Authentication method and device of access equipment and communication equipment

Abstract

The application provides an authentication method and device of an access device and a communication device, and relates to the technical field of network security. The method comprises the following steps: obtaining N characteristic variable information of an access device to be authenticated; wherein N is a positive integer; identifying the N characteristic variable information, and determining a first device type of the access device to be authenticated; and performing legality authentication on the access device to be authenticated according to the first device type, and obtaining a legality authentication result. The scheme of the application solves the problem that the existing authentication method cannot effectively guarantee the security of the access device.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an authentication method, apparatus, and communication equipment for access devices. Background Technology

[0002] With the development of computer and sensor technologies, a large number of heterogeneous devices have been connected to the Internet of Things (IoT) for real-time access and interaction. Today, the IoT has become a bridge connecting the virtual and real worlds, closely related to human production and life. However, if attackers use illegal techniques to control devices and break down the boundaries between the virtual and real worlds, it will pose a serious threat to human property and life safety. Therefore, how to authenticate access devices, identify illegitimate devices, and ensure the secure and stable operation of the IoT is an urgent problem to be solved. Current authentication methods are only applicable to access devices with fixed functions or stable behavioral information. With the large number of heterogeneous devices connecting to the network, and the ever-increasing functional dimensions of devices, complex and diverse network interaction behaviors, and various uncertainties, existing authentication methods are insufficient to effectively guarantee the security of access devices. Summary of the Invention

[0003] The purpose of this invention is to provide an authentication method, apparatus, and communication device for access devices, which solves the problem that existing authentication methods for access devices are unable to effectively guarantee the security of access devices.

[0004] To achieve the above objectives, embodiments of the present invention provide an authentication method for an access device, comprising:

[0005] Obtain N characteristic variables of the access device to be authenticated; where N is a positive integer;

[0006] The first device type of the access device to be authenticated is determined by identifying the N feature variables.

[0007] The legitimacy of the access device to be authenticated is verified according to the first device type, and a legitimacy authentication result is obtained.

[0008] Optionally, identifying the N feature variable information to determine the first device type of the access device to be authenticated includes:

[0009] The N feature variables are used as input variables for the stacked denoising encoder to obtain the output result;

[0010] Based on the output results, the first device type of the access device is determined.

[0011] Optionally, the expression for the output of the stacked denoising encoder is:

[0012]

[0013] Among them, u j The output result is w ij This represents the connection weight between the i-th hidden neuron and the j-th output neuron; This represents the output value of the i-th hidden node in the n-th hidden layer; n is the number of hidden layers. Let be the vector of the nth hidden layer; k is the number of hidden nodes in the nth hidden layer; the expression corresponding to the nth hidden layer is:

[0014]

[0015] …

[0016]

[0017]

[0018] Where W = (w1, w2, ..., w n ) represents the connection weights between each hidden layer, B = (b1, b2, ..., b n ) is the bias vector, and X is the input variable.

[0019] Optionally, the method further includes:

[0020] Construct a stacked denoising encoder and acquire sample data; wherein, the sample data includes N feature variable information and device type of multiple sample access devices;

[0021] The constructed stacked denoising encoder is trained based on the sample data.

[0022] Optionally, the step of performing legitimacy authentication of the access device to be authenticated based on the first device type to obtain a legitimacy authentication result includes:

[0023] A first-level legitimacy authentication is performed based on the first device type and the second device type to obtain a first-level authentication result; wherein, the second device type is the device type historically identified from the access device to be authenticated;

[0024] If the first-level authentication result is the first result, then the legality authentication result is determined to be authentication passed;

[0025] If the first-level authentication result is the second result, then a second-level legality authentication is performed based on the first vector and the second vector to obtain the legality authentication result; wherein, the first vector is determined by m feature variable information from the N feature variable information; the second vector is determined by the average value of the m feature variable information; m is a positive integer and m < N.

[0026] Optionally, the step of performing first-level legitimacy authentication based on the first device type and the second device type to obtain a first-level authentication result includes:

[0027] Compare the first device type with the second device type;

[0028] If the first device type is the same as the second device type, then the first-level authentication result is determined to be the first result;

[0029] If the first device type is inconsistent with the second device type, then the first-level authentication result is determined to be the second result.

[0030] Optionally, the step of performing second-level legitimacy authentication based on the first vector and the second vector to obtain the legitimacy authentication result includes:

[0031] The matching degree is calculated based on the first vector and the second vector;

[0032] If the matching degree is greater than or equal to the preset value, then the legality authentication result is determined to be successful.

[0033] If the matching degree is less than the preset value, the legality authentication result is determined to be authentication failure.

