A terminal access authentication method for wireless networking protocol of Internet of Things node equipment

Abstract

The present invention discloses a terminal access authentication method for a wireless networking protocol of an Internet of Things node device, which belongs to the field of communication technology and includes device initialization and registration, spectrum scanning and target channel selection, terminal authentication and session key negotiation, dynamic trust verification and authority checking, real-time spectrum monitoring and channel optimization, intelligent key update and adaptive channel switching. The method solves the technical problems of device access security, channel dynamic optimization and trust management in the process of wireless networking of Internet of Things node devices. The method effectively responds to key leakage and dynamic threats, dynamically adjusts channel allocation, reduces interference and improves communication efficiency, realizes continuous trust verification of devices, reduces potential risks of untrusted devices, and enhances the tamper-proofness and transparency of data.

Description

Technical Field

[0001] The present invention belongs to the field of communication technology, and in particular relates to a terminal access authentication method for a wireless networking protocol of an Internet of Things node device. Background Art

[0002] Internet of Things ( IoT The large-scale deployment of IoT devices has made network security and communication efficiency an important challenge. Existing IoT terminal access authentication methods usually use static key authentication and fixed channel allocation strategies. These methods have the following shortcomings in practical applications:

[0003] Static key management issues:

[0004] In the existing technology, devices use fixed keys for authentication and communication, and the encryption strength decreases over time, which cannot effectively deal with dynamically changing security threats such as key leakage and malicious man-in-the-middle attacks.

[0005] Channel selection is not flexible enough:

[0006] Traditional channel allocation methods are usually based on fixed priority rules and fail to perceive channel status in real time, which can easily lead to increased interference and decreased communication efficiency, especially in complex wireless environments.

[0007] Lack of dynamic trust mechanism:

[0008] Verification of device identity is usually only performed at the time of access, lacking subsequent dynamic trust assessment, making it difficult to prevent potential malicious or zombie devices. Summary of the invention

[0009] The purpose of the present invention is to provide a terminal access authentication method for a wireless networking protocol of an Internet of Things node device, which solves the technical problems of device access security, channel dynamic optimization and trust management during the communication process during the wireless networking of the Internet of Things node device.

[0010] To achieve the above object, the present invention adopts the following technical solution:

[0011] A terminal access authentication method for a wireless networking protocol of an Internet of Things node device comprises the following steps:

[0012] Step 1: Device initialization and registration, which includes the device generating a public-private key pair through the elliptic curve digital signature algorithm, and sending the device identification and its signature to the authentication management platform to initiate a registration application; the authentication management platform verifies the device identity, issues a digital certificate, and stores the device registration information in the blockchain to form a secure basic whitelist;

[0013] Step 2: Spectrum scanning and target channel selection, specifically including the device scanning the channels in the current environment in real time through the spectrum scanning module, recording the utilization of each channel; and preferentially selecting the channel with utilization lower than the preset threshold as the target channel;

[0014] Step 3: Terminal authentication and session key negotiation, specifically including the device sending an authentication request to the gateway through a dynamic authentication mechanism, including identity information and timestamp; the gateway returns a random number and its own digital certificate, and the two parties negotiate a shared session key through the elliptic curve key exchange protocol for subsequent communication encryption;

[0015] Step 4: Dynamic trust verification and permission check. Specifically, before each communication, the device sends a verification package through dynamic verification, and the gateway performs identity authentication based on the device behavior pattern, trust score, and permission rules. After the verification is passed, the gateway allows communication and only authorizes trusted devices to access resources.

[0016] Step 5: Real-time spectrum monitoring and channel optimization, specifically including during the communication process, the device monitors the current channel usage status in real time, records the channel utilization rate and channel status; normalizes the channel utilization rate and channel status, and then calculates the weight to obtain a comprehensive score; dynamically adjusts channel allocation according to the comprehensive score;

[0017] Step 6: Intelligent key update and adaptive channel switching, including dynamically adjusting the key update cycle according to the device status, communication frequency and security risk level, generating a new session key and synchronizing it to both communication ends; when the channel status deteriorates, a deep reinforcement learning algorithm is used to calculate the switching cost, and a new channel with the smallest delay is selected based on the calculation result to complete the switching.

