A terminal device identity authentication method, device and apparatus

Abstract

The application discloses a terminal device identity authentication method, device and equipment, the method comprises the steps that the device parameter and a plurality of network parameters of the terminal device to be authenticated are determined; the device fingerprint of the terminal device to be authenticated is constructed based on the device parameter and the plurality of network parameters; the matching result is obtained by matching the device fingerprint to be authenticated with the preset device fingerprint in the device fingerprint library; the signature private key of the terminal device is verified by using the preset public key, and the verification result whether the terminal device is verified successfully is obtained; the identity authentication result whether the terminal device is safe is obtained by comprehensively verifying the verification result and the matching result. The technical problem that the identity authentication method of the terminal device in the existing power system cloud edge fusion architecture is weak in security is solved.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to an identity authentication method, apparatus, and device for terminal devices. Background Technology

[0002] With the continuous expansion of the power system, power data is growing exponentially. In order to ensure the security of the power system and power data, it is crucial to carry out security protection for the power system.

[0003] like Figure 1 As shown, most existing power systems are based on a cloud-edge converged architecture. "Cloud" refers to the cloud platform, which has functions such as equipment management and intelligent decision-making; "edge" refers to the edge cloud, which provides intelligent decision-making and services locally; and "end" refers to terminal devices, including smart terminals, smart sensors, and smart devices. Figure 1 As can be seen, terminal devices are located at the bottom layer of the power system's cloud-edge converged architecture and are key nodes in realizing the transformation of physical information into digital information. However, the wide distribution of terminal devices and their diverse communication methods significantly increase the system's security risks.

[0004] In the existing cloud-edge converged architecture of the power system, the authentication methods for terminal devices, although capable of providing security protection, are relatively weak. Summary of the Invention

[0005] In view of this, this application provides a terminal device authentication method, apparatus, and device that can perform accurate and secure authentication of terminal devices in a power system cloud-edge converged architecture, solving the technical problem of weak security in existing terminal device authentication methods in power system cloud-edge converged architectures.

[0006] The first aspect of this application provides a method for authenticating the identity of a terminal device, including:

[0007] Determine the device parameters and several network parameters of the terminal device to be authenticated;

[0008] Based on the device parameters and several network parameters, construct the device fingerprint to be authenticated for the terminal device;

[0009] The fingerprint of the device to be authenticated is matched with the preset device fingerprints in the device fingerprint database to obtain the matching result;

[0010] The signature private key of the terminal device is verified using a preset public key to obtain a verification result indicating whether the terminal device has successfully verified the signature.

[0011] By combining the verification results and the matching results, the identity authentication result of whether the terminal device is secure is obtained.

[0012] Optionally, the configuration process of the network parameter comprises:

[0013] Obtaining traffic data packets of the terminal device;

[0014] Performing feature extraction on the traffic data packets to obtain the network parameter of the terminal device.

[0015] Optionally, the network parameter comprises: a communication protocol, a port number, a time to live of the traffic data packet, a connection rate, a transmission byte amount, and a capture time of the traffic data packet.

[0016] Optionally, the constructing the to-be-authenticated device fingerprint of the terminal device based on the device parameter and the plurality of network parameters comprises:

[0017] Combining the device parameter and each network parameter to obtain a plurality of combined parameters;

[0018] Constructing a matrix using the plurality of combined parameters, and taking the matrix as the to-be-authenticated device fingerprint of the terminal device.

[0019] Optionally, the matching the to-be-authenticated device fingerprint with preset device fingerprints in a device fingerprint library to obtain a matching result comprises:

[0020] Matching the to-be-authenticated device fingerprint with each preset device fingerprint in the device fingerprint library;

[0021] Calculating a similarity between the to-be-authenticated device fingerprint and each preset device fingerprint;

[0022] Obtaining the matching result of the to-be-authenticated device fingerprint based on the similarity.

[0023] Optionally, the verifying, using a preset public key, a signature private key of the terminal device to obtain a verification result of whether the terminal device is verified successfully comprises:

[0024] Obtaining a preset public key corresponding to the terminal device;

[0025] Verifying, using the preset public key, the signature private key of the terminal device to obtain a verification result of whether the terminal device is verified successfully.

