Secure communication method between edge server and terminal equipment

Abstract

The invention relates to a secure communication method between an edge server and terminal equipment. The secure communication method comprises the following steps: establishing a physical layer channel state information database, generating a multi-dimensional feature vector and encoding the multi-dimensional feature vector into a terminal equipment identifier, generating an identity authentication request by the terminal equipment, and performing hash operation to obtain a first hash value; the identity authentication request and the first hash value are sent to the edge server, the edge server verifies the identity authentication request and queries a corresponding device key, performs hash operation to obtain a second hash value, generates an authentication response message after successfully comparing the second hash value with the first hash value, encrypts the authentication response message by using the device key, and sends the encrypted authentication response message to the edge server; and sending the encrypted authentication response message to the terminal equipment. And the terminal equipment decrypts by using the equipment key to obtain the session key, and communicates with the edge server based on the session key. By using the physical layer channel information and the equipment hardware characteristics, the security communication method fusing dynamic identity authentication and efficient key management improves the security, reliability and anti-attack ability of communication between the edge server and the terminal equipment.

Description

Technical Field

[0001] The present invention belongs to the technical field of server communication, and in particular relates to a secure communication method between an edge server and a terminal device. Background Art

[0002] With the rapid development of technologies like the Internet of Things and artificial intelligence, edge computing, with its low latency and high bandwidth advantages, has become a crucial enabler for data processing and interaction on terminal devices. Secure communication between edge servers and terminal devices is a key component in ensuring data privacy and stable system operation, and is widely used in industrial automation, intelligent transportation, smart homes, and other fields. Currently, traditional secure communication solutions between edge servers and terminal devices primarily rely on symmetric or asymmetric encryption algorithms for data protection and static authentication mechanisms to verify device identity. However, these solutions have numerous limitations. Regarding key management, static keys are susceptible to cracking over time, and once compromised, they render the entire communication link insecure. Dynamic key update mechanisms often lack sufficient security and flexibility, making them difficult to adapt to complex and changing network environments. Regarding authentication, methods based on simple passwords and digital certificates are susceptible to man-in-the-middle and replay attacks. Attackers can intercept authentication information and disguise themselves as legitimate devices to access the system. Furthermore, existing solutions often ignore physical layer channel characteristics and device hardware features, making them vulnerable to attacks targeting communication protocol vulnerabilities and failing to fundamentally ensure the true identities of both communicating parties and the security of data transmission. With the explosive growth in the number of terminal devices and the increasing diversity of network attack methods, traditional secure communication methods have been unable to meet the needs of actual applications. The present invention intends to provide a secure communication method that fully utilizes physical layer channel information and device hardware characteristics, integrates dynamic identity authentication and efficient key management, and improves the security, reliability and anti-attack capabilities of communication between edge servers and terminal devices. Summary of the Invention

[0003] The purpose of the present invention is to provide a secure communication method between an edge server and a terminal device, which fully utilizes physical layer channel information and device hardware characteristics, integrates dynamic identity authentication and efficient key management, and improves the security, reliability and anti-attack capability of communication between the edge server and the terminal device.

[0004] In order to solve the above technical problems, the technical solutions adopted by the present invention are as follows: A secure communication method between an edge server and a terminal device, comprising the following steps: S1: The terminal device starts the wireless transceiver module and performs hardware driver loading, physical layer channel detection and modeling, establishes a physical layer channel state information database, and generates a multi-dimensional feature vector; S2: Encode the multidimensional feature vector into a terminal device identifier of a specified bit; S3: The terminal device generates an identity authentication request, wherein the identity authentication request includes a terminal device identifier and a random number, performs a hash operation on the identity authentication request using a preset hash algorithm to obtain a first hash value, and sends the identity authentication request and the first hash value to the edge server; S4: The edge server verifies the legitimacy of the identity authentication request. If the request is deemed legitimate, it queries the device key of the corresponding terminal device stored locally based on the terminal device identifier. S5: Use the same hash algorithm to perform a hash operation on the identity authentication request and the device key to obtain a second hash value. Compare the first hash value and the second hash value. If they are the same, generate an authentication response message including the session key, the edge server identifier, and a timestamp. Use the device key to encrypt the authentication response message and send the encrypted authentication response message to the terminal device. S6: The terminal device uses the device key to perform decryption, obtains the session key, communicates with the edge server using the session key, and dynamically updates the session key during the communication process.

[0005] Preferably, the specific process of step S1 is as follows: S11: The terminal device starts the wireless transceiver module to automatically load a preset physical layer protocol stack firmware, where the physical layer protocol stack firmware includes a radio frequency parameter calibration module and a spectrum sensing engine; S12: The edge server broadcasts a pilot signal containing a time synchronization marker through a directional antenna array, and the terminal device dynamically adjusts the transmit power based on the received signal strength; S13: The terminal device sends an orthogonal frequency division multiplexing training sequence, and the edge server extracts the multipath delay spread parameter and the channel impulse response matrix; S14: Extracting inherent hardware characteristics of the terminal device, including carrier frequency offset statistics and I / Q imbalance parameter phase noise distribution, and collecting physical layer channel state information and random disturbance characteristics of the GPS positioning trajectory, including Doppler frequency shift and path loss index; S15: Generate a multi-dimensional feature vector based on the inherent characteristics of the terminal device hardware, the physical layer channel state information and the random disturbance characteristics of the GPS positioning trajectory.