[0018] Preferably, when executing step 1, the following steps are specifically included:

[0019] Step 1-1: The terminal generates a key pair, specifically using the elliptic curve digital signature algorithm ECDSA Generate a public-private key pair P pub_T and P priv_T , the public and private keys are as follows:

[0020] Public Key: P pub_T = kG ;

[0021] Private Key: P priv_T ∈ [1, n −1];

[0022] in, k is a random private key, G is the elliptic curve base point;n Represents elliptic curve parameters and defines the order of the finite field;

[0023] Step 1-2: Submit a registration application, specifically the device sends its identification ID T and signature Sign T ( ID T ):

[0024] Sign T ( ID T )={ r , s};

[0025] The signature component generated by the private key: r = ( kG ) x mod n ; s = k −1 × ( ID T + P priv_T × r ) mod n ;

[0026] in, ID T It is the unique identifier of the device; Sign T ( ID T ) indicates a device T Use its private key P priv_T Self-identification ID T The digital signature includes r and s ;

[0027] Step 1-3: The authentication management platform issues a certificate, specifically verifying the device signature and generating a digital certificate for the device Cert T :

[0028] Cert T = { ID T , P pub_T , Sign CA ( IDT , P pub_T )};

[0029] in, Cert T It is a digital certificate issued by the authentication management platform; Sign CA ( ID T , P pub_T ) indicates the authentication management platform CA Identification of equipment ID T and the public key P pub_T Generated digital signature;

[0030] Step 1-4: Blockchain storage whitelist, specifically ID T ,Certificate Cert T , Registration time Treg T Stored in the blockchain as a whitelist:

[0031] WhiteList _ Block = { ID T , P pub_T , T reg , Cert T};

[0032] in, WhiteList _ Block It is a whitelist record stored in the blockchain.

[0033] Preferably, when executing step 2, the following steps are specifically included:

[0034] Step 2-1: The terminal scans the spectrum and records the utilization of each channel U i :

[0035] U i = Busy _ Time i ÷ Total _ Time ;

[0036] in, Busy _ Time i Channel occupancy time, Total _Time Total communication time;

[0037] Step 2-2: Target channel selection, select a channel with utilization below the threshold f target :

[0038] f target = argmin ( U i ),and U i ≤ Thresh ;

[0039] in, Thresh It is the preset threshold of channel utilization.

[0040] Preferably, when executing step 3, the following steps are specifically included:

[0041] Step 3-1: The terminal sends an authentication request:

[0042] Req auth = { ID T , T 1, Sign T ( ID T , T 1)};

[0043] in, R eqauth is the authentication request sent by the device; T 1 is the current timestamp, used to prevent replay attacks; Sign T ( ID T , T 1) Indicates the device T Use its private key P priv_T For messages ( ID T , T 1) The generated digital signature, ID T Indicates the unique identifier of the device;

[0044] Step 3-2: Gateway returns a random number RN and its own certificate Cert G :

[0045] in, RN The random number returned by the gateway; CertG It is the digital certificate of the gateway;

[0046] Step 3-3: Both parties negotiate a shared session key through the elliptic curve key exchange protocol Ks :

[0047] Ks = Hash ( P pubG ⋅ P priv_T );

[0048] Among them, ⋅ represents the elliptic curve point multiplication operation; P pubG Indicates the public key of the gateway; P priv_T Represents the private key of the device.

[0049] Preferably, when executing step 4, the following steps are specifically included:

[0050] Step 4-1: Before each communication, the terminal sends a verification packet Verify T :

[0051] Verify T = { ID T , T 2, MAC ( Ks , T 2)};

[0052] in, T 2 represents the timestamp, which is used to prevent replay attacks; MAC ( Ks , T 2) represents a message authentication code generated based on a session key and a timestamp; ID T Indicates the unique identifier of the device; Ks Indicates that the two parties negotiate a shared session key through the elliptic curve key exchange protocol;

[0053] Step 4-2: The gateway performs identity authentication based on the device behavior pattern, trust score, and permission rules. Specifically, it performs identity authentication based on the dynamic behavior pattern and trust score. Trust T The weighted function calculation of is:

[0054] Trust T = w 5× f 1( ID T )+ w 6×f 2( Role )+ w 7× f 3( Behavior );

[0055] in, Role Indicates the role type of the device. Behavior Indicates the behavior mode of the device; f 1 Based on device identifier ID T The scoring function is the cumulative sum of the number of successful authentications of the device in history;

[0056] f 1( ID T )= historical _ score ( ID T );

[0057] f 1 is equipment ID T Cumulative weighted scoring function for authentication success history;

[0058] f 2 is the scoring function of the device role, which assigns a basic trust value according to the role of the device in the network;

[0059] f 3. Scoring function based on device behavior pattern, specifically scoring based on device stability;

[0060] Preferably, when executing step 5, the following steps are specifically included:

[0061] Step 5-1: Real-time spectrum monitoring, specifically collecting all channel utilization and channel status, and constructing a channel utilization set and a channel status set:

[0062] S ={ Interference i , SignalQuality i , NoiseLevel i};

[0063] in, Interference Indicates the interference strength of the channel; SignalQuality Indicates the signal quality of the channel. NoiseLevel Indicates the noise level of the channel; i Indicates the channel number; S represents a set of channel states;

[0064] Step 5-2: Channel UtilizationU i and collection S Perform normalization:

[0065] ;

[0066] ;

[0067] ;

[0068] ;

[0069] in, Represents the normalized channel i The interference intensity; Represents the normalized channel i signal quality; Represents the normalized channel i Noise level; Represents the normalized channel i Utilization rate; U Indicates the utilization of the channel;

[0070] Step 5-3: For each channel, use the normalized channel utilization and collection S , perform weight calculation and obtain the comprehensive score of each channel:

[0071] ;

[0072] in, w 1, w 2, w 3, w 4 are all weights, satisfying w 1 + w 2 + w 3 + w 4 = 1;

[0073] Step 5-4: Select the channel with the highest comprehensive score as the optimal channel and adjust the channel allocation.