[0034] Optionally, calculating the matching degree based on the first vector and the second vector includes:

[0035] Through the formula: The matching degree is calculated;

[0036] Among them, D M (γ) represents the matching degree; γ = (γ1, γ2, ..., γ) m ) represents the first vector; o = (o1, o2, ..., o m ) is the second vector.

[0037] Optionally, the method further includes:

[0038] If the matching degree is greater than or equal to a preset value, then after determining that the legality authentication result is successful, the first device type of the identified access device to be authenticated will be updated to the second device type.

[0039] Optionally, the method further includes:

[0040] If the matching degree is less than the preset value, then after determining that the legality authentication result is authentication failure, an alarm process is executed.

[0041] To achieve the above objectives, embodiments of the present invention provide an authentication device for an access device, comprising:

[0042] The acquisition module is used to acquire N characteristic variable information of the access device to be authenticated; where N is a positive integer;

[0043] The determination module is used to identify the N feature variable information and determine the first device type of the access device to be authenticated;

[0044] The authentication module is used to authenticate the legitimacy of the access device to be authenticated based on the first device type, and obtain the legitimacy authentication result.

[0045] Optionally, the determining module includes:

[0046] The recognition submodule is used to recognize the N feature variable information as input variables of the stacked denoising encoder and obtain the output result;

[0047] The output submodule is used to determine the first device type of the access device based on the output result.

[0048] Optionally, the expression for the output of the stacked denoising encoder is:

[0049]

[0050] Among them, u j The output result is w ij This represents the connection weight between the i-th hidden neuron and the j-th output neuron; This represents the output value of the i-th hidden node in the n-th hidden layer; n is the number of hidden layers. Let be the vector of the nth hidden layer; k is the number of hidden nodes in the nth hidden layer; the expression corresponding to the nth hidden layer is:

[0051]

[0052] …

[0053]

[0054]

[0055] Where W = (w1, w2, ..., w n) represents the connection weights between each hidden layer, B = (b1, b2, ..., b n ) is the bias vector, and X is the input variable.

[0056] Optionally, the device further includes:

[0057] A construction submodule is used to construct a stacked denoising encoder and acquire sample data; wherein, the sample data includes N feature variable information of multiple sample access devices and device type;

[0058] The training submodule is used to train the constructed stacked denoising encoder based on the sample data.

[0059] Optionally, the authentication module includes:

[0060] The first-level authentication submodule is used to perform first-level legitimacy authentication based on the first device type and the second device type to obtain the first-level authentication result; wherein, the second device type is the device type historically identified from the access device to be authenticated;

[0061] The first determining submodule is used to determine that the legality authentication result is successful if the first-level authentication result is the first result;

[0062] The secondary authentication submodule is used to perform secondary legality authentication based on the first vector and the second vector if the first-level authentication result is the second result, thereby obtaining the legality authentication result; wherein, the first vector is determined by m feature variables from the N feature variable information; the second vector is determined by the average value of the m feature variable information; m is a positive integer and m < N.

[0063] Optionally, the primary authentication submodule includes:

[0064] The first authentication unit is used to compare the first device type with the second device type;

[0065] The second authentication unit is configured to determine the first-level authentication result as the first result if the first device type is consistent with the second device type;

[0066] The third authentication unit is used to determine the first-level authentication result as the second result if the first device type is inconsistent with the second device type.

[0067] Optionally, the secondary authentication submodule includes:

[0068] The third authentication unit is used to calculate the matching degree based on the first vector and the second vector;

[0069] The fourth authentication unit is used to determine that the legality authentication result is successful if the matching degree is greater than or equal to a preset value.

[0070] The fifth authentication unit is used to determine that the legality authentication result is an authentication failure if the matching degree is less than the preset value.

[0071] Optionally, the third authentication unit includes:

[0072] The first authentication unit is used to verify the formula: The matching degree is calculated;

[0073] Among them, D M (γ) represents the matching degree; γ = (γ1, γ2, ..., γ) m ) represents the first vector; o = (o1, o2, ..., o m ) is the second vector.

[0074] Optionally, the device further includes:

[0075] The update module is used to update the first device type of the identified access device to be authenticated to the second device type after determining that the legality authentication result is successful if the matching degree is greater than or equal to a preset value.

[0076] Optionally, the device further includes:

[0077] The alarm module is used to perform alarm processing after determining that the legality authentication result is an authentication failure if the matching degree is less than the preset value.

[0078] To achieve the above objectives, embodiments of the present invention provide a communication device, including a transceiver, a processor, a memory, and a program or instructions stored in the memory and executable on the processor; when the processor executes the program or instructions, it implements the steps in the authentication method of the access device as described above.

[0079] To achieve the above objectives, embodiments of the present invention provide a readable storage medium having a program or instructions stored thereon, which, when executed by a processor, implement the steps in the authentication method for the access device as described above.