[0026] Optionally, the obtaining an identity authentication result of whether the terminal device is secure by comprehensively considering the verification result and the matching result comprises:

[0027] When the verification result is verification success and the matching result is that only one preset device fingerprint matches the to-be-authenticated device fingerprint, determining that the identity authentication result of the terminal device is secure, otherwise, determining that the identity authentication result of the terminal device is insecure.

[0028] Optionally, the method further comprises:

[0029] acquiring historical behavior data and current behavior data of the terminal device to be authenticated;

[0030] calculating a current behavior credibility of the terminal device to be authenticated based on the historical behavior data and the current behavior data;

[0031] comparing the current behavior credibility with a preset permission threshold to adjust an access permission of the terminal device to be authenticated.

[0032] The second aspect of the present application provides an identity authentication device of a terminal device, comprising:

[0033] a determination unit configured to determine a device parameter and a plurality of network parameters of a terminal device to be authenticated;

[0034] a construction unit configured to construct an authentication device fingerprint of the terminal device based on the device parameter and the plurality of network parameters;

[0035] a matching unit configured to match the authentication device fingerprint with a preset device fingerprint in a device fingerprint library to obtain a matching result;

[0036] a verification unit configured to verify a signature private key of the terminal device by using a preset public key to obtain a verification result of whether the terminal device is verified successfully;

[0037] an authentication unit configured to comprehensively obtain an identity authentication result of whether the terminal device is safe based on the verification result and the matching result.

[0038] The third aspect of the present application provides an identity authentication device of a terminal device, comprising a processor and a memory;

[0039] The memory is configured to store program code and transmit the program code to the processor;

[0040] The processor is configured to execute the identity authentication method of the terminal device according to the instructions in the program code.

[0041] From the above technical solutions, the present application has the following advantages:

[0042] The application provides a terminal device identity authentication method, comprising: determining device parameters and a plurality of network parameters of a terminal device to be authenticated; constructing a to-be-authenticated device fingerprint of the terminal device based on the device parameters and the plurality of network parameters; matching the to-be-authenticated device fingerprint with a preset device fingerprint in a device fingerprint library to obtain a matching result; verifying a signature private key of the terminal device by using a preset public key to obtain a verification result of whether the terminal device is verified successfully; and comprehensively obtaining an identity authentication result of whether the terminal device is safe based on the verification result and the matching result.

[0043] In the application, the to-be-authenticated device fingerprint is constructed based on the device parameters and the network parameters of the terminal device, and further security authentication is performed based on the public and private keys on the basis of the fingerprint verification, so that the security authentication of the terminal device is more reliable and accurate, and the technical problem of weak security of the identity authentication method of the terminal device in the existing power system cloud edge fusion architecture is solved. BRIEF DESCRIPTION OF DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0045] Figure 1 FIG. 1 is a structural schematic diagram of a power system cloud edge fusion architecture;

[0046] Figure 2 FIG. 2 is a flowchart of an embodiment one of a terminal device identity authentication method in the embodiments of the application;

[0047] Figure 3 FIG. 3 is a flowchart of an embodiment two of a terminal device identity authentication method in the embodiments of the application;

[0048] Figure 4 FIG. 4 is a structural schematic diagram of a terminal device identity authentication device in the embodiments of the application. DETAILED DESCRIPTION

[0049] The embodiments of the application provide a terminal device identity authentication method, device and equipment, and solve the technical problem of weak security of the identity authentication method of the terminal device in the existing power system cloud edge fusion architecture.

[0050] In order to make the personnel in the technical field better understand the scheme of the present application, the technical scheme in the embodiments of the present application will be clearly and completely described in the embodiments of the present application in combination with the drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by the person skilled in the art without creative labor are within the scope of protection of the present application.

[0051] The first aspect of the embodiments of the present application provides an embodiment of a terminal device identity authentication method.

[0052] Please refer to Figure 2 The flowchart of the first embodiment of the terminal device identity authentication method in the embodiments of the present application.