[0074] Preferably, when executing step 6, the following steps are specifically included:

[0075] Step 6-1: Dynamically adjust the update period, specifically including calculating the key update period:

[0076] T update = F usage ÷( R risk ×W importance );

[0077] in, T update Indicates the key update period; F usage Indicates the device communication frequency; R risk represents the communication risk factor; W importance Indicates the key importance weight;

[0078] Key Update Ks new :

[0079] Ks new = Hash ( Ks ∣∣ T update );

[0080] Step 6-2: Channel switching algorithm, including improving the switching cost model and reinforcement learning model:

[0081] The improved switching cost model is as follows:

[0082] Total _ Cost = α × Latency _ Cost + β × Interference _ Cost + γ × Usage _ Cost ;

[0083] in, Total _ Cost represents the total cost of channel switching; Latency _ Cost represents the delay cost of channel switching; Interference _ Cost represents the cost introduced by inter-channel interference; Usage _ Cost represents the performance cost caused by channel utilization; α , β and γ All are weights;

[0084] The reinforcement learning model is as follows:

[0085] Defining the state space S , Action Space A , reward function R :

[0086] Q ( St , At ) = Q ( St , At ) + η × [ Rt + γ 1 × maxQ ( St +1, At +1) − Q ( St , At )];

[0087] in, Q ( St , At ) represents the action value function in deep reinforcement learning, t Indicates the time, η represents the learning rate; γ 1 represents a discount factor, indicating the importance of future rewards.

[0088] The terminal access authentication method of the wireless networking protocol of an Internet of Things node device described in the present invention solves the technical problems of device access security, channel dynamic optimization and trust management in the communication process during the wireless networking of the Internet of Things node device. The present invention dynamically adjusts the key update cycle through elliptic curve digital signature and session key negotiation mechanism, effectively responds to key leakage and dynamic threats, dynamically adjusts channel allocation, reduces interference and improves communication efficiency, realizes continuous trust verification of devices through dynamic trust scoring and behavior pattern analysis, reduces the potential risks of untrusted devices, and uses blockchain technology to store device information and whitelists to enhance the immutability and transparency of data. BRIEF DESCRIPTION OF THE DRAWINGS

[0089] Figure 1 It is the main flow chart of the present invention;

[0090] Figure 2 is a flow chart of step 1 of the present invention;

[0091] Figure 3 is a flow chart of step 3 of the present invention;

[0092] Figure 4 is a flow chart of step 4 of the present invention;

[0093] Figure 5 is a flow chart of step 5 of the present invention;

[0094] Figure 6 It is a flow chart of step 6 of the present invention. DETAILED DESCRIPTION

[0095] Depend on Figures 1 - 6 The terminal access authentication method of the wireless networking protocol of an Internet of Things node device shown includes the following steps:

[0096] Step 1: Device initialization and registration, which includes the device generating a public-private key pair through the elliptic curve digital signature algorithm, and sending the device identification and its signature to the authentication management platform to initiate a registration application; the authentication management platform verifies the device identity, issues a digital certificate, and stores the device registration information in the blockchain to form a secure basic whitelist;

[0097] When executing step 1, the specific steps include:

[0098] Step 1-1: The terminal generates a key pair, specifically using the elliptic curve digital signature algorithm ECDSA Generate a public-private key pair P pub_T and P priv_T , the public and private keys are as follows:

[0099] Public Key: P pub_T = kG ;

[0100] Private Key: P priv_T ∈ [1, n −1];

[0101] in, k is a random private key, G is the elliptic curve base point; n Represents elliptic curve parameters and defines the order of the finite field;

[0102] Step 1-2: Submit a registration application, specifically the device sends its identification ID T and signature Sign T ( ID T ):

[0103] Sign T ( ID T )={ r , s};

[0104] The signature component generated by the private key: r = ( kG ) x mod n ;s = k −1 × ( ID T + P priv_T × r ) mod n ;

[0105] in, ID T It is the unique identifier of the device; Sign T ( ID T ) indicates a device T Use its private key P priv_T Self-identification ID T The digital signature includes r and s ;

[0106] In this embodiment, mod n Used to restrict the horizontal axis to a finite field n Inside. r and s The formula is based on elliptic curve cryptography and mathematical operations on finite fields. The core purpose is to use the private key Ppriv T Digitally sign a message without directly revealing the private key. The validity of the signature can be confirmed through the following process:

[0107] use r and s Combined with public key Ppub T Restore the message (or its hash);

[0108] Compare the restored message with the original message to see if they are consistent;

[0109] If they are consistent, it means that the signature is generated by a legitimate private key and the message has not been tampered with.

