A zero-trust forest and grassland IoT identity authentication method and system based on blockchain

Abstract

The present invention relates to a zero-trust forestry and grassland Internet of Things identity authentication method and system based on blockchain, and the method includes the following steps: S1, blockchain initialization and smart contract formulation; S2, forestry and grassland Internet of Things equipment registration; S3, forestry and grassland Internet of Things gateway accesses forestry and grassland cloud platform and initializes, and executes step S4 after identity authentication, otherwise executes step S5; S4, forestry and grassland Internet of Things terminal accesses forestry and grassland Internet of Things gateway and identity authentication, and executes step S6, otherwise executes step S7; S5, forestry and grassland cloud platform security situation awareness and emergency disposal; S6, forestry and grassland Internet of Things gateway transmits data to forestry and grassland cloud platform; S7, end; the system is used to execute the above authentication method. The present invention constructs a continuous dynamic identity authentication mechanism between forestry and grassland Internet of Things terminals, forestry and grassland Internet of Things gateways and forestry and grassland cloud platforms, and uses the smart contract technology of blockchain to record access sessions into the blockchain network, so as to realize transparent, tamper-proof and traceable access session and data exchange information.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things security technology, and specifically to a zero-trust forest and grassland Internet of Things identity authentication method based on blockchain. Background Art

[0002] Compared with the power Internet of Things, the Internet of Vehicles, and the Industrial Internet of Things, the forest and grassland Internet of Things has the industry specificity of "difficult terminal protection, difficult power supply, difficult network communication, difficult system maintenance, and difficult security protection" because the terminals are deployed in an open natural environment. At present, the traditional password-based static identity authentication method and centralized identity management model have the following defects in the forest and grassland Internet of Things:

[0003] High management and maintenance costs. Due to the large number of forest and grassland IoT terminals and gateways, in order to facilitate password management, the same password is usually used for identity authentication between each forest and grassland IoT terminal and the forest and grassland IoT gateway, and between each forest and grassland IoT gateway and the forest and grassland cloud platform. If the password is lost, all devices will be in a dangerous state, and the workload of replacing the key is large. If different passwords are used, it is difficult to remember and the maintenance cost of the password is high.

[0004] Internal attacks cannot be effectively prevented. Passwords are usually managed by administrators. If the passwords are attacked or the administrators are hacked from the inside, the passwords in the entire vertical system will be lost. In addition, the intruders can also gradually break into the entire IoT system through lateral attacks and obtain the highest authority.

[0005] Unable to dynamically detect intrusion attacks. Since the password is static, once it is lost, the subsequent identity authentication will be invalid, and the attacker can obtain confidential data unimpeded, or continue to lurk or phishing to obtain greater attack benefits.

[0006] It is impossible to effectively prevent forgery and tampering attacks. Password loss can be caused by internal personnel or external hackers. Since static authentication based on passwords cannot track past behaviors, or attackers can easily hide attack behaviors by destroying traces, it is difficult for the system to detect password loss. After discovery, internal personnel can also deny the password loss.

[0007] Unable to provide lightweight protection measures. Traditional password authentication usually requires the combination of encryption, data signature, data envelope and other technologies to achieve identity authentication and data security transmission. However, due to the difficulty in power supply and weak computing power of forest and grassland IoT gateways and terminals, it is impossible to effectively support and implement the above security solutions, and lightweight identity authentication protection measures are needed.

[0008] To sum up, there is an urgent need to provide a low-cost, decentralized forest and grassland IoT identity authentication method and system that can effectively resist internal attacks and realize the concept of "continuous verification, never trust". Summary of the invention

[0009] The purpose of the present invention is to provide a low-cost, decentralized forest and grassland Internet of Things identity authentication method and system that can effectively resist internal attacks and realize the concept of "continuous verification, never trust".

[0010] The above purpose is achieved through the following technical solution: a zero-trust forest and grassland IoT identity authentication method based on blockchain, comprising the following steps:

[0011] S1, blockchain initialization and smart contract formulation: Initialize the blockchain network, complete the definition of the identity authentication smart contract and the installation of the chain code, as well as the definition of the security situation awareness smart contract and the installation of the chain code;

[0012] S2, Registration of forest and grassland IoT devices: Carry out registration of forest and grassland IoT device information, generate static physical fingerprints and multi-dimensional dynamic feature fingerprints of forest and grassland IoT devices, and store the registration information of forest and grassland IoT devices in the database;

[0013] S3, the Lincao IoT gateway accesses the Lincao cloud platform and initializes: the Lincao IoT gateway initiates identity authentication, calls the identity authentication smart contract in step S1 to create the static physical fingerprint and multi-dimensional dynamic feature fingerprint of the Lincao IoT gateway respectively, and performs static identity authentication and continuous dynamic identity authentication. If the authentication is successful, the identity authentication result is uploaded to the blockchain network, and the periodic operation configuration strategy, periodic security perception configuration strategy and data are downloaded and stored locally, and then step S4 is executed. If the authentication fails, step S5 is executed;

[0014] S4, the forestry and grass IoT terminal accesses the forestry and grass IoT gateway and performs identity authentication: the forestry and grass IoT gateway receives and stores the identity authentication access information of the forestry and grass IoT terminal according to the local periodic operation configuration policy in step S3, and generates the static physical fingerprint and multi-dimensional dynamic feature fingerprint of the forestry and grass IoT terminal in combination with the local periodic security perception configuration policy, and completes the static identity authentication and continuous dynamic identity authentication. If the forestry and grass IoT terminal passes the identity authentication, the monitoring data collected by the forestry and grass IoT terminal is stored and the periodic operation configuration policy is issued to the forestry and grass IoT terminal to ensure the next operation, and step S6 is executed. If the forestry and grass IoT terminal fails to pass the identity authentication, the identity authentication is stopped, the access request of the forestry and grass IoT terminal is rejected, and step S7 is executed;

[0015] S5, Lincao cloud platform security situation awareness and emergency disposal: Lincao IoT gateway calls the identity authentication smart contract, records the identity authentication access session failure information to the blockchain network, and determines whether there is a DOS attack. If so, the DOS attack is prevented and step S7 is executed. If not, step S7 is executed directly;

[0016] S6, data transmission from the forest and grass IoT gateway to the forest and grass cloud platform: The forest and grass IoT gateway sends the monitoring data collected by the forest and grass IoT terminal to the forest and grass cloud platform. The forest and grass cloud platform calls the identity authentication smart contract, uploads the forest and grass IoT gateway data transmission session to the blockchain network storage, calls the security situation awareness smart contract, and then stores the forest and grass IoT gateway data into the database of the forest and grass cloud platform;

[0017] S7, end, authentication completed.

[0018] In view of the problems of high management and maintenance costs and difficulty in protecting against internal attacks in traditional static identity authentication technologies based on passwords, the present invention proposes a forestry and grassland Internet of Things identity authentication method with a zero-trust architecture based on blockchain. By combining static physical fingerprints with multi-dimensional dynamic feature fingerprint technologies, a continuous dynamic identity authentication mechanism is constructed between forestry and grassland Internet of Things terminals, forestry and grassland Internet of Things gateways and forestry and grassland cloud platforms. By utilizing the smart contract technology of blockchain, access sessions, authentication results and data exchange records are entered into the blockchain network, thereby realizing the "continuous verification, never trust" of the forestry and grassland Internet of Things system, and also realizing the openness, non-tamperability and traceability of access session and data exchange information.

[0019] A further technical solution is that step S1 specifically includes the following steps:

[0020] S1.1, blockchain network initialization;

[0021] S1.2, identity authentication smart contract definition and chain code installation, where the identity authentication smart contract includes the access session operation strategy and identity authentication operation strategy of the Lincao IoT terminal, Lincao IoT gateway and Lincao cloud platform in the blockchain network;

[0022] S1.3, security situation awareness smart contract definition and chain code installation, where the security situation awareness smart contract includes the data exchange operation strategy of the forestry and grassland IoT terminal, forestry and grassland IoT gateway and forestry and grassland cloud platform in the blockchain network after identity authentication, and the security situation awareness operation strategy in the blockchain network after identity authentication fails;

[0023] A further technical solution is that the access session operation policy includes an organization administrator login session chain policy, an identity authentication session chain policy, an identity authentication failure session chain policy and a data transmission session chain policy; it is used to initiate a transaction for the access session, calculate it through the blockchain network consensus algorithm, form a new block storage into the blockchain network, and realize the tamper-proof and traceability of the access behavior;

[0024] The identity authentication operation strategy includes

[0025] Static physical fingerprint generation strategy: It is used in the Lincao Cloud Platform to generate a static physical fingerprint of the device based on the device type, device MAC, and radio frequency fingerprint of the device in the device registration table, through the set combination and conversion, and use the hash function to generate the device static physical fingerprint as the unique identification strategy of the device;

[0026] Static identity authentication strategy: used to generate a static physical fingerprint of the current device based on the registration information of the currently accessed device, and then obtain the static physical fingerprint of the device's last access in the blockchain platform, and return the identity authentication result after comparison;

[0027] Multi-dimensional dynamic feature fingerprint generation strategy: For the forest and grass cloud platform, it is usually based on the dynamic change characteristics of the equipment registration table over time, space and environment, and uses its physical change characteristics to build a dynamic feature fingerprint for the equipment to form a continuous dynamic verification model;

[0028] Continuous dynamic identity authentication strategy: used to generate a multi-dimensional dynamic feature fingerprint based on the registration information of the current device, and then obtain the multi-dimensional dynamic feature fingerprint of the forestry and grassland IoT gateway’s last visit in the blockchain platform, compare the two pieces of information and return the identity authentication result.

