A collaborative authentication method for cloud-edge-end of IoT gateway

Abstract

The present invention belongs to the field of confidential communication technology, and specifically relates to a collaborative authentication method for an Internet of Things gateway cloud edge terminal, the method comprising: generating three chaotic sequences according to a key and a chaotic mapping system; obtaining verification information according to a first chaotic sequence; arranging all characters according to a second chaotic sequence to obtain a target arrangement; encoding the verification information and an information sequence to be transmitted by a preset initial arithmetic coding and an improved arithmetic coding according to the target arrangement and the ideal frequency of all characters, respectively, to obtain the encoding results of the verification information and the information sequence to be transmitted; using the encoding results of the verification information and the information sequence to be transmitted as the encrypted information of each edge terminal and sending them to the cloud, so that the cloud can collaboratively authenticate each edge terminal. The present invention can protect the data of an Internet of Things device from being tampered with.

Description

Technical Field

[0001] The present invention relates to the field of confidential communication technology. More specifically, the present invention relates to a cloud-edge-end collaborative authentication method for an Internet of Things gateway. Background Art

[0002] With the rapid development of IoT technology, there are more and more application scenarios for IoT, resulting in a rapid increase in the number of devices connected to IoT. The security issues of data in the communication process of IoT are becoming more and more prominent. Identity authentication is a necessary means to ensure the security of IoT gateways.

[0003] In the related technology, for example, the Chinese patent application document with publication number CN116436629A discloses a two-way authentication method and system based on the Internet of Things, including: a tag module generates a first verification code and encrypts it to generate a first verification code ciphertext; the Internet of Things device identity authentication platform obtains a decrypted first verification code for the first verification code ciphertext, the Internet of Things device identity authentication platform generates a second verification code, and encrypts the decrypted first verification code and the second verification code to generate a second verification code ciphertext; the tag module obtains the decrypted first verification code and the second verification code, and determines whether the decrypted first verification code is consistent with the generated first verification code to realize identity authentication of the first device terminal; and the tag module sends the decrypted second verification code to the second device terminal, the second device terminal uses the device private key to sign the second verification code, and the Internet of Things device identity authentication platform verifies the signature based on the device public key to realize identity authentication of the second device terminal.

[0004] In the related technology, signature verification is performed based on the device public key to achieve identity authentication of the device terminal. The public key is public, so the authentication information can be easily imitated by hackers, causing the data of the IoT device to be tampered with. Summary of the invention

[0005] In order to solve the technical problem that when verifying signatures based on the public key of the device, the public public key makes the authentication information easy to be imitated by hackers, causing the data of the Internet of Things device to be tampered with, the present invention provides solutions in the following aspects.

[0006] In the first aspect, the present invention provides an IoT gateway cloud-edge collaborative authentication method, comprising: generating three chaotic sequences according to a key and a chaotic mapping system; obtaining verification information according to a first chaotic sequence; arranging all characters according to a second chaotic sequence to obtain a target arrangement; encoding the verification information and an information sequence to be transmitted by a preset initial arithmetic coding and an improved arithmetic coding according to the target arrangement and the ideal frequencies of all characters, respectively, to obtain the encoding results of the verification information and the information sequence to be transmitted; the ideal frequencies of all characters are equal and the sum is 1; the encoding results of the verification information and the information sequence to be transmitted are used as the encrypted information of each edge end and sent to the cloud, so that the cloud can collaboratively authenticate each edge end; in the improved arithmetic coding, the information sequence to be transmitted is encoded by the cloud. The encoding result of the transmitted information sequence is the data point with the shortest binary data in the area corresponding to the last data in the information sequence to be transmitted; the method for obtaining the area corresponding to the data is as follows: if the third chaotic value is greater than the median in the third chaotic sequence, the first preset dimension is used as the target dimension, otherwise, the second preset dimension is used as the target dimension; according to the order and ideal frequency of each character in the target arrangement, the interval corresponding to the area corresponding to the previous data on the target dimension is divided to obtain the sub-interval corresponding to each character in the target arrangement; the sub-interval corresponding to the character identical to the data is used as the interval corresponding to the data on the target dimension; the interval corresponding to the area corresponding to the previous data on the non-target dimension and the interval corresponding to the data on the target dimension constitute the area corresponding to the data.

[0007] The present invention encodes verification information and information sequences to be transmitted based on the keys of each edge terminal, and then obtains encrypted information of each edge terminal and sends it to the cloud, so that the cloud can collaboratively authenticate each edge terminal. It is difficult for hackers to imitate the verification information of the edge terminal, and the data of the IoT device can be protected from being tampered with.

[0008] In the encoding process of the preset initial arithmetic coding, only one dimension is divided. The present invention sets two dimensions and selects a preset dimension from the two preset dimensions as the target dimension and performs sub-interval division according to the chaotic value in the third chaotic sequence, which increases the complexity of the encoding process of the arithmetic coding, thereby increasing the difficulty of cracking the encoding result of the information sequence to be transmitted, and improving the security of the information sequence during the transmission process; and in the encoding process of the preset initial arithmetic coding, the sub-interval division is performed according to the actual frequency of the characters. The present invention sets the same ideal frequency for all characters and performs sub-interval division according to the ideal frequency of the characters, so that the encoding result of the information sequence to be transmitted cannot reflect the actual frequency of the characters of the information sequence to be transmitted, thereby making the encoding result of the information sequence to be transmitted able to resist statistical analysis attacks.

[0009] Preferably, the obtaining of verification information according to the first chaotic sequence includes: recording the sum of all first chaotic values ​​in the first chaotic sequence as the first sum value, and taking the ratio of each first chaotic value to the first sum value as the first frequency of various characters; generating verification information according to the first frequencies of all characters, the frequencies of various characters in the verification information are equal to the first frequencies of various characters, and all characters in the verification information are randomly arranged.

[0010] By randomly arranging the characters in the verification information, it is more difficult for attackers to predict or infer the structure and content of the original information, which increases the difficulty of cracking and thus improves the security of transmission.

