A method for continuous authentication of IoT based on zero trust and edge intelligence

Abstract

This invention relates to a continuous authentication method for the Internet of Things (IoT) based on zero trust and edge intelligence, comprising the following steps: expanding the coverage dimensions of the zero trust network architecture to construct a zero trust network architecture; establishing a zero trust IoT network based on the zero trust network architecture; collecting features from each dimension while the zero trust IoT network is in operation; constructing an edge intelligent decision model based on a neural network and training it using the features from each dimension; and performing periodic continuous verification of network requests based on the trained edge intelligent decision model to achieve continuous authentication of network requests. Compared with existing technologies, this invention has advantages such as dynamic verification of network connections throughout the entire lifecycle, low network latency overhead, and focus on core IoT resources.

Description

Technical Field

[0001] This invention relates to the field of zero-trust Internet of Things (IoT) and continuous authentication, and in particular to a continuous authentication method for IoT based on zero trust and edge intelligence. Background Technology

[0002] With the rapid development of the Internet of Things (IoT) in smart cities, public services, and industries, the number of IoT terminal devices has also increased rapidly. Because IoT terminal devices are typically deployed in places easily accessible to people, and lack basic cybersecurity protection measures, IoT devices and the data they produce or store are vulnerable to attack. Attackers often use vulnerable IoT devices as entry points to launch attacks on a wider network and physical entities through distributed denial-of-service (DDoS) attacks or other attacks. These attacks pose a significant threat to the economy, personal safety, and user privacy, such as the DYN attack by the Mirai IoT botnet. Furthermore, due to the practical needs of smart cities and the Industrial Internet of Things (IIoT), the vast majority of IoT devices are deployed in vulnerable / intrusion environments, making it impossible to assume that all devices connected to the network or requesting access are as trustworthy as before. At the same time, due to potential internal management vulnerabilities, internal security threats cannot be guaranteed to be eliminated. These facts mean that in the IoT era, the concept of network boundaries is gradually blurring or even disappearing. Therefore, current IoT networks cannot rely solely on firewalls and intrusion detection systems (IDS) to build network security protection; the permissions and behaviors of users, requests, and resources within the IoT must be redesigned, assessed, and controlled to ensure the security of the entire network system.

[0003] Zero Trust Architecture (ZTA) is considered a suitable solution for the security and privacy protection needs of the Internet of Things (IoT). Based on the security principle of "never trust, always verify," ZTA transforms network defense from a static division of trust zones and network boundaries to an open architecture focused on deep protection of users, assets, and resources. ZTA consists of a control plane for communication control and a data plane for carrying application data. Subjects (such as clients) submit access requests on the control plane, which are then processed by a trust assessment engine and an access control engine for authentication and authorization. Once the access request is approved, the system dynamically configures the data plane, and the access agent receives communication data from the subject to establish a one-time secure connection. ZTA is gaining popularity in the IoT because many of its principles can also be applied to improve the security of open and dynamic networks, including smart building IoT, smart campus IoT, and more. However, the primary consideration in the design of existing zero-trust architectures remains scenarios where the subjects and objects are relatively fixed. Security risks arising from changes in the state, spatial location, and physical environment of subjects and objects are not fully addressed. Furthermore, the currently used authentication schemes are still static authentication schemes, which stipulate that the server only verifies the requester once at the beginning of each session. This is vulnerable to attacks such as session hijacking, as it only checks the user at the start of each session. These issues prevent the zero-trust architecture from fully adapting to the rapid development of IoT networks, necessitating improvement and expansion. Summary of the Invention

[0004] The purpose of this invention is to provide a continuous authentication method for the Internet of Things based on zero trust and edge intelligence, which covers more dimensions of features, improves authentication accuracy, and achieves continuous identity authentication.

[0005] The objective of this invention can be achieved through the following technical solutions:

[0006] A continuous authentication method for the Internet of Things (IoT) based on zero trust and edge intelligence includes the following steps:

[0007] Expand the coverage dimensions of the zero-trust network architecture and build a zero-trust network architecture;

[0008] Establish a zero-trust Internet of Things (IoT) network based on a zero-trust network architecture;

[0009] Collect features from various dimensions while the zero-trust IoT network is in operation;

[0010] Construct an edge intelligent decision-making model based on neural networks and train it using features from various dimensions;

[0011] The edge intelligent decision-making model trained is used to periodically and continuously verify network requests, thereby achieving continuous authentication of network requests.

