Equipment identity verification system based on MAC (Media Access Control) address

Abstract

The invention relates to the technical field of network security, in particular to an equipment identity verification system based on an MAC (Media Access Control) address, which comprises a hardware feature acquisition module, a binding MAC address generation module, an authentication code encryption module, an authentication server communication module, an equipment behavior monitoring module and a security response module, wherein the hardware feature acquisition module is used for generating a unique equipment hardware fingerprint; the binding MAC address generation module is used for mapping the equipment hardware fingerprint into a binding MAC address uniquely corresponding to the equipment; the authentication code encryption module is used for generating an equipment authentication code; the authentication server communication module is used for sending the equipment authentication code to an authentication server for verification; and the equipment behavior monitoring module is used for identifying potential abnormal behaviors. According to the invention, through combination of hardware feature binding of the MAC address and multi-dimensional behavior monitoring, uniqueness, security and active protection capability of equipment identity verification are realized, and the security protection level of the system is significantly improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a device identity authentication system based on MAC address. Background Art

[0002] With the rapid popularization of the Internet of Things and smart devices, more and more devices are connected to the network, which makes device authentication particularly important in network security. Existing device authentication technologies usually rely on usernames, passwords or simple hardware features, such as MAC addresses. However, MAC addresses are easily forged or tampered with, and traditional authentication methods lack multi-dimensional monitoring of device characteristics, making it difficult to effectively distinguish between legitimate devices and counterfeit devices. This verification method cannot ensure the uniqueness and non-tamperability of device identity in a highly dynamic network environment, increasing potential security risks.

[0003] Therefore, the existing technology faces the following technical difficulties: First, there is a lack of a deep binding mechanism for device hardware features and network behaviors, which makes the MAC address easy to be tampered with or cloned; second, the existing verification system lacks real-time device behavior analysis and cannot make comprehensive judgments on features such as access frequency, geographic location changes, and network interactions. It is difficult to identify potential abnormal behaviors in a timely manner, which can easily cause security risks. In order to deal with the above problems, a multi-level identity authentication system based on device hardware features and behavior monitoring is urgently needed to solve the above problems. Summary of the invention

[0004] Based on the above purpose, the present invention provides a device identity authentication system based on MAC address.

[0005] The device identity authentication system based on MAC address includes a hardware feature acquisition module, a binding MAC address generation module, an authentication code encryption module, an authentication server communication module, a device behavior monitoring module and a security response module; wherein:

[0006] Hardware feature collection module: used to collect the hardware feature information of the device when the device is first connected to the network; and pre-process the collected hardware feature information to generate a unique device hardware fingerprint;

[0007] Binding MAC address generation module: connected to the hardware feature collection module, used to receive the device hardware fingerprint, and map the device hardware fingerprint to a binding MAC address uniquely corresponding to the device based on the HMAC hash mapping algorithm;

[0008] Authentication code encryption module: connected to the binding MAC address generation module, used to perform double-layer encryption processing on the device hardware fingerprint and the binding MAC address to generate a device authentication code;

[0009] Authentication server communication module: connected to the authentication code encryption module, used to send the device authentication code to the authentication server for verification, and update the device access status information according to the verification result; when the verification is passed, the device is set to the authorized state; when the verification fails, the device is set to the access denied state;

[0010] Device behavior monitoring module: connected to the authentication server communication module, used to monitor and collect device behavior data in real time when the device is in an authorized state, including access frequency, geographic location changes and network interaction characteristics; and compare the device behavior data with the preset normal behavior pattern to identify potential abnormal behavior;

[0011] Security response module: connected to the device behavior monitoring module, used to trigger corresponding security measures when abnormal behavior is detected, including sending security alerts, restricting device network access rights, and updating security policies.

[0012] Optionally, the hardware feature acquisition module includes a hardware information extraction unit, a feature data conversion unit and a hardware fingerprint generation unit; wherein:

[0013] Hardware information extraction unit: used to directly extract the hardware feature information of the device from the device when the device is first connected to the network, the hardware feature information includes the CPU serial number, motherboard identifier and memory identifier of the device; wherein the CPU serial number is extracted by reading the processor unique identification instruction, the motherboard identifier is obtained from the motherboard firmware of the device, and the memory identifier is read from the register of the storage chip;

[0014] Feature data conversion unit: connected to the hardware information extraction unit, used to convert the data format of the collected hardware feature information, convert the CPU serial number, motherboard identifier and memory identifier into a unified data format, and ensure the consistency of the format of the hardware feature information;

[0015] Hardware fingerprint generation unit: connected to the feature data conversion unit, used to encrypt the converted hardware feature information through a hash algorithm to generate a unique device hardware fingerprint. The hardware fingerprint generation process generates fingerprint data of a fixed length through an irreversible hash operation to ensure the uniqueness and non-tamperability of the device hardware fingerprint.

