A method and system for continuous identity authentication suitable for a zero trust architecture

Abstract

The application provides a continuous identity authentication method and system suitable for a zero trust architecture, and belongs to the technical field of network security. The method comprises the following steps of: sequentially performing an initialization and registration method, an initial identity authentication method and a continuous identity authentication method in sequence; the initialization and registration method comprises the following steps: calculating a threshold lower limit of the residual power of a sensor device in a continuous identity authentication period according to the daily average power consumption of the sensor device; when the sensor device initiates a request to a gateway for the first time, important information parameters including an identity and the daily average power consumption of the battery are sent to the gateway through a secure channel, the gateway generates a key, the key is sent to the sensor device through the secure channel, the sensor device stores the key in the memory, and the gateway stores the sensor device information in the database. The application generates a token for continuous identity authentication by using two dynamic characteristics of channel state information and battery power, ensures the system security, and reduces resource consumption.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a continuous identity authentication method and system suitable for a zero-trust architecture. BACKGROUND

[0002] In the protection of resources, the traditional way is to set up a network security boundary to divide the network into different security level areas such as internal and external networks, and to build security protection devices such as firewalls and intrusion detection systems.

[0003] However, with the increase in the number of devices, the diversification of access forms, and the dispersion of distribution, the internal and external network security boundaries are blurred, and the traditional boundary-based network security architecture is constantly collapsing. Moreover, new advanced threats and internal risks emerge in an endless stream, and since the traditional boundary-based network security architecture gives high trust to internal users, security problems are increasingly exposed.

[0004] The zero-trust network security architecture reconsiders the drawbacks of the traditional network security architecture, no longer distinguishes between internal and external networks, and does not set up boundaries, considering that all entities in the network are untrusted, so entities that want to access resources need to be authenticated and authorized in detail before further accessing resources. Based on the above characteristics, zero-trust provides a new solution for the protection of critical infrastructure and has become the focus of industry attention.

[0005] The identity authentication module is a key and basic module for implementing an identity-centric zero-trust security architecture, and is an important research technical point and a challenging research difficulty in the zero-trust architecture.

[0006] The traditional static identity authentication method only authenticates once at the entrance of the platform, and has the legal access right to resources in the following period of time, which obviously violates the concept of "never trust, always verify" of zero-trust, and also has the security risk of being easily stolen and forged by attackers. SUMMARY

[0007] In view of the above deficiencies of the prior art, the present application aims to provide a continuous identity authentication method and system suitable for a zero-trust architecture, which is used for continuous identity authentication between devices, deeply excavates the characteristic attributes of the devices that can be used for identity authentication, generates a dynamic token using two dynamic characteristics of channel state information and battery power characteristics, applies the dynamic token to the continuous identity authentication process, ensures the security of the system while reducing the consumption of computing, storage, communication and other resources, enriches the technical system of zero-trust, further expands the application range of the zero-trust architecture, and improves the security of the zero-trust architecture.

[0008] The identity authentication of the application adopts two-factor authentication, generates a token for continuous identity authentication by using channel state information and battery power as two dynamic characteristics, and updates the token after each continuous identity authentication is completed. Thus, the identity of the visitor is continuously authenticated during the visitor's access to the resource, the network security is improved, the risk of identity forgery by attackers is reduced, and excessive resource consumption caused by repeated authentication in static identity authentication is avoided.

[0009] The application provides a continuous identity authentication method suitable for a zero trust architecture, comprising an initialization and registration method, an initial identity authentication method, and a continuous identity authentication method in a sequential order.

[0010] The initialization and registration method comprises the following steps:

[0011] S11. According to the daily average power consumption of the sensor device, the threshold lower limit BCT of the remaining power of the sensor device is calculated in a continuous identity authentication period with a time length of T. SN , the calculation expression of BCT SN is:

[0012]

[0013] In formula (1), er is the remaining battery power measured by the sensor device in the initial identity authentication stage, BC day is the daily average power consumption of the battery, T is the continuous identity authentication period length; s is a coefficient, and satisfies 0 < s < 1.

[0014] In an actual scenario, the identity authentication between devices mainly involves two subjects of sensor devices and gateways, and the authentication occurs between two sensor devices or between a sensor device and a gateway. The existence of various obstacles and objects in the communication path will affect the channel state information CSI, so that the CSIs at different positions between the communication paths have unique values.

[0015] S12. When the sensor device initiates a request to the gateway for the first time, the important information parameters of the sensor device, including the identity ID SN and the daily average power consumption BC day of the battery, are sent to the gateway (one gateway can receive requests of multiple sensor devices) through a secure channel. After receiving the request information sent by the sensor device, the gateway generates a key SK SN for the sensor device and selects a continuous identity authentication period T for the sensor device.

[0016] S13. The gateway sends the generated key SK SN to the sensor device through a secure channel. After receiving the key SK SNThe identity ID SN , the key SK SN , the battery daily power consumption BC day , and the continuous identity authentication period T are stored in the database as information for subsequent initial identity authentication.

[0017] The gateway stores the identity ID SN corresponding to each sensor device in the database as information. SN , the key SK SN , the battery daily power consumption BC day , and the continuous identity authentication period T are stored in the database as information for subsequent initial identity authentication.

[0018] Further, the method for initial identity authentication comprises the following steps:

[0019] S21, the sensor device hashes the identity to form an anonymous identity H(ID SN ), and sends the anonymous identity H(ID SN ) to the gateway;

[0020] S22, after the gateway receives the anonymous identity H(ID SN ) data sent by the sensor device, the gateway retrieves the key SK SN corresponding to H(ID SN ) from the database; if the identity ID SN is in the database, the channel state information C1 of the received data packet is calculated; if the ID SN is not in the database, the steps S11-S13 are executed again to calculate the channel state information C1 of the received data packet; the gateway sends the hash value H(ID GW ) to the sensor device;

[0021] S23, after the sensor device receives the H(ID GW ) data sent by the gateway, if the stored gateway is matched, the channel state information C2 of the received data packet is calculated, a random number a1 is generated, the current remaining power cb of the sensor device is obtained, and the key SK SN is taken out from the memory; the mask of the current power cb is calculated the mask of the channel state information is calculated and The sensor device calculates MS1 using the key SK SN to prevent the data from being tampered with during transmission; the sensor device sends {H(ID SN ), mC2, M1, MS1, mb, a1} to the gateway;

[0022] S24, after the gateway receives the data {H(ID SN ), mC2, M1, MS1, mb, a1} sent by the sensor device, the gateway calculates the message authentication code SN using the key SK If MS1′ equals MS1, it is determined that the data has not been tampered with during transmission from the sensor device to the gateway, and authentication continues; if MS1′ does not equal MS1, the session is terminated immediately; the gateway calculates the power mask (mb) of the sensor device. And calculate using cb′ Then calculate based on C2′ If M1′ equals M1, then the previously calculated cb′ and C2′ are considered correct, and authentication continues; if M1′ does not equal M1, then the session is terminated; based on the anonymous identifier H(ID)... SN Find the corresponding continuous authentication period T in the database and calculate the power threshold BCT for this period T. SN And store it in the database; let er = cb', record the remaining battery power of the sensor device after the most recent session; the gateway generates random numbers. b 1. Calculate And generate the initial token TK SN ; Using the initial token TK SN calculate Using key SK SN Calculate To prevent data from being attacked and tampered with during transmission, the current timestamp is set to t. s Set the seed to C1; store the initial token TK. SN And seed; send M2, MG1, Y, b1 to the sensor device;

[0023] S25. After receiving the data M2, MG1, Y, b1 sent by the gateway, the sensor device uses the key SK SN Calculate If MG1′ equals MG1, it is determined that the data has not been tampered with during transmission from the gateway to the sensor device, and authentication continues; if MG1′ does not equal MG1, the session terminates; the gateway calculates... And calculate the token using C1' Using TK SN Calculate M2. If M2' equals the received M2, then it is determined to be the calculated TK. SN 'Correct, authentication successful, seed set to C1', initial token TK stored. SN The seed is stored in memory; if M2′ is not equal to the received M2, the session is terminated.