[0006] Preferably, the specific process of encoding the multi-dimensional feature vector into a terminal device identifier of a specified bit in step S2 is as follows: S21: constructing a coding network model, and inputting the multidimensional feature vector into an input layer of the coding network model; S22: The feature extraction layer of the encoding network model extracts spatial correlation features between features in the input multidimensional feature vector; S23: The feature compression layer of the encoding network model performs feature compression on the spatial correlation features, and constrains the output of the feature compression layer to the interval [-1, 1] through a tanh activation function; S24: Encode the features constrained to the interval [-1, 1] into a 128-bit binary dynamic hash code, i.e., a device identifier, through a preset sign function.

[0007] Preferably, the specific process of extracting the spatial correlation features between the features in the input multidimensional feature vector by the feature extraction layer of the encoding network model in step S22 is as follows: S221: Reshape the original multi-dimensional feature vector into a two-dimensional feature matrix, and the number of channels is dynamically adjusted according to the feature dimension; S222: The feature extraction layer includes at least three layers, low-level feature extraction is performed through the first layer of the feature extraction layer, local feature correlation is calculated through a sliding window, and nonlinear values are introduced through a ReLU activation function; S223: Perform mid-level feature aggregation through the second layer of the feature extraction layer, expand the receptive field through hollow convolution, and accelerate convergence through batch normalization; S224: Perform high-level semantic fusion through the third layer of the feature extraction layer, dynamically adjust feature weights through the channel attention mechanism, and capture multi-scale information through spatial pyramid pooling; S225: Perform a jump connection between the features output by the first layer and the features output by the third layer, embed the spatial coordinate information into the feature channel through the position encoding vector, and obtain the spatial correlation feature.

[0008] Preferably, the specific process of step S3 is as follows: S31: The terminal device generates a random number using a built-in random number generator, and combines the device identifier and the random data according to a preset data format to generate an identity authentication request; S32: calling a preset hash algorithm library, using a preset hash algorithm to perform a hash operation on the identity authentication request, and converting the identity authentication request into a first hash value of a specified length; S33: Encapsulate the identity authentication request and the first hash value into a specified network data packet using a transport layer protocol in a TCP / IP protocol stack; S34: Calculate the hash value of the network data packet and compare it with the pre-stored hash value to ensure that the data packet has not been tampered with after encapsulation; S35: The terminal device sends the securely processed data packet to the edge server through the designated network interface.

[0009] Preferably, the specific process of the edge server verifying the legitimacy of the identity authentication request in step S4 is as follows: S41: The network monitoring module of the edge server monitors the designated port in real time. When receiving the identity authentication request data packet sent by the terminal device, the network monitoring module decapsulates the data packet through the network protocol stack and extracts the original data including the identity authentication request and the first hash value from the TCP / IP protocol data. S42: Parse the identity authentication request according to a preset data format, separate the terminal device identifier and random number, and prepare for subsequent verification steps; S43: Check whether the authentication request contains a timestamp field, compare the timestamp in the request with the edge server's own system time, and consider the preset time tolerance range. If the timestamp exceeds the tolerance range, it indicates that the request has expired or the attacker is attempting to illegally authenticate by replaying an old request. The edge server immediately rejects the request and records the abnormal request log for subsequent security audits. S44: Based on the parsed terminal device identifier, a query is performed in the device registration information database stored locally on the edge server to verify whether the device identifier is legal and whether the device registration status is normal. If the device identifier is illegal or the status is abnormal, it indicates that the source of the request is suspicious. The edge server directly rejects the identity authentication request and returns an authentication failure error message to the terminal device. S45: After confirming that the device identification is legitimate, the device key of the corresponding terminal device, which is pre-stored, is extracted from the device key management module based on the device identifier. The device key is assigned and securely stored by the system during the device registration phase and is used for encryption and verification operations during the identity authentication process. It is a key element for ensuring the authenticity of the identities of both communicating parties. S46: Using the same preset hash algorithm as that used by the terminal device, the received identity authentication request and the extracted device key are hashed to generate a second hash value. The generated second hash value is accurately compared with the first hash value carried in the identity authentication request. If the two hash values are completely consistent, it indicates that the terminal device has the correct device key and the request has not been tampered with during transmission, and the identity authentication is preliminarily passed. Otherwise, it is determined that there is a problem with the request, the identity authentication request is rejected, and further security measures are taken, such as limiting the number of retries for the device to prevent brute force attacks. S47: The edge server performs further security verification to check whether the source IP address of the request is within the authorized IP address range to prevent illegal devices from authenticating by disguising their IP addresses; the frequency of requests is analyzed. If a large number of authentication requests are received from the same device in a short period of time, it may be a malicious attack. The edge server will limit or block the requests from the device.

[0010] Preferably, the specific process of step S5 is as follows: S51: extracting the original data fields of the terminal device identifier and the random number from the parsed result of the identity authentication request; S52: calling the system's built-in cryptography library, concatenating the extracted request data and the device key in a preset order, and performing a hash calculation using the preset hash algorithm to generate a second hash value; S53: using a time-constant comparison algorithm to compare the first hash value and the second hash value bit by bit, if the comparison is successful, executing step S54, otherwise recording an exception and punishing the security audit process; S54: Call the secure random number generator of the cryptography library to generate a session key of a specified bit, which will be used for symmetric encryption of subsequent communications; S55: Obtain the high-precision system time of the edge server and convert it into a timestamp in ISO 8601 format string to identify the time when the response was generated; S56: Extract the unique identifier of the edge server from the server configuration file, assemble the session key, timestamp and the unique identifier of the edge server according to a specified rule to generate an authentication response message, encrypt the authentication response message and transmit it to the device terminal.