[0012] The zero-trust network architecture covers the following dimensions: request subject, request object, behavior, environment, and physical entity.

[0013] The request subject dimension refers to the party that initiates the request in the session. The characteristics of the subject dimension include the subject's identity and preset permissions.

[0014] The requested object dimension refers to the resources exchanged in the session, and the characteristics of the object dimension include resource value, degree of demand, and level of harm.

[0015] The behavioral dimension refers to the recording of various operations performed by the subject and object on resources during the session, as well as various events that cause dynamic changes in the environment.

[0016] The environmental dimension refers to information related to session security in the network and the real world;

[0017] The physical entity dimension refers to the security-related configurations of devices in the network.

[0018] The zero-trust IoT network includes trusted resource areas, untrusted zero-trust areas, and access policy control points. The decision control points include edge intelligent decision-making models and continuous authentication schemes. The continuous authentication scheme evaluates the security level of objects and the trust level of subjects based on different dimensions of characteristics, and verifies sessions by matching security levels and trust levels. The continuous authentication scheme periodically performs evaluation operations and provides the evaluation results to policy enforcement points to execute zero-trust-based decision operations.

[0019] An edge intelligent decision-making model is built using a neural network-based decision tree algorithm, and trained using features from various dimensions. The specific steps include:

[0020] A hierarchical structure is constructed based on feature preprocessing and mapping results;

[0021] Calculate the probability path;

[0022] The pre-trained model is loaded onto the nodes of a classic decision tree to construct an induced hierarchical structure. The final decision probability of the decision tree is calculated using a normalized exponential function. The pre-trained model is a trained neural network model.

[0023] Tree-supervised loss is introduced to train the edge intelligent decision-making model.

[0024] The feature preprocessing involves normalizing feature data from different dimensions. Specifically:

[0025] Obtain raw feature data from different dimensions:

[0026] θ ij i∈[1,5],j∈R

[0027]

[0028]

[0029] Where, θ ij The raw feature data was collected for different dimensions, covering a total of 5 dimensions. A vector composed of the original features of a certain dimension. A feature set consisting of five-dimensional feature vectors from a single sampling;

[0030] The original feature data is normalized using the L2 norm to remove units from different feature dimensions:

[0031]

[0032]

[0033] in, A vector composed of features of a certain dimension after normalization. It is a feature set consisting of five normalized feature vectors.

[0034] The method for calculating the probability path is as follows: for a feature set sampled once... The probability of node i having child nodes j∈C(i) is calculated using the softmax inner product:

[0035]

[0036] in, The weights of the nodes are determined by the leaf nodes k∈L(i) and their initial weights ω. k The calculated expression is:

[0037]

[0038] For leaf node k, find all possible paths P. k Its path probability is:

[0039]

[0040] The method uses a normalized exponential function to calculate the final decision probability of the decision tree. The expression is:

[0041]

[0042] The specific steps for training the edge intelligent decision-making model using the introduced tree-supervised loss are as follows:

[0043]

[0044] L=ω t H(D nbdt )+β t H(D nbdt )

[0045]

[0046] Among them, D nbdt The time-varying cross-entropy loss is the path probability on the prediction class, and the function H(D) is the cross-entropy calculation function, ω. t and β t Let L be the time-varying weight and L be the tree supervision loss.

[0047] The step of periodically and continuously verifying network requests based on the trained edge intelligent decision-making model to achieve continuous authentication of network requests specifically involves:

[0048] The final decision probability output by the edge intelligent decision model is used as the original decision for authentication and applied to the continuous authentication scheme of the access control point. For each access request Q, t∈T is any time interval during the request period. The security level of the object and the trust level of the subject are determined based on the level calculation formula, where the time interval is the minimum interval for continuous authentication. The level calculation formula is as follows:

[0049]

[0050] where v t ∈V represents the possible final decision value, p t For the corresponding probability, A t This represents the level to be calculated, specifically the security level of the object or the trust level of the subject.

[0051] By selecting features from various dimensions, the security level S of the object is obtained based on the level calculation formula. t Trust level T of the subject t ;

[0052] If and only if T t ≥S t When a connection is established, it is allowed to be created or maintained; otherwise, the decision control point immediately denies access or disconnects the established connection, thus enabling continuous authentication of network requests.

