Distributed device identity authentication and access control method and system based on blockchain

Abstract

The present invention provides a distributed device identity authentication and access control method and system based on blockchain, which relates to the field of blockchain technology, including that a to-be-accessed device generates a target device fingerprint based on the physical non-cloning function of its own device, binds the target device fingerprint with a device public key to generate device identity information, and stores the device identity information in a blockchain through an identity authentication smart contract; an authentication node queries the corresponding device identity information based on the device fingerprint sent by the to-be-accessed device, and uses the device public key to verify the digital signature in the access authentication request; an access device that passes the authentication and obtains an encrypted session key obtains an access control policy pre-configured by an administrator through an access control smart contract; and when the access device needs to access network resources, it accesses network resources based on the access control policy.

Description

Technical Field

[0001] The present invention relates to blockchain technology, and in particular to a distributed device identity authentication and access control method and system based on blockchain. Background Art

[0002] With the rapid development of IoT technology, it has become normal for a large number of smart devices to access the network. During the device access process, device authentication and access control are key links in ensuring network security. Traditional device authentication methods mainly rely on preset keys or certificates. This centralized management method has a single point of failure risk and is difficult to cope with the identity management needs of large-scale devices.

[0003] Currently, common device identity authentication solutions mainly include the following categories:

[0004] The shared key authentication method requires the same key to be pre-deployed between the device and the authentication server, which has high management costs and is prone to key leakage.

[0005] The certificate authentication method based on PKI (Public Key Infrastructure) relies on a trusted third-party CA organization and has centralization risks;

[0006] Although the authentication method based on device fingerprint can provide unique identification, it lacks an effective distributed evidence storage mechanism.

[0007] In terms of access control, traditional solutions usually adopt centralized policy management and execution mechanisms, which have the following problems:

[0008] Policy management and execution are overly dependent on centralized servers, and availability is difficult to guarantee;

[0009] The efficiency of policy update and distribution is low, making it difficult to meet the needs of dynamic scenarios;

[0010] Access control records are easily tampered with and have poor traceability.

[0011] Blockchain technology has the characteristics of decentralization, immutability, and traceability, which provides a new idea for solving problems in device identity authentication and access control. However, the complete solution of combining blockchain technology with the physical characteristics of devices to achieve trusted registration and authentication of device identities and access control based on smart contracts has yet to be explored.

[0012] Therefore, there is an urgent need to propose a distributed device identity authentication and access control method based on blockchain, which can not only ensure the uniqueness and non-forgeability of device identity, but also realize flexible and reliable access control policy management to meet the actual needs of device access security in the Internet of Things environment. Summary of the invention

[0013] The embodiments of the present invention provide a distributed device identity authentication and access control method and system based on blockchain, which can solve the problems in the prior art.

[0014] According to a first aspect of the embodiments of the present invention,

[0015] Provides a distributed device identity authentication and access control method based on blockchain, including:

[0016] The device to be connected generates the target device fingerprint based on its own physical non-cloning function, binds the target device fingerprint with the device public key to generate the device identity information, and stores the device identity information on the blockchain through the identity authentication smart contract to complete the on-chain registration of the device identity; when the device to be connected initiates an access authentication request, the device fingerprint, public key, access request timestamp and digital signature generated by the device private key of the device to be connected are sent to the authentication node;

[0017] After receiving the access authentication request, the authentication node accesses the identity authentication smart contract; the authentication node queries the corresponding device identity information based on the device fingerprint sent by the access device, obtains the device public key in the device identity information, and uses the device public key to verify the digital signature in the access authentication request; if the digital signature verification is successful, the authentication node randomly generates a session key, encrypts it with the verified device public key, and returns the encrypted session key to the access device;

[0018] The access device that passes the authentication and obtains the encrypted session key obtains the access control policy pre-configured by the administrator through the access control smart contract. The access control policy is signed by the administrator using the administrator's private key and uploaded to the chain. It includes the access permission level of the access device, the accessible target device or service, the access validity time window, and the access limit. When the access device needs to access network resources, it accesses network resources based on the access control policy.

[0019] In an optional embodiment,

[0020] The device to be connected generates the target device fingerprint based on its own physical non-cloning function, and binds the target device fingerprint with the device public key to generate device identity information, including:

[0021] The device to be connected is based on a physical non-cloning chip of its own device, in which a ring oscillator array and an analog-to-digital converter are integrated. When the physical non-cloning chip is powered on, each ring oscillator in the ring oscillator array generates a random oscillation frequency according to its own physical characteristics, including transistor threshold voltage, channel width, and gate oxide layer thickness. The analog-to-digital converter samples and converts the oscillation frequency to obtain a set of digital parameters as the original data of the device fingerprint;

[0022] The device to be connected reads the original data of the device fingerprint from the physical non-cloning chip, pre-processes the original data, confuses and diffuses the original data through a linear feedback shift register circuit or a nonlinear chaotic mapping circuit, extracts the data bits with higher stability, and recombines them to form an intermediate device fingerprint; the device to be connected concatenates the intermediate device fingerprint with the device serial number, device model, and device manufacturer identification ID in a predefined order and format to form fingerprint-identification composite information, and uses a cryptographic secure hash algorithm with the fingerprint-identification composite information as input to calculate a fixed-length hash summary as the target device fingerprint;

[0023] The device to be connected uses the elliptic curve cryptography algorithm to generate a 256-bit elliptic curve public-private key pair, extract the public key, concatenate the target device fingerprint with the device public key, and generate device identity information according to the predefined data structure and serialization rules; a dynamic encryption salt based on timestamp and counter is used to salt the target device fingerprint and device public key respectively, and then concatenate them, and add the salt value to the device identity information.

[0024] In an optional embodiment,

[0025] The authentication node queries the corresponding device identity information based on the device fingerprint sent by the device to be accessed, obtains the device public key in the device identity information, and uses the device public key to verify the digital signature in the access authentication request, including:

[0026] Check the format and field integrity of the authentication request, verify the timestamp of the authentication request, and determine whether the timestamp is within the preset range of the current time. Authentication requests that exceed the preset range will be directly discarded; the authentication node extracts the device fingerprint original from the authentication request, preprocesses the device fingerprint original, and uses the same obfuscation diffusion algorithm and parameters as the device end to obtain preprocessed fingerprint data; the authentication node extracts the device identification information from the preprocessed fingerprint data, and cascades the preprocessed fingerprint data and identification information in the agreed order and format to form fingerprint-identification composite information;

[0027] The authentication node uses a cryptographically secure hash algorithm consistent with the device end, takes the fingerprint-identification composite information as input, and calculates a fingerprint feature value of a fixed length; the authentication node determines the candidate device identity record in the fingerprint feature-device identity mapping table through a prefix tree and a Bloom filter based on the bit string of the fingerprint feature value; the authentication node compares the device public key and device identification in the candidate device identity record with the corresponding fields in the authentication request, selects a fully matching device identity record, and extracts the device identification and device public key therein; if no matching device identity record is found, the authentication node returns an authentication failure message to the device to be connected, and records a failure log;

[0028] The authentication node uses the extracted device public key to verify the digital signature in the authentication request, where the device fingerprint original, device public key, timestamp and random number are extracted from the request message, and are concatenated in the order and format agreed upon with the device to form the signature original. The authentication node calculates the summary of the signature original using the same hash algorithm as the device, and uses the summary, digital signature and device public key as parameters to call the elliptic curve digital signature verification algorithm to verify the digital signature.