[0110] Step 1-3: The authentication management platform issues a certificate, specifically verifying the device signature and generating a digital certificate for the device Cert T :

[0111] Cert T = { ID T , P pub_T , Sign CA (ID T , P pub_T )};

[0112] in, Cert T It is a digital certificate issued by the authentication management platform; Sign CA ( ID T , P pub_T ) indicates the authentication management platform CA Identification of equipment ID T and the public key P pub_T Generated digital signature;

[0113] Step 1-4: Blockchain storage whitelist, specifically ID T ,Certificate Cert T , Registration time Treg T Stored in the blockchain as a whitelist:

[0114] WhiteList _ Block = { ID T , P pub_T , T reg , Cert T};

[0115] in, WhiteList _ Block It is a whitelist record stored in the blockchain.

[0116] In this embodiment, after the device registration is completed, the authentication management platform ( CA ) The device registration information is constructed as a blockchain transaction and submitted to the blockchain network. The device information is stored in the blockchain's smart contract or data storage module as the transaction content. The blockchain can store the device information as a "whitelist" through a mapping data structure (such as mapping). After the transaction is packaged, the device information will be added to the whitelist data structure. The whitelist stored in the blockchain can be queried and verified at any time. The device or gateway can obtain the device registration information through the blockchain's query interface. If the device exists, the device's public key, certificate, registration time and other information will be returned.

[0117] Step 2: Spectrum scanning and target channel selection, specifically including the device scanning the channels in the current environment in real time through the spectrum scanning module, recording the utilization of each channel; and preferentially selecting the channel with utilization lower than the preset threshold as the target channel;

[0118] In this embodiment, the spectrum scanning module is mainly used to monitor the status of available channels in the wireless communication environment in real time, including but not limited to indicators such as channel utilization, interference intensity, and signal strength. The spectrum scanning module is specifically, for example Wi - Fi Modules, Zigbee Module or LoRa The module, through the driver and spectrum scanning algorithm, records the utilization rate of each channel obtained by scanning, the proportion of busy time, and the interference degree of adjacent channels.

[0119] When executing step 2, the specific steps include:

[0120] Step 2-1: The terminal scans the spectrum and records the utilization of each channel U i :

[0121] U i = Busy _ Time i ÷ Total _ Time ;

[0122] in, Busy _ Time i Channel occupancy time, Total _ Time Total communication time;

[0123] Step 2-2: Target channel selection, select a channel with utilization below the threshold f target :

[0124] f target = argmin ( U i ),and U i ≤ Thresh ;

[0125] in, Thresh It is the preset threshold of channel utilization.

[0126] Step 3: Terminal authentication and session key negotiation, specifically including the device sending an authentication request to the gateway through a dynamic authentication mechanism, including identity information and timestamp; the gateway returns a random number and its own digital certificate, and the two parties negotiate a shared session key through the elliptic curve key exchange protocol for subsequent communication encryption;

[0127] When executing step 3, the specific steps include:

[0128] Step 3-1: The terminal sends an authentication request:

[0129] Req auth = { ID T , T 1, Sign T ( ID T , T 1)};

[0130] in, Req auth is the authentication request sent by the device; T 1 is the current timestamp, used to prevent replay attacks; Sign T ( ID T , T 1) Indicates the device T Use its private key P priv_T For messages ( ID T , T 1) The generated digital signature, ID T Indicates the unique identifier of the device;

[0131] Step 3-2: Gateway returns a random number RN and its own certificate Cert G :

[0132] in, RN The random number returned by the gateway; Cert G It is the digital certificate of the gateway;

[0133] Step 3-3: Both parties negotiate a shared session key through the elliptic curve key exchange protocol Ks :

[0134] Ks = Hash ( P pubG ⋅ P priv_T );

[0135] Among them, ⋅ represents the elliptic curve point multiplication operation; P pubG Indicates the public key of the gateway; P priv_T Represents the private key of the device. Hash is a hash function, such as SHA-256 or SHA-3.

[0136] Step 4: Dynamic trust verification and permission check. Specifically, before each communication, the device sends a verification package through dynamic verification, and the gateway performs identity authentication based on the device behavior pattern, trust score, and permission rules. After the verification is passed, the gateway allows communication and only authorizes trusted devices to access resources.

