Security authentication method and system of Internet of Things equipment, medium and equipment

Abstract

The invention relates to the technical field of Internet of Things security, and provides a security authentication method and system for an Internet of Things device, a medium and a device, and the method comprises the steps: responding to an authentication request of the Internet of Things device, the authentication request comprising a unique identifier, a current timestamp and a comprehensive feature vector of the Internet of Things device; after the current timestamp and the comprehensive feature vector are connected, generating a random challenge value through a random function and sending the random challenge value to obtain a returned Internet of Things equipment response value; after the authentication key, the comprehensive feature vector and the random challenge value are connected, an expected response value is generated through a secure hash function, and whether the Internet of Things equipment is successfully authenticated or not is judged through comparison; and if the authentication is successful, generating a session key, connecting the authentication key with the session key, and updating the authentication key through a secure hash function. The common security threats such as replay attack and man-in-the-middle attack are effectively prevented, and the uniqueness and security of each authentication are ensured.

Description

Technical Field

[0001] The present invention belongs to the field of Internet of Things security technology, and in particular relates to a security authentication method, system, medium and equipment for Internet of Things devices. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] With the widespread use of IoT devices, security authentication and management face huge challenges. IoT devices usually have limited computing resources, strong heterogeneity, and are vulnerable to network attacks, which brings multiple problems to the existing authentication system.

[0004] The shortcomings of existing technologies are mainly manifested in: High computational cost: Traditional authentication methods such as PKI and symmetric encryption are too burdensome for IoT devices and difficult to run efficiently on low-power devices; Heterogeneity and large-scale management bottlenecks: There are many types of IoT devices, and it is difficult to take into account the authentication requirements of different devices. In addition, centralized authentication solutions cannot efficiently handle concurrent authentication of large-scale devices. Static authentication is difficult to deal with dynamic threats: Existing technologies are usually static authentication, which makes it difficult to adjust trust assessments in real time according to changes in IoT device behavior, making it difficult to deal with dynamic attacks; Insufficient defense capabilities: In the face of replay attacks, man-in-the-middle attacks, etc., the existing authentication methods lack effective defense mechanisms, making it difficult to ensure the authenticity of device identity and the overall security of the system. Summary of the invention

[0005] In order to solve the technical problems existing in the above-mentioned background technology, the present invention provides a security authentication method, system, medium and device for Internet of Things devices, which effectively prevents common security threats such as replay attacks and man-in-the-middle attacks by introducing timestamps, challenge-response mechanisms and device comprehensive feature vectors, thereby ensuring the uniqueness and security of each authentication.

[0006] In order to achieve the above object, the present invention adopts the following technical solution: A first aspect of the present invention provides a security authentication method for an Internet of Things device, comprising: Responding to an authentication request of an IoT device, the authentication request including a unique identifier of the IoT device, a current timestamp, and a comprehensive feature vector; after connecting the current timestamp and the comprehensive feature vector, a random challenge value is generated through a random function and sent to obtain a returned IoT device response value; after connecting the authentication key, the comprehensive feature vector, and the random challenge value, an expected response value is generated through a secure hash function, and the IoT device response value is compared with the expected response value to determine whether the IoT device is successfully authenticated; If the authentication is successful, the authentication key, the comprehensive feature vector and the random challenge value are concatenated to generate a session key through a secure hash function, and the authentication key and the session key are concatenated to update the authentication key through a secure hash function.

[0007] Furthermore, the IoT device response value is: a response value generated by the IoT device after connecting the authentication key, the comprehensive feature vector and the random challenge value through a secure hash function.

[0008] Furthermore, it also includes: counting the average authentication success rate of IoT devices in multiple time windows, calculating the instant trust score of IoT devices based on the behavioral deviation of IoT devices, and granting different operation permissions to IoT devices based on the instant trust score.

[0009] Furthermore, the behavior deviation is a measure of the difference between the current behavior feature vector of the IoT device and the normal behavior feature vector, and is used to determine whether the IoT device exhibits abnormal behavior.