[0029] In an optional embodiment,

[0030] The authentication node randomly generates a session key, encrypts it using the public key of the verified device, and returns the encrypted session key to the device to be connected, including:

[0031] The authentication node generates a temporary elliptic curve cryptographic key pair, which includes a temporary private key and a temporary public key; the authentication node uses the temporary public key, the public key of the device to be accessed, and the randomly generated challenge random number as input parameters, executes the elliptic curve Diffie-Hellman key exchange protocol, and calculates a shared key; the authentication node uses the shared key as an input of a key derivation function to generate a fixed-length session key, and uses the challenge random number to symmetrically encrypt the session key to obtain an encrypted session key;

[0032] The authentication node generates a unique session identifier based on the timestamp and device identifier, binds the session identifier to the encrypted session key, and stores it in the session management module; the authentication node encapsulates the encrypted session key, temporary public key, challenge random number, and session identifier into a key negotiation message; the authentication node uses the public key of the device to be connected to asymmetrically encrypt the key negotiation message to generate an encrypted key negotiation message;

[0033] The authentication node uses its own private key to calculate the hash summary of the encrypted key negotiation message, and uses the private key to digitally sign the hash summary to obtain a digital signature result; the authentication node packages the encrypted key negotiation message, the digital signature result, and the authentication node public key certificate issued by a trusted third party into a security envelope; the authentication node sends the security envelope to the device to be connected through a two-way authentication security channel established on the transport layer security protocol.

[0034] In an optional embodiment,

[0035] The access device that passes the authentication and obtains the encrypted session key obtains the access control policy pre-configured by the administrator through the access control smart contract, including:

[0036] After receiving the security envelope, the access device that has passed the authentication and obtained the encrypted session key verifies the validity of the authentication node public key certificate to confirm that the authentication node public key certificate is issued by a trusted certificate authority and is within the validity period; the access device uses the public key in the authentication node public key certificate to verify the digital signature result to verify that the key negotiation message has not been tampered with; the access device uses its own private key to decrypt the encrypted key negotiation message and extract the temporary public key, challenge random number, encrypted session key and session identifier;

[0037] The access device executes the same elliptic curve Diffie-Hellman key exchange protocol as the authentication node, and uses the temporary public key of the authentication node, its own private key and the challenge random number to calculate the shared key; the access device uses the shared key as the input of the key derivation function to generate the same session key as the authentication node, and uses the challenge random number and the session key to decrypt the encrypted session key to obtain the original session key; the access device binds the session identifier with the decrypted session key and stores it in the local session management module;

[0038] After the access device passes authentication and obtains the session key, it accesses the access control smart contract deployed on the blockchain, initiates a transaction to the contract, and passes its own device identification, device attributes, and requested operation type as transaction parameters; after receiving the transaction, the access control contract queries the access control list pre-configured in the contract by the administrator based on the device identification, device attributes, and requested operation type, and obtains the access control policy that matches the current device.

[0039] In an optional embodiment,

[0040] When the access device needs to access network resources, it accesses the network resources based on the access control policy, including:

[0041] When the access device needs to access network resources, it constructs a network resource access request according to the target service type and parameters of the request, and encapsulates its own device identification, session identifier, and timestamp in the network resource access request; the access device obtains the session key corresponding to the session established with the target gateway device from the local session management module, and uses the session key to symmetrically encrypt the constructed network resource access request to generate an encrypted access request data packet; the access device sends the encrypted access request data packet to the target gateway device through an authenticated secure channel, and starts a timer to wait for a response from the target gateway device;

[0042] After receiving the access request data packet sent by the access device, the target gateway device checks the format and integrity of the data packet. If the format is wrong or incomplete, the access request data packet is directly discarded; after passing the format check, the target gateway device uses the session identifier to find the corresponding session key from the local session management module, and uses the session key to decrypt the encrypted access request data packet to obtain the original network resource access request; the target gateway device extracts the identity of the access device from the original network resource access request, the identity includes the device number and MAC address, and calls the access control smart contract deployed on the blockchain, passing the identity as a parameter to the access control smart contract;

[0043] After the access control smart contract receives the identity identifier sent by the target gateway device, it queries the access control policy corresponding to the identity identifier in the access control list maintained by the access control smart contract; the access control policy adopts a role-based access control model, defines the roles corresponding to different device identities, and the permission set possessed by each role, the permission set includes the accessible resource type, operation type, time range, and number limit; if the access control policy matching the identity identifier is not found in the access control list, the default access denial policy is returned; the access control smart contract returns the query result of the access control policy to the target network device to determine the network resource access result of the access device.

[0044] In an optional embodiment,

[0045] The access control smart contract returns the query results of the access control policy to the target network device to determine the network resource access results of the access device, including:

[0046] The access control smart contract returns the queried access control policy to the target gateway device. The target gateway device parses the access control policy and determines whether the network resource access request of the access device meets the constraints of the current access control policy based on the permission rules defined in the access control policy. The constraints of the access control policy include that the target resource and operation type of the network resource access request are within the scope allowed by the access control policy, the initiation time of the request is within the time window specified by the access control policy, and the number of accesses of the access device per unit time does not exceed the limit of the access control policy;

[0047] If the network resource access request of the access device meets all the constraints of the access control policy, the target gateway device allows the request and establishes a connection with the corresponding service provider node or device according to the target service type of the request, and forwards the request to the target node for processing; at the same time, the target gateway device submits the successful network resource access request to the blockchain in the form of a transaction, and after consensus confirmation by the nodes in the blockchain network, the network resource access record is written into the blockchain;

[0048] If the network resource access request of the access device does not meet the constraints of the access control policy or the access control smart contract returns an access denial policy, the target gateway device will deny the network resource access request and return an access denied response message to the access device; at the same time, the target gateway device submits the denied network resource access request to the blockchain in the form of a transaction, and after consensus confirmation by the nodes in the blockchain network, the network resource access record will be written into the blockchain.

[0049] According to a second aspect of the embodiments of the present invention,

[0050] Provides distributed device authentication and access control system based on blockchain, including:

[0051] The first unit is used for the device to be connected to generate the target device fingerprint based on the physical non-cloning function of its own device, bind the target device fingerprint with the device public key to generate the device identity information, and store the device identity information on the blockchain through the identity authentication smart contract to complete the on-chain registration of the device identity; when the device to be connected initiates an access authentication request, the device fingerprint, public key, access request timestamp and digital signature generated by the device private key of the device to be connected are sent to the authentication node together;

[0052] The second unit is used for the authentication node to access the identity authentication smart contract after receiving the access authentication request; the authentication node queries the corresponding device identity information based on the device fingerprint sent by the device to be accessed, obtains the device public key in the device identity information, and uses the device public key to verify the digital signature in the access authentication request; if the digital signature verification is successful, the authentication node randomly generates a session key, encrypts it with the verified device public key, and returns the encrypted session key to the device to be accessed;

[0053] The third unit is used to authenticate the access device that has passed the authentication and obtained the encrypted session key. It obtains the access control policy pre-configured by the administrator through the access control smart contract. The access control policy is signed by the administrator using the administrator's private key and then uploaded to the chain. It includes the access permission level of the access device, the accessible target device or service, the access validity time window, and the access number limit. When the access device needs to access network resources, it accesses network resources based on the access control policy.

[0054] According to a third aspect of the embodiments of the present invention,

[0055] An electronic device is provided, comprising:

[0056] processor;

[0057] a memory for storing processor-executable instructions;

[0058] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0059] A fourth aspect of the embodiments of the present invention is:

[0060] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0061] This application generates a secure, unique and difficult-to-forge device identity information by combining physical non-cloning function, public key cryptography and dynamic salt value. This identity information can be used in subsequent device authentication and access control processes to improve the security and credibility of the Internet of Things system. The authentication node can effectively verify the identity of the device to be connected and ensure the authenticity and integrity of the authentication request. This method combines device fingerprint technology and public key cryptography, which can effectively prevent the device identity from being forged or tampered with, and improve the security of the Internet of Things system. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 This is a flowchart of a distributed device identity authentication and access control method based on blockchain according to an embodiment of the present invention;

[0063] Figure 2 This is a schematic diagram of the structure of a distributed device identity authentication and access control system based on blockchain according to an embodiment of the present invention. DETAILED DESCRIPTION

[0064] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0065] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0066] Figure 1 Schematic diagram of the process of distributed device identity authentication and access control method based on blockchain in an embodiment of the present invention. Figure 1 As shown, the method includes:

[0067] S101. The device to be accessed generates a target device fingerprint based on the physical non-cloning function of its own device, binds the target device fingerprint with the device public key to generate device identity information, and stores the device identity information on the blockchain through the identity authentication smart contract to complete the on-chain registration of the device identity; when the device to be accessed initiates an access authentication request, the device fingerprint, public key, access request timestamp and digital signature generated by the device private key of the device to be accessed are sent to the authentication node;

[0068] S102. After receiving the access authentication request, the authentication node accesses the identity authentication smart contract; the authentication node queries the corresponding device identity information based on the device fingerprint sent by the access device, obtains the device public key in the device identity information, and uses the device public key to verify the digital signature in the access authentication request; if the digital signature verification is successful, the authentication node randomly generates a session key, encrypts it with the verified device public key, and returns the encrypted session key to the access device;

[0069] S103. The access device that passes the authentication and obtains the encrypted session key obtains the access control policy pre-configured by the administrator through the access control smart contract. The access control policy is signed by the administrator using the administrator's private key and uploaded to the chain, which includes the access permission level of the access device, the accessible target device or service, the access validity time window, and the access number limit; when the access device needs to access network resources, it accesses network resources based on the access control policy.