[0137] When executing step 4, the specific steps include:

[0138] Step 4-1: Before each communication, the terminal sends a verification packet Verify T :

[0139] Verify T = { ID T , T 2, MAC ( K s , T 2)};

[0140] in, T 2 represents the timestamp, which is used to prevent replay attacks; MAC ( Ks , T 2) represents a message authentication code generated based on a session key and a timestamp; ID T Indicates the unique identifier of the device; Ks Indicates that the two parties negotiate a shared session key through the elliptic curve key exchange protocol;

[0141] Step 4-2: The gateway performs identity authentication based on the device behavior pattern, trust score, and permission rules. Specifically, it performs identity authentication based on the dynamic behavior pattern and trust score. Trust T The weighted function calculation of is:

[0142] Trust T = w 5× f 1( IDT )+ w 6× f 2( Role )+ w 7×f 3( Behavior );

[0143] in, Role Indicates the role type of the device. Behavior Indicates the behavior mode of the device; f 1 is based on the device identifier ID T The scoring function is the cumulative sum of the number of successful historical authentications of the device:

[0144] f 1( ID T )= historical _ score ( ID T );

[0145] f 1 is equipment ID T Cumulative weighted scoring function of the number of successful authentication history records.

[0146] In this embodiment, f 1( ID T ) = α × S auth ( ID T ) − β × F auth ( ID T );

[0147] in, S auth ( ID T ) is the device ID T in the past T window The number of successful authentications within a certain period of time;

[0148] F auth ( ID T ) is the device ID T in the past T window The number of authentication failures within a certain period of time;

[0149] α is the success weight factor (e.g. 1.0, used to control the contribution value of successful authentication);

[0150] β is the failure weight factor (e.g. 2.0, used to penalize the impact of authentication failure);

[0151] T window It is a sliding time window (such as the last 7 days, 30 days).

[0152] f 2 is the scoring function of the device role, which assigns a basic trust value based on the role of the device in the network. For example, key devices in the network (such as gateways and controllers) may have a higher initial trust score. The specific score value is preset based on user needs.

[0153] f 3. A scoring function based on device behavior patterns, specifically a scoring function based on device stability, where devices that operate normally have high scores.

[0154] In this embodiment, the device stability is reflected in the proportion of the normal communication behavior of the device in the total communication time and the proportion of abnormal behavior in the total communication time; a longer proportion of normal communication behavior indicates high device stability and a higher score.

[0155] In this embodiment, the score of a normally operating device is preset to 1 or 0.5. When the proportion of normal communication behavior reaches 60%, the score is fixed to 1, otherwise, it is fixed to 0.5;

[0156] Step 5: Real-time spectrum monitoring and channel optimization, specifically including during the communication process, the device monitors the current channel usage status in real time, records the channel utilization rate and channel status; normalizes the channel utilization rate and channel status, and then calculates the weight to obtain a comprehensive score; dynamically adjusts channel allocation according to the comprehensive score;

[0157] When executing step 5, the specific steps include:

[0158] Step 5-1: Real-time spectrum monitoring, specifically collecting all channel utilization and channel status, and constructing a channel utilization set and a channel status set:

[0159] S ={ Interference i , SignalQuality i , NoiseLevel i};

[0160] in, Interference Indicates the interference strength of the channel; SignalQuality Indicates the signal quality of the channel. NoiseLevel Indicates the noise level of the channel; i Indicates the channel number; Srepresents a set of channel states;

[0161] Step 5-2: Channel Utilization U i and collection S Perform normalization:

[0162] ;

[0163] ;

[0164] ;

[0165] ;

[0166] in, Represents the normalized channel i The interference intensity; Represents the normalized channel i signal quality; Represents the normalized channel i Noise level; Represents the normalized channel i Utilization rate; U Indicates the utilization of the channel;

[0167] Step 5-3: For each channel, use the normalized channel utilization and collection S , perform weight calculation and obtain the comprehensive score of each channel:

[0168] ;

[0169] in, w 1, w 2, w 3, w 4 are all weights, satisfying w 1 + w 2 + w 3 + w 4 = 1;

[0170] Step 5-4: Select the channel with the highest comprehensive score as the optimal channel and adjust the channel allocation.

[0171] Step 6: Intelligent key update and adaptive channel switching, including dynamically adjusting the key update cycle according to the device status, communication frequency and security risk level, generating a new session key and synchronizing it to both communication ends; when the channel status deteriorates, a deep reinforcement learning algorithm is used to calculate the switching cost, and a new channel with the smallest delay is selected based on the calculation result to complete the switching.

