A method and system for secure access of an internet of things terminal

Abstract

The application discloses an Internet of Things terminal security access method and system, and relates to the technical field of information security, comprising the following steps: when performing a key generation operation on an Internet of Things terminal, first, the generation environment is monitored in real time to capture data information in the key generation process. The application quantifies the key strength by real-time monitoring of the generation environment and obtaining data information, combining data preprocessing and feature extraction, and the system can timely identify and adjust the key that does not meet the security requirements. When the evaluation result shows that the key strength is insufficient, the system automatically triggers the key regeneration and extends the key length to ensure that the security standard is met. The scheme enables the Internet of Things terminal key generation to respond to environmental changes in real time, effectively improves the key security, breaks through the limitations of the traditional static generation mechanism, enhances the system protection capability and reduces the security risk.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method and system for secure access to an Internet of Things terminal. Background Art

[0002] Secure IoT device access refers to the use of specific security mechanisms to effectively prevent unauthorized access and data leakage when IoT devices are connected to the network. Specifically, secure access mechanisms include multi-layered security measures such as device authentication, encrypted communications, access control, and data integrity verification. These measures ensure that only authorized devices and trusted users are allowed to interact with IoT devices when connected to the network, thereby preventing risks such as network attacks, malicious tampering, and data theft, and ensuring the security and reliability of the IoT environment. Furthermore, dynamic risk assessment and real-time monitoring are required to promptly identify and respond to potential security threats, further enhancing the overall network's protection capabilities.

[0003] During the secure access process for IoT devices, encrypted communications keys are typically generated to ensure confidentiality, integrity, and identity authentication for data transmitted between the device and the network. Key generation is a core component of secure access. Before connecting to the network, the device establishes a set of symmetric or asymmetric keys through key negotiation or key generation mechanisms. These keys are used for subsequent data encryption and decryption. This key encryption mechanism effectively prevents data from being eavesdropped, tampered with, or forged during transmission. It also verifies the legitimate identities of both communicating parties through signatures or authentication, establishing a trusted and secure access foundation for the entire IoT system.

[0004] Existing technologies have the following shortcomings: In existing IoT terminal security access solutions, key generation is typically based on fixed algorithm templates and static parameter settings. The key length used is often preset by the device and lacks the ability to dynamically adjust based on the actual operating environment. This type of static key generation mechanism has significant limitations when facing complex and changing network security environments. On the one hand, if the key length is set too short, it is difficult to provide sufficient cryptographic strength, making it easy to break through brute force attacks, dictionary attacks, or key replay attacks. On the other hand, when the key usage cycle is long, the terminal device communicates frequently, or is deployed in high-risk areas, static keys cannot meet the differentiated requirements for encryption strength, key lifespan, and communication security level.

[0005] Furthermore, existing key generation mechanisms often lack real-time awareness of factors such as the current security status of terminal devices, the quality of entropy sources, and key usage behavior. These mechanisms are unable to automatically assess and adapt key strength based on these dynamic environmental parameters. This results in the generated key strength in some scenarios falling below the minimum threshold required for current network security protection, thus creating security risks. Once an attacker successfully infers or steals the key through technical means, data transmission content may be tampered with, sessions may be hijacked, or devices may be illegally controlled, posing a serious threat to the security and stability of IoT systems.

[0006] The above information disclosed in this Background section is only for enhancement of understanding of the background of the present disclosure and therefore it may contain information that does not form the prior art that is already known to a person of ordinary skill in the art. Summary of the Invention

[0007] The purpose of the present invention is to provide a method and system for secure access to an Internet of Things (IoT) terminal. By monitoring the generation environment in real time and acquiring data information, combined with data preprocessing and feature extraction, key strength is quantified. The system can promptly identify and adjust keys that do not meet security requirements. When the evaluation results indicate insufficient key strength, the system automatically triggers key regeneration and extends the key length to ensure compliance with security standards. This solution enables IoT terminal key generation to respond to environmental changes in real time, effectively improving key security, breaking through the limitations of traditional static generation mechanisms, enhancing system protection capabilities, and reducing security risks, thereby addressing the problems mentioned in the background technology.

[0008] In order to achieve the above object, the present invention provides the following technical solution: a method for secure access of an Internet of Things terminal, comprising the following steps:

[0009] When performing key generation operations on IoT terminals, the generation environment is first monitored in real time to capture data information during the key generation process;

[0010] Preprocess the acquired raw data to establish a structured data set, extract key features that affect the strength of key generation from the established data set, and conduct a comprehensive analysis of the extracted key features to quantify the key strength;

[0011] The analyzed key features are input into a pre-trained machine learning model, and the model is used to intelligently evaluate the current key generation strength;

[0012] When the evaluation result shows that the strength of the currently generated key is insufficient, the key regeneration mechanism is triggered to generate a new key, and the key length extension mechanism is used to ensure that the generated key meets the security requirements.

[0013] Preferably, when the Internet of Things terminal performs the key generation operation, the generation environment is monitored in real time to capture data information in the key generation process, and the specific steps are as follows:

[0014] First, initialize the monitoring module to start collecting the state of key hardware and system resources;

[0015] Second, real-time collection of data related to the generation process starts at the same time;

[0016] Next, the acquired data is time-stamped and structured to form a complete key generation environment data stream;

[0017] Finally, the acquired data is feature extracted and key strength analyzed as the basis for evaluating key generation quality and security.