[0053] The terminal device identity authentication method in the embodiments includes:

[0054] Step 201, determining the device parameters and the network parameters of the terminal device to be authenticated.

[0055] In the embodiments, the data used in the identity authentication of the terminal device is the to-be-authenticated device fingerprint of the terminal device, and the to-be-authenticated device fingerprint in the embodiments is constructed based on the network parameters and the device parameters of the terminal device. Therefore, the device parameters and the network parameters of the terminal device are determined first in the embodiments.

[0056] It can be understood that the device parameters include but are not limited to the device serial number, the device type, the hardware parameters of the device, the device manufacturer and the device MAC. Specifically, the device parameters can be obtained by data burying, which is not specifically limited in the embodiments.

[0057] Step 202, constructing the to-be-authenticated device fingerprint of the terminal device based on the device parameters and the network parameters.

[0058] After obtaining the network parameters and the device parameters corresponding to the terminal device, the to-be-authenticated device fingerprint of the terminal device can be constructed.

[0059] Step 203, matching the to-be-authenticated device fingerprint with the preset device fingerprint in the device fingerprint library to obtain a matching result.

[0060] After the to-be-authenticated device fingerprint corresponding to the terminal device is determined, the to-be-authenticated device fingerprint can be matched with the preset device fingerprint in the device fingerprint library to obtain a matching result.

[0061] Step 204, verifying the signature private key of the terminal device by using the preset public key to obtain a verification result of whether the terminal device is verified successfully.

[0062] In the authentication of the terminal device by using the to-be-authenticated device fingerprint, the terminal device is also verified by using the public and private keys, that is, the signature private key of the terminal device is verified by using the preset public key to obtain a verification result of whether the terminal device is successfully verified.

[0063] In the authentication of the terminal device by using the to-be-authenticated device fingerprint, the terminal device is also verified by using the public and private keys, that is, the signature private key of the terminal device is verified by using the preset public key to obtain a verification result of whether the terminal device is successfully verified.

[0064] In the authentication of the terminal device by using the to-be-authenticated device fingerprint, the terminal device is also verified by using the public and private keys, that is, the signature private key of the terminal device is verified by using the preset public key to obtain a verification result of whether the terminal device is successfully verified.

[0065] It can be understood that the identity authentication method in this embodiment is used to authenticate the terminal device in the power system cloud edge fusion architecture, and therefore the identity authentication method in this embodiment can be executed by the edge cloud connected to the terminal device.

[0066] In this embodiment, first, the device parameters and the network parameters of the terminal device to be authenticated are determined, then the to-be-authenticated device fingerprint of the terminal device is constructed based on the device parameters and the network parameters, then the to-be-authenticated device fingerprint is matched with the preset device fingerprint in the device fingerprint library to obtain a matching result, then the signature private key of the terminal device is verified by using the preset public key to obtain a verification result of whether the terminal device is successfully verified, and finally the verification result and the matching result are integrated to obtain an identity authentication result of whether the terminal device is safe. In this embodiment, the to-be-authenticated device fingerprint is constructed based on the device parameters and the network parameters of the terminal device, and further security authentication is performed based on the public and private keys on the basis of the fingerprint verification, so that the security authentication of the terminal device is more reliable and accurate, and the technical problem of weak security of the identity authentication method for the terminal device in the existing power system cloud edge fusion architecture is solved.

[0067] The above is embodiment one of the identity authentication method for the terminal device provided in this embodiment, and the following is embodiment two of the identity authentication method for the terminal device provided in this embodiment.

[0068] Please refer to Figure 3 , the flowchart of embodiment two of the identity authentication method for the terminal device in this embodiment.

[0069] The identity authentication method for the terminal device in this embodiment includes:

[0070] Step 301, determining the device parameters and the network parameters of the terminal device to be authenticated.

[0071] It can be understood that the configuration process of the network parameters includes:

[0072] Obtaining the traffic data packet of the terminal device;

[0073] The traffic data packet is characterized to obtain the network parameter of the terminal device.

[0074] Specifically, the network parameter includes a communication protocol, a port number, a survival time of the traffic data packet, a connection rate, a transmission byte amount, and a capture time of the traffic data packet.