[0172] When executing step 6, the specific steps include:

[0173] Step 6-1: Dynamically adjust the update period, specifically including calculating the key update period:

[0174] T update = F usage ÷( R risk × W importance );

[0175] in, T update Indicates the key update period; F usage Indicates the device communication frequency; R risk represents the communication risk factor; W importance Indicates the key importance weight;

[0176] Key Update Ks new :

[0177] Ks new = Hash ( Ks ∣∣ T update );

[0178] Step 6-2: Channel switching algorithm, including improving the switching cost model and reinforcement learning model:

[0179] The improved switching cost model is as follows:

[0180] Total _ Cost = α × Latency _ Cost + β × Interference _ Cost + γ × Usage _ Cost ;

[0181] in, Total _ Cost represents the total cost of channel switching; Latency _ Cost represents the delay cost of channel switching; Interference _ Cost represents the cost introduced by inter-channel interference; Usage _ Cost represents the performance cost caused by channel utilization; α , β and γ All are weights;

[0182] The reinforcement learning model is as follows:

[0183] Defining the state space S , Action Space A , reward function R :

[0184] Q ( St , At ) = Q ( St , At ) + η × [ Rt + γ 1 × maxQ ( St +1, At +1) − Q ( St , At )];

[0185] in, Q ( St , At ) represents the action value function in deep reinforcement learning, t Indicates the time, η represents the learning rate; γ 1 represents a discount factor, indicating the importance of future rewards.

[0186] The following is a specific application scenario in this embodiment:

[0187] S 1: Device initialization and registration:

[0188] equipment: Device _001.

[0189] operate:

[0190] Equipment Use ECDSA The algorithm generates a public and private key pair:

[0191] Public Key P pub_T = kG , private key P priv_T .

[0192] Device generated signature Sign T ( ID T ):

[0193] Equipment identification ID T = Device _001.

[0194] sign{ r , s}, upload to the authentication management platform.

[0195] The authentication management platform verifies the signature and issues a digital certificate:

[0196] Cert T = { ID T , P pub_T , Sign CA ( ID T , P pub_T )}.

[0197] Whitelist stored in blockchain: ID T , P pub_T , T reg , Cert T}.

[0198] S 2: Spectrum scanning and target channel selection:

[0199] Equipment Operation:

[0200] Device _001 Pass Zigbee The module scans channel utilization, and the results are as follows:

[0201] Channel 1: Utilization rate 70%.

[0202] Channel 2: Utilization rate 20%.

[0203] Channel 3: Utilization rate 50%.

[0204] Select channel 2 ( f target = 20%), because its utilization is below the threshold Thresh = 30%.

[0205] S 3: Terminal authentication and session key negotiation:

[0206] Device authentication request:

[0207] Req auth = { Device _001, T 1, Sign T ( Device _001, T 1)}.

[0208] Timestamp T 1 = xxxx-xx-xx t xx:xx:xx .

[0209] Gateway response:

[0210] Returns a random number RN = 123456 and its own certificate Cert G .

[0211] Both parties negotiate a session key Ks = Hash ( P pubG ⋅ P priv_T ).

[0212] S 4: Dynamic trust verification and permission check:

[0213] Verify the package:

[0214] Verify T = { Device _001, T 2, MAC ( Ks , T 2)}, timestamp T 2 = xxxx-xx-xx t xx:xx:xx .

[0215] Trust Assessment:

[0216] The scoring rules are preset in this embodiment:

[0217] Key devices: such as gateways and controllers, are assigned a higher initial trust value (such as 90 points).

[0218] Ordinary devices: such as sensors and terminal devices, are assigned a medium initial trust value (such as 70 points).

[0219] Unconventional devices: such as devices that are not clearly classified, are assigned a lower initial trust value (such as 50 points).

[0220] according to Role = The name of the node device (such as gateway) and the history of its behavior patterns to calculate the trust score Trust T = 0.95 (credible).

[0221] Result: Authentication passed, allowing access to control system data.

[0222] S 5: Real-time spectrum monitoring and channel optimization:

[0223] Operation: The device monitors the interference of channel 2 in real time and finds that the utilization rate has risen to 70%. It is preparing to reallocate a new channel.

[0224] Optimization: For each channel, use the normalized channel utilization U i and collection S , perform weight calculation and obtain the comprehensive score of each channel:

[0225] Interference: The interference strength of the channel, the lower the value, the better;

[0226] SignalQuality: The signal quality of the channel, the higher the value, the better;

[0227] NoiseLevel: The noise level of the channel, the lower the value, the better;

[0228] U： Channel utilization, the lower the value, the better;

[0229] After all channels are scored, the channel with the highest score is selected for allocation;

[0230] In this embodiment, the channel is scored once every 30 minutes.

[0231] S 6: Intelligent key update and adaptive channel switching:

[0232] Operation: Key Renewal Cycle T update = 10 minutes, generate new key Ks new = Hash ( Ks || T update ).

[0233] Channel switching model: Considering delay and interference, switch to the channel with the minimum delay.