[0053] Compared with the prior art, the present invention has the following beneficial effects:

[0054] (1) This invention proposes an improved zero-trust network architecture, which extends the traditional zero-trust concept to multi-dimensional zero trust that focuses on subjects, objects, environment, behavior and physical entities, expands the coverage dimension, and focuses on continuous authentication of access requests in the dynamically changing Internet of Things network environment.

[0055] (2) This invention proposes a continuous authentication scheme, which achieves proactive and continuous authentication by periodically monitoring and re-evaluating variable attributes throughout the entire request lifecycle. In this authentication scheme, this invention designs an edge intelligent decision model based on neural networks to improve the accuracy of authentication. Compared with static authentication schemes, this continuous authentication scheme has a higher recognition rate for dynamic attack requests such as session hijacking, and consumes less computing power for IoT devices. It is suitable for application in IoT networks and can effectively improve the security protection performance of the entire network. Attached Figure Description

[0056] Figure 1 This is a schematic diagram of the zero-trust network architecture of the present invention;

[0057] Figure 2 A schematic diagram illustrating the process of generating edge intelligent decision-making models;

[0058] Figure 3 A comparison chart of startup times for different solutions;

[0059] Figure 4 A comparison chart of processing speeds for different solutions;

[0060] Figure 5 This is a comparison chart of the concurrent processing performance of different schemes. Detailed Implementation

[0061] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. These embodiments are based on the technical solution of the present invention and provide detailed implementation methods and specific operating procedures. However, the scope of protection of the present invention is not limited to the following embodiments.

[0062] This embodiment provides a continuous authentication method for the Internet of Things (IoT) based on zero trust and edge intelligence, including the following steps:

[0063] 1) Expand the coverage dimensions of the zero-trust network architecture and build a zero-trust network architecture, such as... Figure 1 As shown.

[0064] The zero-trust network architecture covers the following dimensions: request subject, request object, behavior, environment, and physical entity.

[0065] The request subject dimension refers to the party that initiates the request in the session. In the Internet of Things network, the request subject includes applications, users and devices located at the edge or in the cloud. The subject dimension mainly includes features such as the subject's identity and preset permissions, which are extracted to calculate the subject's credibility.

[0066] The requested object dimension refers to the resources exchanged during the session. In an IoT network, requested objects include sensor data from edge sensors, video stream data from cameras, and interfaces provided by edge devices. The characteristics of the object dimension include resource value, degree of demand, and level of hazard.

[0067] The behavioral dimension refers to the record of various operations performed by the subject and object on resources during the session, as well as various events that cause dynamic changes in the environment.

[0068] The environmental dimension refers to information related to session security in the network and the real world. The extraction of environmental features is mainly carried out from two aspects: risk awareness and threat analysis.

[0069] The physical entity dimension refers to the security-related configurations of devices in the network. These configurations are often fixed information that is preset before access and need to be read and extracted in a preset manner as a basic condition for security assessment.

[0070] 2) Establish a zero-trust Internet of Things network based on a zero-trust network architecture.

[0071] The zero-trust IoT network includes trusted resource areas, untrusted zero-trust areas, and access policy control points. The decision control points include edge intelligent decision-making models and continuous authentication schemes.

[0072] Trusted resource zones are the core protected resources. Zero-trust architecture requires building a protection surface for the protected resources, which include, but are not limited to, data in the IoT network, various interfaces provided by the network, and operational functions.

[0073] The untrusted zero-trust zone is all areas except the trusted resource zone. It mainly includes digital entities that have been identified, such as personnel, operating equipment, applications, and systems. In a certain access context, these entities can also be combined and bound to further clarify and limit the subject.

[0074] Access policy control points manage connections between clients and resources. They generate any authentication tokens or credentials used by clients to access enterprise resources and are the primary enforcement point for continuous authentication schemes. They are responsible for initiating, continuously monitoring, and ultimately terminating the connection between the accessing subject and the accessing object; their core function is to ensure secure access for business operations.

[0075] The continuous authentication scheme evaluates the security level of the object and the trust level of the subject based on different dimensions of characteristics, and verifies the session by matching the security level and trust level. The continuous authentication scheme performs evaluation operations periodically and provides the evaluation results to the policy enforcement point to perform zero-trust-based decision operations.

[0076] 3) Collect features from various dimensions while the zero-trust IoT network is in operation.