[0018] Preferably, the key features affecting the strength of the key generation are extracted from the established data set, including the entropy degradation degree of the seed data of random number generation and the dissipation speed of the system entropy pool per unit time. The entropy degradation degree of the seed data of random number generation and the dissipation speed of the system entropy pool per unit time are analyzed in the detection window to generate seed degradation reference values and entropy dissipation reference values, respectively. The key strength is quantified by the seed degradation reference value and the entropy dissipation reference value.

[0019] Preferably, the specific steps of generating the seed degradation reference value by comprehensively analyzing the entropy degradation degree of the seed data of random number generation in the detection window are as follows:

[0020] In the key generation process, to evaluate the randomness quality of the seed data, first, N seed samples are continuously collected in the detection window, and are uniformly converted into fixed-length binary representation, each sample length is L bits, adjacent samples are processed bit by bit by exclusive OR, the disturbance situation of the seed source in the microscopic level is described, the bit weight model is introduced to give different disturbance contributions to the exclusive OR result, and the bit-level disturbance entropy calculation expression is constructed as follows:

[0021]

[0022] , in the formula, BPE is the bit-level disturbance entropy, N is the total number of collected seed samples, L is the sample length, P ij is the exclusive OR value of the i-th sample and the i-1-th sample at the j-th bit, and ln2(1+j) is the bit weight factor;

[0023] After obtaining the bit-level disturbance entropy BPE, the symbol complexity analysis method is introduced to detect the sub-pattern diversity in the disturbance sequence, evaluate the structure repeatability and distribution singularity, and construct the seed degradation reference value generation formula as follows:

[0024]

[0025] , where SDRV is the seed degradation reference value, M is the number of unique sub-patterns, and H is the total length of the perturbed bit sequence.

[0026] Preferably, the specific steps of comprehensively analyzing the dissipation rate of the system entropy pool per unit time in the detection window to generate the entropy dissipation reference value are as follows:

[0027] During the key generation process, the remaining entropy value sequence of the entropy pool is monitored and recorded in real time, and an entropy dissipation mapping function is constructed to quantify the change in entropy pool consumption per unit time. The function formula is as follows:

[0028]

[0029] , where H map (f) is the entropy dissipation mapping value, that is, the entropy dissipation mapping value of the f-th sampling point, S f is the remaining entropy in the entropy pool read at the f-th sampling point, α is the scaling factor, β is the exponential enhancement factor, which is used to control the sensitivity to the entropy pool consumption rate, and ε is the minimum constant;

[0030] After completing the entropy dissipation mapping calculation, the entropy mapping value of each sampling point is input into the dissipative jump function to further evaluate the consumption trend of the entropy pool. The dissipative jump function generates an entropy dissipation reference value by comparing the mapping value changes of adjacent sampling points and accumulating them. The generation formula is as follows:

[0031]

[0032] , where EDRV is the entropy dissipation reference value, H map (f+1) is the entropy dissipation map value of the f+1th sampling point, that is, the entropy dissipation map value of the next sampling point, and F is the total number of sampling points.

[0033] Preferably, the analyzed seed degradation reference value and entropy dissipation reference value are input into a pre-trained machine learning model, and a key strength fluctuation evaluation value is generated by the machine learning model, and the key strength fluctuation evaluation value is used to intelligently evaluate the strength of the current key generation.

[0034] Preferably, the key strength fluctuation evaluation value generated when the current key generation strength is intelligently evaluated by a pre-trained machine learning model is compared with a preset key strength fluctuation evaluation value reference threshold to determine the current key generation strength. The determination logic is as follows:

[0035] If the key strength fluctuation evaluation value is greater than the pre-set key strength fluctuation evaluation value reference threshold, it is judged that the currently generated key strength is insufficient; if the key strength fluctuation evaluation value is less than or equal to the pre-set key strength fluctuation evaluation value reference threshold, it is judged that the currently generated key strength is normal.

[0036] Preferably, when the evaluation result indicates that the strength of the currently generated key is insufficient, the key regeneration mechanism is triggered to generate a new key, and the key length extension mechanism is used to ensure that the generated key meets the security requirements. The specific steps are as follows:

[0037] When the evaluation result shows that the currently generated key strength is insufficient, the key regeneration mechanism is activated to generate a new key with higher security strength to ensure that the security requirements of the system are met. The new key generation formula is as follows:

[0038] New_Key=f(Security_Algorithm, Key_Length, GKSFEV, GKSFEV ref ), where New_Key is the new key generated, Security_Algorithm is the type of encryption algorithm selected, Key_Length is the length of the generated key, GKSFEV is the key strength fluctuation assessment value, GKSFEV ref is the reference threshold of the key strength fluctuation assessment value

[0039] The key length extension mechanism ensures that the new key can meet the predetermined security standards and provide higher anti-cracking capabilities. The formula is as follows:

[0040]

[0041] , where New_Key_Length is the new key length after expansion, and Max_Length is the maximum key length supported.

[0042] Preferably, an IoT terminal security access system includes a generation environment real-time monitoring module, a data preprocessing and feature extraction module, an intelligent evaluation and machine learning model module, and a key regeneration and expansion module;

[0043] The generation environment real-time monitoring module first monitors the generation environment in real time when the IoT terminal performs the key generation operation to capture data information during the key generation process;

[0044] The data preprocessing and feature extraction module preprocesses the acquired raw data, establishes a structured data set, extracts key features that affect the strength of key generation from the established data set, and conducts a comprehensive analysis of the extracted key features to quantify the key strength;

[0045] Intelligent evaluation and machine learning model module, input the analyzed key features into the pre-trained machine learning model, and evaluate the current key generation strength intelligently through the model;

[0046] Key regeneration and expansion module, when the evaluation result shows that the current generated key strength is insufficient, trigger the key regeneration mechanism to generate a new key, and through the key length expansion mechanism, ensure that the generated key meets the security requirements.