[0234] The terminal access authentication method of the wireless networking protocol of an Internet of Things node device described in the present invention solves the technical problems of device access security, channel dynamic optimization and trust management in the communication process during the wireless networking of the Internet of Things node device. The present invention dynamically adjusts the key update cycle through elliptic curve digital signature and session key negotiation mechanism, effectively responds to key leakage and dynamic threats, dynamically adjusts channel allocation, reduces interference and improves communication efficiency, realizes continuous trust verification of devices through dynamic trust scoring and behavior pattern analysis, reduces the potential risks of untrusted devices, and uses blockchain technology to store device information and whitelists to enhance the immutability and transparency of data.

Claims

1. A terminal access authentication method for a wireless networking protocol of an Internet of Things node device, characterized in that: The steps include: Step 1: Device initialization and registration, which includes the device generating a public-private key pair through the elliptic curve digital signature algorithm, and sending the device identification and its signature to the authentication management platform to initiate a registration application; the authentication management platform verifies the device identity, issues a digital certificate, and stores the device registration information in the blockchain to form a secure basic whitelist; Step 2: Spectrum scanning and target channel selection, specifically including the device scanning the channels in the current environment in real time through the spectrum scanning module, recording the utilization of each channel; and preferentially selecting the channel with utilization lower than the preset threshold as the target channel; Step 3: Terminal authentication and session key negotiation, specifically including the device sending an authentication request to the gateway through a dynamic authentication mechanism, including identity information and timestamp; the gateway returns a random number and its own digital certificate, and the two parties negotiate a shared session key through the elliptic curve key exchange protocol for subsequent communication encryption; Step 4: Dynamic trust verification and permission check. Specifically, before each communication, the device sends a verification package through dynamic verification, and the gateway performs identity authentication based on the device behavior pattern, trust score, and permission rules. After the verification is passed, the gateway allows communication and only authorizes trusted devices to access resources. Step 5: Real-time spectrum monitoring and channel optimization, specifically including during the communication process, the device monitors the current channel usage status in real time, records the channel utilization rate and channel status; normalizes the channel utilization rate and channel status, and then calculates the weight to obtain a comprehensive score; dynamically adjusts channel allocation according to the comprehensive score; Step 6: Intelligent key update and adaptive channel switching, including dynamically adjusting the key update cycle according to the device status, communication frequency and security risk level, generating a new session key and synchronizing it to both communication ends; when the channel status deteriorates, a deep reinforcement learning algorithm is used to calculate the switching cost, and a new channel with the smallest delay is selected based on the calculation result to complete the switching.

2. A terminal access authentication method for a wireless networking protocol of an Internet of Things node device as claimed in claim 1, characterized in that: When executing step 1, the specific steps include: Step 1-1: The terminal generates a key pair, specifically using the elliptic curve digital signature algorithm ECDSA Generate a public-private key pair P pub_T and P priv_T , the public and private keys are as follows: Public Key: P pub_T = k ; Private Key: P priv_T ∈ [1, n −1]; in, k is a random private key, G is the elliptic curve base point; n Represents elliptic curve parameters and defines the order of the finite field; Step 1-2: Submit a registration application, specifically the device sends its identification ID T and signature Sign T ( ID T ): Sign T ( ID T )={ r , s}； The signature component generated by the private key: r = ( k ) x modn ; s = k −1 × ( ID T + P priv_T × r ) modn ; x Represents an elliptic curve point k of x coordinate; in, ID T It is the unique identifier of the device; Sign T ( ID T ) indicates a device T Use its private key P priv_T Self-identification ID T The digital signature includes r and s ; Step 1-3: The authentication management platform issues a certificate, specifically verifying the device signature and generating a digital certificate for the device Cert T : Cert T = { ID T , P pub_T , Sign CA ( ID T , P pub_T )}； in, Cert T It is a digital certificate issued by the authentication management platform; Sign CA ( ID T , P pub_T ) indicates the authentication management platform CA Identification of equipment ID T and the public key P pub_T Generated digital signature; Step 1-4: Blockchain storage whitelist, specifically ID T ,Certificate Cert T , Registration time Treg T Stored in the blockchain as a whitelist: WhiteList _ Block = { ID T , P pub_T , Treg T , Cert T}； in, WhiteList _ Block It is a whitelist record stored in the blockchain.

3. A terminal access authentication method for a wireless networking protocol of an Internet of Things node device as claimed in claim 2, characterized in that: When executing step 2, the specific steps include: Step 2-1: The terminal scans the spectrum and records the utilization of each channel U i : U i = Busy _ Time i ÷ Total _ Time ； in, Busy _ Time i Channel occupancy time, Total _ Time Total communication time; Step 2-2: Target channel selection, select a channel with utilization below the threshold f target : f target = argmin ( U i ),and U i ≤ Thresh ; in, Thresh It is the preset threshold of channel utilization.