[0011] Preferably, the specific process of encrypting the authentication response message and transmitting it to the device terminal in step S56 is as follows: S561: Convert the authentication response message into a byte stream and generate a random initialization vector value of a specified byte; S562: Encoding the byte stream according to a specified rule based on the device key and then encrypting it using a preset symmetric encryption algorithm to generate a ciphertext and an authentication tag. A message authentication code is automatically generated during the encryption process to ensure data integrity. S563: Concatenate the initialization vector value, ciphertext, and authentication tag according to a specified format, and convert the concatenation result into a Base64-encoded authentication response message; S564: Package the encrypted authentication response into a secure communication protocol frame, add the protocol version number and message type metadata, and send the response message to the terminal device through a preconfigured TLS1.3 session. Use the server certificate and private key to establish an encrypted channel and set a response timeout. If the device terminal does not confirm receipt within the specified time, trigger the retransmission mechanism and record the timeout log. Use the specified transmission protocol to ensure message delivery. After receiving the ACK confirmation from the terminal, close the communication connection.

[0012] The beneficial effects of the present invention include: The present invention provides a secure communication method between an edge server and a terminal device. The terminal device activates a wireless transceiver module, loads a hardware driver, and performs physical layer channel detection and modeling. This establishes a physical layer channel state information database and generates a multidimensional feature vector. Identity authentication is performed using a preset hash algorithm, and the authentication response message is encrypted and sent to the terminal device. The terminal device decrypts the message using a device key, obtains a session key, and then communicates with the edge server based on the session key. By leveraging physical layer channel information and device hardware features, and integrating dynamic identity authentication with efficient key management, this secure communication method improves the security, reliability, and attack resistance of communication between the edge server and the terminal device.

[0013] First, by constructing a multidimensional feature vector based on physical layer channel state information and inherent hardware characteristics of the device, and encoding it into a dynamic device identifier using a coding network model, each terminal device has a unique and difficult-to-replicate identity. The physical layer channel characteristics dynamically change with environmental changes, while the inherent hardware characteristics are device-unique. Combining these two to generate a device identifier effectively protects against man-in-the-middle attacks and replay attacks that are vulnerable to traditional static identity authentication, fundamentally ensuring the authenticity of the identities of both communicating parties. Furthermore, the edge server's multi-dimensional legitimacy verification process, including timestamp verification, IP address checking, and request frequency analysis, further enhances the security and reliability of identity authentication.

[0014] Secondly, hybrid encryption technology is employed during data transmission. The authentication response message is encrypted using a combination of device keys and a symmetric encryption algorithm. The TLS 1.3 protocol is then used to establish an encrypted channel during network transmission. This double encryption ensures the confidentiality and integrity of data during transmission. Furthermore, digital signatures and message authentication codes are applied to the data to ensure it has not been tampered with and that its source is reliable. This effectively prevents data theft, forgery, and tampering, enhancing data transmission security.

[0015] Thirdly, terminal devices dynamically adjust transmit power based on physical layer channel detection results, and edge servers optimize communication parameters by analyzing channel status information. This allows the communication system to better adapt to complex and changing network environments and ensure communication stability. Furthermore, machine learning algorithms analyze communication data in real time, promptly identifying abnormal communication behavior and implementing appropriate protective measures. This strengthens the system's ability to resist network attacks and improves the communication system's survivability in complex network environments.

[0016] Finally, during identity authentication and data transmission, efficient hashing algorithms, symmetric encryption algorithms, and optimized data processing procedures are employed to reduce computing resource consumption and data transmission latency. The use of orthogonal frequency division multiplexing training sequences improves spectrum utilization, and the coding network model's rapid feature processing and compression accelerates identity authentication, thereby improving overall communication efficiency between edge servers and end devices and meeting the needs of application scenarios with high real-time requirements. Dynamically updating session keys during communication avoids the risk of static keys being easily cracked over long periods of use, significantly enhancing key security. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 Schematic diagram of the flow of the secure communication method between the edge server and the terminal device of the present invention.

[0018] Figure 2 It is a flow chart of encoding a multi-dimensional feature vector into a terminal device identifier of a specified position according to the present invention.

[0019] Figure 3 Schematic diagram of the dynamic update process of the session key of the present invention. DETAILED DESCRIPTION

[0020] The following is combined with Figures 1 to 3 The present invention is described in further detail: Example 1 See attached Figure 1 As shown, a secure communication method between an edge server and a terminal device includes the following steps: S1: The terminal device starts the wireless transceiver module and performs hardware driver loading, physical layer channel detection and modeling, establishes a physical layer channel state information database, and generates a multi-dimensional feature vector. After the terminal is powered on, its operating system calls the wireless transceiver module driver through the hardware abstraction layer and drives the physical layer protocol stack firmware. At the same time, the driver initializes the module registers, configures the RF parameters, and completes the hardware self-test. The terminal device actively sends a detection signal or passively receives surrounding wireless signals. Based on physical layer parameters such as signal strength, phase offset, and multipath delay, a channel impulse response model is constructed using a signal processing algorithm. Physical layer channel state information is extracted from the physical layer channel, including time domain features: delay spread and number of multipaths; frequency domain features: channel frequency response and fading depth; spatial features (if there are multiple antennas): angle spread and angle of arrival (AoA); and statistical features: mean, variance, and correlation time.

[0021] S2: Encode the multidimensional feature vector and encode it into a terminal device identifier of a specified bit. Construct a coding network model to extract features from the input multidimensional feature vector. First, the feature extraction layer of the coding network model extracts the spatial correlation features between the features in the input multidimensional feature vector. The feature compression layer of the coding network model compresses the spatial correlation features and constrains the output of the feature compression layer through the tanh activation function. The constrained features are encoded into a specified bit binary dynamic hash code, i.e., a device identifier, through a preset symbol function.