[0029] The data exchange operation strategy includes

[0030] Strategy for storing device registration information: This is used by device registrars to use the factory inspection function of the device management subsystem to detect that the registered device has no safety risks. Through the device scanning and registration function, the device barcode is scanned to form a device registration record with the device information, registration personnel information, registration operation information and device fingerprint information. Information other than the static physical fingerprint of the device and the multi-dimensional dynamic feature fingerprint of the device is registered.

[0031] The periodic operation configuration download strategy of the forest and grass IoT gateway is used by the forest and grass IoT gateway to obtain the address and port of the next access of the forest and grass IoT gateway from the forest and grass cloud platform client, as well as the periodic operation configuration such as the wake-up time and wake-up duration, and store them locally in the forest and grass IoT gateway;

[0032] The periodic security perception configuration download strategy of the forest and grass IoT gateway is used by the forest and grass IoT gateway to obtain the device access registration information of the forest and grass IoT terminal paired with the forest and grass IoT gateway from the forest and grass cloud platform client, as well as the static physical fingerprint generation strategy, static identity authentication strategy, multi-dimensional dynamic feature fingerprint generation strategy, and continuous dynamic identity authentication strategy of the identity authentication smart contract to be stored locally in the forest and grass IoT gateway;

[0033] The Forestry and Grassland IoT Gateway collects data transmission and storage strategies: It is used by the Forestry and Grassland IoT Gateway to obtain the data transmission and storage configuration information and execute operations in the Forestry and Grassland Cloud Platform from the Forestry and Grassland Cloud Platform client, including but not limited to the Forestry and Grassland Cloud Platform client database IP address, access port, database name, and database user.

[0034] The security situation awareness operation strategy includes

[0035] Security situation awareness strategy: used by the Lincao cloud platform to read the historical access session records in the blockchain network, evaluate the number of accesses to the current client node and the Lincao IoT gateway to determine whether there is a DOS attack;

[0036] Security threat emergency response strategy: The Lincao Cloud Platform is used to urgently shut down the current access IP and / or access port for the Lincao IoT gateway that exceeds the specified access threshold to prevent DOS attacks.

[0037] A further technical solution is that step S2 specifically includes the following steps:

[0038] S2.1, Forestry and Grassland IoT Device Registrar Identity Authentication: The device registrar registers this access session through the access session operation policy and uploads it to the blockchain network;

[0039] S2.2, Forestry and Grassland IoT Device Information Registration: The device information, registrar information, registration operation information and device fingerprint information are combined to form a device registration record, and the information is registered through the device registration information storage strategy;

[0040] S2.3, Static physical fingerprint generation of forest and grassland IoT devices: according to the type of forest and grassland IoT devices, the static physical fingerprint generation strategy in the identity authentication smart contract is called to generate a static physical fingerprint as a unique identifier;

[0041] S2.4, generation of multi-dimensional dynamic feature fingerprints for forestry and grassland IoT devices: according to the type of forestry and grassland IoT devices, the multi-dimensional dynamic feature fingerprint generation strategy in the identity authentication smart contract is called to generate multi-dimensional dynamic feature fingerprints to form a continuous dynamic verification model;

[0042] S2.5, the registration information of forestry and grassland IoT devices is stored in the database: call the data exchange operation strategy in the security situation awareness smart contract to store the registration information of forestry and grassland IoT devices in the database.

[0043] A further technical solution is that step S3 specifically includes the following steps:

[0044] S3.1, determine whether the forest and grassland IoT gateway is deployed for the first time, if so, execute step S3.2, if not, execute step S3.3;

[0045] S3.2, the first deployment of the Forestry and Grassland IoT Gateway initiates an identity authentication session: the Forestry and Grassland IoT Gateway is configured with the access address and port, the Forestry and Grassland IoT Gateway sends the device registration information stored locally, and sends an identity authentication access request to the Forestry and Grassland Cloud Platform;

[0046] S3.3, the forest and grass IoT gateway periodically initiates an identity authentication session: the forest and grass IoT gateway sends an identity authentication access request to the forest and grass cloud platform with the device registration information collected and updated locally;

[0047] S3.4, create a static physical fingerprint of the forestry and grassland IoT gateway and perform static identity authentication: call the static physical fingerprint generation strategy of the identity authentication smart contract, generate the static physical fingerprint of the current forestry and grassland IoT gateway based on the registration information of the forestry and grassland IoT gateway sent, and then obtain the static physical fingerprint of the forestry and grassland IoT gateway last accessed in the blockchain platform, call the static identity authentication strategy of the identity authentication smart contract, compare and authenticate the two static physical fingerprints of the forestry and grassland IoT gateway, if passed, execute step S3.5, otherwise, execute step S5;

[0048] S3.5, create a multi-dimensional dynamic feature fingerprint of the forestry and grassland IoT gateway and perform dynamic identity authentication: call the multi-dimensional dynamic feature fingerprint generation strategy of the identity authentication smart contract, generate the multi-dimensional dynamic feature fingerprint of the current forestry and grassland IoT gateway based on the registration information of the forestry and grassland IoT gateway sent, and then obtain the multi-dimensional dynamic feature fingerprint of the forestry and grassland IoT gateway last accessed in the blockchain platform, call the continuous dynamic identity authentication strategy of the identity authentication smart contract, compare and authenticate the multi-dimensional dynamic feature fingerprints of the forestry and grassland IoT gateway twice, if passed, execute step S3.6, otherwise, execute step S5;

[0049] S3.6, Forestry and Grassland IoT Gateway identity authentication result session upload to blockchain network: By calling the identity authentication session chain strategy of the identity authentication smart contract, the session information is recorded into the blockchain network, and by calling the device registration information storage strategy of the security situation awareness smart contract, the device access registration information of the current forestry and grassland IoT gateway is added and updated into the database for the next dynamic verification;

[0050] S3.7, the forestry and grassland IoT gateway downloads and stores periodic operation configuration policies, periodic security awareness configuration policies and data: calls the periodic operation configuration download policy of the forestry and grassland IoT gateway of the security situation awareness smart contract, downloads the periodic operation configuration of the forestry and grassland IoT gateway and stores it locally in the forestry and grassland IoT gateway, and downloads the device access registration information of the forestry and grassland IoT terminal paired with the forestry and grassland IoT gateway through the periodic security awareness configuration download policy of the forestry and grassland IoT gateway, as well as the static physical fingerprint generation policy, static identity authentication policy, multi-dimensional dynamic feature fingerprint generation policy and continuous dynamic identity authentication policy of the forestry and grassland IoT terminal of the identity authentication smart contract and stores them locally in the forestry and grassland IoT gateway, so as to realize the continuous dynamic identity authentication of the forestry and grassland IoT terminal by the forestry and grassland IoT gateway during periodic operation.

[0051] A further technical solution is that step S4 specifically includes the following steps:

[0052] S4.1, the forest and grassland IoT gateway receives and stores the forest and grassland IoT terminal identity authentication access session information;

[0053] S4.2, the forestry and grass IoT gateway creates a static physical fingerprint of the forestry and grass IoT terminal and performs static identity authentication: the forestry and grass IoT gateway generates a static physical fingerprint for accessing the forestry and grass IoT terminal based on the static physical fingerprint generation strategy stored locally, calls the static identity authentication strategy, and compares it with the static physical fingerprint of the forestry and grass IoT terminal stored locally. If it passes, execute step S4.3, otherwise, end;

[0054] S4.3, the forestry and grass IoT gateway creates a multi-dimensional dynamic feature fingerprint of the forestry and grass IoT terminal and performs dynamic identity authentication: the forestry and grass IoT gateway obtains the identity authentication session parameters of the forestry and grass IoT terminal based on the multi-dimensional dynamic feature fingerprint generation strategy stored locally, and obtains the identity authentication session parameters of the last forestry and grass IoT terminal stored locally from the blockchain network when the forestry and grass IoT gateway is awakened, calculates and generates a multi-dimensional dynamic feature fingerprint, and uses the locally stored continuous dynamic identity authentication strategy to compare and authenticate the two multi-dimensional dynamic feature fingerprints of the forestry and grass IoT terminal. If passed, execute step S4.4, otherwise, end;

[0055] S4.4, the forestry and grassland IoT gateway stores the data collected by the forestry and grassland IoT terminal and sends down the periodic operation configuration: the forestry and grassland IoT gateway receives the authentication parameters and collected data transmitted by the forestry and grassland IoT terminal, stores them in the forestry and grassland IoT gateway, and sends the periodic operation policy of the forestry and grassland IoT terminal stored locally to the forestry and grassland IoT terminal.

[0056] A further technical solution is that step S5 specifically includes the following steps:

[0057] S5.1, Forestry and Grassland IoT Gateway identity authentication result session upload to blockchain network:

[0058] Call the identity authentication smart contract's identity authentication failed session chain strategy, and record the identity authentication access session failure information into the blockchain network;

[0059] S5.2, the Lincao cloud platform conducts security situation awareness and emergency disposal: calls the security situation awareness strategy of the security situation awareness smart contract, reads the historical access session records in the blockchain network, evaluates the number of accesses to the current client node and the Lincao IoT gateway to determine whether there is a DOS attack. If the access IP and / or access port exceeds the access upper limit threshold, the client node calls the security threat emergency disposal strategy of the security situation awareness smart contract to urgently close the current access IP and / or access port to prevent the DOS attack.

[0060] A further technical solution is that step S6 specifically includes the following steps:

[0061] S6.1, the forest and grassland IoT gateway sends the collected data to the forest and grassland cloud platform;

[0062] S6.2, the Lincao Cloud Platform uploads the data transmission session to the blockchain network and collects data into the database: the Lincao Cloud Platform calls the data transmission session chain strategy of the identity authentication smart contract, uploads the Lincao IoT gateway data transmission session information to the blockchain network storage, calls the Lincao gateway data collection data storage strategy of the security situation awareness smart contract, and then stores the Lincao IoT gateway data into the database of the Lincao Cloud Platform.