[0070] Exemplarily, the present invention proposes a device identity authentication and access control method based on blockchain, which generates device fingerprints through physical unclonable functions, combines public key cryptography and smart contract technology, and realizes trusted registration, authentication and fine-grained access control of device identity. The specific implementation steps are as follows:

[0071] First, the device to be connected generates a target device fingerprint based on its own physical unclonable function. The physical unclonable function refers to the use of randomness and unpredictability in the device hardware manufacturing process to generate unique and difficult-to-copy device characteristics. For example, the random initial state of SRAM power-on, the frequency difference of the ring oscillator, or the random defects in the chip can be used as the source of the physical unclonable function. Assume that a device to be connected generates a 128-bit device fingerprint based on the startup state of SRAM, which is represented as a hexadecimal string: "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6".

[0072] Next, the device to be connected generates an asymmetric key pair, including a device public key and a device private key. Taking the elliptic curve cryptography algorithm as an example, the generated public key may be: "04a5c58b7b1f4a8f7e56d84e980ac7d47251dd63f3e4dcbcd0cc861e7a4d0f6c9b8f05d878ac6a90d80543c943dcb53544e75c779eb0ee9840f8d609f527d5f890".

[0073] The device to be connected binds the device fingerprint with the device public key to generate device identity information. The binding process can use simple string concatenation or more complex data structures. For example, you can construct a JSON object: {"deviceFingerprint": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6", "publicKey": "04a5c58b7b1f4a8f7e56d84e980ac7d47251dd63f3e4dcbcd0cc861e7a4d0f6c9b8f05d878ac6a90d80543c943dcb53544e75c779eb0ee9840f8d609f527d5f890"}.

[0074] Then, the device to be connected stores the device identity information on the blockchain through the identity authentication smart contract, completing the on-chain registration of the device identity. The smart contract can define a function registerDevice(string deviceFingerprint, string publicKey), pass in the device fingerprint and public key as parameters, and store this information on the blockchain.

[0075] When the device to be connected needs to initiate an access authentication request, it will prepare the following information: device fingerprint, public key, access request timestamp, and digital signature generated using the device private key. The timestamp can use the Unix timestamp format, such as "1633006800". The digital signature generation process includes concatenating the device fingerprint, public key, and timestamp, calculating the hash value using the SHA-256 algorithm, and then signing the hash value with the device private key. Finally, the device to be connected sends this information to the authentication node.

[0076] After receiving the access authentication request, the authentication node first accesses the identity authentication smart contract. The authentication node uses the received device fingerprint as the query parameter and calls the query function getDeviceInfo(stringdeviceFingerprint) in the smart contract to obtain the corresponding device identity information, which includes the device public key.

[0077] The authentication node uses the obtained device public key to verify the digital signature in the access authentication request. The verification process includes recalculating the hash value of the request data using the same method, and then using the device public key to verify whether the signature is valid. If the digital signature verification passes, the authentication node will randomly generate a session key;

[0078] For example, a 256-bit AES key:

[0079] "7c1f3b47a6e8d9c2f5a0b4e3d8c1f9a2b5e0d3c6a9f2e5b8d1c4a7f0e3b6a9c2".

[0080] The authentication node uses the public key of the verified device to encrypt the session key. The encryption process can use algorithms such as ECIES (Elliptic Curve Integrated Encryption Scheme). The encrypted session key may be represented as a Base64-encoded string: "X2FiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6MTIzNDU2Nzg5MA==". The authentication node returns the encrypted session key to the device to be connected.

[0081] After the access device successfully passes the authentication and obtains the encrypted session key, it needs to access the control smart contract to obtain the access control policy pre-configured by the administrator. The access control policy is signed by the administrator using the administrator's private key and stored on the chain. The policy content may include: access permission level (such as an integer from 1 to 5, 5 represents the highest permission), a list of accessible target devices or services, an access validity window (such as the start time and end time), and a limit on the number of accesses.

[0082] When an access device needs to access network resources, it first checks its own access control policy. The device verifies whether the current time is within the valid time window, checks whether the number of accesses exceeds the limit, and confirms whether the target to be accessed is in the allowed list. Only when all conditions are met will the device initiate an actual resource access request.

[0083] For example, if the access device wants to access "serviceB", it will first check whether "serviceB" is in the allowedTargets list, then verify whether the current time is between validFrom and validUntil, and ensure that the number of accesses does not exceed maxAccessCount. If all conditions are met, the device will send an access request and increase the access count counter by one.

[0084] In this way, this method realizes blockchain-based device identity authentication and fine-grained access control, improving the security and manageability of the IoT system. This method combines physical unclonability, asymmetric encryption, smart contracts and other technologies to ensure the uniqueness and unforgeability of device identity while achieving flexible access control policy management.

[0085] In an optional embodiment,

[0086] The device to be connected generates the target device fingerprint based on its own physical non-cloning function, and binds the target device fingerprint with the device public key to generate device identity information, including:

[0087] The device to be connected is based on a physical non-cloning chip of its own device, in which a ring oscillator array and an analog-to-digital converter are integrated. When the physical non-cloning chip is powered on, each ring oscillator in the ring oscillator array generates a random oscillation frequency according to its own physical characteristics, including transistor threshold voltage, channel width, and gate oxide layer thickness. The analog-to-digital converter samples and converts the oscillation frequency to obtain a set of digital parameters as the original data of the device fingerprint;

[0088] The device to be connected reads the original data of the device fingerprint from the physical non-cloning chip, pre-processes the original data, confuses and diffuses the original data through a linear feedback shift register circuit or a nonlinear chaotic mapping circuit, extracts the data bits with higher stability, and recombines them to form an intermediate device fingerprint; the device to be connected concatenates the intermediate device fingerprint with the device serial number, device model, and device manufacturer identification ID in a predefined order and format to form fingerprint-identification composite information, and uses a cryptographic secure hash algorithm with the fingerprint-identification composite information as input to calculate a fixed-length hash summary as the target device fingerprint;

[0089] The device to be connected uses the elliptic curve cryptography algorithm to generate a 256-bit elliptic curve public-private key pair, extract the public key, concatenate the target device fingerprint with the device public key, and generate device identity information according to the predefined data structure and serialization rules; a dynamic encryption salt based on timestamp and counter is used to salt the target device fingerprint and device public key respectively, and then concatenate them, and add the salt value to the device identity information.

[0090] Exemplarily, the present invention proposes a device identity generation method based on physical non-cloning function, which uses the inherent randomness of device hardware to generate a unique device fingerprint and combines it with public key cryptography to form credible device identity information. The specific implementation process is as follows:

[0091] First, the device to be connected generates original device fingerprint data based on its own physical non-cloning chip. The physical non-cloning chip integrates a ring oscillator array and an analog-to-digital converter. The ring oscillator array consists of multiple ring oscillators, each of which is composed of an odd number of inverters in series. When the chip is powered on, each ring oscillator generates a random oscillation frequency based on its own physical characteristics. These physical characteristics include the threshold voltage, channel width, and gate oxide thickness of the transistor. These microscopic parameters cannot be precisely controlled during the chip manufacturing process, which results in each ring oscillator having unique characteristics.