[0080] The beneficial effects of the above-described technical solution of the present invention are as follows:

[0081] In this embodiment of the invention, by acquiring N characteristic variable information of the access device to be authenticated, the device type of the access device to be authenticated can be identified and determined. Then, based on the device type, the legitimacy of the access device to be authenticated can be verified, thereby improving the accuracy of device type identification, having better robustness, and helping to ensure the security of access devices in the Internet of Things. Attached Figure Description

[0082] Figure 1 This is a flowchart of the authentication method for an access device according to an embodiment of the present invention;

[0083] Figure 2 This is a flowchart illustrating the hierarchical authentication process of the access device according to an embodiment of the present invention;

[0084] Figure 3 This is a diagram showing the device authentication results of an embodiment of the present invention;

[0085] Figure 4 This is a block diagram of the authentication device of the access device according to an embodiment of the present invention;

[0086] Figure 5 This is a block diagram of a communication device according to an embodiment of the present invention. Detailed Implementation

[0087] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0088] It should be understood that the phrase "one embodiment" or "an embodiment" throughout the specification means that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of the invention. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments.

[0089] In various embodiments of the present invention, it should be understood that the sequence number of each process described below does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0090] In addition, the terms "system" and "network" are often used interchangeably in this article.

[0091] In the embodiments provided in this application, it should be understood that "B corresponding to A" means that B is associated with A, and B can be determined based on A. However, it should also be understood that determining B based on A does not mean determining B solely based on A; B can also be determined based on A and / or other information.

[0092] like Figure 1 As shown, an authentication method for an access device according to an embodiment of the present invention includes:

[0093] Step 101: Obtain N characteristic variable information of the access device to be authenticated; where N is a positive integer.

[0094] In this step, the feature variable information may include at least one of the following: destination IP, destination IP port, packet type, source IP, source IP port, packet length, sequence number, ACK, URG, device application industry, service call count, alarm count, node type, protocol type, bearer network type, call type, operating system, network operator equipment, network connection method, device physical address, device daily traffic, and activity level. As an optional embodiment, N can be 20, meaning the N feature variable information may include the 20 feature variable information exemplified above.

[0095] Step 102: Identify the N feature variable information to determine the first device type of the access device to be authenticated.

[0096] For example, based on a pre-established algorithm model, the information of the N feature variables can be used as the input of the algorithm model, and the output result is the first device type of the access device to be authenticated.

[0097] Step 103: Perform legality authentication of the access device to be authenticated according to the first device type to obtain the legality authentication result.

[0098] Optionally, the legitimacy of the access device can be verified based on the first device type of the access device identified in this identification and the device types of the access devices identified in the past, in order to improve the authentication accuracy. Alternatively, a hierarchical authentication method can be adopted, such as first verifying the legitimacy of the access device identified in this identification and the device types of the access devices identified in the past, and then performing secondary authentication on access devices that fail authentication by calculating similarity, in order to improve the robustness and fault tolerance of authentication and further improve the authentication accuracy.

[0099] In this embodiment, by acquiring N characteristic variable information of the access device to be authenticated, the device type of the access device to be authenticated can be identified and determined. Then, based on the device type, the legitimacy of the access device to be authenticated can be verified, thereby improving the accuracy of device type identification, having better robustness, and helping to ensure the security of access devices in the Internet of Things.

[0100] Optionally, step 102 may include: identifying the N feature variable information as input variables of the stacked denoising encoder to obtain an output result; and determining the first device type of the access device based on the output result.

[0101] It should be noted that, due to the complexity and uncertainty of the IoT environment, as well as the complexity and uncertainty of the interaction behavior between access devices, the authentication method of access devices needs to be highly robust in order to meet the authentication requirements of the devices.

[0102] In this embodiment of the invention, a stacked denoising encoder is used to classify access devices in the Internet of Things (i.e., identify the device type of the access device). During the process of identifying feature variable information, noisy corrupt samples can be used to reconstruct a noise-free "clean" input, thereby mitigating the impact of uncertain factors and improving classification accuracy.

[0103] Optionally, the expression for the output of the stacked denoising encoder is:

[0104]

[0105] Among them, u j The output result is w ij This represents the connection weight between the i-th hidden neuron and the j-th output neuron; This represents the output value of the i-th hidden node in the n-th hidden layer; n is the number of hidden layers. Let be the vector of the nth hidden layer; k is the number of hidden nodes in the nth hidden layer; the expression corresponding to the nth hidden layer is:

[0106]

[0107] …

[0108]

[0109]

[0110] Where W = (w1, w2, ..., w n ) represents the connection weights between each hidden layer, B = (b1, b2, ..., b n ) is the bias vector, and X is the input variable.