[0063] To achieve the above-mentioned objectives, the present invention also provides a blockchain-based zero-trust forestry and grassland Internet of Things identity authentication system, which is used to implement any of the above-mentioned blockchain-based zero-trust forestry and grassland Internet of Things identity authentication methods. The blockchain-based zero-trust forestry and grassland Internet of Things identity authentication system is established on a blockchain network, and realizes continuous identity authentication management between forestry and grassland Internet of Things terminals, forestry and grassland Internet of Things gateways and forestry and grassland cloud platforms by calling and executing smart contracts.

[0064] A further technical solution is that the blockchain-based zero-trust forest and grassland IoT identity authentication system includes:

[0065] Blockchain initialization and smart contract definition module: used to initialize the blockchain network according to the application scenario, complete the identity authentication smart contract definition and chain code installation, as well as the security situation awareness smart contract definition and chain code installation;

[0066] Device registration management module: used to access the forest and grassland IoT system. After registering the access session on the chain, the forest and grassland IoT device information registration is carried out to generate the static physical fingerprint and multi-dimensional dynamic feature fingerprint of the forest and grassland IoT device, and store the device registration information in the database of the forest and grassland cloud platform;

[0067] The Lincao Cloud Platform's identity authentication module for the Lincao IoT Gateway is used to call the identity authentication smart contract to create static physical fingerprints and multi-dimensional dynamic feature fingerprints for the Lincao IoT Gateway, and to perform static identity authentication and continuous dynamic identity authentication;

[0068] Forestry and Grassland IoT Gateway Initialization Module: used to upload the identity authentication result session to the blockchain network, and download and obtain the storage periodic operation configuration strategy, periodic security awareness configuration strategy and data to the local storage;

[0069] The forestry and grassland IoT gateway to the forestry and grassland IoT terminal identity authentication module: the forestry and grassland IoT gateway receives and stores the identity authentication access session information of the forestry and grassland IoT terminal according to the periodic operation configuration policy downloaded locally, and then generates the static physical fingerprint and multi-dimensional dynamic feature fingerprint of the forestry and grassland IoT terminal in combination with the periodic security perception configuration policy, completes the static identity authentication and continuous dynamic identity authentication, and stores the data collected by the forestry and grassland IoT terminal locally;

[0070] Data interaction module between forestry and grassland IoT gateway and forestry and grassland IoT terminal: used to obtain periodic operation configuration strategy from forestry and grassland IoT gateway and save it in forestry and grassland IoT terminal to ensure the next operation, and transmit the collected data to forestry and grassland IoT gateway for storage;

[0071] Forestry and Grassland IoT Security Situation Awareness Module: It is used for the forestry and grassland IoT gateway to call the identity authentication smart contract's identity authentication failure session chain strategy, record the identity authentication access session failure information into the blockchain network, and call the security situation awareness strategy of the security situation awareness smart contract to read the historical access session records in the blockchain network, evaluate the current client node and the number of visits to the forestry and grassland IoT gateway to determine whether there is a DOS attack;

[0072] Forestry and Grassland IoT Security Emergency Disposal Module: When the access IP and / or access port exceeds the access upper limit threshold, the client node calls the security threat emergency disposal strategy of the security situation awareness smart contract to urgently close the current access IP and / or access port to prevent DOS attacks;

[0073] The data collection and transmission module of the forest and grassland IoT gateway is used to send data transmission sessions to the forest and grassland cloud platform, and transmit the collected and aggregated monitoring data to the forest and grassland cloud platform through the network;

[0074] The Lincao Cloud Platform transmission session chain and data storage module is used to call the data transmission session chain strategy of the identity authentication smart contract, upload the data transmission session information of the Lincao IoT gateway to the blockchain network storage, and call the Lincao gateway collection data transmission storage strategy of the security situation awareness smart contract to store the Lincao IoT gateway data into the database of the Lincao Cloud Platform.

[0075] Compared with the prior art, the technical solution of the present invention has the following advantages:

[0076] (1) Low management and maintenance costs: The identity authentication method adopted by the present invention uses the static physical fingerprint of the forest and grassland IoT device, which relies more on the multi-dimensional dynamic feature fingerprint of the physical properties of the device. These fingerprint information are based on the physical properties of the IoT itself, do not require fixed memory and storage, and have low maintenance costs;

[0077] (2) Effectively prevent internal attacks: The multi-dimensional dynamic feature fingerprint used in the present invention performs continuous dynamic verification based on the characteristics of the IoT device itself. Internal managers can obtain the password information of a certain device or each system and cannot break into other devices or systems;

[0078] (3) Dynamic detection of intrusion attacks: Since identity authentication is based on zero-trust architecture and multi-dimensional dynamic feature fingerprints, the "never trust, continuous verification" approach is implemented. Therefore, the identity authentication method is constantly changing. If there is a forgery, impersonation, or replay attack, the system can promptly detect illegal access and register it in the blockchain network, so it can be discovered and traced in a timely manner.

[0079] (4) Effectively prevent forgery and tampering attacks: For illegal access, the present invention records it in the blockchain network. Through the tamper-proof and traceable characteristics of the blockchain, all illegal access can be queried, effectively preventing attackers from hiding their illegal attack behaviors by tampering with or deleting access records;

[0080] (5) Provide lightweight protection measures: The multi-dimensional dynamic feature fingerprint technology provided by the present invention is verified based on the physical characteristics of the forest and grassland Internet of Things devices. It does not require password preservation, encrypted storage and transmission. The protection method is both "ready-to-use" and fast and lightweight. It is very suitable for security protection in low-power and long-period monitoring scenarios such as forest and grassland Internet of Things where power supply and transmission are difficult. BRIEF DESCRIPTION OF THE DRAWINGS

[0081] The accompanying drawings, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0082] Figure 1A flowchart of a zero-trust forest and grassland IoT identity authentication method based on blockchain according to an embodiment of the present invention;

[0083] Figure 2 A flowchart of a blockchain initialization and smart contract definition process according to an embodiment of the present invention;

[0084] Figure 3 A schematic diagram of the process of registering a forest and grassland IoT device according to an embodiment of the present invention;

[0085] Figure 4 A schematic diagram of the process of accessing the forest and grassland cloud platform and initialization of the forest and grassland Internet of Things gateway involved in one embodiment of the present invention;

[0086] Figure 5 A schematic diagram of the process of a forestry and grassland Internet of Things terminal accessing a forestry and grassland Internet of Things gateway and identity authentication process involved in one embodiment of the present invention;

[0087] Figure 6 This is a structural block diagram of a zero-trust forest and grassland IoT identity authentication system based on blockchain involved in one embodiment of the present invention;

[0088] Figure 7 This is a schematic diagram of the execution flow of a blockchain-based zero-trust forestry and grassland Internet of Things identity authentication system involved in one embodiment of the present invention. DETAILED DESCRIPTION

[0089] The present invention is described in detail below in conjunction with the accompanying drawings. The description in this part is only exemplary and explanatory and should not have any limiting effect on the scope of protection of the present invention. In addition, those skilled in the art can make corresponding combinations of the features in the embodiments and in different embodiments in this document based on the description of this document.

[0090] The embodiments of the present invention are as follows, referring to Figures 1 to 6 , a zero-trust forest and grassland Internet of Things identity authentication method based on blockchain, comprising the following steps:

[0091] S1, blockchain initialization and smart contract formulation: system builders initialize the blockchain network according to the application scenario, complete the definition of identity authentication smart contract and chain code installation, as well as the definition of security situation awareness smart contract and chain code installation;

[0092] like Figure 2 , the specific steps of step S1 are as follows:

[0093] S1.1, blockchain network initialization: select the appropriate blockchain type and specific blockchain platform according to the application scenario, carry out organization registration, identity authentication and verification, define the alliance for the organization according to the actual business and create a channel for the alliance, issue certificates to the organization's client user nodes, peer nodes, sorting nodes, and identity authentication nodes through the certificate authority, and each organization approves the chain code definition and endorsement policy definition and completes the storage on the channel ledger.

[0094] For the forest and grassland IoT application scenario, considering that the users are mainly forest and grassland management departments, the data has strong industry attributes and needs to be connected to the Internet for information exchange. It is most appropriate to use a consortium chain, and Hyperledger Fabric is one of the most widely used consortium chain platforms in the world. Therefore, the Fabric blockchain platform is recommended for the method of the present invention.

[0095] For the forestry and grassland Internet of Things system, the forestry and grassland management departments at all levels are organizations, and usually establish organizations and alliances according to administrative levels. For example, the forestry and grassland management departments at the municipal and county levels are organizations, and alliances are established at the provincial level. Channels are built to enable organizations to communicate with each other and maintain a common ledger.

[0096] Each organization is an organization administrator registered in the Fabric blockchain network MSP, and sends requests and obtains services through the client user node to the Lincao IoT identity continuous authentication management system deployed on the Lincao cloud platform.

[0097] S1.2, identity authentication smart contract definition and chain code installation, where the identity authentication smart contract includes the access session operation strategy and identity authentication operation strategy of the Lincao IoT terminal, Lincao IoT gateway and Lincao cloud platform in the blockchain network;

[0098] The access session operation strategy includes the organization administrator login session chain strategy, identity authentication session chain strategy, identity authentication failure session chain strategy and data transmission session chain strategy; for the forest and grassland IoT system, the access session storage content is different according to the session type, but the storage method is the same, all of which is to update the access session information into the blockchain network. For example, the organization administrator login session chain strategy, the session storage content includes but is not limited to the organization administrator username, login time, login location, login IP, and submits a session write request to the blockchain network after the session is completed.