[0024] Furthermore, the continuous authentication method includes the following steps:

[0025] S31. The sensor device generates random numbers a2 and a3, and obtains its own remaining power cb. The sensor device uses the token TK generated during initial authentication. SN Using seed, calculate the mask for the remaining battery power cb. Calculate using random numbers a2 and a3 To prevent data from being attacked and tampered with during transmission, a token TK is used. SN Perform message authentication calculation Sensor devices will ID SN MS2, mb, ma, a2 are sent to the gateway;

[0026] S32, The gateway receives the data ID sent by the sensor device. SN After MS2, mb, ma, a2, set the current timestamp to t. c Using the timestamp t set during the initial identity authentication phase s Calculate t s and t c The difference is compared with T to determine if a timeout has occurred;

[0027] If the timeout occurs, the sensor device restarts the initial authentication process to ensure session security; the gateway uses the received data to calculate the current battery level. as well as The gateway notifies the sensor device to restart the initial authentication process, and then sends Y1 and ACK to the sensor device.

[0028] If no timeout occurs, the gateway further verifies the integrity of the data using the token TK. SN Calculated with seed Calculate as well as If MS2′ equals the received MS2, it is determined that the data from the sensor device to the gateway has not been tampered with; if MS2′ does not equal the received MS2, the session is terminated; the remaining battery power of the sensor device is checked to see if it is within the threshold range; the gateway generates a random number b2 and calculates... as well as set up Send Y1 and ACK to the sensor device;

[0029] S33. After receiving the data Y1 and ACK sent by the gateway, the sensor device calculates... If b2′ equals (seed||TK) SN If the sensor device's fast authentication cycle expires, it is determined that the initial authentication process has been restarted. Before restarting, it is necessary to verify whether the received data has been compromised or tampered with. The sensor device calculates... If ACK' is equal to the received ACK, it is judged that the data transmitted from the gateway is not tampered, and the initial identity authentication can be started; if ACK' is not equal to the received ACK, the session is terminated;

[0030] If b'2 is not equal to (seed||TK SN ), it is judged that the current session is still in the continuous identity authentication period T, and the initial identity authentication does not need to be restarted; the sensor device calculates If ACK' is equal to the received ACK, it is judged that the received data is not tampered, and the gateway updates the continuous identity authentication for the next data transmission; if ACK' is not equal to the received ACK, the session is terminated.

[0031] After the initial identity authentication succeeds, the application enters a continuous identity authentication period T, and every time the sensor device transmits sensing data to the gateway within the effective period T, a continuous identity authentication process is needed; at this time, the sensor device and the gateway that have completed the initial identity authentication both have the negotiated token TK SN and the seed, which are combined into the algorithm of the current continuous identity authentication stage, and the remaining power range within the current period T calculated in the initial identity authentication stage is used to realize the continuous identity authentication of the device identity. After the current continuous identity authentication process ends, the token TK SN value is updated for the next continuous identity authentication process. SN

[0032] Further, the method for checking whether the remaining power of the sensor device is within the threshold range in the S32 step includes:

[0033] If the calculated power cb' is in (μ T -σ T , μ T +σ T ), it is judged that the remaining power is within the estimated range of the current period, and the sensor device has passed the initial identity authentication; if , the session is terminated.

[0034] The continuous identity authentication method proposed in the application has security attributes such as mutual authentication, data integrity, forward secrecy, and backward secrecy, and the security attributes are specifically described as follows:

[0035] 1. Mutual authentication means that two entities can authenticate each other's identity. In the initial identity authentication stage, the gateway uses the secret key SK SN ​The MS1 value is verified and the sensor device is authenticated. If the calculated value MS1' is equal to the received value MS1, the gateway can guarantee the validity of the sensor device. The sensor device also authenticates the gateway by verifying the value of the ACK SN The MG1 value is verified and the gateway is authenticated. If the calculated value MG1' is equal to the received value MG1, the sensor device can guarantee the validity of the gateway. In the continuous identity authentication phase, the sensor device and the gateway authenticate each other by using the token TK SN and the transmitted random number. First, the gateway authenticates the identity of the sensor device by verifying the value of the initial token TK SN encrypted MS2 value. If the calculated value MS2' is equal to the received value MS2, the gateway can guarantee the validity of the sensor device. Then, the sensor device authenticates the identity of the gateway by verifying the value of the ACK . If the calculated value is equal to the received value ACK, the sensor device can guarantee the validity of the gateway. In summary, the continuous identity authentication method of the present application supports mutual authentication between the sensor device and the gateway.

[0036] 2. Data integrity is that the receiver can guarantee that the content of the message has not been tampered with or damaged in the process of transmitting the message. The present application uses HMAC to guarantee data integrity. In the initial identity authentication phase, an attacker needs to learn the shared key SK SN in order to tamper with the transmitted message. Since the attacker cannot obtain the key SK SN from the eavesdropped message, the attacker cannot calculate the valid values MS1 and MG1 without knowing the key SK SN . Therefore, the attacker cannot successfully tamper with the transmitted message. In the continuous identity authentication phase, an attacker needs to learn the token TK SN in order to tamper with the transmitted message. Since the attacker cannot obtain the token TK SN from the eavesdropped message, the attacker cannot calculate the valid value MS2' without knowing the token TK SN . Therefore, the continuous identity authentication method of the present application can achieve data integrity.

[0037] 3. Forward secrecy means that even if a future generated session key is leaked, the past generated session key can be protected. If the token TK SN is learned by an attacker, the attacker wants to derive the initial token H(C2|C1SK SN used in the last session, the attacker needs to know the previously generated channel state information C2 and C1. The random numbers C2 and C1 are generated by the sensor device and the gateway in the last session. Since the attacker cannot obtain the previously generated channel state information from the eavesdropped message, the attacker cannot use the current token TK SN to derive the previous initial token. Therefore, the continuous identity authentication method of the present application can achieve forward secrecy.

[0038] 4. Backward secrecy means that even if the information of the current session is leaked, the attacker cannot attack and break the future session. In the initial identity authentication phase, if the attacker destroys the current key SK SN , the attacker can obtain some information about the current session. However, the attacker cannot extract any information about the future session because SK SN is changed immediately after each session. In the continuous identity authentication phase, both parties update the token TK SN after each successful authentication. Therefore, the attacker cannot extract the token TK SN for authentication in the future by destroying the current token TK SN . Thus, the continuous identity authentication method of the present application can achieve backward secrecy.

[0039] 5. Anti-replay attack. A malicious attacker can eavesdrop on the valid information transmitted in the authentication session, and then replay some of the information to try to simulate a legitimate entity to establish an identity authenticated session with the target entity. However, in the present application, if the attacker implements a replay attack, the party receiving the message can detect that the information is invalid. In the data transmission process, the data values containing information include MS1, MG1, MS2 and ACK, which are all constructed using new random numbers, and each data value is transmitted together with the corresponding random number, which is one of the variables to dynamically generate the data value. These random numbers are newly generated by both parties during the identity authentication process. The party receiving the message can generate a unique provisional message using the received random number, and verify whether the provisional message is equal to the received message. Only if the two messages are equal, it is confirmed that the message from the sending party is valid. The present application embeds the random number into a single message to maintain the freshness of the transmitted message, and thus can resist replay attacks.

