Agricultural perception node-oriented lightweight secure communication method and system

Abstract

The application discloses a kind of light security communication method and system for agricultural perception node.The method includes that 256-bit static master key is preset in the bottom layer security storage area of perception node and heterogeneous convergence gateway, and the unique hardware serial number is read as node identification;Synchronous acquisition environmental data and visual feature data, splice into long payload plaintext;Derive dynamic session key, use dynamic session key to drive stream cipher to encrypt long payload plaintext, static master key drives block cipher to encrypt short header, and encapsulates into data frame;Data frame is sent through wireless channel, and heterogeneous convergence gateway receives and reversely decrypts short header to extract dynamic anti-fake factor, and replay attack verification is carried out;After verification, dynamic session key is reconstructed to restore data and uploaded to cloud data management server.The application also discloses a system using the above light security communication method for agricultural perception node, realizes the high security node legitimacy authentication and anti-replay attack under limited hardware computing power.

Description

Technical Field

[0001] This invention belongs to the field of Internet of Things information security and agricultural informatization technology, specifically relating to a lightweight secure communication method and system for agricultural sensing nodes. Background Technology

[0002] With the development of smart agriculture, the Internet of Things (IoT) in agriculture plays a vital role in areas such as farmland environmental monitoring and pest and disease early warning. In practical applications, sensing nodes deployed in the field are typically battery-powered, with extremely limited computing power and storage resources. However, with the development of edge computing vision technology, nodes not only need to transmit short scalar data such as temperature and humidity, but also longer data payloads such as visual feature results for pest and disease identification. To ensure the confidentiality and integrity of the aforementioned environmental and visual feature data in the field wireless link, it is essential to encrypt and authenticate the data frames reported by the sensing nodes.

[0003] However, this leads to an unavoidable contradiction between the extremely limited hardware computing power of agricultural sensing nodes and the high-security requirements of the Internet of Things (IoT). Traditional asymmetric encryption algorithms or high-strength symmetric encryption algorithms consume a large amount of microcontroller computing power when encrypting such long payloads, resulting in a surge in node power consumption and making it difficult to meet the requirements of low power consumption and long battery life for agricultural IoT.

[0004] For example, the invention patent with publication number CN121792120A discloses a time-sensitive network end-to-end secure communication method. This method uses the Linux TSN terminal system to implement two-way authentication and key negotiation based on the SM2 national cryptographic algorithm, and uses the SM4CCM algorithm to implement time-sensitive network secure communication and data integrity verification. The SM2 national cryptographic algorithm is an asymmetric encryption algorithm that generates signature pairs based on the elliptic curve discrete logarithm problem. Both parties negotiate and share a key through elliptic curve point operations, encrypting with the receiver's public key and decrypting only with the private key. SM4CCM is a combination of the SM4 block cipher algorithm and the CCM mode, used to provide data confidentiality, integrity, and authenticity. The CCM mode achieves efficient authentication encryption by combining CTR encryption and CBCMAC authentication.

[0005] For example, invention patent CN121690614A discloses a trusted IoT data acquisition and access control method based on TEE and blockchain. This method utilizes a trusted execution environment to encrypt, sign, and bind trusted timestamps to the collected raw data, constructing trusted data packets and generating blockchain transactions. When a user initiates an access request, the trusted execution environment proactively sends a request to the blockchain network to obtain pre-set access control policies from smart contracts deployed on the blockchain. The trusted execution environment verifies the user's access permissions based on the obtained access control policies and the request information carried by the user when initiating the access request. If the user's permissions are verified, the trusted execution environment uses a pre-stored decryption key corresponding to the data encryption to decrypt the encrypted data requested by the user and provides the decrypted data to the user.

[0006] Furthermore, the open nature of wireless communication channels makes them highly vulnerable to eavesdropping and data replay attacks. How to achieve highly secure node authentication and replay attack prevention with limited hardware computing power is a critical technical challenge that urgently needs to be addressed in the field of agricultural IoT security. Summary of the Invention

[0007] The purpose of this invention is to provide a lightweight secure communication method and system for agricultural sensing nodes. It extracts the absolute timestamp as a dynamic anti-counterfeiting factor through the Beidou satellite positioning and timing module, and adopts an asymmetric computing power allocation and light-weight separation encryption strategy to achieve high-security node legitimacy authentication and anti-replay attack under limited hardware computing power.