[0099] Organization administrator login session chain strategy: The device registrar registered through the Fabric blockchain network MSP initiates a transaction to the forest and grassland IoT system device registration management module access session through the organization's client node. After calculation through the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network, realizing the unalterable and traceable strategy of the organization administrator's login behavior;

[0100] Identity authentication session chain strategy: The Lincao IoT gateway uses the configured address and port to send the locally collected and updated device registration information to the Lincao cloud platform through the organization's client node to initiate the identity authentication access session transaction. After calculation through the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network, realizing the strategy of non-tamperability and traceability of identity authentication behavior;

[0101] Strategy for on-chain authentication failure session: When authentication fails, the organization's client node sends an authentication failure access session to the Lincao Cloud platform to initiate a transaction. After calculation by the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network, thus implementing a tamper-proof and traceable strategy for authentication failure behavior.

[0102] Data transmission session chain strategy: The client node in the Lincao Cloud Platform initiates a transaction for the Lincao IoT gateway data transmission session. After calculation through the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network, realizing the strategy of non-tamperability and traceability of data transmission behavior.

[0103] The identity authentication operation strategy includes static physical fingerprint generation strategy, static identity authentication strategy, multi-dimensional dynamic feature fingerprint generation strategy of forestry and grassland Internet of Things gateway, continuous dynamic identity authentication strategy, static physical fingerprint generation strategy, static identity authentication strategy, multi-dimensional dynamic feature fingerprint generation strategy and continuous dynamic identity authentication strategy of forestry and grassland Internet of Things terminal; for the forestry and grassland Internet of Things system, the identity authentication access parameters include all parameters of static Internet of Things fingerprint generation and multi-dimensional dynamic feature fingerprint generation, and the identity authentication access parameters of the previous device can be obtained from the blockchain network to realize the comparative verification of two multi-dimensional dynamic feature fingerprints.

[0104] Static physical fingerprint generation strategy: The Lincao Cloud Platform generates a static physical fingerprint for the device using a hash function based on the device type, device MAC, and radio frequency fingerprint of the device in the device registration table, after a set combination and conversion, as a strategy for the unique identification of the device;

[0105] Static identity authentication strategy: Generate a static physical fingerprint of the current device based on the registration information of the currently accessed device, then obtain the static physical fingerprint of the device's last access in the blockchain platform, and return the identity authentication result after comparison;

[0106] Multi-dimensional dynamic feature fingerprint generation strategy: The Lincao Cloud Platform usually builds dynamic feature fingerprints for devices based on the dynamic change characteristics of time, space and environment in the device registration table, using its physical change characteristics to form a continuous dynamic verification model;

[0107] Continuous dynamic identity authentication strategy: Based on the registration information of the current device, a multi-dimensional dynamic feature fingerprint is generated, and then the multi-dimensional dynamic feature fingerprint of the forestry and grassland IoT gateway that was last accessed in the blockchain platform is obtained. The two pieces of information are compared and the identity authentication result is returned.

[0108] S1.3, security situation awareness smart contract definition and chain code installation, where the security situation awareness smart contract includes the data exchange operation strategy of the forestry and grassland IoT terminal, forestry and grassland IoT gateway and forestry and grassland cloud platform in the blockchain network after identity authentication, and the security situation awareness operation strategy in the blockchain network after identity authentication fails;

[0109] The data exchange operation strategy includes the device registration information storage strategy, the forest and grassland Internet of Things gateway periodic operation configuration download strategy, the forest and grassland Internet of Things gateway periodic security perception configuration download strategy and the forest and grassland Internet of Things gateway collection data transmission storage strategy;

[0110] Strategy for storing device registration information: The device registrar uses the factory inspection function of the device management subsystem to check that the registered device has no safety risks. Through the device scanning and registration function, the device barcode is scanned to form a device registration record with the device information, registration personnel information, registration operation information and device fingerprint information. Information other than the static physical fingerprint of the device and the multi-dimensional dynamic feature fingerprint of the device is registered.

[0111] The strategy for downloading the periodic operation configuration of the forest and grass IoT gateway: The forest and grass IoT gateway obtains the address and port for downloading the next access of the forest and grass IoT gateway from the client of the forest and grass cloud platform, as well as the periodic operation configuration such as the wake-up time and wake-up duration, and stores them locally in the forest and grass IoT gateway;

[0112] The download strategy of the periodic security perception configuration of the Lincao IoT Gateway: The Lincao IoT Gateway obtains the device access registration information of the Lincao IoT terminal paired with the Lincao IoT Gateway from the Lincao Cloud Platform Client, and stores the static physical fingerprint generation strategy, static identity authentication strategy, multi-dimensional dynamic feature fingerprint generation strategy, and continuous dynamic identity authentication strategy of the identity authentication smart contract locally in the Lincao IoT Gateway;

[0113] The Forestry and Grassland IoT Gateway collects data transmission and storage strategies: The Forestry and Grassland IoT Gateway obtains the data transmission and storage configuration information and execution operations in the Forestry and Grassland Cloud Platform from the Forestry and Grassland Cloud Platform client, including but not limited to the Forestry and Grassland Cloud Platform client database IP address, access port, database name, and database user.

[0114] The security situation awareness operation strategy includes a security situation awareness strategy and a security threat emergency handling strategy.

[0115] Security situation awareness strategy: The Lincao cloud platform reads the historical access session records in the blockchain network, evaluates the number of accesses to the current client node and the Lincao IoT gateway, and determines whether there is a DOS attack;

[0116] Emergency response strategy for security threats: The Lincao Cloud Platform will urgently close the current access IP and / or access port for the Lincao IoT gateway that exceeds the specified access threshold to prevent DOS attacks.

[0117] S2, Forestry and Grassland IoT Device Registration: The device registrar who registers through the Fabric blockchain network MSP, after identity authentication, accesses the forestry and grassland IoT system through the organization's client node, registers this access session on the chain, and then carries out the forestry and grassland IoT device information registration, generates the static physical fingerprint and multi-dimensional dynamic feature fingerprint of the forestry and grassland IoT device, and stores the registration information of the forestry and grassland IoT device in the database;

[0118] like Figure 3 , the specific steps of step S2 are as follows:

[0119] S2.1, Forestry and Grassland IoT Device Registrar Identity Authentication: The device registrar registered through the Fabric blockchain network MSP, after identity authentication, accesses the forestry and grassland IoT system device registration management module through the organization's client node, and registers this access session through the identity authentication smart contract access session operation policy to upload the blockchain network. The forestry and grassland IoT system device registration management module is written based on the Fabric blockchain SDK and can interact with the Fabric blockchain network;

[0120] S2.2, Forestry and Grassland IoT Device Information Registration: The device registrar scans the device barcode to form a device registration record with the device information, registration personnel information, registration operation information and device fingerprint information. The device registration information storage strategy of the security situation awareness smart contract is used to register information other than the static physical fingerprint of the device and the multi-dimensional dynamic feature fingerprint of the device. The data logical structure of the device registration is as follows:

[0121] Equipment registration (registration ID, equipment ID, equipment type, equipment mac, equipment power, equipment temperature, equipment external humidity, equipment internal humidity, channel fingerprint, radio frequency fingerprint, registration personnel number, registration batch number, registration workshop, registration time, equipment static physical fingerprint, equipment multi-dimensional dynamic feature fingerprint), where the registration ID is the unique identifier of the equipment registration list and the primary key in the database;

[0122] The device ID is the device number of the forest and grassland IoT device, and the device ID within each device and between devices is unique;

[0123] The device type is the forest and grassland IoT device type, including but not limited to gateways, terminals, and mobile data collection terminals;

[0124] Device mac is the mac address of the device, which is a unique and fixed mark of the device;

[0125] The device power level is the power level read during registration;

[0126] The device temperature is the device temperature read during registration;

[0127] The device humidity is the humidity sensor data on the outside of the device shell during registration, which is equivalent to the ambient humidity;

[0128] The humidity inside the device is the humidity sensor data inside the device shell during registration. The airtightness of the device shell is detected by comparing the humidity inside and outside the device.

[0129] The channel fingerprint is the signal strength of the wireless communication module of the forest and grassland IoT device. The wireless communication module can be WIFI, Bluetooth, or LORA depending on the device.

[0130] Radio frequency fingerprint is the signal characteristic of the wireless communication module of forest and grassland IoT equipment;

[0131] The registrant number is the registrant number that has passed the Fabric blockchain network MSP identity authentication and uses the device to register the client system;

[0132] The registration batch number is the number of the registered equipment in this batch, which is automatically generated according to the numbering rules;

[0133] The registered workshop is the name of the site registered during registration;

[0134] The registration time is the time of scanning and registration;

[0135] The static physical fingerprint of the device is automatically generated according to the static physical fingerprint generation strategy of the identity authentication smart contract;

[0136] The multi-dimensional dynamic feature fingerprint of the device is automatically generated according to the multi-dimensional dynamic feature fingerprint generation strategy of the identity authentication smart contract;

[0137] S2.3, Static physical fingerprint generation of forest and grass IoT devices: The device registrar uses the client node to call the static physical fingerprint generation strategy in the identity authentication smart contract according to the device type to generate a static physical fingerprint. The static physical fingerprint generation strategy is usually based on the device type, device MAC, and radio frequency fingerprint in the registered device registration table. After the set combination and conversion, the device static physical fingerprint is generated through a hash function as the unique identifier of the device;

[0138] The combination and conversion method in the forest and grassland IoT system uses string concatenation operations, that is, the device type, device MAC address and radio frequency fingerprint information are spliced ​​into a string, and then the national secret SM3 cryptographic hash algorithm is used to output a summary information with a length of 256 bits as the static physical fingerprint of the device;

[0139] S2.4, Generation of multi-dimensional dynamic feature fingerprints for forestry and grassland IoT devices: The device registrar uses the client node to call the multi-dimensional dynamic feature fingerprint generation strategy in the identity authentication smart contract according to the device type to generate a multi-dimensional dynamic feature fingerprint. The multi-dimensional dynamic feature fingerprint generation strategy is usually based on the dynamic change characteristics of the device registration table over time, space and environment, and uses its physical change characteristics to construct a dynamic feature fingerprint to form a continuous dynamic verification model;

[0140] For the forestry and grassland Internet of Things system, the device type, device MAC, device power, registration time, and the time-battery power attenuation model can be used to build a dynamic feature fingerprint based on power; the device temperature, external humidity, and internal humidity can be used to build a dynamic feature fingerprint based on temperature and humidity using the consistency characteristics of common spatial environmental factors; the channel fingerprint and RF fingerprint can be used to build a dynamic feature fingerprint based on the network channel using the wireless signal spatial transmission attenuation model.