[0040] 6. Anti-middleman attack. Middleman attack means that a malicious attacker secretly forwards and manipulates information that he believes to be between two parties in direct communication. In the initial identity authentication phase, if the attacker wants to forward and manipulate the transmitted message, the attacker needs to know the key SK SN and the current power cb of the sensor. Since the attacker cannot learn the key SK SN and the current power cb of the sensor from the previously eavesdropped transmission information, the attacker cannot understand the real data of the key SK SN and the current power cb of the sensor, and cannot successfully manipulate the information. In the continuous identity authentication phase, if the attacker wants to forward and manipulate the transmitted information, the attacker needs to know the token TK SN . Since the token TK SN is generated by the sensor device and the gateway respectively in the initial identity authentication phase, the attacker cannot learn the token TKSN The attacker can only eavesdrop the masks mb and ma, however, these masks are the masked data, and the attacker cannot obtain the real data from them. Therefore, the attacker is difficult to modify or manipulate the transmitted messages without the initial token TK SN . Thus, the continuous identity authentication method of the present application can resist the man-in-the-middle attack.

[0041] 7. Anti-simulation attack. The simulation attack means that a malicious attacker can try to pretend to be a valid sensor device. In the initial identity authentication phase, if the attacker wants to pretend to be a sensor device, the attacker needs to forge the information {H(ID SN ), mC2, M1, MS1, mb, a1} sent to the gateway. If the attacker wants to forge MS1, the attacker needs to learn the key SK SN . The attacker can learn the identity ID SN of the sensor from the eavesdropped messages, but cannot learn the key SK SN . Without the key SK SN , the attacker cannot calculate a valid MS1, and cannot pass the detection of the gateway, thus the simulation attack will fail. In the continuous identity authentication phase, if the attacker wants to pretend to be a valid sensor device, the attacker needs to forge the information {ID SN , MS2, mb, ma, a2} sent to the gateway. Therefore, if the attacker wants to forge MS2, the attacker needs to know the initial token TK SN , the random number a2, the seed, and the current power cb of the sensor. The attacker can learn the random number a2 from the eavesdropped messages, but cannot obtain the token TK SN . Therefore, the attacker cannot calculate a valid token TK SN without the key SK SN . In summary, the attacker cannot successfully pretend to be a legitimate node, thus the continuous identity authentication method of the present application can resist the simulation attack.

[0042] The present application also provides a continuous identity authentication system suitable for a zero trust architecture, which performs the continuous identity authentication method suitable for a zero trust architecture as described above, and includes an initialization and registration module, an initial identity authentication module, and a continuous identity authentication module. The initialization and registration module includes:

[0043] A sensor device remaining power threshold lower limit calculation unit is configured to calculate a threshold lower limit of the remaining power of the sensor device according to the daily average power consumption of the sensor device in a continuous identity authentication period with a time length of T.

[0044] The production key and the continuous identity authentication cycle unit is used to include the important information parameters of the sensor device, such as the identity ID SN and the battery daily power consumption BC day , to the gateway through a secure channel when the sensor device initiates a request to the gateway for the first time. The gateway generates a key SK SN for the sensor device after receiving the request information sent by the sensor device, and selects a continuous identity authentication cycle T for the sensor device.

[0045] The sending and receiving storage unit is used for the gateway to send the generated key SK SN to the sensor device through a secure channel. After receiving the key SK SN , the sensor device stores the key SK in the memory. The gateway stores the identity ID SN , the key SK SN , the battery daily power consumption BC day , and the continuous identity authentication cycle T corresponding to each sensor device as a piece of information in the database.

[0046] Further, the initial identity authentication module comprises:

[0047] The anonymous identification unit is used for the sensor device to form an anonymous identification H(ID SN ) by hashing the identity, and send the anonymous identification H(ID SN ) to the gateway.

[0048] The channel state information calculation unit is used for the gateway to retrieve the key SK SN corresponding to H(ID SN ) from the database after receiving the anonymous identification H(ID SN ) data sent by the sensor device. If the identity ID SN is in the database, the channel state information C1 of the received data packet is calculated. If the ID SN is not in the database, the steps S11-S13 are executed again to calculate the channel state information C1 of the received data packet. The gateway sends the hash value H(ID GW ) to the sensor device.

[0049] The mask calculation unit is used for the sensor device to calculate the channel state information C2 of the received data packet, generate a random number a1, obtain the current remaining power cb of the sensor device itself, and take out the key SK SN from the memory after receiving the H(ID GW ) data sent by the gateway. The mask of the current power cb is calculated The mask of the channel state information is calculated and The sensor device utilizes the key SK SN The MS1 is calculated; the sensor device sends {H(ID SN ), mC2, M1, MS1, mb, a1} to the gateway;

[0050] The sensor device transmits an authentication unit to the gateway: after the gateway receives the data {H(ID SN ), mC2, M1, MS1, mb, a1} sent by the sensor device, the key SK SN is utilized to calculate a message authentication code If MS1' is equal to MS1, it is judged that the data has not been attacked and tampered with in the process of transmission from the sensor device to the gateway, and the authentication continues; if MS1' is not equal to MS1, the session is terminated immediately; the gateway calculates and utilizes cb' to calculate and calculates C2' according to C2' If M1' is equal to M1, it is judged that the cb' and C2' calculated in the foregoing are both correct, and the authentication continues; if M1' is not equal to M1, the session is terminated; according to the anonymous identifier H(ID SN ), the corresponding continuous identity authentication period T is found in the database, and the power threshold BCT of the current period T is calculated SN and stored in the database; let er=cb', and record the remaining power of the sensor device after the last session; the gateway generates a random number b1, calculates and generates an initial token TK SN ; the initial token TK SN is utilized to calculate The key SK SN is utilized to calculate and the current timestamp is set as t s , and the seed is set as C1; the initial token TK SN and the seed are stored; M2, MG1, Y, b1 are sent to the sensor device;

[0051] The gateway transmits an authentication unit to the sensor device: after the sensor device receives the data M2, MG1, Y, b1 sent by the gateway, the key SK SN is utilized to calculate If MG1' is equal to MG1, it is judged that the data has not been attacked and tampered with in the process of transmission from the gateway to the sensor device, and the authentication continues; if M1G' is not equal to MG1, the session is terminated; the gateway calculates and utilizes C1' to calculate the token TK SNCalculate M2. If M2' equals the received M2, then it is determined to be the calculated TK. SN 'Correct, authentication successful, seed set to C1', initial token TK stored. SN The seed is stored in memory; if M2′ is not equal to the received M2, the session is terminated.