[0047] In the above technical solution, the technical effects and advantages provided by the present application are:

[0048] The present application monitors the generation environment in real time, obtains various data information in the key generation process, and quantifies the key strength through data preprocessing and feature extraction, so as to ensure that the situation not meeting the security requirements can be identified and adjusted in time during the key generation process. Combined with the intelligent evaluation of the machine learning model, when the evaluation finds that the key strength is insufficient, the system will automatically trigger the regeneration mechanism, and through the key length expansion, ensure that the generated key meets the latest security standards. In this way, the key generation of the Internet of Things terminal can not only respond to environmental changes in real time, but also effectively improve the security of the key, avoid the limitations of the traditional static key generation mechanism, significantly enhance the protection ability of the whole system, and reduce the potential security risk. BRIEF DESCRIPTION OF DRAWINGS

[0049] In order to more clearly illustrate the technical solutions in the embodiments or prior art, the drawings needed in the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments described in the present application, and other drawings can also be obtained by those skilled in the art based on these drawings.

[0050] Figure 1 The method flow chart of the Internet of Things terminal security access method of the present application.

[0051] Figure 2 The module schematic diagram of the Internet of Things terminal security access system of the present application. DETAILED DESCRIPTION

[0052] Example implementations will now be described more fully with reference to the accompanying drawings. Example implementations may, however, be implemented in many different forms and should not be construed as limited to the examples set forth herein; rather, these example implementations are provided so that this disclosure will be thorough and complete, and will fully convey the inventive aspects to those skilled in the art.

[0053] The present application provides an Internet of Things terminal security access method as shown in Figure 1 The method comprises the following steps:

[0054] When performing key generation operations on IoT terminals, the generation environment is first monitored in real time to capture data information during the key generation process;

[0055] When performing key generation operations on IoT terminals, real-time monitoring of the generation environment means that throughout the entire key generation process, the system dynamically collects environmental data related to the generation operation to fully understand the current device operating status and security. This process includes monitoring information such as the availability of the system entropy pool, the use of the random number generator, processor load, memory status, device temperature, power supply fluctuations, and the parameters of the key generation algorithm used. This data reflects whether the software and hardware resources relied upon for key generation are in an ideal state, ensuring that the generated keys are sufficiently random and secure, and avoiding the generation of "weak" or predictable keys due to factors such as system anomalies, insufficient entropy sources, or hardware interference, thereby building a secure and reliable encryption foundation.

[0056] When performing key generation on an IoT terminal, the generation environment is monitored in real time to capture data and information during the key generation process. The specific steps are as follows: First, the monitoring module is initialized to start collecting the status of key hardware and system resources. Second, at the beginning of the key generation operation, data related to the generation process is collected in real time, such as the system entropy pool status, random number generator (RNG) call frequency, CPU load, memory usage, device operating temperature, power supply stability, and the encryption algorithm and parameter configuration called. Next, the acquired data is timestamped and structured to form a complete key generation environment data stream. Finally, the acquired data is subjected to feature extraction and key strength analysis as the basis for evaluating the quality and security of key generation. This process ensures that key generation is performed in a safe and reliable environment, avoiding insufficient key strength due to environmental anomalies.

[0057] Preprocess the acquired raw data to establish a structured data set, extract key features that affect the strength of key generation from the established data set, and conduct a comprehensive analysis of the extracted key features to quantify the key strength;

[0058] After acquiring environmental data, the raw data is first preprocessed. This process includes steps such as data cleaning, denoising, outlier detection, and normalization. Data cleaning removes duplicate or irrelevant data to ensure data quality; denoising eliminates random or unpredictable interference in the system to ensure accurate feature extraction; and normalization and standardization help convert data of different dimensions into a unified standard for input into machine learning models. Through these preprocessing steps, a structured data set is ultimately formed. This data set contains all critical information related to key generation quality and serves as the foundation for subsequent analysis.

[0059] The role of constructing the data set is to clean, organize and structure the raw data collected from the key generation process of the Internet of Things terminal, so as to facilitate subsequent analysis and processing. The raw data usually comes from different sensors, system logs and hardware state monitoring, and its format and content may be complex and inconsistent. Through the preprocessing process, the data will be standardized and denoised, irrelevant information and abnormal data will be removed, and each data item will be ensured to be consistent and reliable. After the data is converted into a structured form, it can be more convenient for feature extraction, intelligent evaluation and analysis, helping the system to monitor the quality and security of key generation in real time. The structured data set provides high-quality, standardized input data for subsequent use of machine learning algorithms for key strength analysis, risk assessment and optimization decision-making.

[0060] From the established data set, the key features that affect the strength of key generation are extracted, including the entropy degradation degree of the seed data (such as timestamp, sensor reading) of random number generation and the dissipation speed of system entropy pool per unit time. The entropy degradation degree of the seed data (such as timestamp, sensor reading) of random number generation and the dissipation speed of system entropy pool per unit time are analyzed comprehensively under the detection window, respectively generating seed degradation reference value and entropy dissipation reference value, and quantifying the key strength through seed degradation reference value and entropy dissipation reference value.