[0010] Furthermore, when a connection is first established with an IoT device, an initial authentication key is generated and shared through the physical layer characteristics of the IoT device.

[0011] Furthermore, the comprehensive feature vector is a result of weighted fusion of multi-level features of the IoT device, wherein the multi-level features include physical layer features, behavioral layer features, environmental layer features, and network layer features of the IoT device.

[0012] Further, the physical layer features include a physical unclonable function, a hardware fingerprint, and a device unique identifier; The behavior layer characteristics include communication frequency, data packet size and operation log; The environmental layer characteristics include the ambient temperature, humidity and light intensity when the IoT device is running; The network layer characteristics include network traffic patterns, data packet characteristics and connection relationships.

[0013] A second aspect of the present invention provides a security authentication system for an Internet of Things device, comprising: The authentication module is configured to: respond to an authentication request of an IoT device, wherein the authentication request includes a unique identifier of the IoT device, a current timestamp, and a comprehensive feature vector; after connecting the current timestamp and the comprehensive feature vector, generate a random challenge value through a random function and send it to obtain a returned IoT device response value; after connecting the authentication key, the comprehensive feature vector, and the random challenge value, generate an expected response value through a secure hash function, compare the IoT device response value with the expected response value, and determine whether the IoT device is successfully authenticated; The key management module is configured to: if the authentication is successful, connect the authentication key, the comprehensive feature vector and the random challenge value, generate a session key through a secure hash function, and connect the authentication key and the session key, and update the authentication key through a secure hash function.

[0014] A third aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in a security authentication method for an Internet of Things device as described above.

[0015] The fourth aspect of the present invention provides a computer device, including a computer-readable storage medium, a processor, and a computer program stored on the computer-readable storage medium and executable on the processor, wherein when the processor executes the program, the steps in the security authentication method for an Internet of Things device as described above are implemented.

[0016] Compared with the prior art, the present invention has the following beneficial effects: 1. Prevent replay attacks and man-in-the-middle attacks: Through the introduction of timestamps, challenge-response mechanisms, and device comprehensive feature vectors, the present invention effectively prevents common security threats such as replay attacks and man-in-the-middle attacks, ensuring the uniqueness and security of each authentication.

[0017] 2. Lightweight authentication and high efficiency: Through adaptive hash chain and multi-dimensional feature fusion, the present invention designs a lightweight authentication mechanism suitable for resource-constrained devices. Compared with traditional complex encryption algorithms, hash chain authentication significantly reduces computational overhead while ensuring the security and efficiency of authentication.

[0018] 3. Secure communication based on session keys: After successful authentication, the present invention ensures the confidentiality and integrity of communication data between the device and the server during transmission by dynamically generating session keys; the dynamic update of session keys avoids the security risks of key reuse and further enhances the communication security between the device and the system.

[0019] 4. Multi-level feature collection and precise identification: Through multi-dimensional feature collection at the physical layer, behavioral layer, environmental layer and network layer, it is possible to comprehensively capture various status information of the device, thereby ensuring the uniqueness of the device identity and the normality of the operating behavior; multi-dimensional feature fusion not only improves the accuracy of device identification, but also enhances the anti-counterfeiting capability.

[0020] 5. Dynamic trust evaluation and security policy adjustment: The present invention can dynamically evaluate the trust of a device and adjust the security policy of the device in real time based on the device's authentication success rate and behavior deviation. This mechanism enables the system to flexibly respond to changes in the device's status, ensuring that the permissions of trusted devices are protected, while potentially risky devices will be restricted or isolated, thereby improving security. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0022] Figure 1 This is a flow chart of a security authentication method for an Internet of Things device according to a first embodiment of the present invention; Figure 2 This is a structural diagram of a security authentication system for an Internet of Things device according to a second embodiment of the present invention; Figure 3 It is a structural diagram of a computer device according to a fourth embodiment of the present invention. DETAILED DESCRIPTION

[0023] To make the purpose, technical solution and advantages of the embodiments of the present invention more clear, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0024] It should be noted that the following detailed descriptions are all illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0025] Embodiment 1 This embodiment provides a security authentication method for an Internet of Things device.