[0022] S3: The terminal device generates an authentication request, which includes a terminal device identifier and a random number. The authentication request is hashed using a preset hash algorithm to obtain a first hash value. The authentication request and the first hash value are then sent to the edge server. The terminal device generates a random number using a built-in random number generator, combines the device identifier and the random data in a preset data format, and generates the authentication request. The authentication request is hashed using a preset hash algorithm to obtain the first hash value, which is then encapsulated with the authentication request. The terminal device sends the securely processed data packet to the edge server via a designated network interface.

[0023] S4: After verifying the legitimacy of the authentication request, the edge server queries the locally stored device key for the corresponding terminal device based on the terminal device identifier. The network monitoring module of the edge server monitors the designated port in real time. Upon receiving the authentication request data packet sent by the terminal device, the network protocol stack decapsulates the data packet to extract the original data of the authentication request and the first hash value. The authentication request is parsed, and the legitimacy and registration status are verified based on the parsed terminal device identifier. The pre-stored device key is extracted from the device key management module, and a hash operation is performed on the authentication request and the device key to generate a second hash value, which is compared with the first hash value. The edge server performs further security verification to check whether the source IP address of the request is within the authorized IP address range.

[0024] S5: Use the same hash algorithm to perform a hash operation on the identity authentication request and the device key to obtain a second hash value. Compare the first hash value and the second hash value. If they are the same, generate an authentication response message including the session key, the edge server identifier, and a timestamp. Use the device key to encrypt the authentication response message and send the encrypted authentication response message to the terminal device. S6: The terminal device uses the device key to decrypt the message and obtain the session key. It then communicates with the edge server using this session key, dynamically updating the session key during communication. The terminal device receives the encrypted response message (ciphertext) from the edge server. It decrypts the response using its locally stored device key. It calculates the HMAC value of the received message and compares it with the MAC value in the response. It checks the difference between the timestamp and the local time to prevent replay attacks. Both parties use the Session_Key as a symmetric key and communicate in AES-GCM mode, which provides encryption and authentication.

[0025] A session key update mechanism is established. The dynamic update trigger conditions for the session key are time-driven, data volume-driven, or event-driven. The dynamic update process for the session key is as follows: when any of the session key dynamic update trigger conditions occurs, the edge server generates a new session key SK-new and sends it to the terminal device. The terminal device receives and updates the session key, verifies the timestamp and sequence number, and activates and saves the new session key SK-new upon verification. A security protection mechanism is established within this dynamic update process for the session key.

[0026] Example 2 Based on Example 1, the specific process of step S1 is as follows: S11: The terminal device automatically loads the preset physical layer protocol stack firmware, which includes a radio frequency parameter calibration module and a spectrum sensing engine, by starting the wireless transceiver module. After the terminal device is powered on, the operating system locates the wireless module firmware path through the device tree or driver registry. The preset physical layer protocol stack firmware, typically stored in SPI Flash or eMMC, is loaded. The physical layer protocol stack firmware includes a radio frequency parameter calibration module and a spectrum sensing engine. The radio frequency parameter calibration module compensates for frequency offset and power fluctuations caused by temperature and voltage variations. The spectrum sensing engine scans for available spectrum resources based on energy detection or signature detection algorithms.

[0027] The firmware performs a hardware self-test to verify the status of the RF front-end components. It also configures initial RF parameters: center frequency, transmit power, modulation mode, and channel bandwidth. The spectrum sensing engine performs a wide frequency band scan (e.g., 2.4 GHz to 6 GHz), detecting primary user signals, co-channel interference sources, and noise floor distribution. It then generates a spectrum occupancy map to select the optimal frequency band for subsequent communications.

[0028] S12: The edge server broadcasts a pilot signal containing a time synchronization marker via a directional antenna array. The terminal device dynamically adjusts its transmit power based on the received signal strength. The edge server generates a narrow beam using a massive MIMO antenna array and broadcasts a pilot signal containing a time synchronization marker. The terminal device receives the pilot signal and calculates the received signal strength indicator. The terminal dynamically adjusts its transmit power based on the RSSI. The formula is: P tx = P ref - RSSI + Δ.

[0029] Among them, P tx is the adjusted power, P ref is the reference power and Δ is the margin.

[0030] The power adjustment step is usually 1dB, and the adjustment period is on the order of 10ms.

[0031] S13: The terminal device sends an OFDM training sequence, and the edge server extracts the multipath delay spread parameters and the channel impulse response matrix. The terminal sends this OFDM training sequence as an OFDM training signal, which includes a time-domain synchronization sequence, frequency-domain pilot symbols, and a cyclic prefix, which is used to mitigate multipath effects. After receiving the signal, the server performs the following actions: time-domain synchronization: determining symbol boundaries through correlation detection; frequency offset estimation: compensating for carrier frequency offset; and channel estimation: calculating the channel frequency response using a least-squares (LS) or minimum mean square error (MMSE) algorithm.