[0077] 4) Construct an edge intelligent decision-making model based on neural networks and train it using features from various dimensions. Specifically, in the constructed improved zero-trust IoT network, simulate potential access and attack requests, collect feature information from various feature dimensions, process it, and use it to train a decision tree based on neural networks. Based on the obtained trained model, calculate the security and trust levels of the subject and object, and perform continuous authentication of access based on this trust level. The process is as follows: Figure 2 As shown, it includes the following steps:

[0078] 41) Construct a hierarchical structure based on feature preprocessing and mapping results.

[0079] Normalization is performed on feature data of different dimensions, specifically:

[0080] Obtain raw feature data from 5 different dimensions:

[0081] θ ij i∈[1,5],j∈R

[0082]

[0083]

[0084] Where, θ ij The raw feature data was collected for different dimensions, covering a total of 5 dimensions. A vector composed of the original features of a certain dimension. A feature set consisting of five-dimensional feature vectors from a single sampling;

[0085] The original feature data is normalized using the L2 norm to remove units from different feature dimensions:

[0086]

[0087]

[0088] in, A vector composed of features of a certain dimension after normalization. It is a feature set consisting of five normalized feature vectors.

[0089] 42) Calculate the probability path.

[0090] For a single sample of the feature set The probability of node i having child nodes j∈C(i) is calculated using the softmax inner product:

[0091]

[0092] in, The weights of the nodes are determined by the leaf nodes k∈L(i) and their initial weights ω. k The calculated expression is:

[0093]

[0094] For leaf node k, find all possible paths P. k Its path probability is:

[0095]

[0096] 43) Load the pre-trained model onto the nodes of the classic decision tree to construct an induced hierarchical structure, and use the normalized exponential function to calculate the final decision probability of the decision tree, wherein the pre-trained model is a trained neural network model.

[0097] The method uses a normalized exponential function to calculate the final decision probability of the decision tree. The expression is:

[0098]

[0099] 44) Introduce tree-supervised loss to train the edge intelligent decision-making model, adjust the internal nodes of the model to increase their discriminative power, and prevent the final decision result of the decision tree from being affected by internal nodes being too close together:

[0100]

[0101] L=ω t H(D nbdt )+β t H(D nbdt )

[0102]

[0103] Among them, D nbdt The time-varying cross-entropy loss is the path probability on the prediction class, and the function H(D) is the cross-entropy calculation function, ω. t and β t Let L be the time-varying weight and L be the tree supervision loss.

[0104] 5) Based on the trained edge intelligent decision-making model, network requests are periodically and continuously verified to achieve continuous authentication of network requests.

[0105] The final decision probability output by the edge intelligent decision model is used as the original decision for authentication and applied to the continuous authentication scheme of the access control point. For each access request Q, t∈T is any time interval during the request period. The security level of the object and the trust level of the subject are determined based on the level calculation formula, where the time interval is the minimum interval for continuous authentication. The level calculation formula is as follows:

[0106]

[0107] where v t ∈V represents the possible final decision value, p t For the corresponding probability, A t This represents the level to be calculated, specifically the security level of the object or the trust level of the subject.

[0108] By selecting features from various dimensions, the security level S of the object is obtained based on the level calculation formula. t Trust level T of the subject t .

[0109] If and only if T t ≥S t When a connection is established, it is allowed to be created or maintained; otherwise, the decision control point immediately denies access or disconnects the established connection, thus enabling continuous authentication of network requests.

[0110] This embodiment verifies the solution by setting up an experimental environment. The experiment consists of three parts: First, an experimental platform based on an improved zero-trust architecture is established to implement a continuous authentication scheme based on edge intelligent decision-making. Second, the decision tree update process is simulated after system startup or new device access. By changing the state of nodes in the network, the impact of real-world device failure, disconnection, or new device access on the regeneration of the edge intelligent decision tree in the continuous authentication scheme is simulated. Third, the sending of session requests is simulated to verify the continuous authentication scheme's ability to identify various attacks and its impact on system processing performance. In both the second and third steps, the attribute-based access control scheme in the traditional zero-trust architecture is used for comparison.