[0141] S2.5, the registration information of forestry and grassland IoT devices is stored in the database: the device registrar calls the data exchange operation policy in the security situation awareness smart contract through the client node to store the registration information of the forestry and grassland IoT devices in the database.

[0142] S3, the Lincao IoT gateway accesses the Lincao cloud platform and initializes: the Lincao IoT gateway initiates an identity authentication session, and the client node calls the identity authentication smart contract in step S1 to create the static physical fingerprint and multi-dimensional dynamic feature fingerprint of the Lincao IoT gateway respectively, and performs static identity authentication and continuous dynamic identity authentication. If the authentication is successful, the identity authentication result is uploaded to the blockchain network, and the periodic operation configuration strategy, periodic security perception configuration strategy and data are downloaded and stored locally, and then step S4 is executed. If the authentication fails, step S5 is executed;

[0143] like Figure 4 , the specific steps of step S3 are as follows:

[0144] S3.1, determine whether the forest and grassland IoT gateway is deployed for the first time, if so, execute step S3.2, if not, execute step S3.3;

[0145] S3.2, the first deployment of the forest and grassland IoT gateway initiates an identity authentication session: the field investigators registered by each organization in the Fabric blockchain network MSP, after passing the MSP identity authentication, use the mobile data collection terminal to connect to the forest and grassland IoT gateway and configure the address and port of the access client node. The forest and grassland IoT gateway sends the locally stored device registration information to the client node, and sends an identity authentication access request to the forest and grassland cloud platform through the client node;

[0146] S3.3, the forest and grass IoT gateway periodically initiates an identity authentication session: the forest and grass IoT gateway uses the configured address and port to send an identity authentication access request to the forest and grass cloud platform through the client node with the locally collected and updated device registration information;

[0147] S3.4, create a static physical fingerprint of the forestry and grassland IoT gateway and perform static identity authentication: the client node calls the static physical fingerprint generation strategy of the identity authentication smart contract, generates the static physical fingerprint of the current forestry and grassland IoT gateway based on the registration information of the sent forestry and grassland IoT gateway, and then obtains the static physical fingerprint of the forestry and grassland IoT gateway last accessed in the blockchain platform, calls the static identity authentication strategy of the identity authentication smart contract, compares and authenticates the two static physical fingerprints of the forestry and grassland IoT gateway, if passed, execute step S3.5, otherwise, execute step S5;

[0148] S3.5, create a multi-dimensional dynamic feature fingerprint of the forestry and grassland IoT gateway and perform dynamic identity authentication: the client node calls the multi-dimensional dynamic feature fingerprint generation strategy of the identity authentication smart contract, generates the multi-dimensional dynamic feature fingerprint of the current forestry and grassland IoT gateway based on the registration information of the sent forestry and grassland IoT gateway, and then obtains the multi-dimensional dynamic feature fingerprint of the forestry and grassland IoT gateway that was last accessed in the blockchain platform, calls the continuous dynamic identity authentication strategy of the identity authentication smart contract, compares and authenticates the multi-dimensional dynamic feature fingerprints of the forestry and grassland IoT gateway twice, if passed, execute step S3.6, otherwise, execute step S5;

[0149] For the forest and grass IoT system, the device type, device mac, device power, and registration time of the last access time node are calculated using the time-battery power attenuation model to compare the battery power result with the power in the current registration information of the forest and grass IoT gateway. If it is within the set threshold range, such as ±10% of the calculation result, it is considered to have passed the verification; the device temperature, humidity outside the device, and humidity inside the device collected by the IoT gateway this time are calculated using the consistency characteristics of the common spatial environmental factors. The fluctuation range of the ambient temperature and humidity of all devices is calculated. If it is within the set threshold range, such as ±10% of the average temperature and humidity, it is considered to have passed the verification; the channel fingerprint and RF fingerprint are constructed based on the network channel using the wireless signal spatial transmission attenuation model. If it is within the set threshold range, such as ±10% of the signal strength, it is considered to have passed the verification. The above multi-dimensional feature fingerprints can be used alone or in combination.

[0150] S3.6, the authentication result session of the forest and grass IoT gateway is uploaded to the blockchain network: the client node records the session information into the blockchain network by calling the authentication session chain strategy of the authentication smart contract, and adds and updates the device access registration information of the current forest and grass IoT gateway into the database by calling the device registration information storage strategy of the security situation awareness smart contract for the next dynamic verification;

[0151] S3.7, the forestry and grassland IoT gateway downloads and stores periodic operation configuration policies, periodic security awareness configuration policies and data: the client node calls the periodic operation configuration download policy of the forestry and grassland IoT gateway of the security situation awareness smart contract, downloads the address and port of the next access of the forestry and grassland IoT gateway, as well as the wake-up time, wake-up duration and other periodic operation configurations stored in the local forestry and grassland IoT gateway, and downloads the device access registration information of the forestry and grassland IoT terminal paired with the forestry and grassland IoT gateway through the periodic security awareness configuration download policy of the forestry and grassland IoT gateway, as well as the static physical fingerprint generation policy, static identity authentication policy, multi-dimensional dynamic feature fingerprint generation policy and continuous dynamic identity authentication policy of the forestry and grassland IoT terminal of the identity authentication smart contract and stores them in the local forestry and grassland IoT gateway, so as to realize the continuous dynamic identity authentication of the forestry and grassland IoT terminal by the forestry and grassland IoT gateway during periodic operation.

[0152] S4, the forestry and grass IoT terminal accesses the forestry and grass IoT gateway and performs identity authentication: the forestry and grass IoT gateway receives and stores the identity authentication access information of the forestry and grass IoT terminal according to the local periodic operation configuration policy in step S3, and generates the static physical fingerprint and multi-dimensional dynamic feature fingerprint of the forestry and grass IoT terminal in combination with the local periodic security perception configuration policy, and completes the static identity authentication and continuous dynamic identity authentication. If the forestry and grass IoT terminal passes the identity authentication, the monitoring data collected by the forestry and grass IoT terminal is stored and the periodic operation configuration policy is issued to the forestry and grass IoT terminal to ensure the next operation, and step S6 is executed. If the forestry and grass IoT terminal fails to pass the identity authentication, the identity authentication is stopped, the access request of the forestry and grass IoT terminal is rejected, and step S7 is executed;

[0153] like Figure 5 , the specific steps of step S4 are as follows:

[0154] S4.1, the forestry and grassland IoT gateway receives and stores the identity authentication access session information of the forestry and grassland IoT terminal; the forestry and grassland IoT gateway receives the identity access request of the forestry and grassland IoT terminal, obtains the identity authentication session parameters of the forestry and grassland IoT terminal, and stores them locally in the forestry and grassland IoT gateway.

[0155] S4.2, the forestry and grass IoT gateway creates a static physical fingerprint of the forestry and grass IoT terminal and performs static identity authentication: the forestry and grass IoT gateway generates a static physical fingerprint for accessing the forestry and grass IoT terminal based on the static physical fingerprint generation strategy stored locally, calls the static identity authentication strategy, and compares it with the static physical fingerprint of the forestry and grass IoT terminal stored locally. If it passes, execute step S4.3, otherwise, end;

[0156] For the forestry and grassland IoT system, the authentication session parameters of the forestry and grassland IoT terminal include device type, device MAC, and radio frequency fingerprint. The static physical fingerprint of the forestry and grassland IoT terminal stored locally is the same as that registered by the device registration management.

[0157] S4.3, the forestry and grass IoT gateway creates a multi-dimensional dynamic feature fingerprint of the forestry and grass IoT terminal and performs dynamic identity authentication: the forestry and grass IoT gateway obtains the identity authentication session parameters of the forestry and grass IoT terminal based on the multi-dimensional dynamic feature fingerprint generation strategy stored locally, and obtains the identity authentication session parameters of the last forestry and grass IoT terminal stored locally from the blockchain network when the forestry and grass IoT gateway is awakened, calculates and generates a multi-dimensional dynamic feature fingerprint, and uses the locally stored continuous dynamic identity authentication strategy to compare and authenticate the two multi-dimensional dynamic feature fingerprints of the forestry and grass IoT terminal. If passed, execute step S4.4, otherwise, end;

[0158] The multi-dimensional dynamic feature fingerprint generation strategy stored and used by the forestry and grassland IoT gateway is consistent with the multi-dimensional dynamic feature fingerprint generation strategy of the identity authentication smart contract. Both use the dynamic change characteristics of the device registration table over time, space and environment, and use their physical change characteristics to construct dynamic feature fingerprints to form a continuous dynamic verification model.