[0032] S14: Extract intrinsic terminal device hardware characteristics, including carrier frequency offset statistics and I / Q imbalance parameter phase noise distribution. Physical layer channel state information, including Doppler shift and path loss exponent, and random perturbation characteristics of the GPS positioning trajectory are collected. Carrier frequency offset statistics are estimated using the phase difference of multiple OFDM symbols. The mean, variance, and autocorrelation function of the carrier frequency offset statistics are calculated as features. Gain imbalance and phase error of the in-phase and quadrature branches are estimated; typical features include gain mismatch and phase error. Raw GPS coordinates (longitude, latitude, altitude) are collected. The velocity fluctuation variance, the number of acceleration mutation points, and the deviation of the trajectory from the mapped road are calculated to obtain random perturbation characteristics of the GPS positioning trajectory.

[0033] S15: Generate a multi-dimensional feature vector based on the inherent characteristics of the terminal device hardware, the physical layer channel state information and the random disturbance characteristics of the GPS positioning trajectory.

[0034] In this embodiment, see Figure 2As shown, the specific process of encoding the multi-dimensional feature vector into a terminal device identifier of a specified bit in step S2 is as follows: S21: constructing a coding network model, and inputting the multidimensional feature vector into an input layer of the coding network model; S22: The feature extraction layer of the encoding network model extracts spatial correlation features between features in the input multidimensional feature vector; S23: The feature compression layer of the encoding network model performs feature compression on the spatial correlation features, and constrains the output of the feature compression layer to the interval [-1, 1] through a tanh activation function; S24: Encode the features constrained to the interval [-1, 1] into a 128-bit binary dynamic hash code, i.e., a device identifier, through a preset sign function.

[0035] The specific process of extracting the spatial correlation features between the features in the input multidimensional feature vector by the feature extraction layer of the encoding network model in step S22 is as follows: S221: Reshape the original multi-dimensional feature vector into a two-dimensional feature matrix, and the number of channels is dynamically adjusted according to the feature dimension; S222: The feature extraction layer includes at least three layers, low-level feature extraction is performed through the first layer of the feature extraction layer, local feature correlation is calculated through a sliding window, and nonlinear values are introduced through a ReLU activation function; S223: Perform mid-level feature aggregation through the second layer of the feature extraction layer, expand the receptive field through hollow convolution, and accelerate convergence through batch normalization; S224: Perform high-level semantic fusion through the third layer of the feature extraction layer, dynamically adjust feature weights through the channel attention mechanism, and capture multi-scale information through spatial pyramid pooling; S225: Perform a jump connection between the features output by the first layer and the features output by the third layer, embed the spatial coordinate information into the feature channel through the position encoding vector, and obtain the spatial correlation feature.

[0036] Example 3 Based on Example 1 or Example 2, the specific process of step S3 is as follows: S31: The terminal device generates a random number using a built-in random number generator, and combines the device identifier and the random data according to a preset data format to generate an identity authentication request; S32: calling a preset hash algorithm library, using a preset hash algorithm to perform a hash operation on the identity authentication request, and converting the identity authentication request into a first hash value of a specified length; S33: Encapsulate the identity authentication request and the first hash value into a specified network data packet using a transport layer protocol in a TCP / IP protocol stack; S34: Calculate the hash value of the network data packet and compare it with the pre-stored hash value to ensure that the data packet has not been tampered with after encapsulation; S35: The terminal device sends the securely processed data packet to the edge server through the designated network interface.

[0037] The specific process of the edge server verifying the legitimacy of the identity authentication request in step S4 is as follows: S41: The network monitoring module of the edge server monitors the designated port in real time. When receiving the identity authentication request data packet sent by the terminal device, the network monitoring module decapsulates the data packet through the network protocol stack and extracts the original data including the identity authentication request and the first hash value from the TCP / IP protocol data. S42: Parse the identity authentication request according to a preset data format, separate the terminal device identifier and random number, and prepare for subsequent verification steps; S43: Check whether the authentication request contains a timestamp field, compare the timestamp in the request with the edge server's own system time, and consider the preset time tolerance range. If the timestamp exceeds the tolerance range, it indicates that the request has expired or the attacker is attempting to illegally authenticate by replaying an old request. The edge server immediately rejects the request and records the abnormal request log for subsequent security audits. S44: Based on the parsed terminal device identifier, a query is performed in the device registration information database stored locally on the edge server to verify whether the device identifier is legal and whether the device registration status is normal. If the device identifier is illegal or the status is abnormal, it indicates that the source of the request is suspicious. The edge server directly rejects the identity authentication request and returns an authentication failure error message to the terminal device. S45: After confirming that the device identification is legitimate, the device key of the corresponding terminal device, which is pre-stored, is extracted from the device key management module based on the device identifier. The device key is assigned and securely stored by the system during the device registration phase and is used for encryption and verification operations during the identity authentication process. It is a key element for ensuring the authenticity of the identities of both communicating parties. S46: Using the same preset hash algorithm as that used by the terminal device, the received identity authentication request and the extracted device key are hashed to generate a second hash value. The generated second hash value is accurately compared with the first hash value carried in the identity authentication request. If the two hash values are completely consistent, it indicates that the terminal device has the correct device key and the request has not been tampered with during transmission, and the identity authentication is preliminarily passed. Otherwise, it is determined that there is a problem with the request, the identity authentication request is rejected, and further security measures are taken, such as limiting the number of retries for the device to prevent brute force attacks. S47: The edge server performs further security verification to check whether the source IP address of the request is within the authorized IP address range to prevent illegal devices from authenticating by disguising their IP addresses; the frequency of requests is analyzed. If a large number of authentication requests are received from the same device in a short period of time, it may be a malicious attack. The edge server will limit or block the requests from the device.

[0038] Example 4 On the basis of Example 1 or Example 2 or Example 3, the specific process of step S5 is as follows: S51: extracting the original data fields of the terminal device identifier and the random number from the parsed result of the identity authentication request, wherein the terminal device identifier is a 128-bit 16-byte symbol, and the random number is a 64-bit 8-byte symbol. The parsed result also includes a 32-bit 4-byte timestamp.