[0111] Step 1: Establish an experimental platform for improving the zero-trust architecture:

[0112] An experimental platform for improving zero-trust architecture was built using Raspberry Pi, a Linux virtual machine, and a mobile phone. The platform uses Raspberry Pi to simulate IoT devices and implements a continuous authentication scheme based on edge intelligent decision-making in a Linux virtual machine, including an edge intelligent decision tree model and decision execution points. In this experimental platform, information from different devices is collected at the decision execution points for continuous trust assessment. Session requests are simulated using mobile phones, and the effectiveness of continuous authentication is evaluated.

[0113] Step 2: Simulate the startup process:

[0114] Startup response time is defined as the time required to provide access control services with higher accuracy than before, during network initialization or structural changes. In practical applications, there are typically two startup scenarios:

[0115] A) Cold start: No attributes are loaded during network initialization. Attributes need to be pre-loaded and trained before startup to enable edge intelligent decision-making. Cold start corresponds to the network initialization scenario when initially deploying a large number of devices in real-world application scenarios.

[0116] B) Standard Operation: Attribute loading and pre-training of the edge decision tree have been completed. Standard operation corresponds to the reconnection of certain devices after they have gone offline in real-world application scenarios.

[0117] like Figure 3 As shown, with the increase in the number of attributes, the time difference between standard operations of different strategies gradually narrows, and even becomes almost the same. The above data indicates that the architecture and solution proposed in this invention will not have a significant impact on system startup under normal circumstances.

[0118] Step 3: Simulate session request sending:

[0119] The test simulates session requests from different terminals using pre-set environments such as mobile phones and computers. The ratio of legitimate to illegitimate requests is 3:7, and the requests do not change behavior after the connection is established, which are considered static requests. After the test is completed, the same requests are resent. During this process, 50% of the authenticated requests are selected to perform illegitimate operations during the session, which are considered dynamic requests.

[0120] The identification results of different request schemes are shown in Table 1. The scheme proposed in this invention has good accuracy in identifying dynamic illegal requests and can effectively reduce the risk of connected devices being hijacked.

[0121] Table 1 Comparison of accuracy of different authentication methods for request authentication

[0122] plan static requests Dynamic requests Attribute-based access control 92.04％ 68.49％ Access control based on edge intelligent decision-making as described in this invention 94.61％ 86.97％

[0123] To further test the impact of the solution on processing performance, tests were conducted under different loads (number of concurrent requests) and different numbers of feature samples collected. The results are as follows: Figure 4 , Figure 5 As shown:

[0124] Figure 4 The relationship between decision time and the number of attributes involved in a decision under low load conditions is shown. As the number of attributes involved in a decision increases, the time consumption of a single decision gradually increases, and the overall variance also increases. Meanwhile, the time spent by the edge intelligence-based strategy is slightly higher than that of general schemes. However, considering the proportion of decision time in a single request time (10–20 milliseconds), the increase in decision time (not exceeding 200 microseconds) is still within an acceptable range. Therefore, the following conclusion can be drawn: the continuous authentication scheme proposed in this invention improves security without significantly impacting the processing performance of the IoT network system.

[0125] Figure 5 Data shows that as the number of concurrent requests increases, the decision time of attribute-based access control schemes increases significantly faster than that of edge-based intelligent decision tree schemes. This results in the former's decision time exceeding the latter's in high-concurrency scenarios. Furthermore, when the concurrency is high, the runtime variance of attribute-based access control schemes is large, indicating that their processing performance is significantly affected by request parameters, while edge-based intelligent decision tree schemes are relatively stable. Therefore, the following conclusions can be drawn: the continuous authentication scheme proposed in this invention has relatively stable processing capabilities under high load conditions, and when facing high-load requests in complex scenarios, it processes faster and exhibits better stability.

[0126] In summary, the embodiments of the present invention have experimentally verified the security improvement of the proposed scheme and its negligible impact on the performance of the entire network system.

[0127] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.

Claims

1. A continuous authentication method for the Internet of Things based on zero trust and edge intelligence, characterized in that, Includes the following steps: Expand the coverage dimensions of the zero-trust network architecture and build a zero-trust network architecture; Establish a zero-trust Internet of Things (IoT) network based on a zero-trust network architecture; Collect features from various dimensions while the zero-trust IoT network is in operation; Construct an edge intelligent decision-making model based on neural networks and train it using features from various dimensions; The edge intelligent decision-making model, trained through training, performs periodic and continuous verification of network requests to achieve continuous authentication of network requests. Specifically: The final decision probability output by the edge intelligent decision model is used as the original decision for authentication and applied to the continuous authentication scheme of the access control point. For each access request Q, t∈T is any time interval during the request period. The security level of the object and the trust level of the subject are determined based on the level calculation formula, where the time interval is the minimum interval for continuous authentication. The level calculation formula is as follows: Where v t ∈V represents the possible final decision value, p t For the corresponding probability, A t This represents the level to be calculated, specifically the security level of the object or the trust level of the subject. By selecting features from various dimensions, the security level S of the object is obtained based on the level calculation formula. t Trust level T of the subject t ; If and only if T t ≥S t When a connection is established, it is allowed to be created or maintained; otherwise, the decision control point immediately denies access or disconnects the established connection, thus enabling continuous authentication of network requests.