[0016] Optionally, the hardware fingerprint generating unit includes:

[0017] Feature information splicing: Splice the converted device CPU serial number, motherboard identifier and memory identifier into a continuous data string in a predetermined order. Let the spliced ​​data string be D. The expression is: D = CPU serial number | motherboard identifier | memory identifier, where | represents the sequential splicing operation of the string;

[0018] Salt value generation: Get a preset salt value S from the authentication server and combine it with the concatenated data string D; the salt value S is a random string of fixed length; the combined data is represented as: D s =D∥S;

[0019] Hash encryption: the combined data D s Perform hash operation to generate a unique hardware fingerprint H of fixed length, specifically using the SHA-256 hash algorithm, the formula is: H = SHA-256 (D s ), where the SHA-256 hash algorithm outputs a 256-bit hash value through an irreversible operation process;

[0020] Hardware fingerprint simplification: In order to reduce storage space usage, the first 128 bits of the hash value H are used as the final device hardware fingerprint, denoted as H 128 .

[0021] Optionally, the binding MAC address generation module includes a key generation unit, a hash operation unit, an address interception unit and an OUI setting unit; wherein:

[0022] Key generation unit: used to generate the encryption key K required to bind the MAC address; specifically, obtain the preset 128-bit symmetric key K through a secure channel with the authentication server;

[0023] Hash operation unit: connected to the key generation unit, used to generate a fixed-length HMAC hash value based on the device hardware fingerprint and the encryption key K; the hash operation unit receives the device hardware fingerprint H 128 The HMAC-SHA256 algorithm is used and the following formula is used for calculation: M = HMAC-SHA256 (K, H 128 ), where M is the generated 256-bit HMAC hash value;

[0024] Address interception unit: connected to the hash operation unit, used to intercept the valid bits of the bound MAC address from the HMAC hash value; specifically, the first 48 bits of M are used as the main part of the bound MAC address, set to M 48 ;

[0025] OUI setting unit: connected to the address interception unit, used to set the first 24 bits of the bound MAC address as the preset organizational unique identifier OUI; and append it to the MAC 48 The front end generates a complete binding MAC address MAC B .

[0026] Optionally, the authentication code encryption module includes a hash encryption unit, a data combination unit and a symmetric encryption unit; wherein:

[0027] Hash encryption unit: used to perform hash encryption on the device hardware fingerprint and generate an intermediate hash value; specifically, first receive the device hardware fingerprint H 128 , and use the SHA-256 algorithm to perform irreversible hash encryption on it to generate an intermediate hash value H with a length of 256 bits s ;

[0028] Data combination unit: connected to the hash encryption unit, used to generate the intermediate hash value H s Bind MAC address to MAC B Perform data splicing to form combined data D c ; The intermediate hash values ​​H are s Put it in front and bind the MAC address B After that, the expression is: D c =H s ∥MAC B , where ∥ represents sequential concatenation operations;

[0029] Symmetric encryption unit: connected to the data combination unit, used to encrypt the combined data D c Perform symmetric encryption to generate the final device authentication code; the symmetric encryption unit receives the 256-bit symmetric encryption key K preset by the authentication server enc, , and uses the AES-256 algorithm to combine the data D c Perform encryption processing to generate device authentication code E c .

[0030] Optionally, the authentication server communication module includes a secure communication unit, an authentication code sending unit, a verification result receiving unit, and a status updating unit; wherein:

[0031] Secure communication unit: used to establish a secure communication channel between the device and the authentication server; the secure communication unit uses the transport layer security protocol for two-way authentication, encrypts the transmission device authentication code, and ensures the confidentiality and integrity of the data during transmission;

[0032] Authentication code sending unit: connected to the secure communication unit, used to send the device authentication code to the authentication server through a secure communication channel; in the process, the device authentication code is encapsulated and a data packet is generated according to a predetermined communication protocol format, including the device identity information and the device authentication code;

[0033] Verification result receiving unit: connected to the security communication unit, used to receive the verification result returned by the authentication server; the verification result includes a verification status and a reason code. When the verification is passed, the verification status is passed and the reason code is 0; when the verification fails, the verification status is failed and the reason code is the corresponding error code;

[0034] Status update unit: connected to the verification result receiving unit, used to update the access status information of the device according to the received verification result; when the verification status is passed, the status update unit sets the access status of the device to the authorized status, allowing the device to access the network normally; when the verification status is failed, the status update unit sets the access status of the device to the denied access status, preventing the device from accessing network resources.