[0159] For the forestry and grassland Internet of Things system, the device type, device MAC, device power, registration time, and the time-battery power attenuation model can be used to build a dynamic feature fingerprint based on power; the device temperature, external humidity, and internal humidity can be used to build a dynamic feature fingerprint based on temperature and humidity using the consistency characteristics of common spatial environmental factors; the channel fingerprint and RF fingerprint can be used to build a dynamic feature fingerprint based on the network channel using the wireless signal spatial transmission attenuation model.

[0160] S4.4, the forestry and grassland IoT gateway stores the data collected by the forestry and grassland IoT terminal and sends down the periodic operation configuration: the forestry and grassland IoT gateway receives the authentication parameters and collected data transmitted by the forestry and grassland IoT terminal, stores them in the forestry and grassland IoT gateway, and sends the periodic operation policy of the forestry and grassland IoT terminal stored locally to the forestry and grassland IoT terminal.

[0161] For the forest and grassland IoT system, the authentication parameter information is consistent with the device registration format. For the collected data, the transmission and storage strategy data formats vary according to the type of sensor. For the forest tree (carbon) meter device, it includes but is not limited to tree species, standing tree type, breast diameter, tree height, hourly temperature sequence, and hourly humidity sequence. The periodic operation strategy of the forest and grassland IoT terminal includes but is not limited to the address and port of the forest and grassland IoT terminal's next visit to the forest and grassland IoT gateway, as well as periodic monitoring configuration information such as wake-up time and wake-up duration.

[0162] S5, security situation awareness and emergency disposal of the Lincao cloud platform: The Lincao IoT gateway calls the Lincao IoT gateway of the identity authentication smart contract to collect data transmission and storage strategies, and records the identity authentication access session failure information to the blockchain network to determine whether there is a DOS attack. If so, prevent the DOS attack and execute step S7. If not, directly execute step S7;

[0163] The specific steps of step S5 are as follows:

[0164] S5.1, Forestry and Grassland IoT Gateway identity authentication result session upload to blockchain network:

[0165] When identity authentication fails, the client node calls the identity authentication failure session chain strategy of the identity authentication smart contract, and records the identity authentication access session failure information into the blockchain network;

[0166] S5.2, the Lincao cloud platform conducts security situation awareness and emergency disposal: the client node calls the security situation awareness strategy of the security situation awareness smart contract, reads the historical access session records in the blockchain network, evaluates the number of accesses to the current client node and the Lincao IoT gateway to determine whether there is a DOS attack. If the access IP and / or access port exceeds the access upper limit threshold, the client node calls the security threat emergency disposal strategy of the security situation awareness smart contract to urgently close the current access IP and / or access port to prevent the DOS attack.

[0167] S6, data transmission from the forest and grass IoT gateway to the forest and grass cloud platform: The forest and grass IoT gateway sends the monitoring data collected by the forest and grass IoT terminal to the forest and grass cloud platform. The forest and grass cloud platform calls the data transmission session chain strategy of the identity authentication smart contract, uploads the forest and grass IoT gateway data transmission session to the blockchain network storage, calls the forest and grass IoT gateway data collection data storage strategy of the security situation awareness smart contract, and stores the forest and grass IoT gateway data into the database of the forest and grass cloud platform;

[0168] The specific steps of step S6 are as follows:

[0169] S6.1, the forest and grassland IoT gateway sends the collected data to the forest and grassland cloud platform; after the forest and grassland IoT gateway passes the identity authentication, it sends a data transmission session to the forest and grassland cloud platform, and transmits the collected and aggregated monitoring data to the forest and grassland cloud platform via a wireless network or a satellite network.

[0170] S6.2, the Lincao cloud platform uploads the data transmission session to the blockchain network and collects data into the database: the client node of the Lincao cloud platform calls the data transmission session chain strategy of the identity authentication smart contract, uploads the Lincao IoT gateway data transmission session information to the blockchain network storage, calls the Lincao gateway data collection data storage strategy of the security situation awareness smart contract, and then stores the Lincao IoT gateway data into the database of the Lincao cloud platform.

[0171] S7, end, authentication completed.

[0172] The present invention also provides a blockchain-based zero-trust forestry and grassland Internet of Things identity authentication system, which is used to implement any of the above-mentioned blockchain-based zero-trust forestry and grassland Internet of Things identity authentication methods. The embodiments are as follows: the blockchain-based zero-trust forestry and grassland Internet of Things identity authentication system is established on a blockchain network, and realizes continuous identity authentication management between forestry and grassland Internet of Things terminals, forestry and grassland Internet of Things gateways and forestry and grassland cloud platforms by calling and executing smart contracts.

[0173] Based on the above embodiment, in another embodiment of the present invention, Figure 6 The blockchain-based zero-trust forest and grassland IoT identity authentication system includes:

[0174] Blockchain initialization and smart contract definition module: used to initialize the blockchain network according to the application scenario, complete the identity authentication smart contract definition and chain code installation, as well as the security situation awareness smart contract definition and chain code installation;

[0175] Device registration management module: used to access the forest and grassland IoT system. After registering the access session on the chain, the forest and grassland IoT device information registration is carried out to generate the static physical fingerprint and multi-dimensional dynamic feature fingerprint of the forest and grassland IoT device, and store the device registration information in the database of the forest and grassland cloud platform;

[0176] The Lincao Cloud Platform's identity authentication module for the Lincao IoT Gateway is used to call the identity authentication smart contract to create static physical fingerprints and multi-dimensional dynamic feature fingerprints for the Lincao IoT Gateway, and to perform static identity authentication and continuous dynamic identity authentication;

[0177] Forestry and Grassland IoT Gateway Initialization Module: used to upload the identity authentication result session to the blockchain network, and download and obtain the storage periodic operation configuration strategy, periodic security awareness configuration strategy and data to the local storage;

[0178] The forestry and grassland IoT gateway to the forestry and grassland IoT terminal identity authentication module: the forestry and grassland IoT gateway receives and stores the identity authentication access session information of the forestry and grassland IoT terminal according to the periodic operation configuration policy downloaded locally, and then generates the static physical fingerprint and multi-dimensional dynamic feature fingerprint of the forestry and grassland IoT terminal in combination with the periodic security perception configuration policy, completes the static identity authentication and continuous dynamic identity authentication, and stores the data collected by the forestry and grassland IoT terminal locally;

[0179] Data interaction module between forestry and grassland IoT gateway and forestry and grassland IoT terminal: used to obtain periodic operation configuration strategy from forestry and grassland IoT gateway and save it in forestry and grassland IoT terminal to ensure the next operation, and transmit the collected data to forestry and grassland IoT gateway for storage;

[0180] Forestry and Grassland IoT Security Situation Awareness Module: It is used for the forestry and grassland IoT gateway to call the identity authentication smart contract's identity authentication failure session chain strategy, record the identity authentication access session failure information into the blockchain network, and call the security situation awareness strategy of the security situation awareness smart contract to read the historical access session records in the blockchain network, evaluate the current client node and the number of visits to the forestry and grassland IoT gateway to determine whether there is a DOS attack;

[0181] Forestry and Grassland IoT Security Emergency Disposal Module: When the access IP and / or access port exceeds the access upper limit threshold, the client node calls the security threat emergency disposal strategy of the security situation awareness smart contract to urgently close the current access IP and / or access port to prevent DOS attacks;

[0182] The data collection and transmission module of the forest and grassland IoT gateway is used to send data transmission sessions to the forest and grassland cloud platform, and transmit the collected and aggregated monitoring data to the forest and grassland cloud platform through the network;

[0183] The Lincao Cloud Platform transmission session chain and data storage module is used to call the data transmission session chain strategy of the identity authentication smart contract, upload the data transmission session information of the Lincao IoT gateway to the blockchain network storage, and call the Lincao gateway collection data transmission storage strategy of the security situation awareness smart contract to store the Lincao IoT gateway data into the database of the Lincao Cloud Platform.

[0184] In order to better understand the technical solution of the present invention, an embodiment of the execution process of the blockchain-based zero-trust forest and grassland Internet of Things identity authentication system of the present invention is provided as follows: Figure 7 :

[0185] (1) The system administrator executes the blockchain initialization and smart contract definition modules to create a blockchain network in the Lincao Cloud Platform;

[0186] (2) The equipment registrar executes the equipment registration management module to register the deployed forest and grassland IoT equipment;

[0187] (3) Field investigators or the Forestry and Grassland IoT Gateway execute the Forestry and Grassland Cloud Platform’s identity authentication module for the Forestry and Grassland IoT Gateway and initiate an identity authentication session to the Forestry and Grassland Cloud Platform;

[0188] (4) Determine whether the forest and grassland IoT gateway identity authentication has passed. If it fails, proceed to step (5); if it passes, proceed to step (7);

[0189] (5) The Lincao Cloud Platform executes the security situation awareness module of the Lincao IoT Gateway, stores authentication failure sessions, and evaluates whether there is a DOS attack;

[0190] (6) The Lincao Cloud Platform executes the Lincao IoT Security Emergency Response Module to determine whether the port or IP address needs to be closed. Execute step (13);

[0191] (7) The Forestry and Grassland IoT Gateway executes the Forestry and Grassland IoT Gateway initialization module, obtains configuration strategies and data from the Forestry and Grassland Cloud Platform and stores them locally;

[0192] (8) The forestry and grassland IoT terminal executes the forestry and grassland IoT gateway’s identity authentication module for the forestry and grassland terminal and sends an identity authentication request to the forestry and grassland IoT gateway;

[0193] (9) Determine whether the forest and grassland IoT terminal identity authentication has been passed. If it has been passed, execute step (10); if not, execute step (11);

[0194] (10) The forestry and grassland IoT terminal executes the data interaction module between the forestry and grassland IoT gateway and the forestry and grassland IoT terminal, obtains the operation configuration strategy from the forestry and grassland IoT gateway, and transmits the collected data to the forestry and grassland IoT gateway;

[0195] (11) The forest and grassland IoT gateway executes the data collection and transmission module of the forest and grassland IoT gateway to transmit the collected and aggregated monitoring data to the forest and grassland cloud platform;

[0196] (12) The Lincao Cloud Platform executes the Lincao Cloud Platform transmission session chain and data storage module, stores the data transmission session and stores the data in the database;

[0197] (13) End the process.