[0026] The present embodiment provides a security authentication method for an IoT device, which realizes efficient authentication and security management of IoT devices through multi-level feature collection, adaptive hash chain lightweight authentication, dynamic trust evaluation and session key generation; ensures the uniqueness of device identity and the security of the authentication process through the comprehensive integration of physical, behavioral, environmental and network layer characteristics; dynamically evaluates device trust by combining authentication success rate and behavioral deviation, adjusts security policies in real time, prevents security threats such as replay attacks and man-in-the-middle attacks, and ensures the security of device communication and operation.

[0027] The present embodiment provides a security authentication method for an IoT device, which is lightweight, efficient, and adaptable, and is suitable for authentication and security management of IoT devices with limited resources.

[0028] This embodiment provides a security authentication method for an Internet of Things device, such as Figure 1 As shown, the following steps are included: Step 1: Initialize the system and start the authentication process.

[0029] At startup, initialization operations are performed first.

[0030] During the initialization phase, necessary parameters and configurations will be loaded, basic communication connections with IoT devices will be established, and the authentication process will be ready to begin. After the initialization is completed, the first step of the authentication process, i.e., multi-dimensional feature collection, will begin.

[0031] Operation and process: Prepare each module and establish communication with the device; initialization ensures that each module can work together smoothly. After starting the authentication process, the multi-dimensional feature data of the device begins to be collected.

[0032] Step 2: Collect multi-dimensional features to obtain IoT device data.

[0033] Entering the multi-dimensional feature collection stage, various feature data are collected from IoT devices through multi-level feature collection modules to ensure that the status of the device can be fully and accurately characterized.

[0034] By collecting multi-dimensional data of IoT devices, basic information is provided for device authentication and trust assessment, including data at the physical layer, behavioral layer, environmental layer, and network layer.

[0035] Among them, IoT device data includes: (A) Physical layer features: such as physical unclonable function (PUF) response, hardware fingerprint, device unique identifier (device ID), etc. These features are used to uniquely identify the device and ensure its authenticity.

[0036] Physical Unclonable Function (PUF): PUF data is a set of binary responses related to the physical characteristics of the device hardware and is used for device authentication. The typical output of PUF is a 128-bit or 256-bit binary string. This data is generated by slight differences in the hardware circuit and cannot be cloned or copied.

[0037] Hardware fingerprint: Hardware fingerprint is extracted based on the unique characteristics of the IoT device circuit and used to assist in authentication. It is usually represented by a 32-bit hexadecimal number, and the generated fingerprint data is unique to the internal components of the device.

[0038] Device ID and serial number: The hardware ID and serial number of each device are auxiliary identification information, usually expressed in the form of a string. The specific format depends on the device manufacturer.

[0039] (B) Behavioral layer characteristics: Collect the operational behavior characteristics of IoT devices, such as command execution frequency, communication frequency, etc., to ensure that the usage and operation patterns of IoT devices can be captured and to identify whether IoT devices are operating as expected.

[0040] Communication frequency: records the number of packets sent and received by IoT devices per unit time. The communication frequency is expressed as an integer, recording the number of packets sent and received per minute.

[0041] Packet size: Packet size reflects the amount of valid data transmitted by IoT devices. It records the size of a single packet in bytes and is used to analyze device communication load.

[0042] Operation log: records the startup, shutdown, restart and other operation behaviors of IoT devices, and constructs the log file format based on timestamp and operation type.

[0043] (C) Environmental layer characteristics: Collect environmental data when IoT devices are running, such as temperature and humidity, to ensure that IoT devices operate in a compliant environment.