[0039] S52: Call the system's built-in cryptography library to concatenate the extracted request data with the device key in a preset order. Specifically, concatenated data = device ID || random number || timestamp || device key, where || represents byte string concatenation. Perform a hash calculation using the preset hash algorithm to generate a second hash value.

[0040] S53: Use a time-constant comparison algorithm to compare the first hash value and the second hash value bit by bit to avoid timing attacks. If the comparison is successful, execute step S54; otherwise, record the exception and punish the security audit process.

[0041] S54: Use the secure random number generator of the cryptography library provided by the operating system to generate a session key of a specified bit and check the generated key entropy value. The key will be used for symmetric encryption of subsequent communications.

[0042] S55: Obtain the high-precision system time of the edge server and convert it into a timestamp in ISO 8601 format string to identify the time when the response was generated; S56: Extract the unique identifier of the edge server from the server configuration file, assemble the session key, timestamp and the unique identifier of the edge server according to a specified rule to generate an authentication response message, encrypt the authentication response message and transmit it to the device terminal.

[0043] The specific process of encrypting the authentication response message and transmitting it to the device terminal in step S56 is as follows: S561: Convert the authentication response message into a byte stream and generate a random initialization vector value of a specified byte; S562: Encoding the byte stream according to a specified rule based on the device key and then encrypting it using a preset symmetric encryption algorithm to generate a ciphertext and an authentication tag. A message authentication code is automatically generated during the encryption process to ensure data integrity. S563: Concatenate the initialization vector value, ciphertext, and authentication tag according to a specified format, and convert the concatenation result into a Base64-encoded authentication response message; S564: Package the encrypted authentication response into a secure communication protocol frame, add the protocol version number and message type metadata, and send the response message to the terminal device through a preconfigured TLS1.3 session. Use the server certificate and private key to establish an encrypted channel and set a response timeout. If the device terminal does not confirm receipt within the specified time, trigger the retransmission mechanism and record the timeout log. Use the specified transmission protocol to ensure message delivery. After receiving the ACK confirmation from the terminal, close the communication connection.

[0044] In step S6, the terminal device uses the device key to perform decryption, obtains the session key, and uses the session key to communicate with the edge server. The specific process of dynamically updating the session key during the communication process is as follows: The terminal device receives an encrypted response message (ciphertext) from the edge server in the following format: Encrypted_Response = AES-CBC(Device Key, Session_Key||Server_ID||Timestamp||MAC). Device Key is the 256-bit device key pre-shared between the terminal and the server; Session_Key is the newly generated 256-bit session key; and MAC is the message authentication code used to verify data integrity.

[0045] The terminal decrypts the response using its locally stored device key. It calculates the HMAC value of the received message and compares it with the MAC in the response. It checks the difference between the timestamp and the local time to prevent replay attacks. Both parties use the Session_Key as a symmetric key and communicate in AES-GCM mode, which provides encryption and authentication.

[0046] The dynamic update mechanism of the session key is as follows: The dynamic update trigger conditions for the session key are: time-driven: set a fixed update period and use a counter to record the session duration; data volume-driven: the cumulative encrypted data volume exceeds a preset threshold; event-driven: abnormal traffic is detected or the number of key uses reaches a preset upper limit.

[0047] See also Figure 3 As shown, the dynamic update process of the session key is as follows: when any session key dynamic update trigger condition occurs, the edge server generates a new session key SK-new, and sends the characters Enc(SK-old, SK-new||timestamp||serial number) obtained by concatenating the new session key SK-new with the original session key SK-old, the timestamp and the serial number to the terminal device. The terminal device receives and decrypts the original session key SK-old to obtain the new session key SK-new, verifies the timestamp and serial number to generate Enc(SK-new, confirmation message||timestamp||) characters and returns them to the edge server. After the edge server verifies the confirmation message, it activates and saves the new session key SK-new.

[0048] In the dynamic session key update process described above, a key update security mechanism is implemented. Specifically, a sequence number is incremented with each key update to prevent old key update messages from overwriting new ones. The terminal and server each maintain local sequence numbers and compare them upon receipt. If the received sequence number is smaller than the local record, the message is discarded. A dual key validity period is also implemented, with the old and new keys coexisting for a specified period of time. During this period, the sender encrypts using the new key, and the receiver attempts to decrypt using both the new and old keys. If successful, the local key is updated.

[0049] Use a key derivation function to generate session keys: Session keys are derived from the master key and include information such as the session ID and timestamp. If the master key is compromised, past session keys remain secure because the derivation process introduces temporal entropy. The terminal device locally stores the most recent N session keys in encrypted form, using the device's unique identifier as the encryption key.

[0050] If the terminal fails to decrypt the new key, it sends a failure message to the server. Upon receiving the failure message, the server retries to send the new key up to three times. If it still fails, the current session is terminated and the terminal is required to re-authenticate. The consistency of the keys between the two parties is regularly verified: the server sends a random number R, encrypted with the current session key; the terminal decrypts and returns Hash(R||timestamp), which the server verifies. If a key leak risk is detected, the server sends a key revocation command, upon which the terminal immediately deletes the current key and begins the reauthentication process.