[0008] A lightweight secure communication method for agricultural sensing nodes includes an Internet of Things (IoT) system. The IoT system comprises a sensing layer detection node group, a heterogeneous aggregation gateway, and a cloud data management server. The sensing layer detection node group includes several sensing nodes. The lightweight secure communication method includes the following steps: (1) Before the deployment of the Internet of Things system, a 256-bit static master key is pre-set in the underlying secure storage area of ​​the sensing node and the heterogeneous aggregation gateway, and a unique hardware serial number is read from the sensing node as the node identifier. (2) The sensing node synchronously collects environmental data and visual feature data, and splices the environmental data and the visual feature data into a long payload plaintext; (3) Using a lightweight hash algorithm based on a sponge structure, the dynamic anti-counterfeiting factor is used as a dynamic entropy source, and it is mixed with the static master key and node identifier for preprocessing and internal permutation to deduce the dynamic session key in real time. The dynamic anti-counterfeiting factor is an absolute timestamp. (4) To address the differences in data payload length, an asymmetric computing power allocation and light-weight separation encryption strategy is adopted: For the long payload plaintext with a large amount of data, lightweight computing power is allocated, and it is encrypted based on the dynamic session key-driven stream cipher to generate a one-time pad ciphertext payload; for the short header containing the node identifier and the dynamic anti-counterfeiting factor, high-security computing power is allocated, and it is encrypted based on the static master key-driven block cipher to generate a ciphertext header; finally, the ciphertext payload and the ciphertext header are encapsulated into the data frame. (5) The sensing node sends the data frame to the heterogeneous aggregation gateway through the wireless channel. The heterogeneous aggregation gateway reverse decrypts the ciphertext header in the data frame and performs time verification to intercept replay attacks. After the time verification is passed, the dynamic session key is reconstructed to decrypt the ciphertext payload in the data frame.

[0009] Specifically, in step (1), a 256-bit static master key and a unique hardware serial number are used as node identifiers. These two static parameters are used as preset parameters for subsequent zero-interaction encryption and node legitimacy authentication.

[0010] Specifically, in step (2), the environmental data includes the temperature and humidity of the farmland environment, soil moisture and soil electrical conductivity; the visual feature data includes the feature results of the target bounding box coordinates and confidence level of pest and disease identification on crop images in the farmland.

[0011] Furthermore, in step (3), the specific process for generating the dynamic session key is as follows: The lightweight hash algorithm based on the sponge structure is the Ascon-Hash lightweight hash algorithm. Using the Ascon-Hash lightweight hash algorithm, the static master key, node identifier, and dynamic anti-counterfeiting factor are XORed and obfuscated to deduce the dynamic session key in real time, achieving dynamic changes to the one-time key. The formula is as follows: ; The dynamic session key is: The static master key is Node identifier With dynamic anti-counterfeiting factors .

[0012] Furthermore, the specific process of the asymmetric computing power allocation and light-heavy separation encryption strategy described in step (4) is as follows: To address the differences in data payload length, the long payload plaintext is defined to include the environmental data and the visual feature data, the short header includes the node identifier and the dynamic anti-counterfeiting factor, the stream cipher is the lightweight ChaCha20 stream cipher, and the block cipher is the SM4 national standard block cipher. The dynamic session key drives the ChaCha20 stream cipher to encrypt the long payload plaintext, generating a ciphertext payload. The static master key drives the SM4 block cipher to encrypt the short header, generating a ciphertext header. The ciphertext payload and the ciphertext header are then encapsulated into a light-weight-separated encrypted data frame.

[0013] Furthermore, in step (5), the wireless channel is a LoRa wireless channel, and the sensing node sends the data frame to the heterogeneous aggregation gateway through the LoRa wireless channel.

[0014] Furthermore, in step (5), the specific process of reverse decryption and time verification of the heterogeneous aggregation gateway is as follows: After receiving the data frame, the heterogeneous aggregation gateway calls the static master key and uses the SM4 national cryptographic block cipher to reverse decrypt the ciphertext header of the data frame to extract the dynamic anti-counterfeiting factor. The dynamic anti-counterfeiting factor is compared with the system time of the heterogeneous aggregation gateway. If the time difference exceeds the preset security tolerance threshold, the data frame is determined to be a replay attack and is discarded. Conversely, the heterogeneous aggregation gateway synchronously reconstructs the dynamic session key according to the same XOR obfuscation operation as the sensing node, and drives the ChaCha20 stream cipher to decrypt the ciphertext payload of the data frame, and finally reports it to the cloud data management server.