[0075] The detailed information and encoding mode of the communication protocol are shown in Table 1, the detailed information and encoding mode of the port number are shown in Table 2, and the detailed information and encoding mode of the survival time of the data packet are shown in Table 3.

[0076] Table 1

[0077]

[0078]

[0079] Table 2

[0080] Port number Number [0,1023] 0 [1024,49151] 1 [49152,65535] 2 Other 3

[0081] Table 3

[0082] Time Number >64 0 <64 1 ＝64 2

[0083] Step 302, combining the device parameter and each network parameter to obtain a plurality of combined parameters.

[0084] Step 303, using the plurality of combined parameters to form a matrix, and using the matrix as the to-be-authenticated device fingerprint of the terminal device.

[0085] In the embodiment, m traffic data packets R = {r1, r2, r3,... r m} of the terminal device are obtained. 26 data features {p1, p2, p3,... p 26} are extracted in each traffic data packet, that is, network parameters, the data features {p 27 , p 28 , p 29 , p 30 , p 31} are obtained by means of data burying, that is, device parameters, and the combined parameters after each network parameter and device parameter are combined are r i = {p i,1 , p i,2 , p i,3 ,... p i,26 , p 27 ,..., p 31}. The to-be-authenticated device fingerprint of the terminal device is composed of a matrix P of m*31:

[0086]

[0087] Step 304, matching the to-be-authenticated device fingerprint with each preset device fingerprint in the device fingerprint library.

[0088] Step 305, calculating the similarity between the to-be-authenticated device fingerprint and each preset device fingerprint.

[0089] It can be understood that the calculation method of the similarity is not specifically described in the embodiment, and it can be understood that the higher the similarity, the more similar the preset device fingerprint corresponding to the similarity and the to-be-authenticated device fingerprint are, and vice versa. That is, when the similarity is greater than a preset threshold, it is considered that the preset device fingerprint corresponding to the similarity and the to-be-authenticated device fingerprint match, and when the similarity is less than the preset threshold, it is considered that the preset device fingerprint corresponding to the similarity and the to-be-authenticated device fingerprint do not match.

[0090] Step 306, obtaining the matching result of the to-be-authenticated device fingerprint based on the similarity.

[0091] After obtaining the similarity, it is judged how many preset device fingerprints with a similarity greater than a preset threshold are, if there is only one, it is considered that the terminal device is a safe terminal device, and if there is none or more than one, it is considered that the terminal device is not a safe terminal device.

[0092] In an optional embodiment, the to-be-authenticated device fingerprint can also be compared based on a decision function, and the specific implementation steps include:

[0093] Through the decision function, the decision value of the to-be-authenticated device fingerprint and each preset device fingerprint in the device fingerprint library is calculated, and the decision function is:

[0094]

[0095] In the formula,

[0096]

[0097]

[0098] Wherein, f(p new ) is a decision function, argmax is a set of numbers of devices corresponding to p new when f(p new ) takes the maximum value, p i , p j are preset device fingerprints, p new is a to-be-authenticated device fingerprint, b is a coefficient of a hyperplane selected by SVM, K(p j , p new ), K(p ip new ) is a Gaussian kernel function, h is the number of types of terminal devices, sigma is the effective range of the Gaussian kernel function, N is the number of preset device fingerprints in the device fingerprint library, a i , a j is a Lagrange multiplier, type new represents the type of the terminal device to be authenticated, type i , type j is the type of the device in the device fingerprint library, a = {a1,..., a n} is a set of alpha coefficients obtained.

[0099] An a j > 0 is selected, and The fingerprint matrix P of the device to be authenticated is substituted into the decision function f(p new ).

[0100] Based on all the decision values, the matching result of the device fingerprint to be authenticated is obtained.

[0101] Step 307, obtaining a preset public key corresponding to the terminal device.

[0102] It can be understood that the preset public key corresponding to the terminal device can be generated based on the network parameters and device parameters corresponding to the terminal device.

[0103] Step 308, verifying the signature private key of the terminal device using the preset public key, to obtain a verification result of whether the terminal device is verified successfully.