[0092] For example, suppose the chip contains 128 ring oscillators, each with a frequency range of 1 MHz to 2 MHz. The analog-to-digital converter samples and quantizes these oscillation frequencies to convert the analog signal into a digital signal. Assuming the resolution of the analog-to-digital converter is 12 bits, the frequency of each ring oscillator can be quantized to an integer value between 0 and 4095. The resulting raw data may be an array of 128 12-bit integers.

[0093] Next, the device to be connected reads the raw data from the physical non-cloned chip and preprocesses it. The purpose of preprocessing is to enhance the randomness and stability of the data. A common preprocessing method is to use a linear feedback shift register (LFSR) circuit. LFSR is a shift register that can generate a pseudo-random sequence, and its feedback function is a linear function. For example, a 32-bit LFSR can be used, and its characteristic polynomial is x^32 + x^22 + x^2 + x + 1. The raw data is input into the LFSR in 32-bit groups, and multiple rounds of iterations are performed to obtain the obfuscated data.

[0094] Another preprocessing method is to use a nonlinear chaotic mapping circuit. Chaotic systems are extremely sensitive to initial conditions and can produce seemingly random but actually deterministic sequences. For example, a logistic map can be used. The original data is normalized to the (0,1) interval as the initial value, and multiple iterations are performed to obtain a chaotic sequence.

[0095] After preprocessing, extract the data bits with higher stability from the obfuscated data. You can select the bits that remain consistent in different measurements by repeating the measurements multiple times. Assuming that 64 stable bytes are extracted, they are recombined to form the intermediate device fingerprint.

[0096] Then, the device to be connected combines the intermediate device fingerprint with other identification information to form fingerprint-identification composite information. For example, the device serial number is "SN2023101001", the device model is "Model-X", and the device manufacturer identification ID is "MFG-ABC-123". Cascading this information in a predefined order and format may result in the following string: "64byteFingerprint|SN2023101001|Model-X|MFG-ABC-123".

[0097] Next, use a cryptographically secure hash algorithm to hash the fingerprint-identification composite information. You can choose the SHA-256 algorithm, which can convert an input of any length into a fixed-length output of 256 bits (32 bytes). The calculated hash summary is used as the final target device fingerprint. For example, the target device fingerprint obtained can be:

[0098] "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8".

[0099] To generate the public and private key pair of the device, the device to be connected uses the elliptic curve cryptography algorithm. Select the P-256 curve (also known as secp256r1) recommended by NIST to generate a 256-bit elliptic curve public and private key pair. The private key is a randomly selected 256-bit integer, and the public key is a point on the curve, consisting of x and y coordinates. For example, the generated public key can be:

[0100] x: "c3b2a1d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8";

[0101] y: "d4c3b2a1e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8".

[0102] To enhance security, a dynamic encryption salt based on a timestamp and a counter is introduced when generating the final device identity information. The current timestamp is "1633006800" and the counter value is "00001". The timestamp and the counter are concatenated to obtain the salt value "163300680000001".

[0103] Salt the target device fingerprint and device public key separately. The salting process can be a simple string concatenation or a more complex operation such as XOR operation. Here we use string concatenation:

[0104] The salted device fingerprint can be:

[0105] "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8163300680000001";

[0106] Salted public key:

[0107] "c3b2a1d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8d4c3b2a1 e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8163300680000001".

[0108] Finally, according to the predefined data structure and serialization rules, the salted device fingerprint, public key and salt value are combined into the device identity information.

[0109] This method combines physical non-cloning function, public key cryptography and dynamic salt value to generate a secure, unique and difficult-to-forge device identity information. This identity information can be used in subsequent device authentication and access control processes to improve the security and credibility of the IoT system.

[0110] In an optional embodiment,

[0111] The authentication node queries the corresponding device identity information based on the device fingerprint sent by the device to be accessed, obtains the device public key in the device identity information, and uses the device public key to verify the digital signature in the access authentication request, including:

[0112] Check the format and field integrity of the authentication request, verify the timestamp of the authentication request, and determine whether the timestamp is within the preset range of the current time. Authentication requests that exceed the preset range will be directly discarded; the authentication node extracts the device fingerprint original from the authentication request, preprocesses the device fingerprint original, and uses the same obfuscation diffusion algorithm and parameters as the device end to obtain preprocessed fingerprint data; the authentication node extracts the device identification information from the preprocessed fingerprint data, and cascades the preprocessed fingerprint data and identification information in the agreed order and format to form fingerprint-identification composite information;

[0113] The authentication node uses a cryptographically secure hash algorithm consistent with the device end, takes the fingerprint-identification composite information as input, and calculates a fingerprint feature value of a fixed length; the authentication node determines the candidate device identity record in the fingerprint feature-device identity mapping table through a prefix tree and a Bloom filter based on the bit string of the fingerprint feature value; the authentication node compares the device public key and device identification in the candidate device identity record with the corresponding fields in the authentication request, selects a fully matching device identity record, and extracts the device identification and device public key therein; if no matching device identity record is found, the authentication node returns an authentication failure message to the device to be connected, and records a failure log;

[0114] The authentication node uses the extracted device public key to verify the digital signature in the authentication request, where the device fingerprint original, device public key, timestamp and random number are extracted from the request message, and are concatenated in the order and format agreed upon with the device to form the signature original. The authentication node calculates the summary of the signature original using the same hash algorithm as the device, and uses the summary, digital signature and device public key as parameters to call the elliptic curve digital signature verification algorithm to verify the digital signature.

[0115] Exemplarily, the present invention proposes an authentication method based on device fingerprint, which ensures the authenticity of the device identity and the integrity of the request by verifying the device fingerprint and digital signature. The specific implementation process is as follows:

[0116] First, after receiving the authentication request sent by the device to be connected, the authentication node performs a preliminary check on the request. The check includes the correctness of the request format and the integrity of the necessary fields. For example, a valid authentication request may contain the following fields: device fingerprint original text, device public key, timestamp, random number and digital signature.

[0117] Next, the authentication node verifies the timestamp in the authentication request. Assume that the current time is 12:00:00 on October 1, 2023, and the preset valid time range is 5 minutes before and after. If the timestamp in the request is 12:03:30 on October 1, 2023, it is within the valid range; if the timestamp is 12:10:00 on October 1, 2023, it is out of the valid range and the request will be directly discarded.

[0118] The authentication node extracts the original device fingerprint from the authentication request and preprocesses it. The preprocessing process uses the same obfuscation diffusion algorithm and parameters as the device side. For example, if the device side uses a linear feedback shift register (LFSR) for obfuscation, the authentication node will also use the same LFSR configuration. Assuming that the extracted device fingerprint original is 64 bytes of binary data, 100 rounds of iterations are performed through a 32-bit LFSR (characteristic polynomial is x^32 + x^22 + x^2 + x + 1) to obtain the preprocessed fingerprint data.

[0119] From the preprocessed fingerprint data, the authentication node extracts the device identification information. This identification information may include the device serial number, device model, and manufacturer ID. For example, the device serial number parsed from the preprocessed data is "SN2023101001", the device model is "Model-X", and the manufacturer ID is "MFG-ABC-123".

[0120] The authentication node concatenates the preprocessed fingerprint data and the extracted identification information in the agreed order and format to form fingerprint-identification composite information. For example:

[0121] "preprocessedFingerprint|SN2023101001|Model-X|MFG-ABC-123".

[0122] Next, the authentication node uses the same cryptographic secure hash algorithm (such as SHA-256) as the device end, takes the fingerprint-identification composite information as input, and calculates the fingerprint feature value of a fixed length. Assume that the calculated fingerprint feature value is:

[0123] "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8".

[0124] The authentication node searches for the corresponding device identity record in the fingerprint feature-device identity mapping table according to the bit string of the fingerprint feature value. In order to improve the search efficiency, a data structure such as a prefix tree or a Bloom filter can be used.