[0015] Preferably, the safety tolerance threshold is 3 seconds.

[0016] The present invention also provides a system employing the above-described lightweight secure communication method, which balances low power consumption operation with high-strength security protection.

[0017] A lightweight secure communication method system includes an Internet of Things (IoT) system, wherein the IoT system includes a sensing layer detection node group, a heterogeneous aggregation gateway, and a cloud data management server, and the sensing layer detection node group includes a plurality of sensing nodes, each of which includes: The system comprises a multi-mode sensor array for collecting environmental data, an edge vision processor for collecting visual feature data, a BeiDou satellite positioning and timing module for extracting absolute timestamps as the dynamic anti-counterfeiting factor, and a microcontroller as the main control chip. The microcontroller encrypts and forms data frames based on the dynamic anti-counterfeiting factor, environmental data, and visual feature data, and outputs these data frames to the heterogeneous aggregation gateway. The heterogeneous aggregation gateway receives the data frames, performs time verification and decryption based on the data frames, and then reports the decrypted data to the cloud data management server. The cloud data management server receives the decrypted data and performs global data aggregation and management.

[0018] Specifically, the sensing node collects environmental data in real time, including temperature and humidity of farmland, soil moisture, and soil conductivity parameters, through the multi-mode sensor group; the sensing node synchronously infers crop images in farmland through the edge vision processor, and outputs visual feature data, including the target bounding box coordinates and confidence scores of pest and disease identification in the image; the sensing node parses the NMEA standard statement output by the Beidou satellite positioning and timing module at high speed through the serial port, and extracts absolute timestamps accurate to the second or millisecond level as dynamic anti-counterfeiting factors.

[0019] Preferably, the main control chip is an STM32 microcontroller and the edge vision processor is a K210, in order to achieve low power consumption, low cost and high efficiency.

[0020] The beneficial effects of this invention are as follows: This invention provides a lightweight secure communication method for agricultural sensing nodes. The method proposes an encryption strategy that combines asymmetric computing power allocation with a separation of light and heavy encryption. It uses lightweight ChaCha20 stream cipher to encrypt long payloads of environmental and visual features, and uses high-security SM4 block cipher only to encrypt the core short message header. Under limited hardware computing power, this method effectively resolves the contradiction between high-strength encryption and low power consumption of nodes.

[0021] This invention extracts the absolute timestamp as a dynamic anti-counterfeiting factor through the BeiDou satellite positioning and timing module. It performs an XOR obfuscation operation with the 256-bit static master key and unique node identifier to deduce the dynamic session key in real time, realizing one-time password. Furthermore, based on time verification, it effectively ensures the authenticity and reliability of data in the wireless communication environment.

[0022] The system of this invention achieves efficient encryption protection of multimodal long-load data on the agricultural edge without increasing the hardware overhead of sensing nodes by implementing an encryption strategy of asymmetric computing power allocation and separation of light and heavy computing power. This effectively resolves the inherent contradiction between "limited computing power" and "high-intensity security requirements" in agricultural Internet of Things. Attached Figure Description

[0023] Figure 1 This is a flowchart illustrating the overall stages of a lightweight secure communication method for agricultural sensing nodes provided in an embodiment of the present invention.

[0024] Figure 2 A detailed flowchart of encryption, decryption, and time verification provided for embodiments of the present invention.

[0025] Figure 3 This is a schematic diagram of the structure of a data frame with light and heavy separation encryption provided in an embodiment of the present invention. Detailed Implementation

[0026] This invention provides a lightweight secure communication method for agricultural sensing nodes. The system implementing this lightweight secure communication method includes an Internet of Things (IoT) system, which comprises a sensing layer detection node group, a heterogeneous aggregation gateway, and a cloud data management server. The sensing layer detection node group includes several sensing nodes, each of which includes: The system comprises a multi-mode sensor array for collecting environmental data, a K210 edge vision processor for collecting visual feature data, a BeiDou satellite positioning and timing module for extracting absolute timestamps as dynamic anti-counterfeiting factors, and an STM32 microcontroller as the main control chip. The microcontroller encrypts data frames based on the dynamic anti-counterfeiting factors, environmental data, and visual feature data, and outputs these data frames to a heterogeneous aggregation gateway. The heterogeneous aggregation gateway receives the data frames, performs time verification and decryption based on the data frames, and then reports the decrypted data to a cloud data management server. The cloud data management server receives the decrypted data and performs global data aggregation and management.