[0104] It can be understood that the private key in the embodiment can be generated according to the master key, network parameters and device parameters.

[0105] Step 309, when the verification result is verification success and the matching result is that only one preset device fingerprint matches the device fingerprint to be authenticated, determining that the identity authentication result of the terminal device is safe, otherwise determining that the identity authentication result of the terminal device is unsafe.

[0106] If f(p new ) contains multiple values or no value, it means that the fingerprint to be authenticated of the terminal device is incorrect, and the device is not safe; if f(p new ) contains only one value and the preset public key is verified successfully, it is considered that the terminal device is safe, and the next operation can be performed.

[0107] Step 310, obtaining historical behavior data and current behavior data of the terminal device to be authenticated.

[0108] Step 311, based on the historical behavior data and the current behavior data, calculating the current behavior credibility of the terminal device to be authenticated.

[0109] Step 312, compare the current behavior credibility and the preset permission threshold to adjust the access permission of the terminal device to be authenticated.

[0110] Behavior credibility:

[0111]

[0112] Wherein, BT i is the current trust degree of the terminal device, BT i-1 is the historical trust degree of the terminal device, r1 and r2 are constants greater than 0 and less than 1, β1, β2 and β3 are constants greater than 0 and less than 1, and β1+β2+β3=1, Z t is the number of samples in which the device i is correctly identified, Z f is the number of samples in which other devices are identified as the device i, E t is the number of samples in which non-device i is identified as non-device i, E f is the number of samples in which non-device i is identified as device i, C t is the number of times that the device i is legally authorized, C f is the number of times that the device i is refused authorization.

[0113] When the current behavior credibility is less than or equal to the preset permission threshold of a certain permission, the terminal device is refused authorization;

[0114] When the current behavior credibility is greater than the preset permission threshold of a certain permission, the terminal device is authorized.

[0115] In this embodiment, first, the device parameters and a plurality of network parameters of the terminal device to be authenticated are determined, then based on the device parameters and the plurality of network parameters, the to-be-authenticated device fingerprint of the terminal device is constructed, then the to-be-authenticated device fingerprint is matched with the preset device fingerprint in the device fingerprint library to obtain a matching result, then the signature private key of the terminal device is verified by using the preset public key to obtain a verification result of whether the terminal device is successfully verified, and finally the identity authentication result of whether the terminal device is safe is obtained by comprehensively considering the verification result and the matching result. In this embodiment, the to-be-authenticated device fingerprint is constructed based on the device parameters and the network parameters of the terminal device, and on the basis of fingerprint verification, further security authentication is performed based on the public and private keys, so that the security authentication of the terminal device is more reliable and accurate, and the technical problem of weak security of the identity authentication method for the terminal device in the existing power system cloud-edge fusion architecture is solved.

[0116] The second aspect of the embodiment of the application provides an embodiment of an identity authentication device of a terminal device.

[0117] Please refer to Figure 4 , the structure diagram of the identity authentication device of a terminal device in the embodiment of the application.

[0118] The identity authentication device of a terminal device in this embodiment comprises:

[0119] A determination unit is configured to determine device parameters and a plurality of network parameters of a terminal device to be authenticated;

[0120] A construction unit is configured to construct a to-be-authenticated device fingerprint of the terminal device based on the device parameters and the plurality of network parameters;

[0121] A matching unit is configured to match the to-be-authenticated device fingerprint with preset device fingerprints in a device fingerprint library to obtain a matching result;

[0122] A verification unit is configured to verify a signature private key of the terminal device by using a preset public key to obtain a verification result of whether the terminal device is successfully verified;

[0123] An authentication unit is configured to comprehensively obtain an identity authentication result of whether the terminal device is secure based on the verification result and the matching result.