[0061] When the entropy value in the seed data (such as timestamp, sensor reading, etc.) used for random number generation appears serious degradation, it is clear that the key generation process has been significantly affected, and it is very likely to result in insufficient strength of the generated key. The security of the key is highly dependent on its unpredictability, and this unpredictability essentially comes from the entropy value of the seed data used by the random number generator (RNG). If the seed data entropy value is insufficient, i.e. the seed source is single, the repetition rate is high or can be predicted (such as consecutive timestamps, constant temperature readings), the generated pseudo-random number sequence will tend to be regularized, and the key will lack sufficient randomness and complexity, becoming a potential breakthrough for attackers through speculation or replay attacks. In the key generation process, entropy degradation means that the system cannot provide a high-quality entropy source to support the construction of secure keys, thereby directly affecting the anti-cracking ability of the key and the overall encryption strength of the system. Therefore, entropy degradation is one of the key indicators of insufficient key strength, and must be supplemented by high-entropy seeds or mechanism switching to correct it in time.

[0062] The specific steps for generating seed degradation reference value by comprehensively analyzing the entropy degradation degree of the seed data (such as timestamp, sensor reading) of random number generation under the detection window are as follows:

[0063] During the key generation process, to evaluate the randomness quality of seed data (such as timestamps and sensor readings), N seed samples are first collected continuously within the detection window and uniformly converted into a fixed-length binary representation. Each sample is L bits long. Adjacent samples are subjected to bit-by-bit XOR processing at the bit level to characterize the perturbation of the seed source at the microscopic level. By introducing a bit weight model, the perturbation contribution of different bits is assigned to the XOR result, and the bit-level perturbation entropy calculation expression is constructed as follows:

[0064]

[0065] , where BPE is the bit-level perturbation entropy, which is an indicator used to measure the randomness and entropy value of seed data during the key generation process. Specifically, it measures the degree of bit-level perturbation and the complexity of data changes during the key generation process. N is the total number of seed samples collected, L is the sample length, and P ij is the XOR value (0 or 1) of the i-th sample and the i-1-th sample at the j-th position, ln2(1+k) is the bit weight factor, which performs a weighted evaluation of the disturbance caused by different bits (bit positions), and the higher the value (higher bit), the greater the impact;

[0066] Bitwise XOR processing involves comparing the binary representations of two adjacent samples at each bit and calculating the XOR result for each bit. The XOR operation is a bitwise operation with the following rules: if the two bits are identical, the result is 0; if they are different, the result is 1. In other words, if the values ​​of two adjacent samples at a certain bit are identical, the XOR result is 0; if they are different, the XOR result is 1.

[0067] Function: The main function of bit-by-bit XOR processing is to detect the degree of change between adjacent samples, especially small changes. When two samples change in a certain bit, the XOR value is 1, indicating that there is a disturbance or information difference at that position. By performing the XOR operation on each bit, the microscopic differences between samples can be accurately captured. Especially when generating keys, the accumulation of such differences can help identify the randomness and entropy value of the seed data. If a large number of adjacent samples do not change in certain bits (the XOR result is 0), it means that the randomness of the data is low, which may lead to weakness in key generation. Therefore, bit-by-bit XOR processing is an important step in quantifying the entropy value of seed data and the quality of key generation. It can reflect whether the key generation process is affected, and thus help evaluate the security strength of the key.

[0068] By monitoring and analyzing seed data disturbances in real time, we assess the randomness and entropy quality of the seed source. This step can effectively capture potential regularities or repetitiveness in the seed data, thereby identifying insufficient randomness and security risks in the key generation process.

[0069] After obtaining the bit-level perturbation entropy BPE, a symbol complexity analysis method is introduced to detect the diversity of sub-patterns in the perturbation sequence, evaluate the structural repetitiveness and distribution singularity, and construct a seed degradation reference value generation formula as follows:

[0070]

[0071] In the formula, SDRV is the seed degradation reference value, M is the number of unique sub-patterns, represents all sub-strings in the extracted perturbation bit sequence in the key generation process, M is the number of different independent patterns (sub-patterns) in these sub-strings, that is, the number of unique and non-repeated patterns in the perturbation sequence, and H is the total length of the perturbation bit sequence, which refers to the number of all data bits collected in the key generation process.

[0072] By introducing the symbol complexity analysis method, the diversity and repetitiveness of the perturbation sequence in the seed data are evaluated, and the degree of entropy value degradation of the seed data is revealed. This step quantifies the structural redundancy and pattern repetition in the data by calculating the seed degradation reference value, so as to accurately identify the risk of insufficient key generation strength caused by the quality problem of the seed data.

[0073] The larger the seed degradation reference value generated by the comprehensive analysis of the entropy value degradation degree of the random number generated seed data (such as time stamp, sensor reading) in the detection window, the more obvious the decrease in randomness, uniqueness and unpredictability of the seed data, and the more obvious the influence on the key generation process, indicating that the generated key has the risk of insufficient strength. In the monitoring window of key generation, real-time entropy value evaluation is performed on the seed sources such as time stamp and sensor reading to determine whether they have degradation characteristics such as high repetition, single source or distribution skew. When the seed degradation reference value increases, it means that the generated random number sequence tends to be predictable, and the randomness of the key decreases, thereby weakening its anti-cracking ability and making it an easy attack target; when the reference value is at a low level, it indicates that the seed source still has a high entropy value and has not had a negative impact on the key generation.