[0011] Preferably, the step of arranging all characters according to the second chaotic sequence to obtain a target arrangement comprises: obtaining the first character in the target arrangement. The method for obtaining characters is as follows: Calculate the first character in the second chaotic sequence The second chaos value and The product of the product is rounded up to an integer. , Indicates the total number of all characters; characters as the first character in the target arrangement characters, and characters are removed from all remaining characters; Indicates the first The total number of characters remaining before the character, Represents the remainder of division.

[0012] Preferably, the method for obtaining the subinterval corresponding to each character in the target arrangement comprises: The subinterval Q2 corresponding to the character is ,in, Indicates the sequence number of the character in the target arrangement. The value range is , Indicates the total number of all characters. Indicates the left boundary of the interval corresponding to the area corresponding to the previous data in the target dimension. Indicates the right boundary of the interval corresponding to the area corresponding to the previous data in the target dimension. Indicates the interval corresponding to the area corresponding to the previous data in the target dimension. is a left-closed and right-open interval, Indicates the first The ideal frequency of characters.

[0013] Preferably, the encoding result of the verification information and the information sequence to be transmitted is used as the encryption information of each edge terminal and sent to the cloud, including: using the encoding result of the verification information as the first sub-encryption information of the edge terminal; using the encoding result of the information sequence to be transmitted as the second sub-encryption information of the edge terminal; using the first sub-encryption information and the second sub-encryption information as the encryption information of the edge terminal; and sending the encrypted information of each edge terminal to the cloud.

[0014] Preferably, the collaborative authentication of each edge end includes: generating three chaotic sequences according to a key and a chaotic mapping system; determining the first frequency of various characters in the verification information of the edge end according to the first chaotic sequence; arranging all characters according to the second chaotic sequence to obtain a target arrangement; decoding the first sub-encrypted information in the encrypted information of the edge end through a preset initial arithmetic coding according to the target arrangement, the ideal frequency of all characters and the length of the verification information in the supplementary information to obtain a first decoding result; counting the second frequency of each character in the first decoding result: if the second frequency of each character is equal to the first frequency of each character, the edge end authentication is passed; if there are characters whose second frequency is not equal to the first frequency, the edge end authentication fails.

[0015] The collaborative authentication mechanism makes the trust chain between the edge and the cloud more complex, making it difficult for attackers to forge the identity of the edge, thereby reducing the possibility of forgery and fraud.

[0016] Preferably, the method also includes: in response to the edge end authentication being passed, decoding the second sub-encrypted information in the encrypted information of the edge end through improved arithmetic coding according to the target arrangement, the ideal frequency of all characters, the third chaotic sequence and the length of the information sequence to be transmitted in the supplementary information, to obtain a second decoding result, wherein the second decoding result is the information sequence to be transmitted corresponding to the edge end; in response to the edge end authentication failing, sending a request to switch channels to the edge end, requiring the edge end to send encrypted information through a new channel.

[0017] If the authentication fails, it indicates that there is a security risk or potential attack attempt at the edge; switching channels can effectively isolate the problematic edge and prevent it from launching further attacks or stealing data in the current channel.

[0018] Preferably, the decoding of the second sub-encrypted information in the encrypted information of the edge terminal comprises: Decode again, Represents the length of the information sequence to be transmitted, where The steps of the second decoding are: If the third chaotic value is greater than the median in the third chaotic sequence, the first preset dimension is used as the target dimension, otherwise, the second preset dimension is used as the target dimension; according to the order and ideal frequency of each character in the target arrangement, the first preset dimension is used as the target dimension. The area corresponding to the data obtained by the second decoding is divided into the interval corresponding to the target dimension to obtain the sub-interval corresponding to each character in the target arrangement; the character corresponding to the sub-interval where the value of the second sub-encrypted information on the target dimension is located is used as the character corresponding to the sub-interval corresponding to the value of the second sub-encrypted information on the target dimension. All the obtained data are combined into a second decoding result.

[0019] Preferably, the generating three chaotic sequences according to the key and the chaotic mapping system comprises: according to the first key, iterating the equation of the improved two-dimensional Henon chaotic mapping system Second-rate, Represents the total number of all characters, and obtains a chaotic value pair in each iteration; each chaotic value pair consists of a first chaotic value and a second chaotic value; all the first chaotic values ​​obtained are composed of a first chaotic sequence, and all the second chaotic values ​​obtained are composed of a second chaotic sequence; the second key is used as the initial value and parameter of the one-dimensional Logistic chaotic mapping system, and the one-dimensional Logistic chaotic mapping system is iterated times, obtained The third chaos value; will get the 31st to The third chaotic values ​​form the third chaotic sequence; among them, Indicates the length of the information sequence to be transmitted.

[0020] Preferably, the method for obtaining the key includes: generating a first key based on the initial conditions of an improved two-dimensional Henon chaotic mapping system; the initial conditions of the improved two-dimensional Henon chaotic mapping system include two initial values; generating a second key based on the initial conditions of a one-dimensional Logistic chaotic mapping system; the initial conditions of the one-dimensional Logistic chaotic mapping system include initial values ​​and parameters.

[0021] The pseudo-randomness, unpredictability, and extreme sensitivity to initial conditions of the chaotic mapping system make the key obtained based on the chaotic mapping system more difficult to crack and highly secure.

[0022] The beneficial effects of the present invention are:

[0023] The present invention encodes the verification information and the information sequence to be transmitted based on the key of each edge terminal, and then obtains the encrypted information of each edge terminal and sends it to the cloud, so that the cloud can collaboratively authenticate each edge terminal. It is difficult for hackers to imitate the verification information of the edge terminal, and the data of the IoT device can be protected from being tampered with.