[0044] Temperature: The current ambient temperature of the IoT device in degrees Celsius (°C). It is collected in real time by the built-in temperature sensor and the data is expressed in floating point type.

[0045] Humidity: The humidity level of the environment where the IoT device is located, expressed as a percentage (%). This data is collected by environmental sensors.

[0046] Light intensity: The light sensor records the light conditions around the IoT device, expressed in lumens (Lux).

[0047] (D) Network layer characteristics: Monitor the network behavior of IoT devices, including data transmission volume, communication targets, etc., to ensure that the network activities of IoT devices are secure and in compliance with regulations.

[0048] Network traffic pattern: Record the upstream and downstream traffic of IoT devices in KB / s. Record the upstream and downstream traffic of the device within a certain time window to determine whether the communication load of the device meets expectations.

[0049] Data packet characteristics: Record the characteristics of the data packet content sent and received by IoT devices, including protocol type, packet header information, etc., to help detect whether the device has abnormal data packets. The data packet content records the protocol and key fields in the form of a string.

[0050] Connection relationship: The connection status between the IoT device and other devices or servers, recording the IP address, port number and connection duration of the connection object to determine whether the device is connected to an unknown or suspicious network.

[0051] Step 3: Standardize the features to eliminate dimensional differences.

[0052] After collecting multi-dimensional feature data, the data is standardized to eliminate the dimensional differences between different features. Since different features (such as temperature, flow, communication frequency, etc.) have different units and ranges, standardization can normalize all features to ensure consistency in subsequent processing.

[0053] Since the multi-dimensional feature data of IoT devices have different dimensions (for example, temperature in degrees Celsius, data flow in KB / s), in order to ensure that these features can be processed reasonably, all features are first standardized. This can eliminate the dimensional differences between features and make all features in the same numerical range. The formula is as follows: ,in: Represents the standardized Layer eigenvalues; Represents the original Layer eigenvalues; Indicates that it is The mean of the layer features; Indicates The standard deviation of the layer characteristics.

[0054] Step 4: Multi-level feature fusion to generate device features.

[0055] After completing the standardization process, all levels of feature data are combined through weighted fusion to generate a comprehensive feature vector of the IoT device. This vector combines multiple layers of features such as physical, behavioral, environmental, and network features, and serves as the unique identity representation of the IoT device for subsequent identity authentication.

[0056] Step 401: feature weight allocation.

[0057] In the IoT device authentication process, different features have different importance for device authentication. In order to use these features more effectively, different weights are assigned to each feature. Physical layer features (such as hardware fingerprints, PUF response) are usually weighted higher, while environmental features (such as temperature, humidity, etc.) are relatively weighted lower, because physical features can better reflect the uniqueness of the device.

[0058] The weight distribution can be set according to the actual application scenario. The initial weight is: Physical layer feature weight: =0.4; Behavior layer feature weight: = 0.3; Environmental layer feature weight: = 0.2; network layer feature weight: = 0.1.

[0059] Step 402: weighted fusion and comprehensive feature generation.

[0060] After standardization and weight assignment, all features are weighted and fused to generate a comprehensive feature vector of the IoT device. , which is the core identifier of device authentication and is calculated using the following formula: ;in, represents the comprehensive feature vector of IoT device i, It is The weights of the layer features, It is the standardized layer feature value, and L is the number of feature layers.

[0061] Step 5: The IoT device initiates an authentication request.

[0062] The lightweight authentication protocol of the adaptive hash chain adopted in this embodiment realizes the dynamic identity authentication of the device. After each successful authentication, a unique session key is generated to ensure the communication security between the device and the system.

[0063] When the IoT device and the server establish a connection for the first time, the two parties generate and share an initial key K0 through the physical characteristics of the IoT device (hardware fingerprint, physical unclonable function PUF), which is used to start the generation of the hash chain and plays an authentication and encryption role in the subsequent authentication process.