[0035] Optionally, the device behavior monitoring module includes a behavior data acquisition unit, a data preprocessing unit, a behavior pattern comparison unit and an abnormality identification unit; wherein:

[0036] Behavior data collection unit: used to record the behavior data of the device in the network in real time when the device is in the authorized state, including the device's access frequency, geographical location changes and network interaction characteristics; specifically, the access frequency refers to the number of times the device accesses the network resources within a specified time; the geographical location changes are obtained through the network location identification method to obtain the location information changes of the device; the network interaction characteristics include the connection information between the device and other nodes, the data transmission rate and the data packet size;

[0037] Data preprocessing unit: connected to the behavior data acquisition unit, used to preprocess the collected behavior data, including data cleaning, format conversion and noise filtering, so as to remove abnormal data points and noise interference in the data acquisition process; and convert the preprocessed behavior data into a standard format;

[0038] Behavior pattern comparison unit: connected to the data preprocessing unit, used to compare the preprocessed device behavior data with the preset normal behavior pattern; based on the established normal behavior model, analyze the access frequency, geographical location change and network interaction characteristics of the device item by item to determine whether the device behavior conforms to the range of the normal pattern;

[0039] Abnormal identification unit: connected to the behavior pattern comparison unit. When the device behavior data deviates from the set range of the normal behavior pattern on a certain monitoring item, it is judged as a potential abnormality and the abnormal behavior is marked as a risk event. At the same time, the marked abnormal behavior is recorded to provide a basis for subsequent security response.

[0040] Optionally, the behavior pattern comparison unit includes:

[0041] Access frequency analysis: Calculate the access frequency F of the device within the preset time window and compare it with the access frequency threshold F in the normal behavior model. norm Compare; when the condition F≤F is met norm When , the access frequency is judged to be normal, otherwise it is judged to be abnormal;

[0042] Geographic location change analysis: Get the current geographic location of the device L current , and the previous record position L previous Compare and calculate the position change distance D; when the condition D≤D is met norm When , the geographical location change is judged to be normal, otherwise it is judged to be abnormal; D norm is the maximum position change distance allowed in the normal behavior model;

[0043] Network interaction feature analysis: Extract the network interaction feature parameter set of the device {P 1 , P 2 , ..., P n}, including packet size, connection duration and transmission rate, and compared with the characteristic parameters of the normal behavior model {P 1norm , P 2norm , P nnorm} to compare; calculate the feature difference ΔP, when the condition ΔP≤ΔP is met norm When , the network interaction characteristics are judged to be normal, otherwise it is judged to be abnormal; ΔP norm The feature difference threshold set in the normal behavior model;

[0044] Comprehensive judgment: The above three analysis results are comprehensively judged. If the device's access frequency, geographic location changes, and network interaction characteristics are all within the set range of the normal behavior model, the device is judged to be in a normal state; if any one of them is marked as a potential anomaly, the device is judged to be in an abnormal state.

[0045] Optionally, the abnormal behavior recorded in the abnormal identification unit includes device identification information, abnormal type information, abnormal occurrence time, abnormal parameter details and network environment information;

[0046] The device identification information includes a device hardware fingerprint and a bound MAC address of the device that records the abnormal behavior;

[0047] The abnormal type information includes abnormal access frequency, abnormal geographical location and abnormal network interaction characteristics;

[0048] The abnormality occurrence time is the specific timestamp when it is detected;

[0049] The abnormal parameter details are the specific parameter values ​​that lead to the abnormal determination, including actual access frequency, location change distance, and feature difference;

[0050] The network environment information is the network status information when the abnormal behavior occurs, including network load and connection status.

[0051] Optionally, the security response module includes a security alarm unit, an access rights control unit, and a security policy update unit; wherein:

[0052] A security alarm unit is used to immediately generate security alarm information when abnormal behavior is detected, and send the security alarm information to the system administrator and the relevant security management platform; the security alarm information includes the identification information of the abnormal device, the abnormal type, the occurrence time and the abnormal parameter details;

[0053] The access control unit is connected to the security alarm unit and is used to score the risk R of abnormal behavior. s Adjust the network access permissions of the device; specifically: s ≤R low When R low <R s ≤R medium When R s >R medium When the device is judged as high risk, the network connection of the device is immediately cut off to prevent it from continuing to access network resources; low and R medium is the preset risk threshold;

[0054] Security policy update unit: connected to the access permission control unit, used to update the system's security policy based on the detected abnormal behavior; specifically, incorporate new abnormal behavior features into the security policy library and adjust the risk threshold to improve the system's defense capabilities against similar abnormal behaviors.

[0055] Beneficial effects of the present invention:

[0056] The present invention solves the technical problem that MAC addresses are easily tampered with or forged by combining the hardware features of the device with the unique bound MAC address, and realizes the high uniqueness and non-tamperability of device identity authentication. By adopting a double-layer encryption mechanism to generate a device authentication code, the integrity and security of the data are effectively guaranteed during the verification process to prevent unauthorized devices from accessing in disguise. At the same time, a more rigorous identity authentication system is constructed by utilizing multiple features such as the device's hardware fingerprint and bound MAC address, making device identity authentication more accurate and significantly improving the system's ability to recognize device identities.