[0051] In summary, the present invention provides a secure communication method between an edge server and a terminal device. By activating a wireless transceiver module on the terminal device and performing hardware driver loading, physical layer channel detection and modeling, a physical layer channel state information database is established, and a multidimensional feature vector is generated. Identity authentication is performed using a preset hash algorithm, an authentication response message is encrypted, and the encrypted authentication response message is sent to the terminal device. The terminal device decrypts using a device key, obtains a session key, and communicates with the edge server based on the session key. By utilizing physical layer channel information and device hardware features, and integrating dynamic identity authentication with efficient key management, a secure communication method improves the security, reliability, and anti-attack capabilities of communication between the edge server and the terminal device.

[0052] By constructing a multidimensional feature vector based on physical layer channel state information and inherent device hardware characteristics, and encoding it into a dynamic device identifier using a coding network model, each terminal device possesses a secure identity. Physical layer channel characteristics dynamically change with environmental changes, while inherent hardware characteristics are device-unique. Combining these two factors, the generated device identifier effectively mitigates security risks. Furthermore, the edge server's multi-dimensional legitimacy verification process and the use of multiple encryption techniques during data transmission ensure confidentiality and integrity during transmission.

[0053] Terminal devices dynamically adjust their transmit power based on physical layer channel detection results, and edge servers optimize communication parameters by analyzing channel state information. This allows the communication system to better adapt to complex and changing network environments and ensures communication stability. During authentication and data transmission, efficient hashing algorithms, symmetric encryption algorithms, and optimized data processing procedures are employed to reduce computing resource consumption and data transmission latency. The use of orthogonal frequency division multiplexing training sequences improves spectrum utilization, and the coding network model's rapid feature processing and compression accelerates authentication, thereby improving overall communication efficiency between edge servers and terminal devices and meeting the needs of application scenarios with high real-time requirements. Dynamic updates of session keys during communication avoid the risk of static keys being easily cracked due to long-term use, significantly enhancing key security.

Claims

1. A secure communication method between an edge server and a terminal device, characterized in that: The following steps are involved: S1: The terminal device starts the wireless transceiver module and performs hardware driver loading, physical layer channel detection and modeling, establishes a physical layer channel state information database, and generates a multi-dimensional feature vector; S2: Encode the multidimensional feature vector into a terminal device identifier of a specified bit; S3: The terminal device generates an identity authentication request, wherein the identity authentication request includes a terminal device identifier and a random number, performs a hash operation on the identity authentication request using a preset hash algorithm to obtain a first hash value, and sends the identity authentication request and the first hash value to the edge server; S4: The edge server verifies the legitimacy of the identity authentication request. If the request is deemed legitimate, it queries the device key of the corresponding terminal device stored locally based on the terminal device identifier. S5: Use the same hash algorithm to perform a hash operation on the identity authentication request and the device key to obtain a second hash value. Compare the first hash value and the second hash value. If they are the same, generate an authentication response message including the session key, the edge server identifier, and a timestamp. Use the device key to encrypt the authentication response message and send the encrypted authentication response message to the terminal device. S6: The terminal device uses the device key to perform decryption, obtains the session key, communicates with the edge server using the session key, and dynamically updates the session key during the communication process.

2. A secure communication method between an edge server and a terminal device according to claim 1, characterized in that: The specific process of step S1 is as follows: S11: The terminal device starts the wireless transceiver module to automatically load a preset physical layer protocol stack firmware, where the physical layer protocol stack firmware includes a radio frequency parameter calibration module and a spectrum sensing engine; S12: The edge server broadcasts a pilot signal containing a time synchronization marker through a directional antenna array, and the terminal device dynamically adjusts the transmit power based on the received signal strength; S13: The terminal device sends an orthogonal frequency division multiplexing training sequence, and the edge server extracts the multipath delay spread parameter and the channel impulse response matrix; S14: Extracting inherent hardware characteristics of the terminal device, including carrier frequency offset statistics and I / Q imbalance parameter phase noise distribution, and collecting physical layer channel state information and random disturbance characteristics of the GPS positioning trajectory, including Doppler frequency shift and path loss index; S15: Generate a multi-dimensional feature vector based on the inherent characteristics of the terminal device hardware, the physical layer channel state information and the random disturbance characteristics of the GPS positioning trajectory.

3. A secure communication method between an edge server and a terminal device according to claim 2, characterized in that: The specific process of encoding the multi-dimensional feature vector into a terminal device identifier of a specified bit in step S2 is as follows: S21: constructing a coding network model, and inputting the multidimensional feature vector into an input layer of the coding network model; S22: The feature extraction layer of the encoding network model extracts spatial correlation features between features in the input multidimensional feature vector; S23: The feature compression layer of the encoding network model performs feature compression on the spatial correlation features, and constrains the output of the feature compression layer to the interval [-1, 1] through a tanh activation function; S24: Encode the features constrained to the interval [-1, 1] into a 128-bit binary dynamic hash code, i.e., a device identifier, through a preset sign function.

4. A secure communication method between an edge server and a terminal device according to claim 3, characterized in that: The specific process of extracting the spatial correlation features between the features in the input multidimensional feature vector by the feature extraction layer of the encoding network model in step S22 is as follows: S221: Reshape the original multi-dimensional feature vector into a two-dimensional feature matrix, and the number of channels is dynamically adjusted according to the feature dimension; S222: The feature extraction layer includes at least three layers, low-level feature extraction is performed through the first layer of the feature extraction layer, local feature correlation is calculated through a sliding window, and nonlinear values are introduced through a ReLU activation function; S223: Perform mid-level feature aggregation through the second layer of the feature extraction layer, expand the receptive field through hollow convolution, and accelerate convergence through batch normalization; S224: Perform high-level semantic fusion through the third layer of the feature extraction layer, dynamically adjust feature weights through the channel attention mechanism, and capture multi-scale information through spatial pyramid pooling; S225: Perform a jump connection between the features output by the first layer and the features output by the third layer, embed the spatial coordinate information into the feature channel through the position encoding vector, and obtain the spatial correlation feature.