[0052] Furthermore, the continuous identity authentication module includes:

[0053] Random number calculation unit: Used by the sensor device to generate random numbers a2 and a3, and to obtain the remaining power cb of the current sensor device. The sensor device uses the token TK generated during initial authentication. SN Using seed, calculate the mask for the remaining battery power cb. Calculate using random numbers a2 and a3 Use token K SN Perform message authentication calculation Sensor devices will ID SN MS2, mb, ma, a2 are sent to the gateway;

[0054] Continuous Authentication Unit: Used by the gateway to receive data IDs sent by sensor devices. SN After MS2, mb, ma, a2, set the current timestamp to t. c Using the timestamp t set during the initial identity authentication phase s Calculate t s and t c The difference is compared with T to determine if a timeout has occurred; if a timeout occurs, the sensor device restarts the initial authentication process to ensure session security; the gateway uses the received data to calculate the current battery level. as well as The gateway instructs the sensor device to restart initial authentication, and then sends Y1 and ACK to the sensor device; if there is no timeout, it further verifies the integrity of the data using the token TK. SN Calculated with seed Calculate as well as If MS2′ equals the received MS2, it is determined that the data from the sensor device to the gateway has not been tampered with; if MS2′ does not equal the received MS2, the session is terminated; the remaining battery power of the sensor device is checked to see if it is within the threshold range; the gateway generates a random number b2 and calculates... as well as set up Send Y1 and ACK to the sensor device;

[0055] The fast authentication unit is used for calculating after the sensor device receives the data Y1 and ACK sent by the gateway If b'2 is equal to (seed||TK SN ), it is judged that the fast authentication period of the sensor device has expired, and the initial identity authentication needs to be restarted; before the start, it is necessary to verify whether the received data is attacked and tampered, and the sensor device calculates If ACK' is equal to the received ACK, it is judged that the data transmitted from the gateway is not tampered, and the initial identity authentication can be started; if ACK' is not equal to the received ACK, the session is terminated;

[0056] If b'2 is not equal to (seed||TK SN ), it is judged that the current session is still in the continuous identity authentication period T, and the initial identity authentication does not need to be restarted; the sensor device calculates If ACK' is equal to the received ACK, it is judged that the received data is not tampered, and the gateway updates The continuous identity authentication for the next data transmission; if ACK' is not equal to the received ACK, the session is terminated.

[0057] Further, the continuous authentication unit comprises:

[0058] The power threshold checking subunit is used for realizing that if the calculated power cb' is equal to (μ T -σ T , μ T +σ T ), it is judged that the remaining power is in the estimated range of the current period, and the sensor device has passed the initial identity authentication; if The session is terminated.

[0059] The application also provides a computer readable storage medium, which stores a computer program, and the program is executed by a processor to realize the steps of the continuous identity authentication method suitable for the zero trust architecture.

[0060] The application also provides a computer device, which comprises a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor realizes the steps of the continuous identity authentication method suitable for the zero trust architecture when executing the program.

[0061] Compared with the prior art, the application has the beneficial effects that:

[0062] The method and system for continuous identity authentication suitable for a zero trust architecture provided by the application generate a token by using channel state information and battery power, which are two dynamic characteristics, for continuous identity authentication, and update the token after each continuous identity authentication is completed; the identity of a visitor is continuously authenticated during the visitor's access to a resource, the network security is improved, the risk of identity forgery by an attacker is reduced, and excessive resource consumption caused by repeated authentication in static identity authentication is avoided. BRIEF DESCRIPTION OF DRAWINGS

[0063] The accompanying drawings are included to provide a further understanding of the application and are incorporated in and constitute a part of this specification, illustrate embodiments of the application and together with the description serve to explain the principles of the application. In the drawings:

[0064] Figure 1 The basic flowchart of the method for continuous identity authentication suitable for a zero trust architecture and the security analysis of the embodiments of the application;

[0065] Figure 2 The model architecture diagram on which the method for continuous identity authentication suitable for a zero trust architecture of the embodiments of the application is based;

[0066] Figure 3 The flowchart of the initial identity authentication suitable for a zero trust architecture of the embodiments of the application;

[0067] Figure 4 The flowchart of the continuous identity authentication suitable for a zero trust architecture of the embodiments of the application;

[0068] Figure 5 The method flowchart of the initialization and registration of the application;

[0069] Figure 6 The structural schematic diagram of the computer device of the embodiments of the application. DETAILED DESCRIPTION

[0070] In order for those skilled in the art to better understand the technical solutions in the embodiments of the application, the technical solutions of the application will be described clearly and completely below with reference to the drawings, obviously, the described embodiments are some of the embodiments of the application, rather than all the embodiments of the application. It should be understood that these descriptions are exemplary, and are not used to limit the scope of the application. Based on the embodiments of the application, all other embodiments obtained by those skilled in the art without creative labor should be within the scope of protection of the application.

[0071] In addition, in the following description, the description of well-known structures and technologies is omitted to avoid unnecessary confusion of the concepts disclosed in the application.

[0072] In the description of the present application, it should be noted that, unless otherwise explicitly specified and limited, the orientation or positional relationship indicated by the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer" and the like is based on the orientation or positional relationship shown in the drawings, and is only for the convenience of describing the present application and simplifying the description, and therefore cannot be understood as indicating or implying that the device or element referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as limiting the present application. In addition, the terms "first", "second", "third" are only for descriptive purposes and cannot be understood as indicating or implying relative importance. The terms "mounting", "connection", "connection" should be broadly understood, for example, it can be fixedly connected, or it can be detachably connected, or integrally connected, it can be mechanically connected, or it can be electrically connected, it can be directly connected, or indirectly connected through an intermediate medium, or it can be the communication between two elements. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0073] The exemplary embodiments will be described in detail hereinbelow, examples of which are shown in the drawings. When the following description refers to the drawings, identical numbers on different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments are not meant to represent all implementations consistent with the present application. Rather, they are merely examples of methods and systems consistent with some aspects of the present application as detailed in the appended claims.

[0074] The embodiments of the present application will be further described in detail below.

[0075] The continuous identity authentication method and system suitable for zero trust architecture are provided in the embodiments of the present application, so as to solve the security risk problem that the existing static identity authentication mode is easy to be stolen and forged by attackers.

[0076] Method embodiment

[0077] In the embodiments of the present application, after the device accesses the resource, it first enters the initial identity authentication stage, and in the initial identity authentication stage, the communication parties authenticate each other's identity and generate an initial token. The initial identity authentication is completed by using the channel state information and the battery power information of the device, and the token generated after passing the initial identity authentication is applied to the continuous identity authentication period. In the continuous identity authentication stage, the negotiated token is merged into the algorithm to speed up the identity authentication, and the token is updated immediately after each continuous identity authentication process is completed. While ensuring the security of the system, the purpose of reducing resource consumption is achieved.

[0078] This invention provides a continuous identity authentication method suitable for a zero-trust architecture, including: an initialization and registration method, an initial identity authentication method, and a continuous identity authentication method performed sequentially;

[0079] The initialization and registration methods are described in [reference needed]. Figure 5 As shown, it includes the following steps:

[0080] S11. Based on the average daily power consumption of the sensor device, calculate the lower threshold BCT of the remaining power of the sensor device within a continuous authentication period of time T. SN BCT SN The calculation expression is:

[0081]

[0082] In equation (1), er is the remaining battery power measured by the sensor device during the initial authentication phase, and BC day denoted as the average daily power consumption of the battery, T as the duration of the continuous identity authentication cycle, and s as a coefficient satisfying 0 < s < 1.

[0083] The persistent authentication method for zero-trust architecture in this embodiment is based on the model as follows: Figure 2 As shown, in Figure 2 These scenarios mainly include four parts: sensor devices (nodes), gateways, cloud servers, and users; the identity authentication between devices mainly involves two entities: sensor devices and gateways, and authentication occurs between two sensor devices or between a sensor device and a gateway.

[0084] The presence of various obstacles and objects in the communication path will affect the Channel State Information (CSI), resulting in unique CSI values ​​at different locations along the communication path.