[0111] It should be noted that the structure of the stacked denoising encoder can include multiple hidden layers and output layers, where w n-1 w represents the connection weight between the (n-1)th hidden layer and the nth hidden layer. n b represents the connection weight between the nth hidden layer and the output layer. n Let represent the bias vector of the nth hidden layer, and e represent the base of the exponential function.

[0112] In this embodiment of the invention, by using a stacked noise reduction encoder to identify the device type, the powerful noise reduction capability of the stacked noise reduction encoder can be utilized to effectively mitigate the impact of uncertain factors, thereby improving the accuracy of the device type identification result.

[0113] Optionally, the method further includes:

[0114] Construct a stacked denoising encoder and acquire sample data; wherein, the sample data includes N feature variable information and device type of multiple sample access devices;

[0115] The constructed stacked denoising encoder is trained based on the sample data.

[0116] As an optional embodiment of the present invention, the sample data may include N characteristic variable information of multiple sample access devices and device type, as shown in the table below:

[0117]

[0118]

[0119] The device type can include smartphones, tablets, printers, wearable watches, and smoke sensors, etc. The N feature variables can be information corresponding to one or more variables other than "device type" in the table above, and this embodiment of the invention is not limited thereto.

[0120] It should be noted that the sample data in this embodiment of the invention can be obtained by collecting access device information. For example, based on dynamic network traffic, the received traffic data can be cleaned and parsed to collect traffic information. In addition, based on the application layer, static information, dynamic information, and historical logs of the device can be collected and analyzed. In this way, the above-mentioned sample data (e.g., device type, destination IP, destination IP port, etc.) can be collected.

[0121] In one optional embodiment of the present invention, the stacked denoising encoder (or stacked denoising encoder) can be formed by stacking multiple basic denoising encoder units layer by layer.

[0122] The denoising encoder consists of an encoder and a decoder. The encoder's output y is:

[0123]

[0124] The decoder output z is:

[0125]

[0126] Where x is the original input variable; Let x be the corruption sample matrix; p represents the corruption factor; w1 and w2 represent the connection weight matrices of the encoder and decoder, respectively; b1 and b2 represent the bias vectors, respectively.

[0127] The loss function L1 of the denoising encoder is:

[0128]

[0129] Here, the parameters (w1, w2, b1, b2) of the denoising encoder can be updated by optimizing the loss function L1; multiple denoising encoders are trained and stacked layer by layer to construct a deep stacked denoising encoder; finally, all connection weight matrices and bias vectors are fine-tuned to complete the training of the stacked denoising encoder.

[0130] Optionally, the training of the stacked denoising encoder is considered complete when the optimization of the loss function reaches a preset threshold, or the training of the stacked denoising encoder is considered complete after a predetermined number of training iterations. This embodiment of the invention is not limited thereto.

[0131] Optionally, the step of performing legitimacy authentication of the access device to be authenticated based on the first device type to obtain a legitimacy authentication result includes:

[0132] A first-level legitimacy authentication is performed based on the first device type and the second device type to obtain a first-level authentication result; wherein, the second device type is the device type historically identified from the access device to be authenticated;

[0133] If the first-level authentication result is the first result, then the legality authentication result is determined to be authentication passed;

[0134] If the first-level authentication result is the second result, then a second-level legality authentication is performed based on the first vector and the second vector to obtain the legality authentication result; wherein, the first vector is determined by m feature variable information from the N feature variable information; the second vector is determined by the average value of the m feature variable information; m is a positive integer and m < N.

[0135] In this embodiment, to verify the legitimacy of the access device, a first-level legitimacy authentication can be performed on the access device to be authenticated, which initially and effectively mitigates the impact of uncertainty. Specifically, authentication can be performed by identifying the device type of the access device to be authenticated (e.g., based on the device type identification using a stacked denoising encoder). Secondly, based on the identification result, a second-level legitimacy authentication is performed using a matching similarity calculation. In this way, by using a hierarchical authentication method to compare changes in device type and matching degree, authentication failure due to classification errors is avoided, thereby further enhancing the robustness of the authentication method and guiding the access device to complete identity authentication.

[0136] Optionally, the step of performing first-level legitimacy authentication based on the first device type and the second device type to obtain a first-level authentication result includes:

[0137] Compare the first device type with the second device type;

[0138] If the first device type is the same as the second device type, then the first-level authentication result is determined to be the first result;

[0139] If the first device type is inconsistent with the second device type, then the first-level authentication result is determined to be the second result.

[0140] For example, the current recognition result of the stacked denoising encoder (i.e., the first device type) can be compared with the historical (e.g., the previous) recognition result (i.e., the second device type). If the two recognition results are consistent (e.g., both are printer devices), then the authentication is successful.