5. The secure communication method between an edge server and a terminal device according to claim 1, wherein: The specific process of step S3 is as follows: S31: The terminal device generates a random number using a built-in random number generator, and combines the device identifier and the random data according to a preset data format to generate an identity authentication request; S32: calling a preset hash algorithm library, using a preset hash algorithm to perform a hash operation on the identity authentication request, and converting the identity authentication request into a first hash value of a specified length; S33: Encapsulate the identity authentication request and the first hash value into a specified network data packet using a transport layer protocol in a TCP / IP protocol stack; S34: Calculate the hash value of the network data packet and compare it with the pre-stored hash value to ensure that the data packet has not been tampered with after encapsulation; S35: The terminal device sends the securely processed data packet to the edge server through the designated network interface.

6. A secure communication method between an edge server and a terminal device according to claim 1, characterized in that: The specific process of the edge server verifying the legitimacy of the identity authentication request in step S4 is as follows: S41: The network monitoring module of the edge server monitors the designated port in real time. When receiving the identity authentication request data packet sent by the terminal device, the network monitoring module decapsulates the data packet through the network protocol stack and extracts the original data including the identity authentication request and the first hash value from the TCP / IP protocol data. S42: Parse the identity authentication request according to a preset data format, separate the terminal device identifier and random number, and prepare for subsequent verification steps; S43: Check whether the authentication request contains a timestamp field, compare the timestamp in the request with the edge server's own system time, and consider the preset time tolerance range. If the timestamp exceeds the tolerance range, it indicates that the request has expired or the attacker is attempting to illegally authenticate by replaying an old request. The edge server immediately rejects the request and records the abnormal request log for subsequent security audits. S44: Based on the parsed terminal device identifier, a query is performed in the device registration information database stored locally on the edge server to verify whether the device identifier is legal and whether the device registration status is normal. If the device identifier is illegal or the status is abnormal, it indicates that the source of the request is suspicious. The edge server directly rejects the identity authentication request and returns an authentication failure error message to the terminal device. S45: After confirming that the device identification is legitimate, the device key of the corresponding terminal device, which is pre-stored, is extracted from the device key management module based on the device identifier. The device key is assigned and securely stored by the system during the device registration phase and is used for encryption and verification operations during the identity authentication process. It is a key element for ensuring the authenticity of the identities of both communicating parties. S46: Using the same preset hash algorithm as that used by the terminal device, the received identity authentication request and the extracted device key are hashed to generate a second hash value. The generated second hash value is accurately compared with the first hash value carried in the identity authentication request. If the two hash values are completely consistent, it indicates that the terminal device has the correct device key and the request has not been tampered with during transmission, and the identity authentication is preliminarily passed. Otherwise, it is determined that there is a problem with the request, the identity authentication request is rejected, and further security measures are taken, such as limiting the number of retries for the device to prevent brute force attacks. S47: The edge server performs further security verification to check whether the source IP address of the request is within the authorized IP address range to prevent illegal devices from authenticating by disguising their IP addresses; the frequency of requests is analyzed. If a large number of authentication requests are received from the same device in a short period of time, it may be a malicious attack. The edge server will limit or block the requests from the device.

7. A secure communication method between an edge server and a terminal device according to claim 6, characterized in that: The specific process of step S5 is as follows: S51: extracting the original data fields of the terminal device identifier and the random number from the parsed result of the identity authentication request; S52: calling the system's built-in cryptography library, concatenating the extracted request data and the device key in a preset order, and performing a hash calculation using the preset hash algorithm to generate a second hash value; S53: using a time-constant comparison algorithm to compare the first hash value and the second hash value bit by bit, if the comparison is successful, executing step S54, otherwise recording an exception and punishing the security audit process; S54: Call the secure random number generator of the cryptography library to generate a session key of a specified bit, which will be used for symmetric encryption of subsequent communications; S55: Obtain the high-precision system time of the edge server and convert it into a timestamp in ISO 8601 format string to identify the time when the response was generated; S56: Extract the unique identifier of the edge server from the server configuration file, assemble the session key, timestamp and the unique identifier of the edge server according to a specified rule to generate an authentication response message, encrypt the authentication response message and transmit it to the device terminal.

8. A secure communication method between an edge server and a terminal device according to claim 7, characterized in that: The specific process of encrypting the authentication response message and transmitting it to the device terminal in step S56 is as follows: S561: Convert the authentication response message into a byte stream and generate a random initialization vector value of a specified byte; S562: Encoding the byte stream according to a specified rule based on the device key and then encrypting it using a preset symmetric encryption algorithm to generate a ciphertext and an authentication tag. A message authentication code is automatically generated during the encryption process to ensure data integrity. S563: Concatenate the initialization vector value, ciphertext, and authentication tag according to a specified format, and convert the concatenation result into a Base64-encoded authentication response message; S564: Package the encrypted authentication response into a secure communication protocol frame, add the protocol version number and message type metadata, and send the response message to the terminal device through a preconfigured TLS1.3 session. Use the server certificate and private key to establish an encrypted channel and set a response timeout. If the device terminal does not confirm receipt within the specified time, trigger the retransmission mechanism and record the timeout log. Use the specified transmission protocol to ensure message delivery. After receiving the ACK confirmation from the terminal, close the communication connection.

Images