[0027] like Figure 1 As shown, the overall stages of the lightweight secure communication method for agricultural sensing nodes in this embodiment include: S1. Global Initialization Phase: A 256-bit static master key is pre-set in the underlying secure storage area of ​​the sensing node and the heterogeneous aggregation gateway. At the same time, a unique hardware serial number is read from the sensing node as the node identifier, which forms the basis for the system's node legitimacy authentication and zero-interaction encryption.

[0028] S2, Multi-source Data Sensing and Precise Time Synchronization Stage: Sensing nodes collect environmental data from farmland and visual feature data for pest and disease identification, splicing them together to create a long payload plaintext. Simultaneously, the BeiDou satellite positioning and timing module is analyzed to extract the absolute timestamp as a dynamic anti-counterfeiting factor.

[0029] S3, Asymmetric Computing Power Fusion Encryption Phase: Deducing Dynamic Session Keys: ; The dynamic session key is: The static master key is Node identifier With dynamic anti-counterfeiting factors .

[0030] The ChaCha20 encryption of long payload plaintext is driven by a dynamic session key, and the SM4 encryption of short header containing node identifier and dynamic anti-counterfeiting factor is driven by a static master key. The two are then encapsulated into a data frame.

[0031] S4. Data wireless transmission and gateway decryption and verification stage: The data frame is sent to the heterogeneous aggregation gateway via LoRa. The heterogeneous aggregation gateway uses the static master key to decrypt the header to extract the dynamic anti-counterfeiting factor and perform verification. After the verification is successful, the dynamic session key is reconstructed to restore the data and upload it to the cloud data management server.

[0032] like Figure 2 As shown, the specific process of encryption, decryption, and time verification of the lightweight secure communication method in this embodiment is as follows: 1. Initialization: Before deploying the IoT system in farmland, static parameters need to be preset in the underlying secure storage area of ​​the sensing nodes and heterogeneous aggregation gateways. That is, a 256-bit static master key needs to be preset, and a unique hardware serial number needs to be read from the sensing nodes as the node identifier. These two static parameters will no longer be transmitted in plaintext through the wireless channel in subsequent processes, thus building the foundation for node legitimacy authentication and zero-interaction encryption.

[0033] 2. Data Sensing and Time Acquisition: After the system starts, the sensing nodes continuously monitor the farmland environment through a multi-mode sensor group, acquiring temperature, humidity, soil moisture, and soil conductivity in real time to form environmental data; the K210 edge vision processor synchronously infers the crop images in the farmland, outputting pest and disease feature results including target bounding box coordinates and confidence scores, generating visual feature data; as the main control chip of the sensing nodes, the STM32 microcontroller is responsible for stitching the above environmental data and visual feature data to construct a long payload plaintext containing complete agricultural information to be transmitted.

[0034] Meanwhile, the sensing node uses a serial port to parse the NMEA standard statement output by the BeiDou satellite positioning and timing module at high speed, extracting the UTC absolute timestamp accurate to the second or millisecond level, which serves as a dynamic anti-counterfeiting factor, providing a time-dimensional benchmark guarantee for the system's secure communication and time verification.

[0035] 3. Asymmetric computing power fusion encryption: Dynamic session keys are derived, and the sensing node calls the Ascon-Hash lightweight hash algorithm to perform an XOR obfuscation operation on the static master key, dynamic anti-counterfeiting factor, and unique node identifier, as shown in the following formula: ; The dynamic session key is: The static master key is Node identifier With dynamic anti-counterfeiting factors .

[0036] By calculating the dynamic session key in real time, the key used for each communication changes dynamically with the time factor, thus achieving a one-time key in a physical sense.