[0125] When using a prefix tree, you can use the first few digits of the fingerprint feature value as an index to quickly locate possible candidate records. For example, using the first 8 digits of "a1b2c3d4" as an index may result in multiple candidate records being found.

[0126] When using a Bloom filter, the entire fingerprint feature value can be mapped to multiple bits. Assume that 3 hash functions are used to map the 256-bit fingerprint feature value to a 1024-bit bit array. By checking whether all these bits are 1, it is possible to quickly determine whether the fingerprint feature value may exist in the data set.

[0127] For the candidate device identity records found, the authentication node compares the device public key and device identifier with the corresponding fields in the authentication request. For example, the device serial number, device model, and manufacturer ID are compared to see if they completely match. Through this process, the device identity records that completely match are screened out, and the device identifier and device public key are extracted from them.

[0128] If no matching device identity record is found, the authentication node will generate an authentication failure message and return it to the device to be connected. This message may contain the failure reason code and a brief description, such as "404: Device identity not found". At the same time, the authentication node will record the failed authentication attempt, including the time, source IP address, provided device fingerprint and other information for subsequent analysis and auditing.

[0129] When a matching device identity record is successfully found, the authentication node begins to verify the digital signature. First, the device fingerprint original, device public key, timestamp and random number are extracted from the request message. Assume that the extracted information is as follows:

[0130] Device fingerprint original text: 64 bytes of binary data;

[0131] Device public key:

[0132] x: "c3b2a1d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8";

[0133] y: "d4c3b2a1e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8";

[0134] Timestamp: 1633089600 (2023-10-01 12:00:00 UTC);

[0135] Random number: 1234567890abcdef;

[0136] The authentication node concatenates this information in the order and format agreed upon with the device to form the original signature. For example:

[0137] "64byteFingerprint|c3b2a1d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8d4c3b 2a1e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8|1633089600|1234567890abcdef".

[0138] The authentication node uses the same hash algorithm (such as SHA-256) as the device to calculate the digest of the original signature. The resulting digest is a 32-byte data.

[0139] Finally, the authentication node calls the elliptic curve digital signature verification algorithm (such as ECDSA) and uses the calculated digest, the digital signature in the request, and the extracted device public key as parameters to perform signature verification. The verification process includes using the public key to reversely calculate the signature and compare it with the provided signature. If the comparison results are consistent, the signature is valid and the authentication request passes the verification; otherwise, the authentication fails.

[0140] Through this series of steps, the authentication node can effectively verify the identity of the device to be connected and ensure the authenticity and integrity of the authentication request. This method combines device fingerprint technology and public key cryptography to effectively prevent the device identity from being forged or tampered with, thereby improving the security of the IoT system.

[0141] In an optional embodiment,

[0142] The authentication node randomly generates a session key, encrypts it using the public key of the verified device, and returns the encrypted session key to the device to be connected, including:

[0143] The authentication node generates a temporary elliptic curve cryptographic key pair, which includes a temporary private key and a temporary public key; the authentication node uses the temporary public key, the public key of the device to be accessed, and the randomly generated challenge random number as input parameters, executes the elliptic curve Diffie-Hellman key exchange protocol, and calculates a shared key; the authentication node uses the shared key as an input of a key derivation function to generate a fixed-length session key, and uses the challenge random number to symmetrically encrypt the session key to obtain an encrypted session key;

[0144] The authentication node generates a unique session identifier based on the timestamp and device identifier, binds the session identifier to the encrypted session key, and stores it in the session management module; the authentication node encapsulates the encrypted session key, temporary public key, challenge random number, and session identifier into a key negotiation message; the authentication node uses the public key of the device to be connected to asymmetrically encrypt the key negotiation message to generate an encrypted key negotiation message;

[0145] The authentication node uses its own private key to calculate the hash summary of the encrypted key negotiation message, and uses the private key to digitally sign the hash summary to obtain a digital signature result; the authentication node packages the encrypted key negotiation message, the digital signature result, and the authentication node public key certificate issued by a trusted third party into a security envelope; the authentication node sends the security envelope to the device to be connected through a two-way authentication security channel established on the transport layer security protocol.

[0146] For example, after the authentication node completes the device identity authentication, it needs to securely pass the session key to the device to be connected. This process involves multiple cryptographic operations to ensure the security and non-repudiation of the key exchange. The specific implementation process is as follows:

[0147] First, the authentication node generates a temporary elliptic curve cryptographic key pair. Assuming the NIST P-256 curve is used, the authentication node randomly selects a 256-bit integer as the temporary private key, for example: 0x1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t1u2v3w4x5y6z7a8b9.

[0148] Then the corresponding temporary public key is calculated according to the elliptic curve algorithm. Next, the authentication node prepares to execute the elliptic curve Diffie-Hellman key exchange protocol. It uses the temporary public key, the public key of the device to be connected (previously verified), and a randomly generated challenge random number as input parameters.

[0149] The authentication node uses these parameters to perform the elliptic curve Diffie-Hellman key exchange algorithm to calculate a shared key. This shared key is a point on the curve, and usually only its x coordinate is used as the actual shared secret.

[0150] The authentication node then uses this shared secret as input to a key derivation function to generate a fixed-length session key. For example, using HKDF (HMAC-based key derivation function) with SHA-256 to generate a 256-bit session key.

[0151] The authentication node uses the previously generated challenge random number to symmetrically encrypt the session key, and the AES-GCM algorithm can be used. Next, the authentication node needs to generate a unique session identifier. It can be generated based on the current timestamp and device identification. The authentication node binds this session identifier to the encrypted session key and stores it in the session management module for subsequent use.

[0152] The authentication node then encapsulates the encrypted session key, temporary public key, challenge random number, and session identifier into a key agreement message.

[0153] The authentication node uses the public key of the device to be connected to asymmetrically encrypt the key negotiation message. ECIES (Elliptic Curve Integrated Encryption Scheme) can be used for encryption. The encrypted key negotiation message may be a longer byte string.

[0154] Next, the authentication node needs to sign the encrypted key agreement message to prove the authenticity and integrity of the message. First, it uses the SHA-256 algorithm to calculate the hash digest of the encrypted message;

[0155] The authenticating node then digitally signs the hash summary using its own private key.

[0156] Finally, the authentication node packages the encrypted key negotiation message, the digital signature result, and the authentication node public key certificate issued by a trusted third party into a secure envelope.

[0157] The authentication node sends this security envelope to the device to be connected through a two-way authenticated secure channel built on top of the transport layer security protocol (such as TLS 1.3). Using TLS 1.3 can provide additional transmission security to prevent man-in-the-middle attacks and replay attacks.

[0158] In an optional embodiment,

[0159] The access device that passes the authentication and obtains the encrypted session key obtains the access control policy pre-configured by the administrator through the access control smart contract, including:

[0160] After receiving the security envelope, the access device that has passed the authentication and obtained the encrypted session key verifies the validity of the authentication node public key certificate to confirm that the authentication node public key certificate is issued by a trusted certificate authority and is within the validity period; the access device uses the public key in the authentication node public key certificate to verify the digital signature result to verify that the key negotiation message has not been tampered with; the access device uses its own private key to decrypt the encrypted key negotiation message and extract the temporary public key, challenge random number, encrypted session key and session identifier;

[0161] The access device executes the same elliptic curve Diffie-Hellman key exchange protocol as the authentication node, and uses the temporary public key of the authentication node, its own private key and the challenge random number to calculate the shared key; the access device uses the shared key as the input of the key derivation function to generate the same session key as the authentication node, and uses the challenge random number and the session key to decrypt the encrypted session key to obtain the original session key; the access device binds the session identifier with the decrypted session key and stores it in the local session management module;

[0162] After the access device passes authentication and obtains the session key, it accesses the access control smart contract deployed on the blockchain, initiates a transaction to the contract, and passes its own device identification, device attributes, and requested operation type as transaction parameters; after receiving the transaction, the access control contract queries the access control list pre-configured in the contract by the administrator based on the device identification, device attributes, and requested operation type, and obtains the access control policy that matches the current device.