[0064] When an IoT device needs to be authenticated, it generates its comprehensive feature vector and then sends an authentication request to the server. The request contains a unique identifier (device ID), the current timestamp, and comprehensive feature vectors of IoT devices to ensure the uniqueness and timeliness of requests.

[0065] The IoT device ID ensures that the server can identify the IoT device, the comprehensive feature vector is used for subsequent identity authentication, and the timestamp prevents replay attacks.

[0066] Step 6: Server challenge and response verification.

[0067] Step 601: After receiving the authentication request from the IoT device, the server and the current timestamp , generate a random challenge value Ch, and send the challenge value to the IoT device.

[0068] in: ; : A random challenge value generated by the server to verify the device's responsiveness; : Indicates a string concatenation operation, which concatenates the timestamp and the device feature vector as input; (): Random function, which means randomly extracting a string from the input.

[0069] Step 602: After receiving the challenge value Ch from the server, the IoT device uses the current authentication key , the comprehensive feature vector of the device And the challenge value Ch, calculate an expected response value R, and return it to the server.

[0070] in, ;in, The response value returned by the device to the server; is the current authentication key, generated by the hash chain; H() represents a secure hash function (such as SHA-256), which is used to ensure the security of the calculation.

[0071] Step 603: The server verifies the response.

[0072] After receiving the response R from the IoT device, the server uses the current authentication key , comprehensive feature vector of IoT devices and the challenge value Ch, and generates the expected response value according to the same calculation process as the IoT device .

[0073] The server will calculate Compare with R returned by IoT device. If R = , the authentication succeeds; otherwise, the authentication fails.

[0074] Step 7: Dynamic trust evaluation, update device trust.

[0075] By combining historical data and current behavior, a time series model is used to evaluate the trustworthiness of a device in real time. The trustworthiness of a device is dynamically updated as its behavior changes, providing real-time trust evidence.

[0076] After the authentication is passed, the trust of the IoT device is dynamically updated through the dynamic trust evaluation model based on the authentication success rate and behavior deviation of the IoT device. The trust reflects the trustworthiness of the device and directly affects the operation authority of the IoT device in the network.

[0077] Among them, the dynamic trust evaluation model is: ;in, is the trustworthiness of device i at time t; is the instant trust score of IoT device i; is the weight factor of historical trust, 0< <1.

[0078] Among them, real-time scoring It is composed of the authentication success rate and behavior deviation of IoT devices, and its calculation formula is as follows: ;in, is the authentication success rate, the average authentication success rate of device i in multiple time windows , the ratio of the number of times the IoT device successfully passes authentication to the total number of authentication requests. For example, within a 1-minute time window, the IoT device initiated 10 authentication requests, of which 8 authentications were successful and 2 authentications failed, then the authentication success rate is 8 / 10=0.8; it should be noted that the time window is used to count the authentication success rate of IoT devices within a certain period of time, such as 1 minute is a time window; and time t refers to the current moment, and the authentication success rate and behavior deviation corresponding to the current moment will be used when calculating the instant score.

[0079] in, Behavior deviation is a measure of the difference between the current behavior of an IoT device and its normal behavior pattern. It is used to determine whether the device has abnormal behavior. The calculation formula is: ; In the formula, : The Mahalanobis distance of IoT device i at time t, indicating the degree of deviation between the current behavior and the normal behavior; : The current behavior feature vector of IoT device i at time t (including communication mode, operation behavior, network connection); : The mean of the normal behavior feature vector of IoT device i, which is usually obtained from the statistics of the device's historical behavior data; : The behavioral feature covariance matrix of device i, reflecting the correlation between features; T: represents the transpose operation of the vector. In order to limit the behavioral deviation to the range of 0 to 1 and facilitate calculation in combination with other features (such as authentication success rate), it is usually necessary to normalize the Mahalanobis distance. The normalized behavioral deviation formula is: ; In the formula, : The normalized behavior deviation of IoT device i at time t, with a value range of [0, 1]; : A predefined maximum value or threshold of the Mahalanobis distance, which is used for normalization and can be set based on historical data or manually. After normalization, a behavior deviation close to 0 indicates that the device behavior is very close to the normal mode, while a behavior deviation close to 1 indicates that the device behavior is significantly abnormal.