[0037] To address the differences in data payload length, an asymmetric computing power allocation and a light-heavy encryption strategy are adopted to adapt to the limited computing power of agricultural sensing nodes, as detailed below: The long payload plaintext contains environmental data and visual feature data. For long payload plaintext with large data volumes, lightweight computing power is allocated. The system uses a derived dynamic session key to drive a lightweight ChaCha20 stream cipher to encrypt the long payload plaintext, generating a ciphertext payload. This encryption method effectively reduces the computing power consumption of the microcontroller during long data processing, balancing node power consumption while ensuring data confidentiality. For short headers containing node identifiers and dynamic anti-counterfeiting factors, high-security computing power is allocated. The system uses a static master key to drive a high-strength symmetric encryption algorithm, the SM4 national standard block cipher, to encrypt the short header, generating a ciphertext header.

[0038] This asymmetric computing power allocation model ensures that the core metadata has an extremely high level of security and maximizes the utilization of the hardware energy efficiency of the perception layer nodes.

[0039] 4. Data frame assembly and transmission: such as Figure 3 As shown, in this embodiment, the data frame is encapsulated by a ciphertext payload and a ciphertext header. The sensing node sends the data frame to the heterogeneous aggregation gateway via the LoRa wireless channel.

[0040] 5. Reception and Decryption Verification: After receiving a data frame, the heterogeneous aggregation gateway first calls the static master key in the underlying secure storage area and reverse decrypts the ciphertext header in the data frame using the SM4 national cryptographic block cipher to extract the dynamic anti-counterfeiting factor. The dynamic anti-counterfeiting factor is compared with the current system time of the heterogeneous aggregation gateway for time difference verification. If the time difference exceeds the preset security tolerance threshold of 3 seconds, the data frame is determined to be a replay attack, and the message is directly discarded.

[0041] 6. Key Reconstruction and Data Decryption: If the time difference is less than the preset security tolerance threshold, the heterogeneous aggregation gateway will reconstruct the dynamic session key using the static master key and dynamic anti-counterfeiting factor according to the XOR confusion operation consistent with the sensing node, and drive the ChaCha20 stream cipher to decrypt the ciphertext payload in the data frame in reverse, restoring the environmental data and visual feature data.

[0042] 7. Data Reporting and Processing: The restored data is reported to the cloud data management server via the heterogeneous aggregation gateway, completing a complete secure communication loop.

Claims

1. A lightweight secure communication method for agricultural sensing nodes, comprising an Internet of Things (IoT) system, wherein the IoT system includes a sensing layer detection node group, a heterogeneous aggregation gateway, and a cloud data management server, the sensing layer detection node group comprising a plurality of sensing nodes, characterized in that, The lightweight secure communication method includes the following steps: (1) The sensing node and the heterogeneous aggregation gateway have a 256-bit static master key pre-set in their underlying secure storage area. At the same time, a unique hardware serial number is read from the sensing node as a node identifier, which serves as a pre-set parameter for subsequent zero-interaction encryption and node legitimacy authentication. (2) The sensing node synchronously collects environmental data and visual feature data, and splices the environmental data and the visual feature data into a long payload plaintext; (3) Using a lightweight hash algorithm based on a sponge structure, the dynamic anti-counterfeiting factor is used as a dynamic entropy source, and it is mixed with the static master key and node identifier for preprocessing and internal permutation to deduce the dynamic session key in real time. The dynamic anti-counterfeiting factor is an absolute timestamp. (4) To address the differences in data payload length, an asymmetric computing power allocation and light-weight separation encryption strategy is adopted: For the long payload plaintext with a large amount of data, lightweight computing power is allocated, and it is encrypted based on the dynamic session key-driven stream cipher to generate a one-time pad ciphertext payload; for the short header containing the node identifier and the dynamic anti-counterfeiting factor, high-security computing power is allocated, and it is encrypted based on the static master key-driven block cipher to generate a ciphertext header; finally, the ciphertext payload and the ciphertext header are encapsulated into the data frame. (5) The sensing node sends the data frame to the heterogeneous aggregation gateway through the wireless channel. The heterogeneous aggregation gateway reverse decrypts the ciphertext header in the data frame and performs time verification to intercept replay attacks. After the time verification is passed, the dynamic session key is reconstructed to decrypt the ciphertext payload in the data frame.