[0074] A rapid depletion of the system's entropy pool per unit time often indicates compromised key generation, potentially leading to insufficient key strength. This is because the entropy pool stores the entropy required for random number generation. Higher entropy levels increase the unpredictability of generated random numbers and keys, thereby enhancing key security. Rapid entropy pool depletion indicates the system is unable to replenish sufficient high-quality entropy sources in a timely manner, resulting in repetitive or predictable random numbers. Rapid entropy pool depletion can be caused by a variety of factors, such as excessive system load, insufficient hardware resources, or the use of a low-quality entropy source, all of which can affect the performance of the random number generator (RNG). A lack of sufficient entropy reduces the randomness of the key, making the generated key vulnerable to brute force, prediction, or collision attacks, thereby reducing key strength. IoT devices, particularly those operating for extended periods or exposed to insecure environments, are more susceptible to rapid entropy pool depletion. This not only compromises the security of single-shot key generation but can also cause the system to remain in a low-security state for extended periods.

[0075] The specific steps for comprehensively analyzing the dissipation rate of the system entropy pool per unit time in the detection window to generate the entropy dissipation reference value are as follows:

[0076] During the key generation process, the remaining entropy value sequence of the entropy pool is monitored and recorded in real time, and an entropy dissipation mapping function is constructed to quantify the change in entropy pool consumption per unit time. The function formula is as follows:

[0077]

[0078] , where H map (f) is the entropy dissipation mapping value, that is, the entropy dissipation mapping value of the f-th sampling point, which reflects the dissipation degree of the system entropy pool at this time point. f is the remaining entropy of the entropy pool read at the f-th sampling point, in bits, reflecting the current randomness reserve. α is the scaling factor, which adjusts the sensitivity of the exponential mapping to changes in the entropy pool state. It usually takes a value in the range of 1<α<10. β is the exponential enhancement factor, which is used to control the sensitivity to the entropy pool consumption rate. Especially in the low entropy state, when its value is greater than 1, it will amplify the small changes in the remaining entropy of the entropy pool. ε is a minimum constant (such as 10 -5 ), used to avoid division by zero errors;

[0079] This mapping function uses an exponential form, which has a nonlinear amplification effect and is particularly sensitive to changes in entropy pool consumption when the entropy pool is in a low entropy state. When the entropy value is low, the changes in the mapping value will be exacerbated, indicating that the entropy pool is being rapidly depleted in a short period of time, and the generated key may be affected and lack strength.

[0080] After completing the entropy dissipation mapping calculation, the entropy mapping value of each sampling point is input into the dissipative jump function to further evaluate the consumption trend of the entropy pool. The dissipative jump function generates an entropy dissipation reference value by comparing the mapping value changes of adjacent sampling points and accumulating them. The generation formula is as follows:

[0081]

[0082] , where EDRV is the entropy dissipation reference value, H map (f+1) is the entropy dissipation map value of the f+1th sampling point, that is, the entropy dissipation map value of the next sampling point, and F is the total number of sampling points.

[0083] This step measures the severity of entropy pool depletion between each time step by calculating the logarithmic ratio of adjacent entropy map values. A large entropy dissipation reference value indicates highly uneven entropy pool consumption, potentially leading to insufficient system randomness and weaker generated keys. By accumulating these changes, the resulting entropy dissipation reference value reflects the overall entropy pool depletion status over the entire monitoring window.

[0084] The larger the entropy dissipation reference value, generated by comprehensively analyzing the rate of dissipation of the system entropy pool per unit time within the detection window, the more significant the decline in the randomness, uniqueness, and unpredictability of the seed data, indicating that the key generation process has been affected and the generated key is at risk of insufficient strength. Within the key generation monitoring window, by evaluating the real-time entropy value of seed sources such as timestamps and sensor readings, it is possible to determine whether they exhibit degradation characteristics such as high repetition, a single source, or a skewed distribution. When the seed degradation reference value increases, it means that the generated random number sequence becomes predictable, the randomness of the key decreases, and its resistance to cracking is weakened, making it an easy target for attack. When the reference value is at a low level, it indicates that the seed source still has a high entropy value and has not negatively affected key generation.

[0085] The analyzed key features are input into a pre-trained machine learning model, and the model is used to intelligently evaluate the current key generation strength;

[0086] The analyzed seed degradation reference value and entropy dissipation reference value are input into a pre-trained machine learning model, and a key strength fluctuation evaluation value is generated by the machine learning model. The key strength fluctuation evaluation value is used to intelligently evaluate the strength of the current key generation.

[0087] A pre-trained machine learning model is an optimized and learned machine learning model trained using historical and environmental data during the key generation process. This model does not need to be retrained every time a key is generated. Instead, it uses previously collected data from the key generation process to build a general model, enabling it to make intelligent predictions and assessments based on newly input data. Specifically, pre-trained models typically utilize features and labels from a large amount of historical data (such as key strength, generation environment, entropy source quality, random number generator performance, etc.) to discover the relationship between this data and key strength through supervised or unsupervised learning algorithms. These datasets are used to train the model, enabling it to output corresponding key strength assessments during new, real-time key generation processes by inputting new environmental data (such as seed degradation reference values ​​and entropy dissipation reference values).

[0088] The training process typically includes multiple steps, such as data cleaning, feature extraction, feature selection, model selection, and hyperparameter tuning. Through these steps, the machine learning model can accurately capture the underlying patterns in the key generation process and transform these patterns into effective predictive capabilities. For example, the model may learn the correlation between changes in the entropy pool state, decreased seed quality, and the generation of weak keys, or the relationship between excessive system load and decreased key generation quality. During the training process, the algorithm automatically adjusts the model parameters to ensure that it minimizes error and improves accuracy when new data is input. In this way, the pre-trained machine learning model can perform real-time intelligent evaluation of the key generation process in real-world applications, determine the strength of the current key generation, and predict in advance whether the key poses security risks.