[0085] S12. When the sensor device first sends a request to the gateway, it will include important information parameters of the sensor device, including its identity ID. SN and the average daily power consumption of the battery BC day The request is sent to the gateway via a secure channel. After receiving the request from the sensor device, the gateway generates a key SK for the sensor device. SN And select a continuous authentication period T for the sensor device;

[0086] S13, The gateway will generate the key SK SN The key SK is sent to the sensor device via a secure channel. Upon receiving it, the sensor device will... SN Stored in memory.

[0087] The gateway identifies each sensor device by its unique ID. SN, the key SK SN , the battery daily power consumption BC day , the continuous identity authentication period T is stored in the database as an information.

[0088] The method of the initial identity authentication, comprising the following steps:

[0089] S21, the sensor device forms an anonymous identification H(ID SN ) through hash calculation of the identity, and sends the anonymous identification H(ID SN ) to the gateway;

[0090] S22, after the gateway receives the anonymous identification H(ID SN ) data sent by the sensor device, the gateway retrieves the key SK SN ) corresponding to H(ID SN ) from the database; if the identity identification ID SN is in the database, the channel state information C1 of the received data packet is calculated; if ID SN is not in the database, the steps of S11-S13 are returned to calculate the channel state information C1 of the received data packet again; the gateway sends the hash value H(ID GW ) to the sensor device;

[0091] S23, after the sensor device receives the H(ID GW ) data sent by the gateway, if the stored gateway is matched, the channel state information C2 of the received data packet is calculated, a random number a1 is generated, the current remaining power cb of the sensor device is obtained, and the key SK SN ) is taken out from the memory; the mask of the current power cb is calculated the mask of the channel state information is calculated and The sensor device calculates MS1 by using the key SK SN to prevent the data from being attacked and tampered during transmission; the sensor device sends {H(ID SN ), mC2, M1, MS1, mb, a1} to the gateway;

[0092] S24, after the gateway receives the data {H(ID SN ), mC2, M1, MS1, mb, a1} sent by the sensor device, the message authentication code is calculated by using the key SK SN ; if MS1' is equal to MS1, it is judged that the data has not been attacked and tampered during the transmission from the sensor device to the gateway, and the authentication continues; if MS1' is not equal to MS1, the session is terminated immediately; the gateway calculates And calculate cb' using cb' And calculate C2' using C2 If M1' is equal to M1, it is judged that both cb' and C2' calculated above are correct, and the authentication continues; if M1' is not equal to M1, the session is terminated; according to the anonymous identifier H(ID SN ), the corresponding persistent identity authentication period T is found in the database, and the power threshold BCT SN of the current period T is calculated and stored in the database; let er=cb', and record the remaining power of the sensor device after the last session; the gateway generates a random number b1, calculates , and generates an initial token TK SN ; TK SN is used to calculate SK SN is used to calculate to prevent the data from being attacked and tampered with during transmission, and set the current timestamp as t s , and set the seed as C1; store the initial token TK SN and the seed; send M2, MG1, Y, and b1 to the sensor device;

[0093] S25, after the sensor device receives the data M2, MG1, Y, and b1 sent by the gateway, SK SN is used to calculate If MG1' is equal to MG1, it is judged that the data has not been attacked and tampered with during transmission from the gateway to the sensor device, and the authentication continues; if MG1' is not equal to MG1, the session is terminated; the gateway calculates , and calculates the token using C1' TK SN ' is used to calculate M2', if M2' is equal to the received M2, it is judged that the calculated TK SN ' is correct, the authentication is successful, the seed is set as C1', and the initial token TK SN and the seed are stored in the memory; if M2' is not equal to the received M2, the session is terminated.

[0094] The specific process of the initial identity authentication of the embodiment is shown in Figure 3 .

[0095] The method for persistent identity authentication comprises the following steps:

[0096] S31, the sensor device generates random numbers a2 and a3, and obtains the current remaining power cb of the sensor device itself, and the sensor device calculates the mask of the remaining power cb using the token TK SN and the seed generated by the initial identity authentication The random number a2, a3 is used to calculate In order to prevent data from being tampered with during transmission, a token TK is used SN Message authentication calculation is performed The sensor device sends the ID SN , MS2, mb, ma, a2 to the gateway;

[0097] After the gateway receives the data ID SN , MS2, mb, ma, a2 sent by the sensor device, the current timestamp is set as t c The timestamp t s set in the initial identity authentication stage is used to calculate t s The difference between t c and t SN is compared with T to determine whether it is overdue;

[0098] If it is overdue, the sensor device restarts the initial identity authentication to ensure the security of the session; the gateway calculates the current power consumption using the received data and informs the sensor device to restart the initial identity authentication, and then the gateway sends Y1 and ACK to the sensor device;

[0099] If it is not overdue, the integrity of the data is further verified; the gateway calculates SN and the seed seed to calculate to calculate and If MS2' is equal to the received MS2, it is determined that the data from the sensor device to the gateway has not been tampered with; if MS2' is not equal to the received MS2, the session is terminated; it is checked whether the remaining power of the sensor device is within the threshold range; the gateway generates a random number b2 and calculates and is set Y1 and ACK are sent to the sensor device;

[0100] After the sensor device receives the data Y1 and ACK sent by the gateway, it calculates If b'2 is equal to (seed||TK SN ), it is determined that the fast authentication period of the sensor device has expired and the initial identity authentication needs to be restarted; before starting, it is necessary to verify whether the received data has been tampered with by an attack, and the sensor device calculates If ACK' is equal to the received ACK, it is determined that the data transmitted from the gateway has not been tampered with, and the initial identity authentication can be started; if ACK' is not equal to the received ACK, the session is terminated;

[0101] If b′2 is not equal to (seed||TK) SN If the sensor device calculates that the current session is still within the continuous authentication period T, it is determined that the initial authentication does not need to be restarted; If ACK′ equals the received ACK, it is determined that the received data has not been tampered with, and the gateway updates accordingly. Continuous authentication for the next data transmission; if ACK′ is not equal to the received ACK, the session is terminated.

[0102] The specific process of continuous identity authentication in this embodiment is as follows: Figure 4 As shown.

[0103] In this embodiment, after successful initial authentication, a continuous authentication cycle of duration T begins. During the validity period T, each time the sensor device transmits sensing data to the gateway, a continuous authentication process is required. At this time, both the sensor device that has completed the initial authentication and the gateway possess the negotiated token TK. SN and seed, will use token TK SN The seed is incorporated into the current persistent authentication algorithm. Based on the remaining battery level within the current period T calculated during the initial authentication phase, persistent authentication of the device identity is achieved. Furthermore, after the current persistent authentication process concludes, the token TK is updated. SN This value is used in the next continuous authentication process.

[0104] The continuous authentication method in this embodiment possesses security attributes such as mutual authentication, data integrity, forward confidentiality, and backward confidentiality. Figure 1 This embodiment illustrates the continuous authentication method and basic process of security analysis applicable to zero-trust architectures.

[0105] System Implementation Examples

[0106] This invention also provides a persistent identity authentication system suitable for a zero-trust architecture, executing the persistent identity authentication method for a zero-trust architecture as described above, including: an initialization and registration module, an initial identity authentication module, and a persistent identity authentication module; wherein, the initialization and registration module includes:

[0107] The unit for calculating the lower limit of the remaining power threshold of the sensor device is used to calculate the lower limit of the remaining power threshold of the sensor device based on the average daily power consumption of the sensor device within a continuous authentication period of time T.