[0024] Furthermore, in the encoding process of the preset initial arithmetic coding, only one dimension is divided, and the present invention sets two dimensions, and selects a preset dimension from the two preset dimensions as the target dimension and performs sub-interval division according to the chaotic value in the third chaotic sequence, which increases the complexity of the encoding process of the arithmetic coding, thereby increasing the difficulty of cracking the encoding result of the information sequence to be transmitted, and improving the security of the information sequence during the transmission process;

[0025] Furthermore, in the encoding process of the preset initial arithmetic coding, sub-intervals are divided according to the actual frequencies of the characters. The present invention sets the same ideal frequency for all characters and divides the sub-intervals according to the ideal frequencies of the characters, so that the encoding result of the information sequence to be transmitted can not reflect the actual frequency of the characters of the information sequence to be transmitted, thereby making the encoding result of the information sequence to be transmitted able to resist statistical analysis attacks, thereby improving the security of the information sequence during the transmission process. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The above and other purposes, features and advantages of the exemplary embodiments of the present invention will become readily understood by reading the detailed description below through the accompanying drawings. In the accompanying drawings, several embodiments of the present invention are shown in an exemplary and non-limiting manner, and the same or corresponding reference numerals represent the same or corresponding parts, wherein:

[0027] Figure 1 It is a flow chart schematically illustrating a method for collaborative authentication of an Internet of Things gateway cloud-edge device in the present invention. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0029] The specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0030] The cloud-edge integrated architecture is the main product architecture of IoT edge computing, which includes two parts: the cloud and the edge. The cloud is to integrate and develop edge machine-related resources through the edge computing console, manage connected terminal devices, applications, algorithms, etc., and monitor the edge machine and its software and hardware resources in real time; the edge is that after the terminal device is connected to the edge machine, the edge machine can realize the collection, circulation, storage, analysis and reporting of terminal device data to the cloud. At the same time, the edge machine also provides container services and edge function computing to facilitate scene orchestration and business expansion.

[0031] The embodiment of the present invention discloses a method for collaborative authentication of an IoT gateway cloud-edge terminal, referring to Figure 1 , comprising steps S1 to S7:

[0032] S1. Determine the information sequence to be transmitted.

[0033] Specifically, for any edge end, the information that needs to be transmitted by the edge end is encoded using the UTF16 encoding method, and the encoding result is used to form an information sequence to be transmitted by the edge end. The information sequence to be transmitted includes numbers from 0 to 9 and 16 Latin letters A, B, C, D, E, F, and U.

[0034] Among them, Unicode is a character encoding standard used to represent and process characters in text in computer systems. It is a global standard that covers almost all character sets in the world, including various languages, symbols, punctuation marks, and special characters. Unicode assigns a unique numeric value to each character, which is called a "code point". Code points are usually represented by the prefix "U" plus a number representing the hexadecimal value, such as U0041 for the Latin letter "A". Unicode's code points range from U0000 to U10FFFF, a total of about 137,000 code points.

[0035] Initially, all characters are arranged in the order of 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, F, and U.

[0036] S2. Generate three chaotic sequences according to the key and the chaotic mapping system.

[0037] It should be noted that chaos is a special form of motion of nonlinear systems. Chaotic mapping systems have the characteristics of pseudo-randomness, unpredictability, and extreme sensitivity to initial conditions, which makes chaotic mapping systems more suitable for use as key generators.

[0038] In this embodiment, the three chaotic sequences are generated according to the key and the chaotic mapping system, including: generating a first key according to the initial conditions of the improved two-dimensional Henon chaotic mapping system; generating a second key according to the initial conditions of the one-dimensional Logistic chaotic mapping system; generating a first chaotic sequence and a second chaotic sequence according to the first key and the improved two-dimensional Henon chaotic mapping system; generating a third chaotic sequence according to the second key and the one-dimensional Logistic chaotic mapping system; specifically:

[0039] 1. Generate the first key according to the initial conditions of the improved two-dimensional Henon chaotic mapping system.

[0040] It should be noted that the two-dimensional Henon chaotic mapping system is a chaotic mapping system. The traditional two-dimensional Henon chaotic mapping system is a two-dimensional nonlinear system with problems such as small chaotic space and simple chaotic orbit. Therefore, the present invention generates a key according to the initial conditions of the improved two-dimensional Henon chaotic mapping system, and generates a chaotic sequence according to the key and the improved two-dimensional Henon chaotic mapping system for subsequent encryption process.

[0041] Specifically, the initial conditions of the improved two-dimensional Henon chaotic mapping system include two initial values, and the value ranges of the two initial values ​​are both [0,1]; therefore, within the value range of the two initial values ​​of the improved two-dimensional Henon chaotic mapping system, an initial condition is randomly generated as the first key.

[0042] 2. Generate a second key based on the initial conditions of the one-dimensional Logistic chaotic mapping system.

[0043] Specifically, the range of the initial value of the one-dimensional Logistic chaotic mapping system is And the range of parameter values A combination of an initial value and a parameter is randomly generated as the second key.

[0044] It should be noted that the first key and the second key are agreed upon in advance between the cloud and the edge, and do not need to be transmitted, thus ensuring the security of the keys; and the first keys agreed upon between different edge and cloud ends are different, and the second keys agreed upon between different edge and cloud ends are also different.

[0045] It should be further explained that the characteristics of the chaotic mapping system, such as pseudo-randomness, unpredictability, and extreme sensitivity to initial conditions, make the key obtained based on the chaotic mapping system more difficult to crack and highly secure.

[0046] 3. Generate a first chaotic sequence and a second chaotic sequence according to the first key and the improved two-dimensional Henon chaotic mapping system.

[0047] Specifically, according to the first key, the equation of the improved two-dimensional Henon chaotic mapping system is iterated Second-rate, Represents the total number of all characters, and obtains a chaotic value pair in each iteration; each chaotic value pair consists of two chaotic values, and the two chaotic values ​​are respectively a first chaotic value and a second chaotic value; a sequence consisting of all the first chaotic values ​​obtained is used as a first chaotic sequence, and a sequence consisting of all the second chaotic values ​​obtained is used as a second chaotic sequence.