[0163] Exemplarily, first, the access device performs certificate verification after receiving the security envelope. The security envelope contains the public key certificate, digital signature, and encrypted key negotiation message of the authentication node. The access device obtains the trusted root certificate from the local certificate storage and verifies the certificate chain of the authentication node certificate. Taking the authentication node certificate serial number "SN20240001" as an example, the access device checks the certificate status through the certificate verification module to confirm that the certificate is within the validity period and has not been revoked.

[0164] Next, the access device verifies the digital signature using the public key in the authentication node certificate. Using SHA-256 as the signature algorithm, the access device calculates the hash value of the key negotiation message and compares the calculation result with the decrypted digital signature. After verification, the key negotiation message is decrypted using the device private key to extract the temporary public key, random challenge value, encrypted session key, and session identifier. Taking the session identifier "SESSION_001" as an example, the temporary public key length is 256 bits, and the random challenge value is a 32-byte random number.

[0165] Subsequently, the access device executes the key exchange protocol. The device uses its own private key, the authentication node's temporary public key, and the random challenge value to calculate the shared key through the key exchange algorithm. The shared key is input into the key derivation function to generate the session key. Taking AES-256-GCM as an example, a 256-bit session key is derived. The access device uses the derived session key and the random challenge value to decrypt the encrypted session key and verify that the decryption result is consistent with the original session key. The session identifier "SESSION_001" is bound to the session key and stored in the local session management module of the device.

[0166] Finally, the access device accesses the access control smart contract on the blockchain. Taking the device ID "DEVICE_001", device type "SENSOR", and request operation "READ_DATA" as an example, the device packages these parameters into a transaction and sends it to the smart contract. The contract queries the access control policy table based on the device ID and attributes to obtain the pre-configured access rights. The access control policy includes specific restrictions such as the permission level "Level_2", the accessible target "TARGET_SERVICE_A", the access time window "2024-11-08 00:00:00 to 2024-12-08 00:00:00", and the upper limit of the number of visits "1000 times / day".

[0167] The beneficial effects are as follows:

[0168] First, by introducing authentication node certificate verification and key exchange mechanism, the security of the device authentication process is ensured. Certificate chain verification prevents forgery of authentication nodes, and the key exchange protocol protects session key transmission, effectively resisting man-in-the-middle attacks and replay attacks.

[0169] Second, the use of smart contract-based access control policy management enables refined control and dynamic update of access rights. Administrators can flexibly configure device access rights, time limits, and number limits, and the policy is stored on the blockchain to ensure that it cannot be tampered with.

[0170] Third, the entire authentication and authorization process is decentralized, eliminating the risk of single point failure. Device identity information and access policies are distributed and stored on the blockchain, which improves the availability and scalability of the system and is suitable for large-scale IoT device access scenarios.

[0171] In an optional embodiment,

[0172] When the access device needs to access network resources, it accesses the network resources based on the access control policy, including:

[0173] When the access device needs to access network resources, it constructs a network resource access request according to the target service type and parameters of the request, and encapsulates its own device identification, session identifier, and timestamp in the network resource access request; the access device obtains the session key corresponding to the session established with the target gateway device from the local session management module, and uses the session key to symmetrically encrypt the constructed network resource access request to generate an encrypted access request data packet; the access device sends the encrypted access request data packet to the target gateway device through an authenticated secure channel, and starts a timer to wait for a response from the target gateway device;

[0174] After receiving the access request data packet sent by the access device, the target gateway device checks the format and integrity of the data packet. If the format is wrong or incomplete, the access request data packet is directly discarded; after passing the format check, the target gateway device uses the session identifier to find the corresponding session key from the local session management module, and uses the session key to decrypt the encrypted access request data packet to obtain the original network resource access request; the target gateway device extracts the identity of the access device from the original network resource access request, the identity includes the device number and MAC address, and calls the access control smart contract deployed on the blockchain, passing the identity as a parameter to the access control smart contract;

[0175] After the access control smart contract receives the identity identifier sent by the target gateway device, it queries the access control policy corresponding to the identity identifier in the access control list maintained by the access control smart contract; the access control policy adopts a role-based access control model, defines the roles corresponding to different device identities, and the permission set possessed by each role, the permission set includes the accessible resource type, operation type, time range, and number limit; if the access control policy matching the identity identifier is not found in the access control list, the default access denial policy is returned; the access control smart contract returns the query result of the access control policy to the target network device to determine the network resource access result of the access device.

[0176] Exemplarily, when an access device needs to access network resources, it first constructs an access request. Taking the temperature sensor device accessing the data acquisition service as an example, the device identifier is "SENSOR_001", the session identifier is "SESSION_102", and the request timestamp is "2024-11-08 10:30:25". The device packages this information together with the request parameters (such as the data acquisition frequency "60 seconds / time") into a request message. The access device searches the local session management module for the session key corresponding to the identifier "SESSION_102", encrypts the request message using the AES-256-GCM algorithm, and generates an encrypted data packet. The device sends the encrypted data packet to the gateway device "GATEWAY_001" through the TLS1.3 secure channel, and starts a 60-second timeout timer at the same time.

[0177] After receiving the data packet, the target gateway device first checks the packet format. The packet header must contain a fixed identification field "0xABCD", and the length field must match the actual payload length. After the format is correct, the gateway device searches the local session table for the session key corresponding to "SESSION_102". The session key is used to decrypt the packet and extract the device identification "SENSOR_001" and the hardware address "00:1A:2B:3C:4D:5E". The gateway device encapsulates this identity information into a smart contract call transaction and sends it to the access control contract in the blockchain network.

[0178] The access control smart contract maintains the role permission model. The contract stores the role definition table, mapping "SENSOR_001" to the "normal sensor" role. The role permission table defines that "normal sensor" can perform the "data reporting" operation and access the "data collection service". The permission is valid from "2024-11-01 to 2024-12-31", and the daily call limit is 1440 times. The contract queries the corresponding role permission based on the device identity. If no match is found, the default rejection policy is returned. The permission query result is returned to the gateway device through the blockchain transaction.

[0179] After receiving the permission query result, the gateway device determines whether to allow access according to the permission policy. If it meets the permission requirements, the gateway device forwards the request to the target service; otherwise, it returns an access denial response. At the same time, the gateway device records the access log locally, including device identification, access time, request content, processing results and other information.

[0180] Beneficial effects:

[0181] First, the use of session key encryption and secure channel transmission mechanisms protects the confidentiality and integrity of device access requests. Session keys are dynamically generated and updated regularly, so even if the key is leaked, the scope of impact is limited, greatly improving communication security.

[0182] Second, role-based permission control based on smart contracts makes access policy management more flexible and transparent. Role permissions can be adjusted dynamically, and all policy changes are recorded on the blockchain for easy auditing and tracing, effectively preventing illegal access and unauthorized operations.

[0183] Third, the request legitimacy is verified on the gateway device side, and local access logs are maintained, realizing distributed security protection and monitoring. This multi-level security mechanism not only ensures system security, but also avoids the risk of the entire system being paralyzed due to a single point of failure.

[0184] In an optional embodiment,

[0185] The access control smart contract returns the query results of the access control policy to the target network device to determine the network resource access results of the access device, including:

[0186] The access control smart contract returns the queried access control policy to the target gateway device. The target gateway device parses the access control policy and determines whether the network resource access request of the access device meets the constraints of the current access control policy based on the permission rules defined in the access control policy. The constraints of the access control policy include that the target resource and operation type of the network resource access request are within the scope allowed by the access control policy, the initiation time of the request is within the time window specified by the access control policy, and the number of accesses of the access device per unit time does not exceed the limit of the access control policy;

[0187] If the network resource access request of the access device meets all the constraints of the access control policy, the target gateway device allows the request and establishes a connection with the corresponding service provider node or device according to the target service type of the request, and forwards the request to the target node for processing; at the same time, the target gateway device submits the successful network resource access request to the blockchain in the form of a transaction, and after consensus confirmation by the nodes in the blockchain network, the network resource access record is written into the blockchain;

[0188] If the network resource access request of the access device does not meet the constraints of the access control policy or the access control smart contract returns an access denial policy, the target gateway device will deny the network resource access request and return an access denied response message to the access device; at the same time, the target gateway device submits the denied network resource access request to the blockchain in the form of a transaction, and after consensus confirmation by the nodes in the blockchain network, the network resource access record will be written into the blockchain.