[0089] In short, pre-trained machine learning models leverage patterns and knowledge learned from historical data to intelligently analyze new data and make predictions. Specifically, during the key generation process, they can assess key strength changes in real time based on environmental factors such as seed degradation and entropy dissipation. A key advantage of this approach is that it eliminates the need for de novo training each time. Instead, it leverages the knowledge from pre-trained models, improving efficiency, accuracy, and real-time performance. This intelligent evaluation process not only enables key generation to dynamically adapt to changing environments but also automatically identifies potential security risks during the generation process, providing an efficient and reliable security protection mechanism.

[0090] The machine learning model is not limited here. Any machine learning model that can perform a comprehensive analysis of the seed degradation reference value SDRV and the entropy dissipation reference value EDRV to generate a key strength fluctuation evaluation value GKSFEV is acceptable. To implement the technical solution of the present invention, the present invention provides a specific implementation method.

[0091] The key strength fluctuation evaluation value GKSFEV is generated by the following formula: GKSFEV=k1·SDRV+k2·EDRV, where k1 and k2 are the preset proportional coefficients of the seed degradation reference value SDRV and the entropy dissipation reference value EDRV, respectively, and both k1 and k2 are greater than 0.

[0092] "Preset scaling factors" are constants used in mathematical models to balance and weight the impact of different input variables on the output. k1 and k2 are the corresponding preset scaling factors, which determine the weights of the seed degradation reference value (SDRV) and the entropy dissipation reference value (EDRV) in the generated key strength fluctuation estimate (GKSFEV).

[0093] These two coefficients are not randomly assigned; instead, they are pre-weighted parameters based on actual application scenarios, historical empirical data, or model training results. Their purpose is to reflect the relative importance of these two factors within a specific security assessment system. For example, in certain high-frequency devices, changes in entropy dissipation have a greater impact on key security. Therefore, k2 can be set to a value greater than k1, thereby increasing the weight of EDRV on GKSFEV. Keeping both values ​​greater than 0 ensures that both variables contribute positively to the results, preventing unexpected negative shifts in the assessment value.

[0094] In summary, the preset proportional coefficient is a weight factor used to quantify the contribution of each key indicator to the final evaluation value. It is the key bridge to unify multi-source features into a computable evaluation model.

[0095] It can be seen from the key strength fluctuation evaluation value that the larger the seed degradation reference value generated after comprehensive analysis of the degree of entropy degradation in the seed data generated by random numbers (such as timestamps, sensor readings) under the detection window, and the larger the entropy dissipation reference value generated after comprehensive analysis of the dissipation rate of the system entropy pool per unit time under the detection window, the larger the key strength fluctuation evaluation value generated when the current key generation strength is intelligently evaluated by the pre-trained machine learning model, indicating that the probability of insufficient strength of the generated key is greater, and vice versa, the probability of insufficient strength of the generated key is smaller.

[0096] The key strength fluctuation assessment value generated by the pre-trained machine learning model when intelligently evaluating the current key generation strength is compared with the pre-set key strength fluctuation assessment value reference threshold to determine the current key generation strength. The judgment logic is as follows:

[0097] If the key strength fluctuation evaluation value is greater than the pre-set key strength fluctuation evaluation value reference threshold, it is judged that the currently generated key strength is insufficient; if the key strength fluctuation evaluation value is less than or equal to the pre-set key strength fluctuation evaluation value reference threshold, it is judged that the currently generated key strength is normal.

[0098] When the evaluation result shows that the strength of the currently generated key is insufficient, the key regeneration mechanism is triggered to generate a new key. The key length extension mechanism is used to ensure that the generated key meets the security requirements.

[0099] This step ensures that the generated key meets the required security requirements, thereby preventing potential security risks caused by insufficient key strength. When performing key generation on IoT terminals, key security directly impacts the confidentiality and integrity of data transmission, as well as the overall security of the system. If the key strength is insufficient, attackers can easily crack the key using brute force, dictionary attacks, or other cryptographic attacks, obtaining sensitive data or controlling the communication link. Therefore, when the evaluation results indicate that the currently generated key strength is insufficient, the system triggers a rekey mechanism to generate a stronger key, thereby resolving the security risk of the original key being cracked.

[0100] The core function of the rekeying mechanism is to replace weak keys with new ones, ensuring that the system always uses secure encryption to protect data. This mechanism does not rely on manual intervention and automatically identifies potential risks based on the assessment system in real time, ensuring the automation and efficiency of the entire key generation and management process.

[0101] The key length extension mechanism further enhances key security. Specifically, if the current key length is too short to withstand complex attacks, the system will automatically increase the key length (for example, from RSA-2048 to RSA-4096, or from AES-128 to AES-256). The key length extension mechanism significantly increases the computational difficulty of cracking the key, forcing attackers to expend more computing resources and time, thereby effectively improving the system's resistance to cracking. This extension mechanism ensures that the key still provides sufficient security when facing more complex computational attacks.

[0102] This step ensures that IoT terminals always meet the latest security standards during key generation through the dual measures of key regeneration and key length extension, reducing security vulnerabilities caused by insufficient key strength.

[0103] When the evaluation results indicate that the currently generated key is insufficient, the key regeneration mechanism is triggered to generate a new key. The key length extension mechanism is then used to ensure that the generated key meets security requirements. The specific steps are as follows:

[0104] When the evaluation result shows that the currently generated key strength is insufficient, the key regeneration mechanism is activated to generate a new key with higher security strength to ensure that the security requirements of the system are met. The new key generation formula is as follows:

[0105] New_Key=f(Security_Algorithm, Key_Length, GKSFEV, GKSFEV ref )

[0106] , where New_Key is the new key generated, Security_Algorithm is the type of encryption algorithm selected, such as RSA-4096 or AES-256, Key_Length is the length of the generated key, GKSFEV is the key strength fluctuation assessment value, GKSFEV ref is the reference threshold of the key strength fluctuation assessment value

[0107] Through this mechanism, when GKSFEV>GKSFEV ref When a new key is generated, the system will increase the key length and / or change the encryption algorithm to improve security.