[0048] Furthermore, the equation of the improved two-dimensional Henon chaotic mapping system is:

[0049] ;

[0050] ;

[0051] In the formula, Indicates A chaotic value pair, and Indicates the composition The two chaotic values ​​of a chaotic value pair, Indicates The first chaos value, Indicates The second chaos value, Indicates An initial chaotic value pair, and Indicates the composition The two initial chaotic values ​​of the initial chaotic value pair, Indicates The first initial chaos value, Indicates The second initial chaos value, Indicates rounding down.

[0052] Among them, the two initial chaotic values ​​that make up the nth initial chaotic value pair are and The equation is:

[0053] ;

[0054] ;

[0055] In the formula, , is the control parameter, and , , Indicates The first initial chaos value, Indicates The second initial chaos value, The value range is ,when hour, and Respectively represent the two initial values ​​in the first key.

[0056] It should be noted that when the control parameter , When , the improved two-dimensional Henon chaotic mapping system is in a chaotic state.

[0057] 4. Generate a third chaotic sequence based on the second key and the one-dimensional Logistic chaotic mapping system.

[0058] Specifically, the second key is used as the initial value and parameter of the one-dimensional Logistic chaotic mapping system, and the one-dimensional Logistic chaotic mapping system is iterated. times, obtained The third chaos value; will get the 31st to The sequence composed of the third chaotic values ​​is taken as the third chaotic sequence; among which, Indicates the length of the information sequence to be transmitted.

[0059] In other embodiments, the generating three chaotic sequences according to the key and the chaotic mapping system includes: generating three keys according to the initial conditions of the one-dimensional Logistic chaotic mapping system, namely the first key, the second key and the third key; generating three chaotic sequences according to the first key, the second key and the third key and the one-dimensional Logistic chaotic mapping system, namely the first chaotic sequence, the second chaotic sequence and the third chaotic sequence.

[0060] In other embodiments, the generating three chaotic sequences according to the key and the chaotic mapping system includes: generating a first key according to the initial conditions of the three-dimensional Lorenz chaotic mapping system; generating three chaotic sequences according to the first key and the three-dimensional Lorenz chaotic mapping system, namely a first chaotic sequence, a second chaotic sequence and a third chaotic sequence.

[0061] In other embodiments, implementers can select a chaotic mapping system according to actual application scenarios and requirements, such as a one-dimensional Singer chaotic mapping system, a one-dimensional Tent chaotic mapping system, a two-dimensional Logistic chaotic mapping system, a Lotka-Volterra model, a coupled Sine chaotic mapping and Logistic chaotic mapping system (a three-dimensional chaotic mapping system), etc.

[0062] S3. Obtain verification information according to the first chaotic sequence.

[0063] Specifically, according to the first chaotic sequence, the first frequencies of various characters in the verification information are determined, including: recording the sum of all first chaotic values ​​in the first chaotic sequence as the first sum value, and taking the ratio of each first chaotic value to the first sum value as the first frequency of various characters.

[0064] Furthermore, verification information is generated according to the first frequency of all characters, the frequency of each character in the verification information is equal to the first frequency of each character, and all characters in the verification information are randomly arranged.

[0065] When obtaining the first frequencies of various characters, when retaining one valid digit after the decimal point of each first frequency, the length of the verification information is required to be equal to , is a positive integer; when two valid digits are retained after the decimal point of each first frequency, the length of the verification information is required to be equal to ; When three significant digits are retained after the decimal point of each first frequency, the length of the verification information is required to be equal to ; And so on, when the decimal point of each first frequency is retained When the number is valid, the length of the verification information is required to be equal to .

[0066] Exemplarily, if all characters include A, B, C, and D, and the first chaotic sequence is {0.23716, 0.90262, 0.33804, 0.29379}, the first frequencies of these four characters are calculated to be {0.1, 0.5, 0.2, 0.2} respectively, then the verification information generated according to the first frequencies of all characters is {A, C, B, B, D, D, B, C, B, B}, or it can also be {B, D, B, A, C, B, B, B, C, D}.

[0067] It should be noted that by randomly arranging the characters in the verification information, it is more difficult for attackers to predict or infer the structure and content of the original information, which increases the difficulty of cracking and thus improves the security of transmission.

[0068] S4. Arrange all characters according to the second chaotic sequence to obtain a target arrangement.

[0069] Specifically, get the first The method for obtaining characters is as follows: Calculate the first character in the second chaotic sequence The second chaos value and The product of the product is rounded up to an integer. , Indicates the total number of all characters; characters as the first character in the target arrangement characters, and characters are deleted from all remaining characters; it should be noted that when When the first character of all remaining characters is characters as the first character in the target arrangement characters, and characters are removed from all remaining characters; Indicates the first The total number of characters remaining before the character, Represents the remainder of division.

[0070] For example, if all characters include A, B, C, D characters, the second chaotic sequence is {0.77287,0.35141,0.11020,0.50193}; , calculate the first The second chaos value is 0.77287 and The product of the product is rounded down to the integer value. ,at this time , then all characters in The first character D is used as the first character in the target arrangement, and the fourth character D is deleted from all characters. At this time, all the remaining characters are A, B, and C. , calculate the first The second chaos value is 0.35141 and The product of the product is rounded down to the integer value. , then all characters in The character B is selected as the second character in the target arrangement, and the second character B is deleted from all the remaining characters. At this time, all the remaining characters are A and C. , calculate the first The second chaos value is 0.11020 and The product of the product is rounded down to the integer value. , then all characters in The character A is selected as the third character in the target arrangement, and the first character A is deleted from all the remaining characters. At this time, all the remaining characters are C. , calculate the first The second chaos value is 0.50193 and The product of the product is rounded down to the integer value. ,at this time , then all characters in The character C is taken as the fourth character in the target arrangement, and the first character C is deleted from all remaining characters; the final target arrangement is D, B, A, C.