[0141] In this way, during the first-level legitimacy authentication process, it can be determined whether the currently output device type (i.e., the first device type) is consistent with the second device type (i.e., the device type historically identified by the access device to be authenticated). If they are consistent, the first-level authentication result is determined to be successful, indicating that the current behavior of the access device to be authenticated is legitimate; if they are inconsistent, the second-level legitimacy authentication can be performed to further verify whether the current behavior of the access device to be authenticated is legitimate.

[0142] Optionally, the step of performing second-level legitimacy authentication based on the first vector and the second vector to obtain the legitimacy authentication result includes:

[0143] The matching degree is calculated based on the first vector and the second vector;

[0144] If the matching degree is greater than or equal to the preset value, then the legality authentication result is determined to be successful.

[0145] If the matching degree is less than the preset value, the legality authentication result is determined to be authentication failure.

[0146] In this embodiment, the preset value can be set according to specific circumstances; for example, it can be set to 0.75. If authentication is successful, it indicates that the behavior of the access device to be authenticated is legitimate; if authentication fails, it indicates that the behavior of the access device to be authenticated is abnormal.

[0147] Optionally, calculating the matching degree based on the first vector and the second vector includes:

[0148] Through the formula: The matching degree is calculated;

[0149] Among them, D M (γ) represents the matching degree; γ = (γ1, γ2, ..., γ) m ) represents the first vector; o = (o1, o2, ..., o m ) is the second vector.

[0150] In this embodiment, m feature variables (e.g., source IP, source IP port, packet length, MAC address, etc.) can be selected from N feature variable information to form a first vector. The first vector can be represented as γ = (γ1, γ2, ..., γ m The second vector can also be determined by the average value of these m feature variables. The second vector can be represented as o = (o1, o2, ..., o2). m In this way, the second vector can be used as a reference point, and the formula can be used to... The matching degree D was calculated. M (γ). Where ∑(.) represents the covariance matrix, "T" represents the transpose matrix, and "-1" represents the inverse matrix.

[0151] Optionally, the method further includes:

[0152] If the matching degree is greater than or equal to a preset value, then after determining that the legality authentication result is successful, the first device type of the identified access device to be authenticated will be updated to the second device type.

[0153] In this embodiment, if the matching degree is greater than or equal to a preset value, it can be analyzed that the previous authentication failure may have been caused by classification. At this time, the device type of the access device to be authenticated can be updated to the correct device type (i.e., the second device type) for the next device authentication.

[0154] Optionally, the method further includes:

[0155] If the matching degree is less than the preset value, then after determining that the legality authentication result is authentication failure, an alarm process is executed.

[0156] For example, an alarm message can be sent to indicate that the device behavior of the access device to be authenticated is abnormal, or other methods can be used, but the embodiments of the present invention are not limited thereto.

[0157] The following provides specific examples of the solutions provided in the embodiments of this application.

[0158] like Figure 2 The diagram shown is a flowchart of the hierarchical authentication process for the access device according to an embodiment of the present invention.

[0159] S201: Beginning;

[0160] S202: Taking a printer device on a certain access platform as an example, N relevant feature variables (i.e. feature variable information) of the device can be collected first, and the collected N relevant feature variables can be input into the trained stacked denoising encoder.

[0161] For example, if N is 20, the 20 relevant feature variables are: destination IP, destination IP port, packet type, source IP, source IP port, packet length, sequence number, ACK, URG, device application industry, service call count, alarm count, node type, protocol type, bearer network type, call type, operating system, network operator equipment, network connection method, device physical address, device daily traffic and activity.

[0162] S203: Using the trained stacked denoising encoder, identify the device type of the device and output the identification result (i.e., device type). The structure of the trained stacked denoising encoder can be 20-18-13-8-5-1.

[0163] It should be noted that the device type identification method in the embodiments of the present invention includes, but is not limited to, machine learning algorithms such as stacked denoising encoders and deep belief networks, and the similarity calculation method includes, but is not limited to, methods such as Eulerian distance, cosine, and mutual information.

[0164] S204: Compare the identification result (i.e., the first device type) output in S203 with the previous classification result (i.e., the device type obtained from the historical identification of the access device to be authenticated, i.e., the second device type) to determine whether the two are consistent.

[0165] If they match, proceed to step S207; otherwise, proceed to step S205.

[0166] S205: Calculate the matching degree D of the five indicators. M (γ); where these five indicators are determined by a portion of the information from N characteristic variables. For example, these five indicators are the protocol type, bearer network type, service call count, daily device traffic, and activity level, respectively, from the N characteristic variables.

[0167] S206: Determine D M The relationship between (γ) and the preset value of the matching degree ζ; where the preset value of the matching degree ζ can be set to 0.75.