[0080] in, and is the weight coefficient, satisfying + =1.

[0081] Communication mode: In the security authentication of IoT devices, the communication mode refers to how the device exchanges data with the outside world. This includes the communication protocol used by the device for transmission, the frequency of data sending and receiving, and which devices or network nodes the device communicates with. These characteristics help determine whether the device's communication behavior is normal. During the authentication process, an abnormal communication mode may mean that the device has been attacked or malfunctioned.

[0082] Operation behavior: refers to the operations performed by the IoT device itself. For example, for smart home appliances, operation behaviors include powering on, powering off, adjusting temperature, switching modes, etc. In security authentication, the frequency, sequence, and rationality of the operation are analyzed by monitoring the operation behavior of the device. If the operation behavior of the device deviates from its normal mode, it may indicate that the device is illegally controlled or malfunctions, thus affecting the authentication result.

[0083] Network connection: The network connection feature mainly focuses on the connection between IoT devices and the network. This includes the type of network the device is connected to (such as LAN, WAN), the stability of the connection (whether it frequently drops offline or reconnects), and the object of the connection (which servers or other devices it is connected to). During the security certification process, a stable and normal network connection is the guarantee for the normal operation of the device. An abnormal network connection may be a signal that the device is under attack (such as a man-in-the-middle attack).

[0084] Step 8: Execute the security policy based on trust.

[0085] Based on the trust assessment results, the preset security policies are dynamically selected and executed, and the access rights and operating scope of the device are adjusted in real time to ensure that the security behavior of the device at different trust levels is effectively managed and controlled.

[0086] According to the trust level of IoT devices, IoT devices are assigned to different trust levels and corresponding security policies are implemented. IoT devices with high trust levels can perform more corresponding operations, while IoT devices with low trust levels will be restricted or even isolated.

[0087] In the embodiment, the security policy execution adopts a security policy dynamic adjustment mechanism as follows: According to the trust level of the device, IoT devices are classified into different trust levels and corresponding security policies are implemented. The specific security policy is based on the trust level threshold ( , , , , the specific threshold can be set according to the application scenario) and divided into different levels: When the trust level (instant trust score) is higher than the first preset threshold, the device is granted full operation permissions. , defined as high trust, at this trust level, the device is considered to be trusted and can have full network access and perform all functional operations, including: modifying system configurations such as network settings and communication protocols, performing firmware updates, restarting or shutting down the device, and full data access, including sensitive data; When the trust level is between the first preset threshold and the second preset threshold, some highly sensitive operations of the device are restricted. , defined as partial trust. At this trust level, the device trustworthiness decreases, but it can still perform daily operations (such as data transmission and status reporting). At this time, some highly sensitive operations (such as modifying system configuration, firmware updates, and accessing sensitive data) will be restricted and require secondary verification; When the trust level is between the second preset threshold and the third preset threshold, the function of the device is further restricted. , defined as restricted access. At this trust level, basic operations are allowed (such as regularly uploading health reports and transmitting device status information), but firmware updates, device restarts, system configuration modifications, and access to sensitive data are prohibited.

[0088] When the trust level is lower than the third preset threshold, the device is isolated and prohibited from accessing network resources. , defined as an isolated state. At this trust level, all functions are completely prohibited, including basic data transmission, network connection, system configuration operations, etc.; the device completely loses access to the network.

[0089] Through this layered security strategy, the permissions of the device can be adjusted according to its real-time status to ensure the overall security of the network.

[0090] Step 9: Generate session keys to ensure secure communication.

[0091] After each authentication, a session key is generated for encrypted communication between the IoT device and the server. The session key is generated based on the current authentication key and the device feature vector to ensure the uniqueness and security of each communication key.

[0092] Step 901: Generate dynamic session key.