[0071] S5. Encode the verification information according to the target arrangement and the ideal frequencies of all characters through a preset initial arithmetic coding to obtain a coding result of the verification information.

[0072] Specifically, the ideal frequencies of the characters are equal and the sum of all the ideal frequencies is equal to 1, so the ideal frequencies of the characters are equal to , Indicates the total number of all characters.

[0073] Further, according to the target arrangement and the ideal frequency of all characters, the verification information is encoded by a preset initial arithmetic coding until the interval corresponding to the last data in the verification information is obtained. For all the values ​​in the interval corresponding to the last data in the verification information, the shortest value of the binary data is used as the encoding result of the verification information; wherein, the method for obtaining the interval corresponding to the data is:

[0074] 1. Initially, the initial interval is divided according to the order of each character in the target arrangement and the ideal frequency of each character to obtain the sub-interval Q1 corresponding to each character in the target arrangement; the sub-interval Q1 corresponding to the character identical to the first data in the verification information is used as the interval corresponding to the first data in the verification information, and the initial interval is [0,1].

[0075] 2. For the data other than the first data in the verification information, divide the interval corresponding to the previous data according to the order of each character in the target arrangement and the ideal frequency of each character to obtain the sub-interval Q1 corresponding to each character in the target arrangement; take the sub-interval Q1 corresponding to the character identical to the data as the interval corresponding to the data.

[0076] The sub-interval is a left-closed and right-open interval.

[0077] It should be noted that the preset initial arithmetic coding refers to conventional arithmetic coding. Conventional arithmetic coding is a well-known technology, and its coding process is also well-known, which will not be described in detail here.

[0078] S6. According to the target arrangement and the ideal frequencies of all characters, the information sequence to be transmitted is encoded by improved arithmetic coding, thereby obtaining the encoding result of the information sequence to be transmitted.

[0079] Specifically, according to the target arrangement and the ideal frequency of all characters, the information sequence to be transmitted is encoded by improved arithmetic coding until the area corresponding to the last data in the information sequence to be transmitted is obtained, wherein the method for obtaining the area corresponding to the data is:

[0080] 1. Preset two dimensions, which are respectively recorded as the first preset dimension and the second preset dimension; set an initial region according to the first preset dimension and the second preset dimension, and the value range of the initial region in the first preset dimension is [0, 1], and the value range of the initial region in the second preset dimension is also [0, 1].

[0081] 2. The median of all third chaotic values ​​in the third chaotic sequence is used as the threshold; in other embodiments, implementers can select the threshold according to actual application scenarios and requirements, such as the mean, the first quartile, etc.

[0082] 3. When the third chaos value is greater than the threshold, the first preset dimension is used as the target dimension; otherwise, the second preset dimension is used as the target dimension.

[0083] It should be specially noted that, for the first preset dimension and the second preset dimension, when the first preset dimension is taken as the target dimension, the second preset dimension is the non-target dimension; and when the second preset dimension is taken as the target dimension, the first preset dimension is the non-target dimension.

[0084] 4. In this embodiment, according to the order and ideal frequency of each character in the target arrangement, the interval corresponding to the area corresponding to the previous data in the target dimension is divided. The division is performed from left to right to obtain the sub-interval Q2 corresponding to each character in the target arrangement; then The subinterval Q2 corresponding to the character is , Indicates the sequence number of the character in the target arrangement. The value range is , Indicates the total number of all characters.

[0085] in, Indicates the left boundary of the interval corresponding to the area corresponding to the previous data in the target dimension. Indicates the right boundary of the interval corresponding to the area corresponding to the previous data in the target dimension. Indicates the interval corresponding to the area corresponding to the previous data in the target dimension. is a left-closed and right-open interval, Indicates the first The ideal frequency of characters.

[0086] In other embodiments, according to the order and ideal frequency of each character in the target arrangement, the interval corresponding to the area corresponding to the previous data on the target dimension is divided, and the division is performed in order from right to left to obtain the sub-interval Q2 corresponding to each character in the target arrangement; then the first character in the target arrangement The subinterval Q2 corresponding to the character is , Indicates the sequence number of the character in the target arrangement. The value range is , Indicates the total number of all characters.

[0087] It should be specially noted that the sub-interval is a left-closed interval and a right-open interval.

[0088] It should be noted that when obtaining the area corresponding to the first data in the information sequence to be transmitted, since the first data in the information sequence to be transmitted has no previous data, the area corresponding to the previous data is the initial area.

[0089] 5. Take the subinterval Q2 corresponding to the same character as the data as the interval corresponding to the data on the target dimension; take the interval corresponding to the area corresponding to the previous data on the non-target dimension as the interval corresponding to the data on the non-target dimension; the interval corresponding to the data on the non-target dimension and the interval corresponding to the data on the target dimension constitute the area corresponding to the data.

[0090] It should be noted that, in the encoding process of the preset initial arithmetic coding, division is only performed on one dimension. The present invention sets two dimensions, and according to the chaotic value in the third chaotic sequence, selects a preset dimension from the two preset dimensions as the target dimension and performs sub-interval division, which increases the complexity of the encoding process of the arithmetic coding, thereby increasing the difficulty of cracking the encoding result of the information sequence to be transmitted, and improving the security of the information sequence during the transmission process.

[0091] It should be further explained that, in the encoding process of the preset initial arithmetic coding, sub-intervals are divided according to the actual frequency of the characters. The present invention sets the same ideal frequency for all characters and divides the sub-intervals according to the ideal frequency of the characters, so that the encoding result of the information sequence to be transmitted can not reflect the actual frequency of the characters of the information sequence to be transmitted, thereby making the encoding result of the information sequence to be transmitted able to resist statistical analysis attacks.

[0092] Furthermore, for all data points in the area corresponding to the last data in the information sequence to be transmitted, the data point with the shortest binary data is used as the encoding result of the information sequence to be transmitted; wherein the binary data of the data point refers to the concatenation result of the binary data corresponding to the value of the data point in the first preset dimension and the binary data corresponding to the value of the data point in the second preset dimension.