[0108] Production key and continuous authentication cycle unit: used to transmit important information parameters of the sensor device, including its identity ID, when the sensor device first sends a request to the gateway. SN and the average daily power consumption of the battery BCday , through the secure channel to the gateway, the gateway receives the request information sent by the sensor device, for the sensor device to generate a key SK SN , and select a continuous identity authentication period T for the sensor device;

[0109] Send and receive storage unit: for the gateway to send the generated key SK SN Through the secure channel to the sensor device, the sensor device receives the key SK SN Stored in the memory; the gateway stores the identity ID SN , the key SK SN , the daily average power consumption of the battery BC day , the continuous identity authentication period T of each sensor device as a piece of information in the database.

[0110] The initial identity authentication module comprises:

[0111] Anonymous identification unit: for the sensor device to form an anonymous identification H(ID SN ) by hashing the identity, and send the anonymous identification H(ID SN ) to the gateway;

[0112] The channel state information calculation unit is used for the gateway to receive the anonymous identification H(ID SN ) data sent by the sensor device, retrieve the key SK SN corresponding to H(ID SN ) from the database; if the identity ID SN is in the database, calculate the channel state information C1 of the received data packet; if ID SN is not in the database, return to execute steps S11-S13, and calculate the channel state information C1 of the received data packet again; the gateway sends the hash value H(ID GW ) to the sensor device;

[0113] The mask calculation unit is used for the sensor device to receive the H(ID GW ) data sent by the gateway, and if it matches the stored gateway, calculate the channel state information C2 of the received data packet, generate a random number a1, obtain the current remaining power cb of the sensor device itself, and take out the key SK SN from the memory; calculate the mask of the current power cb Calculate the mask of the channel state information and The sensor device calculates MS1 using the key SK SN ; the sensor device calculates MS1 using the key SK SN), mC2, M1, MS1, mb, a1} to the gateway;

[0114] The sensor device transmits an authentication unit to the gateway: for the gateway to receive data {H(ID SN ), mC2, M1, MS1, mb, a1} sent by the sensor device, using the key SK SN to calculate a message authentication code If MS1' is equal to MS1, it is judged that the data has not been tampered with by an attack in the process of transmission from the sensor device to the gateway, and the authentication continues; if MS1' is not equal to MS1, the session is terminated immediately; the gateway calculates using the power mask mb of the sensor device, and calculates According to C2', it is calculated that If M1' is equal to M1, it is judged that the cb' and C2' calculated above are both correct, and the authentication continues; if M1' is not equal to M1, the session is terminated; according to the anonymous identifier H(ID SN ), the corresponding continuous identity authentication period T is found in the database, and the power threshold BCT SN of the current period T is calculated and stored in the database; let er=cb', record the remaining power of the sensor device after the last session; the gateway generates a random number b1, calculates and generates an initial token TK SN ; using the initial token TK SN , it is calculated that Using the key SK SN , it is calculated that and the current timestamp is set to t s , and the seed seed is set to C1; the initial token TK SN and the seed seed are stored; M2, MG1, Y, b1 are sent to the sensor device;

[0115] The gateway transmits an authentication unit to the sensor device: for the sensor device to receive data M2, MG1, Y, b1 sent by the gateway, using the key SK SN , it is calculated that If MG1' is equal to MG1, it is judged that the data has not been tampered with by an attack in the process of transmission from the gateway to the sensor device, and the authentication continues; if MG1' is not equal to MG1, the session is terminated; the gateway calculates and calculates the token using C1', TK SN ' is calculated, and if M2' is equal to the received M2, it is judged that the calculated TK SN ' is correct, the authentication is successful, and the seed seed is set to C1', and the initial token TK SNThe seed is stored in memory; if M2′ is not equal to the received M2, the session is terminated.

[0116] The continuous identity authentication module includes:

[0117] Random number calculation unit: Used by the sensor device to generate random numbers a2 and a3, and to obtain the remaining power cb of the current sensor device. The sensor device uses the token TK generated during initial authentication. SN Using seed, calculate the mask for the remaining battery power cb. Calculate using random numbers a2 and a3 Use token TK SN Perform message authentication calculation Sensor devices will ID SN MS2, mb, ma, a2 are sent to the gateway;

[0118] Continuous Authentication Unit: Used by the gateway to receive data IDs sent by sensor devices. SN After MS2, mb, ma, a2, set the current timestamp to t. c Using the timestamp t set during the initial identity authentication phase s Calculate t s and t c The difference is compared with T to determine if a timeout has occurred; if a timeout occurs, the sensor device restarts the initial authentication process to ensure session security; the gateway uses the received data to calculate the current battery level. as well as The gateway instructs the sensor device to restart initial authentication, and then sends Y1 and ACK to the sensor device; if there is no timeout, it further verifies the integrity of the data using the token TK. SN Calculated with seed Calculate as well as If MS2′ equals the received MS2, it is determined that the data from the sensor device to the gateway has not been tampered with; if MS2′ does not equal the received MS2, the session is terminated; the remaining battery power of the sensor device is checked to see if it is within the threshold range; the gateway generates a random number b2 and calculates... as well as set up Send Y1 and ACK to the sensor device;

[0119] Fast authentication unit: Used by the sensor device to calculate the value after receiving data Y1 and ACK sent by the gateway. If b′2 equals (seed||TK) SN), it is judged that the fast authentication period of the sensor device has expired, and the initial identity authentication needs to be restarted; before the start, it is necessary to verify whether the received data is attacked and tampered, and the sensor device calculates If ACK' is equal to the received ACK, it is judged that the data transmitted from the gateway is not tampered, and the initial identity authentication can be started; if ACK' is not equal to the received ACK, the session is terminated;

[0120] If b'2 is not equal to (seed||TK SN ), it is judged that the current session is still in the continuous identity authentication period T, and the initial identity authentication does not need to be restarted; the sensor device calculates If ACK' is equal to the received ACK, it is judged that the received data is not tampered, and the gateway updates the continuous identity authentication for the next data transmission; if ACK' is not equal to the received ACK, the session is terminated.

[0121] The continuous authentication unit comprises:

[0122] The power threshold checking subunit is configured to: if the calculated power cb'∈(μ T -σ T , μ T +σ T ), it is judged that the remaining power is within the estimated range of the current period, and the sensor device has passed the initial identity authentication; if the session is terminated.

[0123] In a third aspect, the embodiment of the present application further provides a computer device, Figure 6 is a structural schematic diagram of a computer device provided by the embodiment of the present application; as shown in Figure 6 , the computer device comprises an input system 23, an output system 24, a memory 22 and a processor 21; the memory 22 is configured to store one or more programs; when the one or more programs are executed by the one or more processors 21, the one or more processors 21 implement the continuous identity authentication method suitable for the zero trust architecture provided by the above embodiment; wherein the input system 23, the output system 24, the memory 22 and the processor 21 can be connected through a bus or other means, Figure 6 in the embodiment, the connection through the bus is taken as an example.

[0124] The memory 22 can be used to store software programs, computer executable programs, such as program instructions corresponding to the continuous identity authentication method suitable for the zero trust architecture according to the embodiments of the present application, as a readable and writable storage medium of a computing device. The memory 22 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system and application programs required by at least one function; the data storage area can store data created according to the use of the device, etc. In addition, the memory 22 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some examples, the memory 22 can further include a memory remotely arranged with respect to the processor 21, which can be connected to the device through a network. Examples of the above network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0125] The input system 23 can be used to receive input digital or character information, and generate key signal inputs related to user settings and function control of the device. The output system 24 can include a display device such as a display screen.

[0126] The processor 21 executes various function applications and data processing of the device by running software programs, instructions and modules stored in the memory 22, that is, implements the continuous identity authentication method suitable for the zero trust architecture as described above.