4. A terminal access authentication method for a wireless networking protocol of an Internet of Things node device as claimed in claim 3, characterized in that: When executing step 3, the specific steps include: Step 3-1: The terminal sends an authentication request: Req auth = { ID T , T 1, Sign T ( ID T , T 1)}； in, R eqauth is the authentication request sent by the device; T 1 is the current timestamp, used to prevent replay attacks; Sign T ( ID T , T 1) Indicates the device T Use its private key P priv_T For messages ( ID T , T 1) The generated digital signature, ID T Indicates the unique identifier of the device; Step 3-2: Gateway returns a random number RN and its own certificate Cert G : in, RN The random number returned by the gateway; Cert G It is the digital certificate of the gateway; Step 3-3: Both parties negotiate a shared session key through the elliptic curve key exchange protocol Ks : Ks = Hash ( P pubG ⋅ P priv_T )； Among them, ⋅ represents the elliptic curve point multiplication operation; P pubG Indicates the public key of the gateway; P priv_T Represents the private key of the device.

5. The terminal access authentication method of the wireless networking protocol of an Internet of Things node device as claimed in claim 4 is characterized in that: When executing step 4, the specific steps include: Step 4-1: Before each communication, the terminal sends a verification packet Verify T : Verify T = { ID T , T 2, MAC ( Ks , T 2)}； in, T 2 represents the timestamp, which is used to prevent replay attacks; MAC ( Ks , T 2) represents a message authentication code generated based on a session key and a timestamp; ID T Indicates the unique identifier of the device; Ks Indicates that the two parties negotiate a shared session key through the elliptic curve key exchange protocol; Step 4-2: The gateway performs identity authentication based on the device behavior pattern, trust score, and permission rules. Specifically, it performs identity authentication based on the dynamic behavior pattern and trust score. Trust T The weighted function calculation of is: Trust T = w 5× f 1( ID T )+ w 6× f 2( Role )+ w 7× f 3( Behavior )； in, Role Indicates the role type of the device. Behavior Indicates the behavior mode of the device. w 5. w 6 and w 7 are weight coefficients; f 1 Based on device identifier ID T The scoring function is the cumulative sum of the number of successful historical authentications of the device: f 1( ID T )= historical _ score ( ID T )； f 1 is equipment ID T Cumulative weighted scoring function for authentication success history; f 2 is the scoring function of the device role, which assigns a basic trust value according to the role of the device in the network; f 3. Scoring function based on device behavior pattern, specifically, scoring based on device stability.

6. A terminal access authentication method for a wireless networking protocol of an Internet of Things node device as claimed in claim 5, characterized in that: When executing step 5, the specific steps include: Step 5-1: Real-time spectrum monitoring, specifically collecting all channel utilization and channel status, and constructing a channel utilization set and a channel status set: S ={ Interference i , SignalQuality i , NoiseLevel i}； in, Interference Indicates the interference strength of the channel; SignalQuality Indicates the signal quality of the channel. NoiseLevel Indicates the noise level of the channel; i Indicates the channel number; S represents a set of channel states; Step 5-2: Channel Utilization U i and collection S Perform normalization: ； ； ； ； in, Represents the normalized channel i The interference intensity; Represents the normalized channel i signal quality; Represents the normalized channel i Noise level; Represents the normalized channel i Utilization rate; U Indicates the utilization of the channel; Step 5-3: For each channel, use the normalized channel utilization and collection S , perform weight calculation and obtain the comprehensive score of each channel: ； in, w 1, w 2, w 3, w 4 are all weights, satisfying w 1 + w 2 + w 3 + w 4 = 1; Step 5-4: Select the channel with the highest comprehensive score as the optimal channel and adjust the channel allocation.

7. A terminal access authentication method for a wireless networking protocol of an Internet of Things node device as claimed in claim 6, characterized in that: When executing step 6, the specific steps include: Step 6-1: Dynamically adjust the update period, specifically including calculating the key update period: T update = F usage ÷（ R risk × W importance ）； in, T update Indicates the key update period; F usage Indicates the device communication frequency; R risk represents the communication risk factor; W importance Indicates the key importance weight; Key Update Ks new : Ks new = Hash ( Ks ∣∣ T update )； Step 6-2: Channel switching algorithm, including improving the switching cost model and reinforcement learning model: The improved switching cost model is as follows: Total _ Cost = α × Latency _ Cost + β × Interference _ Cost + γ × Usage _ Cost ； in, Total _ Cost represents the total cost of channel switching; Latency _ Cost represents the delay cost of channel switching; Interference _ Cost represents the cost introduced by inter-channel interference; Usage _ Cost represents the performance cost caused by channel utilization; α , β and γ All are weights; The reinforcement learning model is as follows: Defining the state space S , Action Space A , reward function R : Q ( St , At ) = Q ( St , At ) + η × [ R + γ 1 × maxQ ( St +1, At +1) − Q ( St , At )]； in, Q ( St , At ) represents the action value function in deep reinforcement learning, t Indicates the time, η represents the learning rate; γ 1 represents a discount factor, indicating the importance of future rewards.

Images