[0093] For example, for a 20-length information sequence {B, D, A, A, C, D, B, B, ..., A, C, A, B} to be transmitted, which contains 4 characters: A, B, C, D, the ideal frequencies of the 4 characters are ; At this time, the target arrangement is D, B, A, C; then the process of encoding the information sequence to be transmitted according to the third chaotic sequence {0.27382, 0.91024, 0.85199, ..., 0.40736} is as follows:

[0094] 1. The median of all the third chaotic values ​​in the third chaotic sequence, 0.63731, is used as the threshold;

[0095] 2. For the first data "B", according to the first third chaotic value 0.2738 in the third chaotic sequence, determine the target dimension of the first data: Since the first third chaotic value is not greater than the threshold, the second preset dimension is selected as the target dimension of the first data; Since the first data has no previous data, the previous data area of ​​the first data is the initial area, then the area corresponding to the previous data of the first data corresponds to the interval [0,1] on the target dimension, i.e., the second preset dimension; According to the order and ideal frequency of each character in the target arrangement, the interval [0,1] corresponding to the area corresponding to the previous data of the first data on the target dimension is divided to obtain the sub-intervals corresponding to each character in the target arrangement, then the sub-intervals corresponding to characters D, B, A, and C are respectively :[0,0.25), [0.25,0.5), [0.5,0.75), [0.75,1]; the subinterval [0.25,0.5) corresponding to the character "B" equal to the first data "B" is used as the interval corresponding to the first data on the target dimension; the interval [0,1] corresponding to the area corresponding to the previous data of the first data on the non-target dimension is used as the interval corresponding to the first data on the non-target dimension; the interval [0,1] corresponding to the first data on the non-target dimension and the interval [0.25,0.5) corresponding to the first data on the target dimension are combined to form the area corresponding to the first data. At this time, the area corresponding to the first data is [0,1] in the first preset dimension and [0.25,0.5) in the second preset dimension.

[0096] 3. For the second data "D", according to the second third chaotic value 0.91024 in the third chaotic sequence, determine the target dimension of the second data: Since the second third chaotic value is greater than the threshold, the first preset dimension is selected as the target dimension of the second data; the interval corresponding to the area corresponding to the previous data of the second data on the target dimension, that is, the interval [0,1] corresponding to the area corresponding to the first data on the first preset dimension; according to the order and ideal frequency of each character in the target arrangement, the interval [0,1] corresponding to the area corresponding to the previous data of the second data on the target dimension is divided to obtain the sub-intervals corresponding to each character in the target arrangement. The sub-intervals corresponding to the characters D, B, A, and C are: [0,0.25), [0.25,0.5), [0.5, 0.75), [0.75,1]; the subinterval [0.75,1] corresponding to the character "D" equal to the second data "D" is used as the interval corresponding to the second data on the target dimension; the interval corresponding to the area corresponding to the previous data of the second data on the non-target dimension, that is, the interval [0.25,0.5) of the area corresponding to the first data in the second preset dimension, is used as the interval corresponding to the second data on the non-target dimension; the interval [0.25,0.5) corresponding to the second data on the non-target dimension and the interval [0.75,1] corresponding to the second data on the target dimension are combined to form the area corresponding to the second data. At this time, the area corresponding to the second data in the first preset dimension is [0.75,1], and the interval in the second preset dimension is [0.25,0.5);

[0097] 4. For the third data "A", according to the third third chaotic value 0.85199 in the third chaotic sequence, determine the target dimension of the third data: Since the third third chaotic value is greater than the threshold, the first preset dimension is selected as the target dimension of the third data; the interval corresponding to the area corresponding to the previous data of the third data on the target dimension, that is, the interval [0.75,1] corresponding to the area corresponding to the second data on the first preset dimension; according to the order and ideal frequency of each character in the target arrangement, the interval [0.75,1] corresponding to the area corresponding to the previous data of the third data on the target dimension is divided to obtain the sub-intervals corresponding to each character in the target arrangement. The sub-intervals corresponding to characters D, B, A, and C are: [0.75,0.8125), [0.8125,0.875), [0.875,0 .9375), [0.9375,1]; the subinterval [0.75,0.8125) corresponding to the character "A" equal to the third data "A" is used as the interval corresponding to the third data on the target dimension; the interval corresponding to the area corresponding to the previous data of the third data on the non-target dimension, that is, the interval [0.25,0.5) of the area corresponding to the second data in the second preset dimension, is used as the interval corresponding to the third data on the non-target dimension; the interval [0.25,0.5) corresponding to the third data on the non-target dimension and the interval [0.75,0.8125) corresponding to the third data on the target dimension are combined to form the area corresponding to the third data. At this time, the area corresponding to the third data in the first preset dimension is [0.75,0.8125) and the interval in the second preset dimension is [0.25,0.5);

[0098] 5. Continue in this way until the area corresponding to the last data is obtained. At this time, the value range of the last data area in the first dimension is [0.76713067270109623466, 0.76713162637541264091), and the value range in the second dimension is [0.4290274158, 0.4300039783); among them, the binary data of the data point (0.76713085174560546875, 0.4296875) refers to the value "0.76713085174560546875" corresponding to the data point in the first preset dimension. The concatenation result of the binary data "0.11000100011000101011" and the binary data "0.0110111" corresponding to the value "0.4296875" of the data point in the second preset dimension is "0.11000100011000101011, 0.0110111"; the binary data of the data point (0.76713085174560546875, 0.4296875) is the shortest, therefore, the data point (0.76713085174560546875, 0.4296875) is used as the encoding result of the information sequence to be transmitted.

[0099] S7. Use the encoding result of the verification information and the information sequence to be transmitted as the encryption information of each edge terminal; send the encrypted information of each edge terminal to the cloud, so that the cloud can collaboratively authenticate each edge terminal.