2. The IoT continuous authentication method based on zero trust and edge intelligence according to claim 1, characterized in that, The zero-trust network architecture covers the following dimensions: request subject, request object, behavior, environment, and physical entity.

3. The IoT continuous authentication method based on zero trust and edge intelligence according to claim 2, characterized in that, The request subject dimension refers to the party that initiates the request in the session. The characteristics of the subject dimension include the subject's identity and preset permissions. The requested object dimension refers to the resources exchanged in the session, and the characteristics of the object dimension include resource value, degree of demand, and level of harm. The behavioral dimension refers to the recording of various operations performed by the subject and object on resources during the session, as well as various events that cause dynamic changes in the environment. The environmental dimension refers to information related to session security in the network and the real world; The physical entity dimension refers to the security-related configurations of devices in the network.

4. The IoT continuous authentication method based on zero trust and edge intelligence according to claim 1, characterized in that, The zero-trust IoT network includes a trusted resource zone, an untrusted zero-trust zone, and an access policy control point. The decision control point includes an edge intelligent decision model and a continuous authentication scheme. The continuous authentication scheme evaluates the security level of the object and the trust level of the subject based on different dimensions of characteristics, and verifies the session by matching the security level and the trust level. The continuous certification scheme performs evaluation operations periodically and provides the evaluation results to policy enforcement points to carry out zero-trust-based decision-making operations.

5. The IoT continuous authentication method based on zero trust and edge intelligence according to claim 1, characterized in that, An edge intelligent decision-making model is built using a neural network-based decision tree algorithm, and trained using features from various dimensions. The specific steps include: A hierarchical structure is constructed based on feature preprocessing and mapping results; Calculate the probability path; The pre-trained model is loaded onto the nodes of a classic decision tree to construct an induced hierarchical structure. The final decision probability of the decision tree is calculated using a normalized exponential function. The pre-trained model is a trained neural network model. Tree-supervised loss is introduced to train the edge intelligent decision-making model.

6. The IoT continuous authentication method based on zero trust and edge intelligence according to claim 5, characterized in that, The feature preprocessing involves normalizing feature data from different dimensions. Specifically: Obtain raw feature data from different dimensions: i ij ,i∈[1,5],j∈R Where, θ ij The raw feature data was collected for different dimensions, covering a total of 5 dimensions. A vector composed of the original features of a certain dimension. A feature set consisting of five-dimensional feature vectors from a single sampling; The original feature data is normalized using the L2 norm to remove units from different feature dimensions: in, A vector composed of features of a certain dimension after normalization. It is a feature set consisting of five dimensional feature vectors after normalization.

7. The IoT continuous authentication method based on zero trust and edge intelligence according to claim 6, characterized in that, The method for calculating the probability path is as follows: for a feature set sampled once... The probability of node i having child nodes j∈C(i) is calculated using the softmax inner product: in, The weights of the nodes are determined by the leaf nodes k∈L(i) and their initial weights ω. k The calculated expression is: For leaf node k, find all possible paths P. k Its path probability is:

8. The IoT continuous authentication method based on zero trust and edge intelligence according to claim 7, characterized in that, The method uses a normalized exponential function to calculate the final decision probability of the decision tree. The expression is:

9. The IoT continuous authentication method based on zero trust and edge intelligence according to claim 8, characterized in that, The specific steps for training the edge intelligent decision-making model using the introduced tree-supervised loss are as follows: L=ω t H(D nbdt )+b t H(D nbdt ) Among them, D nbdt The time-varying cross-entropy loss is the path probability on the prediction class, and the function H(D) is the cross-entropy calculation function, ω. t and β t Let L be the time-varying weight and L be the tree supervision loss.

Images