[0124] In this embodiment, the device parameters and the plurality of network parameters of the terminal device to be authenticated are first determined, then the to-be-authenticated device fingerprint of the terminal device is constructed based on the device parameters and the plurality of network parameters, and then the to-be-authenticated device fingerprint is matched with the preset device fingerprints in the device fingerprint library to obtain the matching result. Then, the signature private key of the terminal device is verified by using the preset public key to obtain the verification result of whether the terminal device is successfully verified. Finally, the identity authentication result of whether the terminal device is secure is obtained based on the verification result and the matching result. In this embodiment, the to-be-authenticated device fingerprint is constructed based on the device parameters and the network parameters of the terminal device, and further security authentication is performed based on the public and private keys on the basis of the fingerprint verification, so that the security authentication of the terminal device is more reliable and accurate, and the technical problem of weak security of the identity authentication method for the terminal device in the existing power system cloud-edge fusion architecture is solved.

[0125] The third aspect of the embodiment of the application provides an embodiment of an identity authentication device of a terminal device.

[0126] The identity authentication device of a terminal device comprises a processor and a memory; the memory is configured to store program code and transmit the program code to the processor; and the processor is configured to execute the identity authentication method of the terminal device according to the instructions in the program code.

[0127] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and units can refer to the corresponding processes in the foregoing method embodiments, which will not be described herein again.

[0128] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can be implemented in other manners. For example, the division of the apparatus embodiments is merely illustrative, and the division of units can be changed according to actual conditions, such as the combination or integration of multiple units, or the omission or addition of some features. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interfaces, and can be in electrical, mechanical or other forms.

[0129] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they can be located in one place or distributed on multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0130] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0131] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part of the prior art that contributes to the technical solutions or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0132] The above embodiments are merely used to illustrate the technical solutions of the present application, rather than limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacements for some technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for authenticating the identity of a terminal device, characterized in that, include: The device parameters and several network parameters of the terminal device to be authenticated are determined; the device parameters include, but are not limited to: device serial number, device type, device hardware parameters, device manufacturer, and device MAC address. Based on the device parameters and several network parameters, construct the device fingerprint to be authenticated for the terminal device; The fingerprint of the device to be authenticated is matched with the preset device fingerprints in the device fingerprint database to obtain the matching result; The signature private key of the terminal device is verified using a preset public key to obtain a verification result indicating whether the terminal device has successfully verified the signature. By combining the verification results and the matching results, a result indicating whether the terminal device is secure is obtained. The configuration process for the network parameters includes: Obtain m traffic data packets from the terminal device; Twenty-six data features are extracted from each traffic data packet and used as network parameters for the terminal device. The step of constructing the device fingerprint to be authenticated for the terminal device based on the device parameters and several network parameters specifically includes: The device parameters and each of the network parameters are combined to obtain several combined parameters; A matrix is ​​constructed using several of the aforementioned combined parameters, and this matrix serves as the device fingerprint to be authenticated for the terminal device; the device fingerprint to be authenticated is composed of an m*31 matrix P: ； The step of matching the fingerprint of the device to be authenticated with a preset device fingerprint in the device fingerprint database to obtain a matching result includes: The fingerprint of the device to be authenticated is substituted into the decision function to calculate the decision value of the fingerprint of the device to be authenticated and each of the preset device fingerprints in the device fingerprint database; Based on all the aforementioned decision values, the matching result of the fingerprint of the device to be authenticated is obtained; The decision function is: ； In the formula, ； ； in, Let be the decision function. for One of the values ​​that is obtained when the maximum value is reached. , All are preset device fingerprints. Let be the fingerprint of the device to be authenticated, and b be the coefficient of the hyperplane selected by the SVM. , Let h be the Gaussian kernel function, and h be the number of types of terminal devices. Let N be the range of the Gaussian kernel function, and N be the number of preset device fingerprints in the device fingerprint database. , For Lagrange multipliers, To indicate the type of terminal device to be authenticated, , For the type of device in the device fingerprint database, To find The set of coefficients; H represents the type of device in the device fingerprint database. The total number; n is The total number of coefficients; in, .

2. The terminal device authentication method according to claim 1, characterized in that, The network parameters include: communication protocol, port number, time to life of traffic data packets, connection rate, number of bytes transmitted, and time to capture traffic data packets.