[0093] After successful authentication, the server and IoT device will generate a new session key , used for subsequent encrypted communication between the server and the IoT device. The session key is composed of the current authentication key , the comprehensive feature vector of the device and timestamp The calculation formula is: ;in, is the session key used for current communication; H(): secure hash function, used to generate a secure session key.

[0094] Step 902: Update the authentication key.

[0095] In order to ensure the security of the next authentication key, the authentication key will be updated after each authentication. The new key is based on the current authentication key. and the generated session key The calculation formula is as follows: ;in: This is the new key that will be used for the next authentication.

[0096] Through this update mechanism, even if the attacker intercepts the current key or session key , and it is impossible to derive the key for the next authentication , thereby enhancing overall security.

[0097] In summary, the security authentication method for an IoT device provided by the present invention ensures the efficiency and security of device identity authentication through multi-level feature collection, adaptive hash chain authentication, dynamic trust evaluation and session key generation, can flexibly respond to changes in device status, dynamically adjust security policies, effectively prevent replay attacks and man-in-the-middle attacks, and ensure the security and integrity of device communications.

[0098] The invention provides a security authentication method for an IoT device, which is suitable for a resource-constrained IoT environment, has the advantages of being efficient, secure, and scalable, and can meet various application requirements of IoT device authentication and management.

[0099] Embodiment 2 This embodiment provides a security authentication system for an Internet of Things device, which specifically includes several Internet of Things devices and a server.

[0100] like Figure 2 As shown, the IoT device is configured with a multi-level feature collection module, a feature fusion and representation module; the IoT device and the server are both configured with an authentication and key management module (including an authentication module and a key management module); the server is configured with a dynamic trust assessment module and a security policy execution module.

[0101] A multi-level feature collection module is configured to: collect multi-dimensional feature information from IoT devices, wherein the feature information includes physical layer features, behavioral layer features, environmental layer features, and network layer features; A feature fusion and representation module is configured to: perform standardization processing on the collected feature information to eliminate dimensional differences, and perform weighted fusion based on preset feature weights to generate a comprehensive feature vector of the device; The authentication module is configured as follows: the Internet of Things device sends an authentication request to the server, wherein the authentication request includes a unique identifier of the Internet of Things device, a current timestamp and a comprehensive feature vector; the server responds to the authentication request of the Internet of Things device, connects the current timestamp and the comprehensive feature vector, generates a random challenge value through a random function, and sends it; the Internet of Things device connects the authentication key, the comprehensive feature vector and the random challenge value, and generates an Internet of Things device response value through a secure hash function; the server connects the authentication key, the comprehensive feature vector and the random challenge value, and generates an expected response value through a secure hash function, compares the Internet of Things device response value with the expected response value, and determines whether the Internet of Things device is successfully authenticated; The key management module is configured to: generate and share an initial authentication key through the physical layer characteristics of the IoT device when the server and the IoT device are connected for the first time; and after each successful authentication, connect the authentication key, the comprehensive feature vector and the random challenge value, generate a session key through a secure hash function, and connect the authentication key and the session key, and update the authentication key through a secure hash function; A dynamic trust evaluation module is configured to: count the average authentication success rate of IoT devices in multiple time windows, and evaluate the trust of the devices in real time based on the authentication success rate and behavior deviation of the devices; The security policy execution module is configured to dynamically adjust the device's operating permissions and security policies based on the device's trustworthiness, including restricting highly sensitive operations or isolating the device.

[0102] It should be noted here that each module in this embodiment corresponds to each step in Example 1 one by one, and the specific implementation process is the same, which will not be repeated here.

[0103] Embodiment 3 This embodiment provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps in the security authentication method for an Internet of Things device as described in the first embodiment above are implemented.

