioral characteristics of the identity certificate through the neighboring nodes, and outputs the device layer authentication result, including the following steps: The new node sends an authentication request message to its neighbor nodes based on the authentication path information provided in the dynamic authentication graph; After receiving the authentication request message from the new node, the neighboring node uses the public key of the network control center to verify the identity certificate and quantum-resistant signature of the new node; Based on the verification results of quantum-resistant signatures, the behavior of new nodes is monitored in real time; Neighboring nodes compare these behaviors with historical normal behavior models and calculate behavior deviation scores; The neighboring node updates the trust score of the new node based on the authentication result and the behavior deviation score; Set a trust threshold, compare the trust score of the updated new node with the trust threshold, and output the device-level authentication result.

5. The multi-level security authentication method as claimed in claim 4, characterized in that: According to the device layer authentication result, the verification node in the authentication path is selected to conduct identity review and trust score weighted update on the new node. The neighbor layer authentication result and the whole network trust score are obtained, including the following steps: The network control center obtains the connection relationship and edge weight between the new node and the neighboring nodes based on the dynamic authentication graph; Based on the shortest path algorithm of the dynamic graph, the neighbor node set with the lowest authentication cost is selected as the verification node set; The new node sends an authentication request message to each verification node based on the information of the verification node set; Each verification node re-checks the legitimacy of the new node’s identity credentials and quantum-resistant signature; Based on the review results and the trust score of the device layer, combined with its own trust score, the trust score of the new node is weighted and updated to obtain the trust score of the entire network; Set the trust threshold of the network layer, compare the trust score of the entire network with the trust threshold of the network layer, and obtain the neighbor layer authentication result.

6. The multi-level security authentication method as claimed in claim 5, characterized in that: Based on the neighbor layer authentication results, the core node verifies the network-wide trust score and quantum-resistant signature legitimacy of the new node through a dynamic authentication graph, including the following steps: The network control center broadcasts the neighbor layer verification results to the network layer core node set; The core node obtains the network-wide connection relationship and network-wide trust score of the new node from the dynamic authentication graph; According to the security policy of the network layer, the core node determines whether the network-wide trust score of the new node meets the security threshold of the network layer; When the network-wide trust score of a new node is less than the security threshold, the core node triggers a high-intensity quantum-resistant authentication and requires the new node to submit a multi-factor signature. The core node verifies the first factor signature and the second factor signature submitted by the new node respectively; The core node queries the physical layer fingerprint in the dynamic authentication map and compares it with the fingerprint data submitted by the new node in the device layer and neighbor layer authentication to obtain the physical layer fingerprint verification result; The core node verifies the integrity and consistency of the dynamic authentication path of the neighbor layer; The core node combines the results of the whole network trust score, multi-factor signature verification, physical layer fingerprint review and dynamic authentication path verification to determine whether the network layer authentication has passed.

7. The multi-level security authentication method according to claim 6, wherein: Based on the network-wide trust score of the new node and the legitimacy verification results of the quantum-resistant signature, the dynamic graph is updated and anomaly detected, including the following steps: After the network layer authentication is passed, the network control center broadcasts the authentication result and trust score of the new node to the entire network, informs all nodes of the authentication result, and formally adds the new node to the dynamic authentication map for update; Extract the trust score change rate, communication frequency, edge weight change rate and authentication path change rate associated with the node from the updated dynamic authentication graph; Based on the extracted data, define the anomaly detection threshold of the trust score change rate, the anomaly detection threshold of the communication frequency, the anomaly detection threshold of the edge weight change rate, and the anomaly detection threshold of the authentication path change rate; Compare the extracted data with the corresponding anomaly detection threshold. When a node meets any abnormal condition, it is determined to be an abnormal node. For detected abnormal nodes, the nodes and their related edges are temporarily isolated from the authentication graph, and the re-authentication process is triggered; When no abnormal nodes are detected, the authentication process ends and the dynamic authentication graph enters a stable operating state.

8. A multi-level security authentication system, based on the multi-level security authentication method according to any one of claims 1 to 7, characterized in that: include, Initial authentication module: When a new node accesses the network, the neighboring node extracts the physical layer characteristics of the new node by receiving wireless signals, generates a physical layer fingerprint and performs initial authentication; The map update module dynamically updates the authentication map based on the preliminary authentication results of the physical layer and generates a dynamic authentication path; Device authentication module: Based on the dynamic authentication path, the new node verifies the legitimacy of the quantum-resistant signature and the trust score of the behavioral characteristics of the identity credential through the neighboring nodes, and outputs the device-level authentication result; The neighbor authentication module selects the verification node in the authentication path to perform identity review and weighted update of the trust score of the new node based on the device layer authentication result, and obtains the neighbor layer authentication result and the trust score of the whole network; Anomaly detection module, based on the neighbor layer authentication results, the core node verifies the new node's full network trust score and the legitimacy of the quantum-resistant signature through a dynamic authentication graph, and updates and detects anomalies in the dynamic graph.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the multi-level security authentication method described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the multi-level security authentication method described in any one of claims 1 to 7 are implemented.

Images