2. The lightweight secure communication method according to claim 1, characterized in that, In step (2), the environmental data includes the temperature and humidity of the farmland, soil moisture and soil electrical conductivity parameters; the visual feature data includes the feature results of the target bounding box coordinates and confidence scores for identifying pests and diseases on crop images in the farmland.

3. The lightweight secure communication method according to claim 1, characterized in that, In step (3), the specific process of generating the dynamic session key is as follows: The lightweight hash algorithm based on the sponge structure is the Ascon-Hash lightweight hash algorithm. Using the Ascon-Hash lightweight hash algorithm, the static master key, node identifier, and dynamic anti-counterfeiting factor are XORed and obfuscated to deduce the dynamic session key in real time, achieving dynamic changes to the one-time key. The formula is as follows: ； The dynamic session key is: The static master key is Node identifier With dynamic anti-counterfeiting factors .

4. The lightweight secure communication method according to claim 1, characterized in that, In step (4), the specific process of the asymmetric computing power allocation and light-heavy separation encryption strategy is as follows: To address the differences in data payload length, the long payload plaintext is defined to include the environmental data and the visual feature data, the short header includes the node identifier and the dynamic anti-counterfeiting factor, the stream cipher is the lightweight ChaCha20 stream cipher, and the block cipher is the SM4 national standard block cipher. The dynamic session key drives the ChaCha20 stream cipher to encrypt the long payload plaintext, generating a ciphertext payload. The static master key drives the SM4 block cipher to encrypt the short header, generating a ciphertext header. The ciphertext payload and the ciphertext header are then encapsulated into a light-weight-separated encrypted data frame.

5. The lightweight secure communication method according to claim 1, characterized in that, In step (5), the wireless channel is a LoRa wireless channel, and the sensing node sends the data frame to the heterogeneous aggregation gateway through the LoRa wireless channel.

6. The lightweight secure communication method according to claim 1, characterized in that, In step (5), the specific process of reverse decryption and time verification of the heterogeneous aggregation gateway is as follows: After receiving the data frame, the heterogeneous aggregation gateway calls the static master key and uses the SM4 national cryptographic block cipher to reverse decrypt the ciphertext header of the data frame to extract the dynamic anti-counterfeiting factor. The dynamic anti-counterfeiting factor is compared with the system time of the heterogeneous aggregation gateway. If the time difference exceeds the preset security tolerance threshold, the data frame is determined to be a replay attack and is discarded. Conversely, the heterogeneous aggregation gateway synchronously reconstructs the dynamic session key according to the same XOR obfuscation operation as the sensing node, and drives the ChaCha20 stream cipher to decrypt the ciphertext payload of the data frame, and finally reports it to the cloud data management server.

7. The lightweight secure communication method according to claim 6, characterized in that, The safety tolerance threshold is 3 seconds.

8. A system employing the lightweight secure communication method according to any one of claims 1-7, comprising an Internet of Things (IoT) system, wherein the IoT system includes a sensing layer detection node group, a heterogeneous aggregation gateway, and a cloud data management server. The sensing layer detection node group includes several sensing nodes, characterized in that... Each of the aforementioned sensing nodes includes: The system includes a multi-mode sensor group for collecting environmental data, an edge vision processor for collecting visual feature data, a BeiDou satellite positioning and timing module for extracting absolute timestamps as the dynamic anti-counterfeiting factor, and a microcontroller as the main control chip. The microcontroller encrypts and forms a data frame based on the dynamic anti-counterfeiting factor, environmental data and visual feature data, and outputs the data frame to the heterogeneous aggregation gateway. The heterogeneous aggregation gateway receives the data frame, performs time verification and decryption based on the data frame, and then reports the decrypted data to the cloud data management server. The cloud-based data management server is used to receive decrypted data and realize the aggregation and management of global data.

9. The system of the lightweight secure communication method according to claim 8, characterized in that, The sensing node parses the NMEA standard statement output by the BeiDou satellite positioning and timing module at high speed via serial port, and extracts the absolute timestamp accurate to the second or millisecond level as a dynamic anti-counterfeiting factor.

10. The system of the lightweight secure communication method according to claim 8, characterized in that, The edge vision processor is a K210 edge vision processor; the main control chip is an STM32 microcontroller.

Images