[0168] If the value is greater than the preset value, then execute S207; if the value is less than the preset value, then execute S209.

[0169] S207: i.e., D M If (γ) > 0.75, it indicates successful authentication, meaning the authentication error of the device was caused by a classification error.

[0170] S208: Replace the identification result of this time with the device type identified last time (i.e., the identification result output in S203). That is, update the first device type of the identified access device to be authenticated to the second device type for the next authentication.

[0171] S209: That is, D M If (γ) < 0.75, it indicates that authentication has failed, which means that the device behavior is abnormal. In this case, an alarm can be triggered.

[0172] S210: Output authentication result;

[0173] S211: End.

[0174] Furthermore, based on this access platform, this embodiment of the invention performs device authentication on 64 types of access devices, and the authentication results are as follows: Figure 3 As shown, the authentication method for access devices in this embodiment of the invention, by calculating the matching degree, can effectively avoid authentication failures caused by classification errors, thereby further enhancing the robustness of the authentication method and improving authentication accuracy.

[0175] The method in this embodiment can identify and determine the device type of the access device to be authenticated by obtaining the characteristic variable information of the access device to be authenticated, and then perform legality authentication on the access device to be authenticated based on the device type. In this way, the authentication accuracy can be improved, the problem of poor robustness of traditional authentication methods can be overcome, the fault tolerance can be improved, and the robustness can be better, thus ensuring the security of access devices in the Internet of Things.

[0176] like Figure 4 As shown, an authentication device for an access device according to an embodiment of the present invention includes:

[0177] The acquisition module 410 is used to acquire N characteristic variable information of the access device to be authenticated; where N is a positive integer;

[0178] The determination module 420 is used to identify the N feature variable information and determine the first device type of the access device to be authenticated;

[0179] The authentication module 430 is used to authenticate the legitimacy of the access device to be authenticated according to the first device type, and obtain the legitimacy authentication result.

[0180] In this embodiment, by obtaining the characteristic variable information of the access device to be authenticated, the device type of the access device to be authenticated can be identified and determined. Then, based on the device type, the legitimacy of the access device to be authenticated can be verified. This can improve the authentication accuracy, have better robustness, and ensure the security of access devices in the Internet of Things.

[0181] Optionally, the determining module 420 includes:

[0182] The recognition submodule is used to recognize the N feature variable information as input variables of the stacked denoising encoder and obtain the output result;

[0183] The output submodule is used to determine the first device type of the access device based on the output result.

[0184] Optionally, the expression for the output of the stacked denoising encoder is:

[0185]

[0186] Among them, u j The output result is w ij This represents the connection weight between the i-th hidden neuron and the j-th output neuron; This represents the output value of the i-th hidden node in the n-th hidden layer; n is the number of hidden layers. Let be the vector of the nth hidden layer; k is the number of hidden nodes in the nth hidden layer; the expression corresponding to the nth hidden layer is:

[0187]

[0188] …

[0189]

[0190]

[0191] Where W = (w1, w2, ..., w n ) represents the connection weights between each hidden layer, B = (b1, b2, ..., b n ) is the bias vector, and X is the input variable.

[0192] Optionally, the device further includes:

[0193] A construction submodule is used to construct a stacked denoising encoder and acquire sample data; wherein, the sample data includes N feature variable information of multiple sample access devices and device type;

[0194] The training submodule is used to train the constructed stacked denoising encoder based on the sample data.

[0195] Optionally, the authentication module 430 includes:

[0196] The first-level authentication submodule is used to perform first-level legitimacy authentication based on the first device type and the second device type to obtain the first-level authentication result; wherein, the second device type is the device type historically identified from the access device to be authenticated;

[0197] The first determining submodule is used to determine that the legality authentication result is successful if the first-level authentication result is the first result;

[0198] The secondary authentication submodule is used to perform secondary legality authentication based on the first vector and the second vector if the first-level authentication result is the second result, thereby obtaining the legality authentication result; wherein, the first vector is determined by m feature variables from the N feature variable information; the second vector is determined by the average value of the m feature variable information; m is a positive integer and m < N.

[0199] Optionally, the primary authentication submodule includes:

[0200] The first authentication unit is used to compare the first device type with the second device type;

[0201] The second authentication unit is configured to determine the first-level authentication result as the first result if the first device type is consistent with the second device type;

[0202] The third authentication unit is used to determine the first-level authentication result as the second result if the first device type is inconsistent with the second device type.

[0203] Optionally, the secondary authentication submodule includes:

[0204] The third authentication unit is used to calculate the matching degree based on the first vector and the second vector;

[0205] The fourth authentication unit is used to determine that the legality authentication result is successful if the matching degree is greater than or equal to a preset value.