[0127] The computer device provided above can be used to execute the continuous identity authentication method suitable for the zero trust architecture provided by the above embodiments, and has corresponding functions and beneficial effects.

[0128] In a fourth aspect, the embodiments of the present application further provide a computer readable storage medium having a computer program stored thereon, which can be loaded and executed by a processor to implement the continuous identity authentication method suitable for the zero trust architecture according to the first aspect.

[0129] The applicant of the present application has made a detailed description and explanation of the embodiments of the present application in combination with the drawings of the specification, but those skilled in the art should understand that the above embodiments are only preferred embodiments of the present application, and the detailed description is only to help the reader better understand the spirit of the present application, and is not a limitation on the protection scope of the present application. On the contrary, any improvement or modification based on the spirit of the present application should fall within the protection scope of the present application.

[0130] It should be pointed out finally that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present application, but not to limit them. Although the present application has been described in detail with reference to the foregoing embodiments, it should be understood by those skilled in the art that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features can be replaced equivalently; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application. Any changes or replacements that can be easily thought of by those skilled in the art within the technical scope disclosed by the present application should be covered within the protection scope of the present application.

Claims

1. A continuous identity authentication method suitable for zero-trust architecture, characterized in that, include: The initialization and registration methods, the initial authentication method, and the continuous authentication method are performed in sequence. The initialization and registration method includes the following steps: S11. Based on the average daily power consumption of the sensor device, calculate the lower threshold BCT of the remaining power of the sensor device within a continuous authentication period of time T. SN BCT SN The calculation expression is: In equation (1), er is the remaining battery power measured by the sensor device during the initial authentication phase, and BC day denoted as the average daily power consumption of the battery, T as the duration of the continuous identity authentication cycle, and s as a coefficient satisfying 0 < s < 1. S12. When the sensor device first sends a request to the gateway, it will include important information parameters of the sensor device, including its identity ID. SN and the average daily power consumption of the battery BC day The request is sent to the gateway via a secure channel. After receiving the request from the sensor device, the gateway generates a key SK for the sensor device. SN And select a continuous authentication period T for the sensor device; S13, The gateway will generate the key SK SN The key SK is sent to the sensor device via a secure channel. Upon receiving it, the sensor device will... SN Stored in memory; The gateway identifies each sensor device by its unique ID. SN Key SK SN Daily battery power consumption BC day The continuous identity authentication period T is stored as a piece of information in the database.

2. The continuous identity authentication method for zero-trust architecture according to claim 1, characterized in that, The initial identity authentication method includes the following steps: S21. The sensor device uses hash calculation to form an anonymous identifier H(ID) for the identity. SN ), and assign the anonymous identifier H(ID) SN Send to the gateway; S22. The gateway receives the anonymous identifier H(ID) sent by the sensor device. SN After obtaining the data, retrieve H(ID) from the database. SN The corresponding key SK SN If the identity ID SN In the database, the channel state information C1 of the received data packet is calculated; if ID SN If not found in the database, return to steps S11-S13 and calculate the channel state information C1 of the received data packet; the gateway will then hash the value H(ID). GW Send to the sensor device; S23, The sensor device receives the H(ID) sent by the gateway. GW After receiving the data, if it matches a stored gateway, the channel state information C2 of the received data packet is calculated, a random number a1 is generated, the current remaining power cb of the sensor device is obtained, and the key SK is retrieved from the memory. SN ; Calculate the mask for the current battery level cb Calculate the mask for the channel state information as well as Sensor devices utilize key SK SN Calculate MS1; the sensor device will {H(ID)} SN ), mC2, M1, MS1, mb, a1} are sent to the gateway; S24. The gateway receives data {H(ID) sent by the sensor device. SN After {mC2, M1, MS1, mb, a1}, use the key SK SN Calculate the message authentication code If MS1′ equals MS1, it is determined that the data has not been tampered with during transmission from the sensor device to the gateway, and authentication continues; if MS1′ does not equal MS1, the session is terminated immediately; the gateway calculates the power mask (mb) of the sensor device. And calculate using cb′ Then calculate based on C2′ If M1′ equals M1, then the previously calculated cb′ and C2′ are considered correct, and authentication continues; if M1′ does not equal M1, then the session is terminated; based on the anonymous identifier H(ID)... SN Find the corresponding continuous authentication period T in the database and calculate the power threshold BCT for this period T. SN And store it in the database; let er = cb′, record the remaining power of the sensor device after the most recent session; the gateway generates a random number b1 and calculates... And generate the initial token TK SN ; Using the initial token TK SN calculate Using key SK SN Calculate And set the current timestamp to t s Set the seed to C1; store the initial token TK. SN And seed; send M2, MG1, Y, b1 to the sensor device; S25. After receiving the data M2, MG1, Y, b1 sent by the gateway, the sensor device uses the key SK SN Calculate If MG1′ equals MG1, it is determined that the data has not been tampered with during transmission from the gateway to the sensor device, and authentication continues; if MG1′ does not equal MG1, the session terminates; the gateway calculates... And calculate the token using C1' Using TK SN Calculate M2. If M2' equals the received M2, then it is determined to be the calculated TK. SN 'Correct, authentication successful, seed set to C1', initial token TK stored. SN The seed is stored in memory; if M2′ is not equal to the received M2, the session is terminated.

3. The continuous identity authentication method for zero-trust architecture according to claim 1, characterized in that, The method for continuous identity authentication includes the following steps: S31. The sensor device generates random numbers a2 and a3, and obtains its own remaining power cb. The sensor device uses the token TK generated during initial authentication. SN Using seed, calculate the mask for the remaining battery power cb. Calculate using random numbers a2 and a3 Use token TK SN Perform message authentication calculation Sensor devices will ID SN MS2, mb, ma, a2 are sent to the gateway; S32, The gateway receives the data ID sent by the sensor device. SN After MS2, mb, ma, a2, set the current timestamp to t. c Using the timestamp t set during the initial identity authentication phase s Calculate t s and t c The difference is compared with T to determine if a timeout has occurred; If the timeout occurs, the sensor device restarts the initial authentication process to ensure session security; the gateway uses the received data to calculate the current battery level. as well as The gateway notifies the sensor device to restart the initial authentication process, and then sends Y1 and ACK to the sensor device. If no timeout occurs, the gateway further verifies the integrity of the data using the token TK. SN Calculated with seed Calculate as well as If MS2′ equals the received MS2, it is determined that the data from the sensor device to the gateway has not been tampered with; if MS2′ does not equal the received MS2, the session is terminated; the remaining battery power of the sensor device is checked to see if it is within the threshold range; the gateway generates a random number b2 and calculates... as well as set up Send Y1 and ACK to the sensor device; S33. After receiving the data Y1 and ACK sent by the gateway, the sensor device calculates... If b′2 equals (seed||TK) SN If the sensor device's fast authentication cycle expires, it is determined that the initial authentication process has been restarted. Before restarting, it is necessary to verify whether the received data has been compromised or tampered with. The sensor device calculates... If ACK′ equals the received ACK, it is determined that the data transmitted from the gateway has not been tampered with, and initial authentication can be initiated; if ACK′ does not equal the received ACK, the session is terminated. If b′2 is not equal to (seed||TK) SN If the sensor device calculates that the current session is still within the continuous authentication period T, it is determined that the initial authentication does not need to be restarted; If ACK′ equals the received ACK, it is determined that the received data has not been tampered with, and the gateway updates accordingly. Continuous authentication for the next data transmission; if ACK′ is not equal to the received ACK, the session is terminated.