[0100] Specifically, the encoding result of the verification information is used as the first sub-encryption information of the edge; the encoding result of the information sequence to be transmitted is used as the second sub-encryption information of the edge; the first sub-encryption information and the second sub-encryption information are used as the encryption information of the edge.

[0101] It should be noted that the present invention encodes the verification information and the information sequence to be transmitted based on the key of each edge terminal, and then obtains the encrypted information of each edge terminal and sends it to the cloud, so that the cloud can collaboratively authenticate each edge terminal. It is difficult for hackers to imitate the verification information of the edge terminal, and the data of the IoT device can be protected from being tampered with.

[0102] Among them, in order to ensure that the cloud can decode the encrypted information of the edge, the length of the information sequence to be transmitted and the length of the verification information are required as supplementary information, and the supplementary information is sent to the cloud, so that the cloud can decode the encrypted information of the edge according to the key and supplementary information, and then perform collaborative authentication on each edge.

[0103] Furthermore, the encrypted information of each edge terminal is sent to the cloud so that the cloud can collaboratively authenticate each edge terminal, including: generating three chaotic sequences according to the key and the chaotic mapping system; determining the first frequency of various characters in the verification information of the edge terminal according to the first chaotic sequence; arranging all characters according to the second chaotic sequence to obtain the target arrangement; decoding the first sub-encrypted information in the encrypted information of the edge terminal through a preset initial arithmetic coding according to the target arrangement, the ideal frequency of all characters and the length of the verification information in the supplementary information to obtain a first decoding result; counting the second frequency of each character in the first decoding result: if the second frequency of each character is equal to the first frequency of each character, the edge terminal authentication is passed; if there are characters whose second frequency is not equal to the first frequency, the edge terminal authentication fails.

[0104] It should be noted that the collaborative authentication mechanism makes the trust chain between the edge and the cloud more complex, making it difficult for attackers to forge the identity of the edge, thereby reducing the possibility of forgery and fraud.

[0105] Further, in response to the edge end authentication being successful, the second sub-encrypted information in the encrypted information of the edge end is decoded through improved arithmetic coding according to the target arrangement, the ideal frequency of all characters, the third chaotic sequence and the length of the information sequence to be transmitted in the supplementary information, to obtain a second decoding result, where the second decoding result is the information sequence to be transmitted corresponding to the edge end; in response to the edge end authentication failing, a request to switch channels is sent to the edge end, requiring the edge end to send encrypted information through a new channel.

[0106] It should be noted that if the authentication fails, it indicates that there is a security risk or potential attack attempt at the edge; switching channels can effectively isolate the problematic edge and prevent it from further launching attacks or stealing data in the current channel.

[0107] According to the target arrangement, the ideal frequency of all characters, the third chaotic sequence and the length of the information sequence to be transmitted in the supplementary information, the second sub-encrypted information in the encrypted information of the edge end is decoded by improved arithmetic coding. Decode again, Indicates the length of the information sequence to be transmitted. Each time a piece of data is obtained by decoding, all the obtained data constitute the second decoding result.

[0108] Among them, The steps of the second decoding are: If the third chaotic value is greater than the median in the third chaotic sequence, the first preset dimension is used as the target dimension, otherwise, the second preset dimension is used as the target dimension; according to the order and ideal frequency of each character in the target arrangement, the first preset dimension is used as the target dimension. The area corresponding to the data obtained by the second decoding is divided into the interval corresponding to the target dimension to obtain the sub-interval corresponding to each character in the target arrangement; the character corresponding to the sub-interval where the value of the second sub-encrypted information on the target dimension is located is used as the character corresponding to the sub-interval corresponding to the value of the second sub-encrypted information on the target dimension. The data obtained by decoding.

[0109] In the description of this specification, "plurality" or "several" means at least two, such as two, three or more, etc., unless otherwise clearly and specifically defined.

[0110] Although this specification has shown and described a number of embodiments of the present invention, it will be apparent to those skilled in the art that such embodiments are provided by way of example only. Those skilled in the art will conceive of many modifications, changes and alternatives without departing from the ideas and spirit of the present invention. It should be understood that in the practice of the present invention, alternatives to the embodiments of the present invention described herein may be employed.

Claims

1. A method for collaborative authentication of an Internet of Things gateway cloud-edge device, characterized in that: include: Generate three chaotic sequences according to the key agreed upon between the cloud and the edge and the chaotic mapping system; obtain verification information according to the first chaotic sequence; Arrange all characters according to the second chaotic sequence to obtain a target arrangement; According to the target arrangement and the ideal frequencies of all characters, the verification information and the information sequence to be transmitted are encoded by the preset initial arithmetic coding and the improved arithmetic coding respectively to obtain the encoding results of the verification information and the information sequence to be transmitted; the ideal frequencies of all characters are equal and the sum value is 1; The encoding result of the verification information and the information sequence to be transmitted is used as the encryption information of each edge end, the length of the information sequence to be transmitted and the length of the verification information are used as the supplementary information of each edge end, and the encryption information and supplementary information of each edge end are sent to the cloud, so that the cloud can perform collaborative authentication on each edge end; In the improved arithmetic coding, the encoding result of the information sequence to be transmitted is the data point with the shortest binary data in the area corresponding to the last data in the information sequence to be transmitted; the horizontal axis and the vertical axis of the rectangular coordinate system are respectively recorded as the first preset dimension and the second preset dimension; the method for obtaining the area corresponding to the data: if the third chaotic value is greater than the median in the third chaotic sequence, the first preset dimension is used as the target dimension, otherwise, the second preset dimension is used as the target dimension; According to the order and ideal frequency of each character in the target arrangement, the interval corresponding to the area corresponding to the previous data on the target dimension is divided to obtain the sub-intervals corresponding to each character in the target arrangement; the sub-intervals corresponding to the characters identical to the data are used as the intervals corresponding to the data on the target dimension; the interval corresponding to the area corresponding to the previous data on the non-target dimension and the interval corresponding to the data on the target dimension constitute the area corresponding to the data.