[0206] The fifth authentication unit is used to determine that the legality authentication result is an authentication failure if the matching degree is less than the preset value.

[0207] Optionally, the third authentication unit includes:

[0208] The first authentication unit is used to verify the formula: The matching degree is calculated;

[0209] Among them, D M (γ) represents the matching degree; γ = (γ1, γ2, ..., γ) m ) represents the first vector; o = (o1, o2, ..., o m ) is the second vector.

[0210] Optionally, the device further includes:

[0211] The update module is used to update the first device type of the identified access device to be authenticated to the second device type after determining that the legality authentication result is successful if the matching degree is greater than or equal to a preset value.

[0212] Optionally, the device further includes:

[0213] The alarm module is used to perform alarm processing after determining that the legality authentication result is an authentication failure if the matching degree is less than the preset value.

[0214] The authentication device for the access device in this embodiment can identify and determine the device type of the access device to be authenticated by acquiring the characteristic variable information of the access device to be authenticated, and then perform legality authentication on the access device to be authenticated based on the device type. In this way, the authentication accuracy can be improved, the problem of poor robustness of traditional authentication methods can be overcome, the fault tolerance can be improved, and the robustness can be better, thus ensuring the security of access devices in the Internet of Things.

[0215] like Figure 5 As shown, this embodiment of the invention also provides a communication device, including a transceiver 510, a processor 500, a memory 520, and a program or instructions stored in the memory 520 and executable on the processor 500; when the processor 500 executes the program or instructions, it implements the steps in the authentication method of the access device described above and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0216] The transceiver 510 is used to receive and send data under the control of the processor 500.

[0217] Among them, Figure 5 In this context, the bus architecture may include any number of interconnected buses and bridges, specifically linking various circuits together, represented by one or more processors (processor 500) and memory (memory 520). The bus architecture may also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 510 may be multiple elements, including transmitters and receivers, providing a unit for communicating with various other devices over a transmission medium. The processor 500 is responsible for managing the bus architecture and general processing, and the memory 520 may store data used by the processor 500 during operation.

[0218] An embodiment of the present invention provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the steps in the authentication method described above and achieve the same technical effect. To avoid repetition, further details are omitted here.

[0219] The processor mentioned above is the processor in the communication device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0220] It should be further noted that the terminals described in this specification include, but are not limited to, smartphones, tablets, etc., and many of the functional components described are referred to as modules in order to emphasize the independence of their implementation.

[0221] In this embodiment of the invention, the module can be implemented in software so that it can be executed by various types of processors. For example, an identified executable code module may include one or more physical or logical blocks of computer instructions, which may be constructed as objects, procedures, or functions. Nevertheless, the executable code of the identified module does not need to be physically located together, but may include different instructions stored in different bits, which, when logically combined, constitute the module and achieve the module's intended purpose.

[0222] In practice, an executable code module can be a single instruction or many instructions, and can even be distributed across multiple different code segments, different programs, and across multiple memory devices. Similarly, operational data can be identified within the module and can be implemented in any suitable form and organized within any suitable type of data structure. This operational data can be collected as a single dataset or distributed across different locations (including different storage devices), and can exist, at least in part, solely as electronic signals within the system or network.

[0223] When a module can be implemented using software, considering the current level of hardware technology, modules that can be implemented in software can be implemented using hardware circuits by those skilled in the art to achieve the corresponding functions, without considering cost. These hardware circuits include conventional very-large-scale integrated circuits (VLSI) or gate arrays, as well as existing semiconductors such as logic chips and transistors, or other discrete components. Modules can also be implemented using programmable hardware devices, such as field-programmable gate arrays, programmable array logic, and programmable logic devices.

[0224] The exemplary embodiments described above are with reference to the accompanying drawings. Many different forms and embodiments are feasible without departing from the spirit and teachings of the invention. Therefore, the invention should not be construed as limiting the exemplary embodiments set forth herein. Rather, these exemplary embodiments are provided to make the invention complete and convey the scope of the invention to those skilled in the art. In these drawings, component dimensions and relative dimensions may be exaggerated for clarity. The terminology used herein is for the purpose of describing particular exemplary embodiments only and is not intended to be limiting. As used herein, unless clearly indicated otherwise, the singular forms “a,” “an,” and “the” are intended to include all such forms. It will be further understood that the terms “comprising” and / or “including”, when used in this specification, indicate the presence of the stated features, integers, steps, operations, components, and / or elements, but do not exclude the presence or addition of one or more other features, integers, steps, operations, components, and / or groups thereof. Unless otherwise indicated, when stated, a range of values ​​includes the upper and lower limits of the range and any subranges in between.