[0189] For example, the access control smart contract returns the query results to the gateway device through blockchain transactions. Taking the temperature sensor accessing the data collection service as an example, the access control policy returned by the contract contains permission rules: allowing access to resource type "data collection service", allowing operation type "data reporting", valid time window "2024-11-01 00:00:00 to 2024-12-31 23:59:59", and access frequency limit "once per minute". The gateway device parses the policy content and extracts the constraints for verification.

[0190] The gateway device first verifies the resource type match. Checks whether the request target "data collection service" is in the list of resources allowed to be accessed, and whether the operation type "data reporting" is in the allowed operation set. Then verifies the time constraint, comparing the request timestamp "2024-11-08 10:30:25" with the policy time window. Finally, checks the access frequency, and queries whether the number of accesses to the device "SENSOR_001" in the last minute exceeds the limit.

[0191] When the request meets all constraints, the gateway device processes the access request. The gateway device locates the data collection service node "COLLECTOR_002" through the service discovery module, establishes a TCP connection, and forwards the decrypted request content to the target node. At the same time, a blockchain transaction record access log is constructed. The transaction content includes: device identifier "SENSOR_001", request time "2024-11-08 10:30:25", target service "data collection service", operation type "data reporting", and processing result "access allowed". The transaction is written to the blockchain through the consensus algorithm.

[0192] If the request does not meet the constraints, such as the access frequency exceeds the limit, the gateway device returns the error code "ERROR_429" to the temperature sensor, indicating that the request is too frequent. At the same time, the rejection record is submitted to the blockchain, and the transaction content includes: device identification, request time, target service, operation type, processing result "access denied", and rejection reason "exceeding the access frequency limit". The gateway device updates the local access statistics and records the number of device accesses and time distribution.

[0193] Beneficial effects:

[0194] First, through the multi-dimensional constraint verification mechanism, refined access control is achieved. The combined verification of resource type, operation type, time window and frequency limit effectively prevents unauthorized access and resource abuse, ensuring the safe operation of the system.

[0195] Second, the access log storage on the chain provides complete behavior auditing capabilities. The processing results of all access requests are recorded through the tamper-proof characteristics of the blockchain, which facilitates traceability analysis and security incident investigation, and improves the credibility and transparency of the system.

[0196] Third, the use of a distributed architecture for access control and logging improves the reliability and scalability of the system. Even if some nodes fail, the entire access control system can still operate normally, which is suitable for large-scale distributed IoT application scenarios.

[0197] Figure 2 The structure diagram of the distributed device identity authentication and access control system based on blockchain in the embodiment of the present invention is as follows: Figure 2As shown, the system comprises:

[0198] The first unit is used for the device to be connected to generate the target device fingerprint based on the physical non-cloning function of its own device, bind the target device fingerprint with the device public key to generate the device identity information, and store the device identity information on the blockchain through the identity authentication smart contract to complete the on-chain registration of the device identity; when the device to be connected initiates an access authentication request, the device fingerprint, public key, access request timestamp and digital signature generated by the device private key of the device to be connected are sent to the authentication node together;

[0199] The second unit is used for the authentication node to access the identity authentication smart contract after receiving the access authentication request; the authentication node queries the corresponding device identity information based on the device fingerprint sent by the device to be accessed, obtains the device public key in the device identity information, and uses the device public key to verify the digital signature in the access authentication request; if the digital signature verification is successful, the authentication node randomly generates a session key, encrypts it with the verified device public key, and returns the encrypted session key to the device to be accessed;

[0200] The third unit is used to authenticate the access device that has passed the authentication and obtained the encrypted session key. It obtains the access control policy pre-configured by the administrator through the access control smart contract. The access control policy is signed by the administrator using the administrator's private key and then uploaded to the chain. It includes the access permission level of the access device, the accessible target device or service, the access validity time window, and the access number limit. When the access device needs to access network resources, it accesses network resources based on the access control policy.

[0201] According to a third aspect of the embodiments of the present invention,

[0202] An electronic device is provided, comprising:

[0203] processor;

[0204] a memory for storing processor-executable instructions;

[0205] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0206] A fourth aspect of the embodiments of the present invention is:

[0207] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0208] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0209] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A distributed device identity authentication and access control method based on blockchain, characterized in that: include: The device to be connected generates the target device fingerprint based on its own physical non-cloning function, binds the target device fingerprint with the device public key to generate the device identity information, and stores the device identity information on the blockchain through the identity authentication smart contract to complete the on-chain registration of the device identity; when the device to be connected initiates an access authentication request, the device fingerprint, public key, access request timestamp and digital signature generated by the device private key of the device to be connected are sent to the authentication node; After receiving the access authentication request, the authentication node accesses the identity authentication smart contract; The authentication node queries the corresponding device identity information based on the device fingerprint sent by the device to be accessed, obtains the device public key in the device identity information, and uses the device public key to verify the digital signature in the access authentication request; If the digital signature verification is successful, the authentication node randomly generates a session key, encrypts it using the verified device public key, and returns the encrypted session key to the device to be connected; The access device that has passed the authentication and obtained the encrypted session key obtains the access control policy pre-configured by the administrator through the access control smart contract. The access control policy is signed by the administrator using the administrator's private key and uploaded to the chain, which includes the access permission level of the access device, the accessible target device or service, the access validity time window, and the access number limit; when the access device needs to access network resources, it accesses network resources based on the access control policy; The device to be connected generates the target device fingerprint based on its own physical non-cloning function, and binds the target device fingerprint with the device public key to generate device identity information, including: The device to be connected is based on a physical non-cloning chip of its own device, in which a ring oscillator array and an analog-to-digital converter are integrated. When the physical non-cloning chip is powered on, each ring oscillator in the ring oscillator array generates a random oscillation frequency according to its own physical characteristics, including transistor threshold voltage, channel width, and gate oxide layer thickness. The analog-to-digital converter samples and converts the oscillation frequency to obtain a set of digital parameters as the original data of the device fingerprint; The device to be connected reads the original data of the device fingerprint from the physical non-cloning chip, pre-processes the original data, confuses and diffuses the original data through a linear feedback shift register circuit or a nonlinear chaotic mapping circuit, extracts the data bits with higher stability, and recombines them to form an intermediate device fingerprint; the device to be connected concatenates the intermediate device fingerprint with the device serial number, device model, and device manufacturer identification ID in a predefined order and format to form fingerprint-identification composite information, and uses a cryptographic secure hash algorithm with the fingerprint-identification composite information as input to calculate a fixed-length hash summary as the target device fingerprint; The device to be connected uses the elliptic curve cryptography algorithm to generate a 256-bit elliptic curve public-private key pair, extract the public key, concatenate the target device fingerprint with the device public key, and generate device identity information according to the predefined data structure and serialization rules; a dynamic encryption salt based on timestamp and counter is used to salt the target device fingerprint and device public key respectively, and then concatenate them, and add the salt value to the device identity information.