[0108] The key length extension mechanism ensures that the new key can meet the predetermined security standards and provide higher anti-cracking capabilities. The formula is as follows:

[0109]

[0110] , where New_Key_Length is the new key length after expansion, and Max_Length is the maximum key length supported.

[0111] When GKSFEV>GKSFEV ref When the key length is increased, the new key length will be expanded according to the formula, ensuring that the generated key can meet higher security requirements. This mechanism allows the key length to be automatically adjusted according to actual fluctuations during the key generation process, improving the adaptability and security of the key generation process.

[0112] The present invention monitors the generation environment in real time, obtains various data and information during the key generation process, and quantifies the key strength through data preprocessing and feature extraction, ensuring that situations that do not meet security requirements can be promptly identified and adjusted during the key generation process. Combined with the intelligent evaluation of the machine learning model, when the evaluation finds that the key strength is insufficient, the system automatically triggers the regeneration mechanism and ensures that the generated key meets the latest security standards through key length expansion. In this way, the key generation of the IoT terminal can not only respond to environmental changes in real time, but also effectively improve the security of the key, avoid the limitations of the traditional static key generation mechanism, significantly enhance the protection capabilities of the entire system, and reduce potential security risks.

[0113] The present invention provides Figure 2The IoT terminal security access system shown includes a generation environment real-time monitoring module, a data preprocessing and feature extraction module, an intelligent evaluation and machine learning model module, and a key regeneration and expansion module;

[0114] The generation environment real-time monitoring module first monitors the generation environment in real time when the IoT terminal performs the key generation operation to capture data information during the key generation process;

[0115] The data preprocessing and feature extraction module preprocesses the acquired raw data, establishes a structured data set, extracts key features that affect the strength of key generation from the established data set, and conducts a comprehensive analysis of the extracted key features to quantify the key strength;

[0116] The intelligent evaluation and machine learning model module inputs the analyzed key features into a pre-trained machine learning model and uses the model to intelligently evaluate the current key generation strength;

[0117] The key regeneration and extension module triggers the key regeneration mechanism when the evaluation result shows that the strength of the currently generated key is insufficient, generates a new key, and uses the key length extension mechanism to ensure that the generated key meets the security requirements.

[0118] An embodiment of the present invention provides a method for secure access to an Internet of Things terminal, which is implemented through the above-mentioned secure access system for an Internet of Things terminal. The specific methods and processes of the secure access system for an Internet of Things terminal are detailed in the embodiment of the above-mentioned method for secure access to an Internet of Things terminal, and will not be repeated here.

[0119] The above formulas are all dimensionless and numerical calculations. The formulas are obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters in the formulas are set by technicians in this field according to actual conditions.

[0120] The above description is merely illustrative of certain exemplary embodiments of the present invention. It goes without saying that those skilled in the art will be able to modify the described embodiments in various ways without departing from the spirit and scope of the present invention. Therefore, the above drawings and description are illustrative in nature and should not be construed as limiting the scope of protection of the claims.

[0121] It should be noted that, in this document, if there are relational terms such as first and second, etc., they are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device that includes the element.

[0122] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0123] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0124] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0125] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0126] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0127] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0128] The above description is merely illustrative of certain exemplary embodiments of the present invention. It goes without saying that those skilled in the art will be able to modify the described embodiments in various ways without departing from the spirit and scope of the present invention. Therefore, the above drawings and description are illustrative in nature and should not be construed as limiting the scope of protection of the claims.

Claims

1. A secure access method for an Internet of Things terminal, characterized in that: The following steps are involved: When performing key generation operations on IoT terminals, the generation environment is first monitored in real time to capture data information during the key generation process; Preprocess the acquired raw data to establish a structured data set, extract key features that affect the strength of key generation from the established data set, and conduct a comprehensive analysis of the extracted key features to quantify the key strength; The analyzed key features are input into a pre-trained machine learning model, and the model is used to intelligently evaluate the current key generation strength; When the evaluation result shows that the strength of the currently generated key is insufficient, the key regeneration mechanism is triggered to generate a new key, and the key length extension mechanism is used to ensure that the generated key meets the security requirements.

2. The method for secure access to an Internet of Things terminal according to claim 1, wherein: When performing key generation operations on IoT terminals, the generation environment is monitored in real time to capture data information during the key generation process. The specific steps are as follows: Initialize the monitoring module and start collecting status of key hardware and system resources; At the beginning of the key generation operation, data related to the generation process is collected in real time; Timestamp and structure the acquired data to form a complete key generation environment data stream; The acquired data is subjected to feature extraction and key strength analysis as the basis for evaluating the quality and security of key generation.

3. The method for secure access to an Internet of Things terminal according to claim 1, wherein: Key features that affect the strength of key generation are extracted from the established data set. The extracted features include the degree of entropy degradation in the seed data generated by random numbers and the dissipation rate of the system entropy pool per unit time. The degree of entropy degradation in the seed data generated by random numbers and the dissipation rate of the system entropy pool per unit time are comprehensively analyzed under the detection window to generate a seed degradation reference value and an entropy dissipation reference value respectively. The key strength is quantified by the seed degradation reference value and the entropy dissipation reference value.