[0225] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. An authentication method for an access device, characterized in that, include: Obtain N characteristic variables of the access device to be authenticated; where N is a positive integer; The first device type of the access device to be authenticated is determined by identifying the N feature variables. The legitimacy of the access device to be authenticated is verified according to the first device type to obtain the legitimacy authentication result; The step of identifying the N feature variables to determine the first device type of the access device to be authenticated includes: The N feature variables are used as input variables for the stacked denoising encoder to obtain the output result; Based on the output results, determine the first device type of the access device; The expression for the output of the stacked denoising encoder is as follows: in, The output result is as described; This represents the connection weight between the i-th hidden neuron and the j-th output neuron; This represents the output value of the i-th hidden node in the n-th hidden layer; n is the number of hidden layers. Let be the vector of the nth hidden layer; k is the number of hidden nodes in the nth hidden layer; the expression corresponding to the nth hidden layer is: … Where W=(w1,w2,...,w n ) represents the connection weights between each hidden layer, B=(b1,b2,...,b n ) is the bias vector, and X is the input variable.

2. The method according to claim 1, characterized in that, Also includes: Construct a stacked denoising encoder and acquire sample data; wherein, the sample data includes N feature variable information and device type of multiple sample access devices; The constructed stacked denoising encoder is trained based on the sample data.

3. The method according to claim 1, characterized in that, The step of authenticating the legitimacy of the access device to be authenticated according to the first device type, and obtaining the legitimacy authentication result, includes: A first-level legitimacy authentication is performed based on the first device type and the second device type to obtain a first-level authentication result; wherein, the second device type is the device type historically identified from the access device to be authenticated; If the first-level authentication result is the first result, then the legality authentication result is determined to be authentication passed; If the first-level authentication result is the second result, then a second-level legality authentication is performed based on the first vector and the second vector to obtain the legality authentication result; wherein, the first vector is determined by m feature variable information from the N feature variable information; the second vector is determined by the average value of the m feature variable information; m is a positive integer and m < N.

4. The method according to claim 3, characterized in that, The first-level legitimacy authentication based on the first device type and the second device type, to obtain the first-level authentication result, includes: Compare the first device type with the second device type; If the first device type is the same as the second device type, then the first-level authentication result is determined to be the first result; If the first device type is inconsistent with the second device type, then the first-level authentication result is determined to be the second result.

5. The method according to claim 3, characterized in that, The second-level legitimacy authentication based on the first vector and the second vector, to obtain the legitimacy authentication result, includes: The matching degree is calculated based on the first vector and the second vector; If the matching degree is greater than or equal to the preset value, then the legality authentication result is determined to be successful. If the matching degree is less than the preset value, the legality authentication result is determined to be authentication failure.

6. The method according to claim 5, characterized in that, The step of calculating the matching degree based on the first vector and the second vector includes: Through the formula: The matching degree is calculated. in, The matching degree; The first vector; This is the second vector.

7. The method according to claim 5, characterized in that, Also includes: If the matching degree is greater than or equal to a preset value, then after determining that the legality authentication result is successful, the first device type of the identified access device to be authenticated will be updated to the second device type.

8. The method according to claim 5, characterized in that, Also includes: If the matching degree is less than the preset value, then after determining that the legality authentication result is authentication failure, an alarm process is executed.

9. An authentication device for an access device, characterized in that, include: The acquisition module is used to acquire N characteristic variable information of the access device to be authenticated; where N is a positive integer; The determination module is used to identify the N feature variable information and determine the first device type of the access device to be authenticated; The authentication module is used to authenticate the legitimacy of the access device to be authenticated according to the first device type, and obtain the legitimacy authentication result; The determining module includes: The recognition submodule is used to recognize the N feature variable information as input variables of the stacked denoising encoder and obtain the output result; An output submodule is used to determine the first device type of the access device based on the output result; The expression for the output of the stacked denoising encoder is as follows: in, The output result is as described; This represents the connection weight between the i-th hidden neuron and the j-th output neuron; This represents the output value of the i-th hidden node in the n-th hidden layer; n is the number of hidden layers. Let be the vector of the nth hidden layer; k is the number of hidden nodes in the nth hidden layer; the expression corresponding to the nth hidden layer is: … Where W=(w1,w2,...,w n ) represents the connection weights between each hidden layer, B=(b1,b2,...,b n ) is the bias vector, and X is the input variable.

10. A communication device, comprising: A transceiver, a processor, a memory, and a program or instructions stored in the memory and executable on the processor; characterized in that, when the processor executes the program or instructions, it implements the steps of the authentication method of the access device as claimed in any one of claims 1 to 8.

11. A readable storage medium having a program or instructions stored thereon, characterized in that, When the program or instructions are executed by the processor, they implement the steps in the authentication method of the access device as described in any one of claims 1 to 8.

Images