[0198] For ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention, and these improvements and modifications should also be considered as the scope of protection of the present invention.

Claims

1. A zero-trust forest and grassland IoT identity authentication method based on blockchain, characterized in that: The steps include: S1, blockchain initialization and smart contract formulation: Initialize the blockchain network, complete the definition of the identity authentication smart contract and the installation of the chain code, as well as the definition of the security situation awareness smart contract and the installation of the chain code; S2, Registration of forest and grassland IoT devices: Carry out registration of forest and grassland IoT device information, generate static physical fingerprints and multi-dimensional dynamic feature fingerprints of forest and grassland IoT devices, and store the registration information of forest and grassland IoT devices in the database; The static physical fingerprint generation method is as follows: the Lincao Cloud Platform generates a static physical fingerprint of the device using a hash function based on the device type, device MAC and radio frequency fingerprint of the device in the registered device registration table, after a set combination and conversion, and uses it as the unique identifier of the device; The multi-dimensional dynamic feature fingerprint generation method is as follows: the Lincao Cloud Platform uses the dynamic change characteristics of the equipment registration table over time, space and environment, and uses its physical change characteristics to construct a dynamic feature fingerprint for the equipment to form a continuous dynamic verification model; S3, the Lincao IoT gateway accesses the Lincao cloud platform and initializes: the Lincao IoT gateway initiates identity authentication, calls the identity authentication smart contract in step S1 to create the static physical fingerprint and multi-dimensional dynamic feature fingerprint of the Lincao IoT gateway respectively, and performs static identity authentication and continuous dynamic identity authentication. If the authentication is successful, the identity authentication result is uploaded to the blockchain network, and the periodic operation configuration strategy, periodic security perception configuration strategy and data are downloaded and stored locally, and then step S4 is executed. If the authentication fails, step S5 is executed; S4, the forestry and grass IoT terminal accesses the forestry and grass IoT gateway and performs identity authentication: the forestry and grass IoT gateway receives and stores the identity authentication access information of the forestry and grass IoT terminal according to the local periodic operation configuration policy in step S3, and generates the static physical fingerprint and multi-dimensional dynamic feature fingerprint of the forestry and grass IoT terminal in combination with the local periodic security perception configuration policy, and completes the static identity authentication and continuous dynamic identity authentication. If the forestry and grass IoT terminal passes the identity authentication, the monitoring data collected by the forestry and grass IoT terminal is stored and the periodic operation configuration policy is issued to the forestry and grass IoT terminal to ensure the next operation, and step S6 is executed. If the forestry and grass IoT terminal fails to pass the identity authentication, the identity authentication is stopped, the access request of the forestry and grass IoT terminal is rejected, and step S7 is executed; S5, Lincao cloud platform security situation awareness and emergency disposal: Lincao IoT gateway calls the identity authentication smart contract, records the identity authentication access session failure information to the blockchain network, and determines whether there is a DOS attack. If so, the DOS attack is prevented and step S7 is executed. If not, step S7 is executed directly; S6, data transmission from the forest and grass IoT gateway to the forest and grass cloud platform: The forest and grass IoT gateway sends the monitoring data collected by the forest and grass IoT terminal to the forest and grass cloud platform. The forest and grass cloud platform calls the identity authentication smart contract to upload the forest and grass IoT gateway data transmission session to the blockchain network storage, calls the security situation awareness smart contract and then stores the forest and grass IoT gateway data into the database of the forest and grass cloud platform; S7, end, authentication completed.

2. According to the blockchain-based zero-trust forest and grassland IoT identity authentication method of claim 1, it is characterized in that: The step S1 specifically includes the following steps: S1.1, blockchain network initialization; S1.2, identity authentication smart contract definition and chain code installation, where the identity authentication smart contract includes the access session operation strategy and identity authentication operation strategy of the Lincao IoT terminal, Lincao IoT gateway and Lincao cloud platform in the blockchain network; S1.3, security situation awareness smart contract definition and chain code installation, where the security situation awareness smart contract includes the data exchange operation strategy of the forestry and grassland IoT terminal, forestry and grassland IoT gateway and forestry and grassland cloud platform in the blockchain network after identity authentication, as well as the security situation awareness operation strategy in the blockchain network after identity authentication fails.

3. The blockchain-based zero-trust forest and grassland IoT identity authentication method according to claim 2 is characterized in that: The access session operation policies include organization administrator login session chain policy, identity authentication session chain policy, identity authentication failure session chain policy and data transmission session chain policy; all of them are used to initiate access session transactions, and after calculation by the blockchain network consensus algorithm, form new blocks to be stored in the blockchain network, so as to achieve the tamper-proof and traceability of access behavior; The identity authentication operation strategy includes Static physical fingerprint generation strategy: used for the Lincao cloud platform to generate static physical fingerprints of devices as unique identifiers; Static identity authentication strategy: used to generate a static physical fingerprint of the current device based on the registration information of the currently accessed device, and then obtain the static physical fingerprint of the device's last access in the blockchain platform, and return the identity authentication result after comparison; Multi-dimensional dynamic feature fingerprint generation strategy: For the forest and grass cloud platform, it is usually based on the dynamic change characteristics of the equipment registration table over time, space and environment, and uses its physical change characteristics to build a dynamic feature fingerprint for the equipment to form a continuous dynamic verification model; Continuous dynamic identity authentication strategy: used to generate a multi-dimensional dynamic feature fingerprint based on the current device registration information, and then obtain the multi-dimensional dynamic feature fingerprint of the forest and grassland IoT gateway that was last accessed in the blockchain platform, compare the two pieces of information and return the identity authentication result; The data exchange operation strategy includes Device registration information storage strategy: used to detect that there are no security risks in the registered devices, and to form a device registration record with the device information, registration personnel information, registration operation information and device fingerprint information, registering information other than the static physical fingerprint of the device and the multi-dimensional dynamic feature fingerprint of the device; The periodic operation configuration download strategy of the forest and grass IoT gateway is used by the forest and grass IoT gateway to obtain the address and port of the next access of the forest and grass IoT gateway from the forest and grass cloud platform client, as well as the periodic operation configuration such as the wake-up time and wake-up duration, and store them locally in the forest and grass IoT gateway; The periodic security perception configuration download strategy of the forest and grass IoT gateway is used by the forest and grass IoT gateway to obtain the device access registration information of the forest and grass IoT terminal paired with the forest and grass IoT gateway from the forest and grass cloud platform client, as well as the static physical fingerprint generation strategy, static identity authentication strategy, multi-dimensional dynamic feature fingerprint generation strategy, and continuous dynamic identity authentication strategy of the identity authentication smart contract to be stored locally in the forest and grass IoT gateway; The Forestry and Grassland IoT Gateway collects data transmission and storage strategies: It is used by the Forestry and Grassland IoT Gateway to obtain the data transmission and storage configuration information and perform operations in the Forestry and Grassland Cloud Platform from the Forestry and Grassland Cloud Platform Client; The security situation awareness operation strategy includes Security situation awareness strategy: used by the Lincao cloud platform to read the historical access session records in the blockchain network, evaluate the number of accesses to the current client node and the Lincao IoT gateway to determine whether there is a DOS attack; Security threat emergency response strategy: The Lincao Cloud Platform is used to urgently shut down the current access IP and / or access port for the Lincao IoT gateway that exceeds the specified access threshold to prevent DOS attacks.

4. The zero-trust forest and grassland IoT identity authentication method based on blockchain according to claim 3 is characterized in that: The step S2 specifically includes the following steps: S2.1, Forestry and Grassland IoT Device Registrar Identity Authentication: The device registrar registers this access session through the access session operation policy and uploads it to the blockchain network; S2.2, Forestry and Grassland IoT Device Information Registration: The device information, registrar information, registration operation information and device fingerprint information are combined to form a device registration record, and the information is registered through the device registration information storage strategy; S2.3, Static physical fingerprint generation of forest and grassland IoT devices: according to the type of forest and grassland IoT devices, the static physical fingerprint generation strategy in the identity authentication smart contract is called to generate a static physical fingerprint as a unique identifier; S2.4, generation of multi-dimensional dynamic feature fingerprints for forestry and grassland IoT devices: according to the type of forestry and grassland IoT devices, the multi-dimensional dynamic feature fingerprint generation strategy in the identity authentication smart contract is called to generate multi-dimensional dynamic feature fingerprints to form a continuous dynamic verification model; S2.5, the registration information of forestry and grassland IoT devices is stored in the database: call the data exchange operation strategy in the security situation awareness smart contract to store the registration information of forestry and grassland IoT devices in the database.