4. The method for secure access to an Internet of Things terminal according to claim 3, wherein: The specific steps for comprehensively analyzing the entropy degradation degree of the seed data generated by random numbers within the detection window to generate the seed degradation reference value are as follows: During the key generation process, in order to evaluate the randomness quality of the seed data, N seed samples are first continuously collected within the detection window and uniformly converted into a fixed-length binary representation. Each sample is L bits long. Adjacent samples are subjected to bit-by-bit XOR processing at the bit level to characterize the perturbation of the seed source at the microscopic level. By introducing a bit weight model, the perturbation contribution of different bits is assigned to the XOR result, and the bit-level perturbation entropy calculation expression is constructed as follows: Where BPE is the bit-level perturbation entropy, N is the total number of seed samples collected, L is the sample length, and P ij is the XOR value of the i-th sample and the i-1-th sample at the j-th position, and ln2(1+j) is the bit weight factor; After obtaining the bit-level perturbation entropy (BPE), the symbolic complexity analysis method is introduced to detect the diversity of sub-patterns in the perturbation sequence, evaluate the structural repeatability and distribution uniformity, and construct the seed degradation reference value generation formula as follows: Where SDRV is the seed degradation reference value, M is the number of unique sub-patterns, and H is the total length of the perturbed bit sequence.

5. The method for secure access to an Internet of Things terminal according to claim 3, wherein: The specific steps for comprehensively analyzing the dissipation rate of the system entropy pool per unit time in the detection window to generate the entropy dissipation reference value are as follows: During the key generation process, the remaining entropy value sequence of the entropy pool is monitored and recorded in real time, and an entropy dissipation mapping function is constructed to quantify the change in entropy pool consumption per unit time. The function formula is as follows: Where H map (f) is the entropy dissipation mapping value, that is, the entropy dissipation mapping value of the f-th sampling point, S f is the remaining entropy in the entropy pool read at the f-th sampling point, α is the scaling factor, β is the exponential enhancement factor, which is used to control the sensitivity to the entropy pool consumption rate, and ε is the minimum constant; After completing the entropy dissipation mapping calculation, the entropy mapping value of each sampling point is input into the dissipative jump function to further evaluate the consumption trend of the entropy pool. The dissipative jump function generates an entropy dissipation reference value by comparing the mapping value changes of adjacent sampling points and accumulating them. The generation formula is as follows: Where EDRV is the entropy dissipation reference value, H map (f+1) is the entropy dissipation map value of the f+1th sampling point, that is, the entropy dissipation map value of the next sampling point, and F is the total number of sampling points.

6. The method for secure access to an Internet of Things terminal according to claim 3, wherein: The analyzed seed degradation reference value and entropy dissipation reference value are input into a pre-trained machine learning model, and a key strength fluctuation evaluation value is generated by the machine learning model. The key strength fluctuation evaluation value is used to intelligently evaluate the strength of the current key generation.

7. The method for secure access to an Internet of Things terminal according to claim 6, wherein: The key strength fluctuation assessment value generated by the pre-trained machine learning model when intelligently evaluating the current key generation strength is compared with the pre-set key strength fluctuation assessment value reference threshold to determine the current key generation strength. The judgment logic is as follows: If the key strength fluctuation assessment value is greater than a preset key strength fluctuation assessment value reference threshold, it is determined that the currently generated key strength is insufficient; If the key strength fluctuation evaluation value is less than or equal to a preset key strength fluctuation evaluation value reference threshold, it is determined that the currently generated key strength is normal.

8. The method for secure access to an Internet of Things terminal according to claim 7, wherein: When the evaluation results indicate that the currently generated key is insufficient, the key regeneration mechanism is triggered to generate a new key. The key length extension mechanism is then used to ensure that the generated key meets security requirements. The specific steps are as follows: When the evaluation result shows that the currently generated key strength is insufficient, the key regeneration mechanism is activated to generate a new key with higher security strength to ensure that the security requirements of the system are met. The new key generation formula is as follows: New_Key=f(Security_Algorithm, Key_Length, GKSFEV, GKSFEV ref ), where New_Key is the new key generated, Security_Algorithm is the type of encryption algorithm selected, Key_Length is the length of the generated key, GKSFEV is the key strength fluctuation assessment value, GKSFEV ref is the reference threshold of the key strength fluctuation assessment value The key length extension mechanism ensures that the new key can meet the predetermined security standards and provide higher anti-cracking capabilities. The formula is as follows: Where New_Key_Length is the length of the new key after expansion, and Max_Length is the maximum supported key length.

9. A secure access system for an Internet of Things terminal, used to implement a secure access method for an Internet of Things terminal according to any one of claims 1 to 8, characterized in that: It includes a real-time monitoring module for the generation environment, a data preprocessing and feature extraction module, an intelligent evaluation and machine learning model module, and a key regeneration and expansion module; The generation environment real-time monitoring module first monitors the generation environment in real time when the IoT terminal performs the key generation operation to capture data information during the key generation process; The data preprocessing and feature extraction module preprocesses the acquired raw data, establishes a structured data set, extracts key features that affect the strength of key generation from the established data set, and conducts a comprehensive analysis of the extracted key features to quantify the key strength; The intelligent evaluation and machine learning model module inputs the analyzed key features into a pre-trained machine learning model and uses the model to intelligently evaluate the current key generation strength; The key regeneration and extension module triggers the key regeneration mechanism when the evaluation result shows that the strength of the currently generated key is insufficient, generates a new key, and uses the key length extension mechanism to ensure that the generated key meets the security requirements.

Images