2. The method according to claim 1, characterized in that The authentication node queries the corresponding device identity information based on the device fingerprint sent by the device to be accessed, obtains the device public key in the device identity information, and uses the device public key to verify the digital signature in the access authentication request, including: Check the format and field integrity of the authentication request, verify the timestamp of the authentication request, and determine whether the timestamp is within the preset range of the current time. Authentication requests that exceed the preset range will be directly discarded; the authentication node extracts the device fingerprint original from the authentication request, preprocesses the device fingerprint original, and uses the same obfuscation diffusion algorithm and parameters as the device end to obtain preprocessed fingerprint data; the authentication node extracts the device identification information from the preprocessed fingerprint data, and cascades the preprocessed fingerprint data and identification information in the agreed order and format to form fingerprint-identification composite information; The authentication node uses a cryptographically secure hash algorithm consistent with the device end, takes the fingerprint-identification composite information as input, and calculates a fingerprint feature value of a fixed length; the authentication node determines the candidate device identity record in the fingerprint feature-device identity mapping table through a prefix tree and a Bloom filter based on the bit string of the fingerprint feature value; the authentication node compares the device public key and device identification in the candidate device identity record with the corresponding fields in the authentication request, selects a fully matching device identity record, and extracts the device identification and device public key therein; if no matching device identity record is found, the authentication node returns an authentication failure message to the device to be connected, and records a failure log; The authentication node uses the extracted device public key to verify the digital signature in the authentication request, where the device fingerprint original, device public key, timestamp and random number are extracted from the request message, and are concatenated in the order and format agreed upon with the device to form the signature original. The authentication node calculates the summary of the signature original using the same hash algorithm as the device, and uses the summary, digital signature and device public key as parameters to call the elliptic curve digital signature verification algorithm to verify the digital signature.

3. The method according to claim 1, characterized in that The authentication node randomly generates a session key, encrypts it using the public key of the verified device, and returns the encrypted session key to the device to be connected, including: The authentication node generates a temporary elliptic curve cryptographic key pair, which includes a temporary private key and a temporary public key; the authentication node uses the temporary public key, the public key of the device to be accessed, and the randomly generated challenge random number as input parameters, executes the elliptic curve Diffie-Hellman key exchange protocol, and calculates a shared key; the authentication node uses the shared key as an input of a key derivation function to generate a fixed-length session key, and uses the challenge random number to symmetrically encrypt the session key to obtain an encrypted session key; The authentication node generates a unique session identifier based on the timestamp and device identifier, binds the session identifier to the encrypted session key, and stores it in the session management module; the authentication node encapsulates the encrypted session key, temporary public key, challenge random number, and session identifier into a key negotiation message; the authentication node uses the public key of the device to be connected to asymmetrically encrypt the key negotiation message to generate an encrypted key negotiation message; The authentication node uses its own private key to calculate the hash summary of the encrypted key negotiation message, and uses the private key to digitally sign the hash summary to obtain a digital signature result; the authentication node packages the encrypted key negotiation message, the digital signature result, and the authentication node public key certificate issued by a trusted third party into a security envelope; the authentication node sends the security envelope to the device to be connected through a two-way authentication security channel established on the transport layer security protocol.

4. The method according to claim 3, characterized in that: The access device that passes the authentication and obtains the encrypted session key obtains the access control policy pre-configured by the administrator through the access control smart contract, including: After receiving the security envelope, the access device that has passed the authentication and obtained the encrypted session key verifies the validity of the authentication node public key certificate to confirm that the authentication node public key certificate is issued by a trusted certificate authority and is within the validity period; the access device uses the public key in the authentication node public key certificate to verify the digital signature result to verify that the key negotiation message has not been tampered with; the access device uses its own private key to decrypt the encrypted key negotiation message and extract the temporary public key, challenge random number, encrypted session key and session identifier; The access device executes the same elliptic curve Diffie-Hellman key exchange protocol as the authentication node, and uses the temporary public key of the authentication node, its own private key and the challenge random number to calculate the shared key; the access device uses the shared key as the input of the key derivation function to generate the same session key as the authentication node, and uses the challenge random number and the session key to decrypt the encrypted session key to obtain the original session key; the access device binds the session identifier with the decrypted session key and stores it in the local session management module; After the access device passes authentication and obtains the session key, it accesses the access control smart contract deployed on the blockchain, initiates a transaction to the contract, and passes its own device identification, device attributes, and requested operation type as transaction parameters; after receiving the transaction, the access control contract queries the access control list pre-configured in the contract by the administrator based on the device identification, device attributes, and requested operation type, and obtains the access control policy that matches the current device.

5. The method according to claim 1, characterized in that When the access device needs to access network resources, it accesses the network resources based on the access control policy, including: When the access device needs to access network resources, it constructs a network resource access request according to the target service type and parameters of the request, and encapsulates its own device identification, session identifier, and timestamp in the network resource access request; the access device obtains the session key corresponding to the session established with the target gateway device from the local session management module, and uses the session key to symmetrically encrypt the constructed network resource access request to generate an encrypted access request data packet; the access device sends the encrypted access request data packet to the target gateway device through an authenticated secure channel, and starts a timer to wait for a response from the target gateway device; After receiving the access request data packet sent by the access device, the target gateway device checks the format and integrity of the data packet. If the format is wrong or incomplete, the access request data packet is directly discarded; after passing the format check, the target gateway device uses the session identifier to find the corresponding session key from the local session management module, and uses the session key to decrypt the encrypted access request data packet to obtain the original network resource access request; the target gateway device extracts the identity of the access device from the original network resource access request, the identity includes the device number and MAC address, and calls the access control smart contract deployed on the blockchain, passing the identity as a parameter to the access control smart contract; After the access control smart contract receives the identity identifier sent by the target gateway device, it queries the access control policy corresponding to the identity identifier in the access control list maintained by the access control smart contract; the access control policy adopts a role-based access control model, defines the roles corresponding to different device identities, and the permission set possessed by each role, the permission set includes the accessible resource type, operation type, time range, and number limit; if the access control policy matching the identity identifier is not found in the access control list, the default access denial policy is returned; the access control smart contract returns the query result of the access control policy to the target network device to determine the network resource access result of the access device.

6. The method according to claim 5, characterized in that The access control smart contract returns the query results of the access control policy to the target network device to determine the network resource access results of the access device, including: The access control smart contract returns the queried access control policy to the target gateway device. The target gateway device parses the access control policy and determines whether the network resource access request of the access device meets the constraints of the current access control policy based on the permission rules defined in the access control policy. The constraints of the access control policy include that the target resource and operation type of the network resource access request are within the scope allowed by the access control policy, the initiation time of the request is within the time window specified by the access control policy, and the number of accesses of the access device per unit time does not exceed the limit of the access control policy; If the network resource access request of the access device meets all the constraints of the access control policy, the target gateway device allows the request and establishes a connection with the corresponding service provider node or device according to the target service type of the request, and forwards the request to the target node for processing; at the same time, the target gateway device submits the successful network resource access request to the blockchain in the form of a transaction, and after consensus confirmation by the nodes in the blockchain network, the network resource access record is written into the blockchain; If the network resource access request of the access device does not meet the constraints of the access control policy or the access control smart contract returns an access denial policy, the target gateway device will deny the network resource access request and return an access denied response message to the access device; at the same time, the target gateway device submits the denied network resource access request to the blockchain in the form of a transaction, and after consensus confirmation by the nodes in the blockchain network, the network resource access record will be written into the blockchain.

7. A distributed device identity authentication and access control system based on blockchain, used to implement the method described in any one of claims 1 to 6, characterized in that: include: The first unit is used for the device to be connected to generate the target device fingerprint based on the physical non-cloning function of its own device, bind the target device fingerprint with the device public key to generate the device identity information, and store the device identity information on the blockchain through the identity authentication smart contract to complete the on-chain registration of the device identity; when the device to be connected initiates an access authentication request, the device fingerprint, public key, access request timestamp and digital signature generated by the device private key of the device to be connected are sent to the authentication node together; The second unit is used for the authentication node to access the identity authentication smart contract after receiving the access authentication request; The authentication node queries the corresponding device identity information based on the device fingerprint sent by the device to be accessed, obtains the device public key in the device identity information, and uses the device public key to verify the digital signature in the access authentication request; If the digital signature verification is successful, the authentication node randomly generates a session key, encrypts it using the verified device public key, and returns the encrypted session key to the device to be connected; The third unit is used to authenticate the access device that has passed the authentication and obtained the encrypted session key. It obtains the access control policy pre-configured by the administrator through the access control smart contract. The access control policy is signed by the administrator using the administrator's private key and then uploaded to the chain. It includes the access permission level of the access device, the accessible target device or service, the access validity time window, and the access number limit. When the access device needs to access network resources, it accesses network resources based on the access control policy.

8. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images