5. According to claim 4, the blockchain-based zero-trust forest and grassland Internet of Things identity authentication method is characterized in that: The step S3 specifically includes the following steps: S3.1, determine whether the forest and grassland IoT gateway is deployed for the first time, if so, execute step S3.2, if not, execute step S3.3; S3.2, the first deployment of the Forestry and Grassland IoT Gateway initiates an identity authentication session: the Forestry and Grassland IoT Gateway is configured with the access address and port, the Forestry and Grassland IoT Gateway sends the device registration information stored locally, and sends an identity authentication access request to the Forestry and Grassland Cloud Platform; S3.3, the forest and grass IoT gateway periodically initiates an identity authentication session: the forest and grass IoT gateway sends an identity authentication access request to the forest and grass cloud platform with the device registration information collected and updated locally; S3.4, create a static physical fingerprint of the forestry and grassland IoT gateway and perform static identity authentication: call the static physical fingerprint generation strategy of the identity authentication smart contract, generate the static physical fingerprint of the current forestry and grassland IoT gateway based on the registration information of the forestry and grassland IoT gateway sent, and then obtain the static physical fingerprint of the forestry and grassland IoT gateway last accessed in the blockchain platform, call the static identity authentication strategy of the identity authentication smart contract, compare and authenticate the two static physical fingerprints of the forestry and grassland IoT gateway, if passed, execute step S3.5, otherwise, execute step S5; S3.5, create a multi-dimensional dynamic feature fingerprint of the forestry and grassland IoT gateway and perform dynamic identity authentication: call the multi-dimensional dynamic feature fingerprint generation strategy of the identity authentication smart contract, generate the multi-dimensional dynamic feature fingerprint of the current forestry and grassland IoT gateway based on the registration information of the forestry and grassland IoT gateway sent, and then obtain the multi-dimensional dynamic feature fingerprint of the forestry and grassland IoT gateway last accessed in the blockchain platform, call the continuous dynamic identity authentication strategy of the identity authentication smart contract, compare and authenticate the multi-dimensional dynamic feature fingerprints of the forestry and grassland IoT gateway twice, if passed, execute step S3.6, otherwise, execute step S5; S3.6, Forestry and Grassland IoT Gateway identity authentication result session upload to blockchain network: By calling the identity authentication session chain strategy of the identity authentication smart contract, the session information is recorded into the blockchain network, and by calling the device registration information storage strategy of the security situation awareness smart contract, the device access registration information of the current forestry and grassland IoT gateway is added and updated into the database for the next dynamic verification; S3.7, the forestry and grassland IoT gateway downloads and stores periodic operation configuration policies, periodic security awareness configuration policies and data: calls the periodic operation configuration download policy of the forestry and grassland IoT gateway of the security situation awareness smart contract, downloads the periodic operation configuration of the forestry and grassland IoT gateway and stores it locally in the forestry and grassland IoT gateway, and downloads the device access registration information of the forestry and grassland IoT terminal paired with the forestry and grassland IoT gateway through the periodic security awareness configuration download policy of the forestry and grassland IoT gateway, as well as the static physical fingerprint generation policy, static identity authentication policy, multi-dimensional dynamic feature fingerprint generation policy and continuous dynamic identity authentication policy of the identity authentication smart contract and stores them locally in the forestry and grassland IoT gateway, so as to realize the continuous dynamic identity authentication of the forestry and grassland IoT terminal by the forestry and grassland IoT gateway during periodic operation.

6. The zero-trust forest and grassland IoT identity authentication method based on blockchain according to claim 5 is characterized in that: The step S4 specifically includes the following steps: S4.1, the forest and grassland IoT gateway receives and stores the forest and grassland IoT terminal identity authentication access session information; S4.2, the forestry and grass IoT gateway creates a static physical fingerprint of the forestry and grass IoT terminal and performs static identity authentication: the forestry and grass IoT gateway generates a static physical fingerprint for accessing the forestry and grass IoT terminal based on the static physical fingerprint generation strategy stored locally, calls the static identity authentication strategy, and compares it with the static physical fingerprint of the forestry and grass IoT terminal stored locally. If it passes, execute step S4.3, otherwise, end; S4.3, the forestry and grass IoT gateway creates a multi-dimensional dynamic feature fingerprint of the forestry and grass IoT terminal and performs dynamic identity authentication: the forestry and grass IoT gateway obtains the identity authentication session parameters of the forestry and grass IoT terminal based on the multi-dimensional dynamic feature fingerprint generation strategy stored locally, and obtains the identity authentication session parameters of the last forestry and grass IoT terminal stored locally from the blockchain network when the forestry and grass IoT gateway is awakened, calculates and generates a multi-dimensional dynamic feature fingerprint, and uses the locally stored continuous dynamic identity authentication strategy to compare and authenticate the two multi-dimensional dynamic feature fingerprints of the forestry and grass IoT terminal. If passed, execute step S4.4, otherwise, end; S4.4, the forestry and grassland IoT gateway stores the data collected by the forestry and grassland IoT terminal and sends down the periodic operation configuration: the forestry and grassland IoT gateway receives the authentication parameters and collected data transmitted by the forestry and grassland IoT terminal, stores them in the forestry and grassland IoT gateway, and sends the periodic operation policy of the forestry and grassland IoT terminal stored locally to the forestry and grassland IoT terminal.

7. The zero-trust forest and grassland IoT identity authentication method based on blockchain according to claim 6 is characterized in that: The step S5 specifically includes the following steps: S5.1, Forestry and Grassland IoT Gateway identity authentication result session upload to blockchain network: Call the identity authentication smart contract's identity authentication failed session chain strategy, and record the identity authentication access session failure information into the blockchain network; S5.2, the Lincao cloud platform conducts security situation awareness and emergency disposal: calls the security situation awareness strategy of the security situation awareness smart contract, reads the historical access session records in the blockchain network, evaluates the number of accesses to the current client node and the Lincao IoT gateway to determine whether there is a DOS attack. If the access IP and / or access port exceeds the access upper limit threshold, the client node calls the security threat emergency disposal strategy of the security situation awareness smart contract to urgently close the current access IP and / or access port to prevent the DOS attack.

8. The zero-trust forest and grassland IoT identity authentication method based on blockchain according to claim 7 is characterized in that: The step S6 specifically includes the following steps: S6.1, the forest and grassland IoT gateway sends the collected data to the forest and grassland cloud platform; S6.2, the Lincao Cloud Platform uploads the data transmission session to the blockchain network and collects data into the database: the Lincao Cloud Platform calls the data transmission session chain strategy of the identity authentication smart contract, uploads the Lincao IoT gateway data transmission session information to the blockchain network storage, calls the Lincao gateway data collection data storage strategy of the security situation awareness smart contract, and then stores the Lincao IoT gateway data into the database of the Lincao Cloud Platform.

9. A zero-trust forest and grassland IoT identity authentication system based on blockchain, characterized in that: Used to implement the blockchain-based zero-trust forestry and grassland Internet of Things identity authentication method as described in any one of claims 1 to 8, the blockchain-based zero-trust forestry and grassland Internet of Things identity authentication system is established on a blockchain network, and realizes continuous identity authentication management between forestry and grassland Internet of Things terminals, forestry and grassland Internet of Things gateways and forestry and grassland cloud platforms by calling and executing smart contracts.

10. The blockchain-based zero-trust forest and grassland IoT identity authentication system according to claim 9 is characterized in that: The blockchain-based zero-trust forest and grassland IoT identity authentication system includes: Blockchain initialization and smart contract definition module: used to initialize the blockchain network according to the application scenario, complete the identity authentication smart contract definition and chain code installation, as well as the security situation awareness smart contract definition and chain code installation; Device registration management module: used to access the forest and grassland IoT system. After registering the access session on the chain, the forest and grassland IoT device information registration is carried out, the static physical fingerprint and multi-dimensional dynamic feature fingerprint of the forest and grassland IoT device are generated, and the device registration information is stored in the database of the forest and grassland cloud platform; The Lincao Cloud Platform's identity authentication module for the Lincao IoT Gateway is used to call the identity authentication smart contract to create static physical fingerprints and multi-dimensional dynamic feature fingerprints for the Lincao IoT Gateway, and to perform static identity authentication and continuous dynamic identity authentication; Forestry and Grassland IoT Gateway Initialization Module: used to upload the identity authentication result session to the blockchain network, and download and obtain the storage periodic operation configuration strategy, periodic security awareness configuration strategy and data to the local storage; The forestry and grassland IoT gateway to the forestry and grassland IoT terminal identity authentication module: the forestry and grassland IoT gateway receives and stores the identity authentication access session information of the forestry and grassland IoT terminal according to the periodic operation configuration policy downloaded locally, and then generates the static physical fingerprint and multi-dimensional dynamic feature fingerprint of the forestry and grassland IoT terminal in combination with the periodic security perception configuration policy, completes the static identity authentication and continuous dynamic identity authentication, and stores the data collected by the forestry and grassland IoT terminal locally; Data interaction module between forestry and grassland IoT gateway and forestry and grassland IoT terminal: used to obtain periodic operation configuration strategy from forestry and grassland IoT gateway and save it in forestry and grassland IoT terminal to ensure the next operation, and transmit the collected data to forestry and grassland IoT gateway for storage; Forestry and Grassland IoT Security Situation Awareness Module: It is used for the forestry and grassland IoT gateway to call the identity authentication smart contract's identity authentication failure session chain strategy, record the identity authentication access session failure information into the blockchain network, and call the security situation awareness strategy of the security situation awareness smart contract to read the historical access session records in the blockchain network, evaluate the current client node and the number of visits to the forestry and grassland IoT gateway to determine whether there is a DOS attack; Forestry and Grassland IoT Security Emergency Disposal Module: When the access IP and / or access port exceeds the access upper limit threshold, the client node calls the security threat emergency disposal strategy of the security situation awareness smart contract to urgently close the current access IP and / or access port to prevent DOS attacks; The data collection and transmission module of the forest and grassland IoT gateway is used to send data transmission sessions to the forest and grassland cloud platform, and transmit the collected and aggregated monitoring data to the forest and grassland cloud platform through the network; The Lincao Cloud Platform transmission session chain and data storage module is used to call the data transmission session chain strategy of the identity authentication smart contract, upload the data transmission session information of the Lincao IoT gateway to the blockchain network storage, and call the Lincao gateway collection data transmission storage strategy of the security situation awareness smart contract to store the Lincao IoT gateway data into the database of the Lincao Cloud Platform.

Images