3. The terminal device authentication method according to claim 1, characterized in that, The step of matching the fingerprint of the device to be authenticated with a preset device fingerprint in the device fingerprint database to obtain a matching result specifically includes: Match the fingerprint of the device to be authenticated with each preset device fingerprint in the device fingerprint database; Calculate the similarity between the fingerprint of the device to be authenticated and the fingerprints of each preset device; Based on the similarity, the matching result of the fingerprint of the device to be authenticated is obtained.

4. The terminal device authentication method according to claim 1, characterized in that, The step of verifying the signature private key of the terminal device using a preset public key to obtain a verification result indicating whether the terminal device has successfully verified the signature includes: Obtain the preset public key corresponding to the terminal device; The signature private key of the terminal device is verified using the preset public key to obtain a verification result indicating whether the terminal device has been successfully verified.

5. The terminal device authentication method according to claim 1, characterized in that, The method of combining the verification result and the matching result to obtain the identity authentication result of whether the terminal device is secure specifically includes: When the verification result is successful and the matching result is that only one preset device fingerprint matches the fingerprint of the device to be authenticated, the identity authentication result of the terminal device is determined to be secure; otherwise, the identity authentication result of the terminal device is determined to be insecure.

6. The terminal device authentication method according to claim 1, characterized in that, The method further includes: Obtain the historical and current behavior data of the terminal device to be authenticated; Based on the historical behavior data and the current behavior data, the credibility of the current behavior of the terminal device to be authenticated is calculated; The access permissions of the terminal device to be authenticated are adjusted by comparing the credibility of the current behavior with the preset permission threshold.

7. An identity authentication device for a terminal device, characterized in that, include: The determining unit is used to determine the device parameters and several network parameters of the terminal device to be authenticated; the device parameters include, but are not limited to: device serial number, device type, device hardware parameters, device manufacturer, and device MAC address; The construction unit is used to construct the device fingerprint to be authenticated for the terminal device based on the device parameters and several network parameters. The matching unit is used to match the fingerprint of the device to be authenticated with a preset device fingerprint in the device fingerprint database to obtain a matching result; The verification unit is used to verify the signature private key of the terminal device using a preset public key, and to obtain a verification result as to whether the terminal device has been successfully verified. An authentication unit is used to combine the verification result and the matching result to obtain an identity authentication result indicating whether the terminal device is secure. The construction unit is specifically used to combine the device parameters and each of the network parameters to obtain several combined parameters; to construct a matrix using the several combined parameters, and to use the matrix as the device fingerprint to be authenticated for the terminal device; The configuration process for the network parameters includes: Obtain m traffic data packets from the terminal device; Twenty-six data features are extracted from each traffic data packet and used as network parameters of the terminal device; the device parameters are data features. The construction unit is specifically used to combine the device parameters and each of the network parameters to obtain several combined parameters; to construct a matrix using the several combined parameters, and to use the matrix as the device fingerprint to be authenticated for the terminal device; the device fingerprint to be authenticated is composed of an m*31 matrix P: ； The matching unit is specifically used to: substitute the fingerprint of the device to be authenticated into the decision function, calculate the decision value of the fingerprint of the device to be authenticated and each of the preset device fingerprints in the device fingerprint database; and obtain the matching result of the fingerprint of the device to be authenticated based on all the decision values. The decision function is: ； In the formula, ； ； in, Let be the decision function. for One of the values ​​that is obtained when the maximum value is reached. , All are preset device fingerprints. Let be the fingerprint of the device to be authenticated, and b be the coefficient of the hyperplane selected by the SVM. , Let h be the Gaussian kernel function, and h be the number of types of terminal devices. Let N be the range of the Gaussian kernel function, and N be the number of preset device fingerprints in the device fingerprint database. , For Lagrange multipliers, To indicate the type of terminal device to be authenticated, , For the type of device in the device fingerprint database, To find The set of coefficients; H represents the type of device in the device fingerprint database. The total number; n is The total number of coefficients; in, .

8. An identity authentication device for a terminal device, characterized in that, Including the processor and memory; The memory is used to store program code and transmit the program code to the processor; The processor is used to execute the authentication method of the terminal device according to any one of claims 1 to 6 according to the instructions in the program code.

Images