[0104] Embodiment 4 This embodiment provides a computer device, such as Figure 3 As shown, it includes a computer-readable storage medium 1003, a processor 1001, a communication interface 1002, and a computer program stored on the computer-readable storage medium 1003 and executable on the processor 1001, wherein the processor 1001, the communication interface 1002, and the computer-readable storage medium 1003 may be connected via a bus or other means. The communication interface 1002 is used to receive and send data, and when the processor 1001 executes the program, the steps in the security authentication method for an Internet of Things device as described in the first embodiment above are implemented.

[0105] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A security authentication method for an Internet of Things device, characterized in that: include: Responding to an authentication request of the IoT device, the authentication request including a unique identifier of the IoT device, a current timestamp, and a comprehensive feature vector; After connecting the current timestamp and the comprehensive feature vector, a random challenge value is generated through a random function and sent to obtain the returned IoT device response value; after connecting the authentication key, the comprehensive feature vector and the random challenge value, an expected response value is generated through a secure hash function, and the IoT device response value is compared with the expected response value to determine whether the IoT device is successfully authenticated; If the authentication is successful, the authentication key, the comprehensive feature vector and the random challenge value are concatenated to generate a session key through a secure hash function, and the authentication key and the session key are concatenated to update the authentication key through a secure hash function.

2. A security authentication method for an Internet of Things device as claimed in claim 1, characterized in that: The IoT device response value is: a response value generated by the IoT device after connecting the authentication key, the comprehensive feature vector and the random challenge value through a secure hash function.

3. A security authentication method for an Internet of Things device as claimed in claim 1, characterized in that: Also includes: Statistics are collected on the average authentication success rate of IoT devices in multiple time windows. Combined with the behavioral deviation of IoT devices, the instant trust score of IoT devices is calculated. Different operation permissions are granted to IoT devices based on the instant trust score.

4. A security authentication method for an Internet of Things device as claimed in claim 3, characterized in that: The behavior deviation is a measure of the difference between the current behavior feature vector of the IoT device and the normal behavior feature vector, and is used to determine whether the IoT device has abnormal behavior.

5. A security authentication method for an Internet of Things device as claimed in claim 1, characterized in that: When a connection is first established with an IoT device, an initial authentication key is generated and shared through the physical layer characteristics of the IoT device.

6. A security authentication method for an Internet of Things device as claimed in claim 1, characterized in that: The comprehensive feature vector is the result of weighted fusion of multi-level features by the IoT device, where the multi-level features include physical layer features, behavioral layer features, environmental layer features, and network layer features of the IoT device.

7. A security authentication method for an Internet of Things device as claimed in claim 1, characterized in that: The physical layer characteristics include a physical unclonable function, a hardware fingerprint, and a device unique identifier; The behavior layer characteristics include communication frequency, data packet size and operation log; The environmental layer characteristics include the ambient temperature, humidity and light intensity when the IoT device is running; The network layer characteristics include network traffic patterns, data packet characteristics and connection relationships.

8. A security authentication system for an Internet of Things device, characterized in that: include: The authentication module is configured to: respond to an authentication request of an IoT device, wherein the authentication request includes a unique identifier of the IoT device, a current timestamp, and a comprehensive feature vector; after connecting the current timestamp and the comprehensive feature vector, generate a random challenge value through a random function and send it to obtain a returned IoT device response value; after connecting the authentication key, the comprehensive feature vector, and the random challenge value, generate an expected response value through a secure hash function, compare the IoT device response value with the expected response value, and determine whether the IoT device is successfully authenticated; The key management module is configured to: if the authentication is successful, connect the authentication key, the comprehensive feature vector and the random challenge value, generate a session key through a secure hash function, and connect the authentication key and the session key, and update the authentication key through a secure hash function.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps in a security authentication method for an Internet of Things device as described in any one of claims 1 to 7 are implemented.

10. A computer device comprising a computer-readable storage medium, a processor, and a computer program stored in the computer-readable storage medium and executable on the processor, characterized in that: When the processor executes the program, the steps in the security authentication method for an Internet of Things device as described in any one of claims 1-7 are implemented.

Images