2. According to claim 1, a method for collaborative authentication of an Internet of Things gateway cloud-edge device, characterized in that: The obtaining verification information according to the first chaotic sequence includes: The sum of all first chaotic values ​​in the first chaotic sequence is recorded as a first sum value, and the ratio of each first chaotic value to the first sum value is used as the first frequency of various characters; Verification information is generated according to the first frequency of all characters, the frequency of various characters in the verification information is equal to the first frequency of various characters, and all characters in the verification information are randomly arranged.

3. According to claim 1, a method for collaborative authentication of an Internet of Things gateway cloud-edge device is characterized in that: The step of arranging all characters according to the second chaotic sequence to obtain a target arrangement comprises: Get the first The method for obtaining characters is as follows: Calculate the first character in the second chaotic sequence The second chaos value and The product of the product is rounded up to an integer. , Indicates the total number of all characters; characters as the first character in the target arrangement characters, and characters are removed from all remaining characters; Indicates the first The total number of characters remaining before the character, Represents the remainder of division.

4. According to claim 1, a method for collaborative authentication of an Internet of Things gateway cloud-edge device, characterized in that: The method for obtaining the subinterval corresponding to each character in the target arrangement includes: Target sorting The subinterval Q2 corresponding to the character is ,in, Indicates the sequence number of the character in the target arrangement. The value range is , Indicates the total number of all characters. Indicates the left boundary of the interval corresponding to the area corresponding to the previous data in the target dimension. Indicates the right boundary of the interval corresponding to the area corresponding to the previous data in the target dimension. Indicates the interval corresponding to the area corresponding to the previous data in the target dimension. is a left-closed and right-open interval, Indicates the first The ideal frequency of characters.

5. According to claim 1, a method for collaborative authentication of an Internet of Things gateway cloud-edge device, characterized in that: The encoding result of the verification information and the information sequence to be transmitted is used as the encryption information of each edge end, including: The encoding result of the verification information is used as the first sub-encrypted information of the edge end; the encoding result of the information sequence to be transmitted is used as the second sub-encrypted information of the edge end; the first sub-encrypted information and the second sub-encrypted information are used as the encryption information of the edge end.

6. According to claim 5, a method for collaborative authentication of an Internet of Things gateway cloud-edge device is characterized in that: The collaborative authentication of each edge terminal includes: Three chaotic sequences are generated according to a key and a chaotic mapping system; according to the first chaotic sequence, the first frequencies of various characters in the verification information of the edge end are determined; according to the second chaotic sequence, all characters are arranged to obtain a target arrangement; according to the target arrangement, the ideal frequencies of all characters and the length of the verification information in the supplementary information, the first sub-encrypted information in the encrypted information of the edge end is decoded through a preset initial arithmetic coding to obtain a first decoding result; the second frequency of each character in the first decoding result is counted: if the second frequency of each character is equal to the first frequency of each character, the edge end authentication is passed; if there are characters whose second frequency is not equal to the first frequency, the edge end authentication fails.

7. The method for collaborative authentication of an IoT gateway cloud-edge device according to claim 6, characterized in that: The method further comprises: In response to the edge end authentication being successful, the second sub-encrypted information in the encrypted information of the edge end is decoded through improved arithmetic coding according to the target arrangement, the ideal frequency of all characters, the third chaotic sequence and the length of the information sequence to be transmitted in the supplementary information, to obtain a second decoding result, where the second decoding result is the information sequence to be transmitted corresponding to the edge end; in response to the edge end authentication failing, a request to switch channels is sent to the edge end, requiring the edge end to send encrypted information through a new channel.

8. The method for collaborative authentication of an IoT gateway cloud-edge device according to claim 7, characterized in that: The decoding of the second sub-encrypted information in the encrypted information of the edge end includes: A total of Decode again, Represents the length of the information sequence to be transmitted, where The steps of the second decoding are: If the third chaotic value is greater than the median in the third chaotic sequence, the first preset dimension is used as the target dimension, otherwise, the second preset dimension is used as the target dimension; according to the order and ideal frequency of each character in the target arrangement, the first preset dimension is used as the target dimension. The area corresponding to the data obtained by the second decoding is divided into the interval corresponding to the target dimension to obtain the sub-interval corresponding to each character in the target arrangement; the character corresponding to the sub-interval where the value of the second sub-encrypted information on the target dimension is located is used as the character corresponding to the sub-interval corresponding to the value of the second sub-encrypted information on the target dimension. All the obtained data are combined into a second decoding result.

9. The method for collaborative authentication of an IoT gateway cloud-edge device according to claim 1, characterized in that: The three chaotic sequences are generated according to the key agreed upon between the cloud and the edge and the chaotic mapping system, including: According to the first key, the equation of the improved two-dimensional Henon chaotic mapping system is iterated Second-rate, represents the total number of all characters, and each iteration obtains a chaotic value pair; each chaotic value pair consists of a first chaotic value and a second chaotic value; all the first chaotic values ​​obtained are combined into a first chaotic sequence, and all the second chaotic values ​​obtained are combined into a second chaotic sequence; The second key is used as the initial value and parameter of the one-dimensional Logistic chaotic mapping system, and the one-dimensional Logistic chaotic mapping system is iterated. times, obtained The third chaos value; will get the 31st to The third chaotic values ​​form the third chaotic sequence; among them, Indicates the length of the information sequence to be transmitted.

10. The method for collaborative authentication of an IoT gateway cloud-edge device according to claim 1, characterized in that: The method for obtaining the key includes: Generate a first key according to the initial conditions of the improved two-dimensional Henon chaotic mapping system; the initial conditions of the improved two-dimensional Henon chaotic mapping system include two initial values; A second key is generated according to the initial conditions of the one-dimensional Logistic chaotic mapping system; the initial conditions of the one-dimensional Logistic chaotic mapping system include initial values ​​and parameters.

Images