4. The continuous identity authentication method for zero-trust architecture according to claim 3, characterized in that, The method for checking whether the remaining power of the sensor device is within the threshold range in step S32 includes: If the calculated charge cb′∈(μ T -σ T μ T +σ T If the remaining battery power is within the estimated range for this cycle, then the sensor device has passed initial authentication; if Then the session will be terminated.

5. A persistent identity authentication system suitable for a zero-trust architecture, executing the persistent identity authentication method for a zero-trust architecture as described in any one of claims 1-4, characterized in that, include: The system includes an initialization and registration module, an initial identity authentication module, and a continuous identity authentication module; wherein, the initialization and registration module includes: The unit for calculating the lower limit of the remaining power threshold of the sensor device is used to calculate the lower limit of the remaining power threshold of the sensor device based on the average daily power consumption of the sensor device within a continuous authentication period of time T. Production key and continuous authentication cycle unit: used to transmit important information parameters of the sensor device, including its identity ID, when the sensor device first sends a request to the gateway. SN and the average daily power consumption of the battery BC day The request is sent to the gateway via a secure channel. After receiving the request from the sensor device, the gateway generates a key SK for the sensor device. SN And select a continuous authentication period T for the sensor device; Transmit / receive storage unit: used by the gateway to store the generated key SK SN The key SK is sent to the sensor device via a secure channel. Upon receiving it, the sensor device will... SN Stored in memory; the gateway stores the identity ID corresponding to each sensor device. SN Key SK SN Daily battery power consumption BC day The continuous identity authentication period T is stored as a piece of information in the database.

6. The persistent identity authentication system for zero-trust architecture according to claim 5, characterized in that, The initial identity authentication module includes: Anonymous Identification Unit: Used by sensor devices to generate an anonymous identifier H(ID) from an identity through hash calculation. SN ), and assign the anonymous identifier H(ID) SN Send to the gateway; Calculate Channel State Information Unit: Used by the gateway to receive the anonymous identifier H(ID) sent by the sensor device. SN After obtaining the data, retrieve H(ID) from the database. SN The corresponding key SK SN If the identity ID SN In the database, the channel state information C1 of the received data packet is calculated; if ID SN If not found in the database, return to steps S11-S13 and calculate the channel state information C1 of the received data packet; the gateway will then hash the value H(ID). GW Send to the sensor device; Calculate the mask unit: used by the sensor device to receive the H(ID) sent by the gateway. GW After receiving the data, if it matches a stored gateway, the channel state information C2 of the received data packet is calculated, a random number a1 is generated, the current remaining power cb of the sensor device is obtained, and the key SK is retrieved from the memory. SN ; Calculate the mask for the current battery level cb Calculate the mask for the channel state information as well as Sensor devices utilize key SK SN Calculate MS1; the sensor device will {H(ID)} SN ), mC2, M1, MS1, mb, a1} are sent to the gateway; The sensor device transmits an authentication unit to the gateway: used by the gateway to receive data {H(ID) sent by the sensor device}. SN After {mC2, M1, MS1, mb, a1}, use the key SK SN Calculate the message authentication code If MS1′ equals MS1, it is determined that the data has not been tampered with during transmission from the sensor device to the gateway, and authentication continues; if MS1′ does not equal MS1, the session is terminated immediately; the gateway calculates the power mask (mb) of the sensor device. And calculate using cb′ Then calculate based on C2′ If M1′ equals M1, then the previously calculated cb′ and C2′ are considered correct, and authentication continues; if M1′ does not equal M1, then the session is terminated; based on the anonymous identifier H(ID)... SN Find the corresponding continuous authentication period T in the database and calculate the power threshold BCT for this period T. SN And store it in the database; let er = cb′, record the remaining power of the sensor device after the most recent session; the gateway generates a random number b1 and calculates... And generate the initial token TK SN ; Using the initial token TK SN calculate Using key SK SN Calculate And set the current timestamp to t s Set the seed to C1; store the initial token TK. SN And seed; send M2, MG1, Y, b1 to the sensor device; The gateway transmits an authentication unit to the sensor device: This unit is used by the sensor device to authenticate the data M2, MG1, Y, b1 sent by the gateway, using the key SK. SN Calculate If MG1′ equals MG1, it is determined that the data has not been tampered with during transmission from the gateway to the sensor device, and authentication continues; if MG1′ does not equal MG1, the session terminates; the gateway calculates... And calculate the token using C1' Using TS′ SN Calculate M2′. If M2′ equals the received M2, then it is determined to be the calculated TK. SN 'Correct, authentication successful, seed set to C1', initial token TK stored. SN The seed is stored in memory; if M2′ is not equal to the received M2, the session is terminated.

7. The persistent identity authentication system suitable for zero-trust architecture according to claim 6, characterized in that, The continuous identity authentication module includes: Random number calculation unit: Used by the sensor device to generate random numbers a2 and a3, and to obtain the remaining power cb of the sensor device itself. The sensor device uses the token TK generated during initial authentication. SN Using seed, calculate the mask for the remaining battery power cb. Calculate using random numbers a2 and a3 Use token TK SN Perform message authentication calculation Sensor devices will ID SN MS2, mb, ma, a2 are sent to the gateway; Continuous Authentication Unit: Used by the gateway to receive data IDs sent by sensor devices. SN After MS2, mb, ma, a2, set the current timestamp to t. c Using the timestamp t set during the initial identity authentication phase s Calculate t s and t c The difference is compared with T to determine if a timeout has occurred; if a timeout occurs, the sensor device restarts the initial authentication process to ensure session security; the gateway uses the received data to calculate the current battery level. as well as The gateway instructs the sensor device to restart initial authentication, and then sends Y1 and ACK to the sensor device; if there is no timeout, it further verifies the integrity of the data using the token TK. SN Calculated with seed Calculate as well as If MS2′ equals the received MS2, it is determined that the data from the sensor device to the gateway has not been tampered with; if MS′2 does not equal the received MS2, the session is terminated; the remaining battery power of the sensor device is checked to see if it is within the threshold range; the gateway generates a random number b2 and calculates... as well as set up Send Y1 and ACK to the sensor device; Fast authentication unit: Used by the sensor device to calculate the value after receiving data Y1 and ACK sent by the gateway. If b′2 equals (seed||TK) SN If the sensor device's fast authentication cycle expires, it is determined that the initial authentication process has been restarted. Before restarting, it is necessary to verify whether the received data has been compromised or tampered with. The sensor device calculates... If ACK′ equals the received ACK, it is determined that the data transmitted from the gateway has not been tampered with, and initial authentication can be initiated; if ACK′ does not equal the received ACK, the session is terminated. If b′2 is not equal to (seed||TK) SN If the sensor device calculates that the current session is still within the continuous authentication period T, it is determined that the initial authentication does not need to be restarted; If ACK′ equals the received ACK, it is determined that the received data has not been tampered with, and the gateway updates accordingly. Continuous authentication for the next data transmission; if ACK′ is not equal to the received ACK, the session is terminated.

8. The persistent identity authentication system suitable for zero-trust architecture according to claim 7, characterized in that, The continuous authentication unit includes: The energy threshold check subunit is used to check if the calculated energy cb′∈(μ) T -σ T μ T +σ T If the remaining battery power is within the estimated range for this cycle, then the sensor device has passed initial authentication; if Then the session will be terminated.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps of the persistent authentication method for a zero-trust architecture as described in any one of claims 1-4.

10. A computer device, the computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the persistent authentication method for a zero-trust architecture as described in any one of claims 1-4.

Images