[0057] The present invention realizes efficient identification of abnormal device behavior by real-time monitoring of the device's access frequency, geographical location changes, and network interaction characteristics, and performing multi-dimensional comparison with a preset normal behavior model. For device behavior identified as abnormal, the system can quickly take security response measures, including sending security alerts, restricting network access rights, and dynamically updating security policies to ensure the security of network resources. The dynamic response mechanism enables the system to have active protection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only for the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0059] Figure 1 A schematic diagram of a device identity authentication system according to an embodiment of the present invention;

[0060] Figure 2 Schematic diagram of a device behavior monitoring module according to an embodiment of the present invention. DETAILED DESCRIPTION

[0061] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. At the same time, it is explained here that in order to make the embodiments more detailed, the following embodiments are the best and preferred embodiments, and those skilled in the art may also adopt other alternatives to implement some known technologies; and the accompanying drawings are only for more specific description of the embodiments, and are not intended to specifically limit the present invention.

[0062] It should be noted that the references to "one embodiment", "an embodiment", "an exemplary embodiment", "some embodiments" and the like in the specification indicate that the embodiments described may include specific features, structures or characteristics, but not every embodiment may include the specific features, structures or characteristics. In addition, when a specific feature, structure or characteristic is described in conjunction with an embodiment, it should be within the knowledge of a person skilled in the art to implement such feature, structure or characteristic in conjunction with other embodiments (whether or not explicitly described).

[0063] In general, a term can be understood, at least in part, from its use in context. For example, depending, at least in part, on the context, the term "one or more" as used herein can be used to describe any feature, structure, or characteristic in the singular sense, or can be used to describe a combination of features, structures, or characteristics in the plural sense. Additionally, the term "based on" can be understood as not necessarily intended to convey an exclusive set of factors, but can instead, depending, at least in part, on the context, allow for the presence of other factors that are not necessarily explicitly described.

[0064] like Figure 1-Figure 2 As shown, the device identity authentication system based on MAC address includes a hardware feature acquisition module, a binding MAC address generation module, an authentication code encryption module, an authentication server communication module, a device behavior monitoring module and a security response module; wherein:

[0065] Hardware feature collection module: used to collect the hardware feature information of the device when the device is first connected to the network; and pre-process the collected hardware feature information to generate a unique device hardware fingerprint;

[0066] Binding MAC address generation module: connected to the hardware feature collection module, used to receive the device hardware fingerprint, and map the device hardware fingerprint to a binding MAC address uniquely corresponding to the device based on the HMAC hash mapping algorithm to prevent the MAC address from being tampered with or forged;

[0067] Authentication code encryption module: connected to the binding MAC address generation module, used to perform double-layer encryption processing on the device hardware fingerprint and the binding MAC address to generate the device authentication code. Specifically, the device hardware fingerprint is first hashed and then the hash result is combined with the binding MAC address for symmetric encryption to generate the device authentication code to ensure the data integrity and security of the authentication code;

[0068] Authentication server communication module: connected to the authentication code encryption module, used to send the device authentication code to the authentication server for verification, and update the device access status information according to the verification result; when the verification is passed, the device is set to the authorized state; when the verification fails, the device is set to the access denied state;

[0069] Device behavior monitoring module: connected to the authentication server communication module, used to monitor and collect device behavior data in real time when the device is in an authorized state, including access frequency, geographic location changes, and network interaction characteristics; and compare the device behavior data with the preset normal behavior pattern to identify potential abnormal behavior;

[0070] Security response module: connected to the device behavior monitoring module, used to trigger corresponding security measures when abnormal behavior is detected, including sending security alerts, restricting device network access rights and updating security policies to maintain the overall security of the system.

[0071] The hardware feature acquisition module includes a hardware information extraction unit, a feature data conversion unit and a hardware fingerprint generation unit; wherein:

[0072] Hardware information extraction unit: used to directly extract the hardware feature information of the device from the device when the device is first connected to the network. The hardware feature information includes the CPU serial number, motherboard identifier and memory identifier of the device. The CPU serial number is extracted by reading the processor unique identification instruction, the motherboard identifier is obtained from the motherboard firmware of the device, and the memory identifier is read from the register of the storage chip to ensure that the collected hardware feature information is complete and unique.

[0073] Feature data conversion unit: connected to the hardware information extraction unit, used to convert the data format of the collected hardware feature information, convert the CPU serial number, motherboard identifier and memory identifier into a unified data format, and ensure the consistency of the format of the hardware feature information;

[0074] Hardware fingerprint generation unit: connected to the feature data conversion unit, used to encrypt the converted hardware feature information through a hash algorithm to generate a unique device hardware fingerprint. The hardware fingerprint generation process generates fingerprint data of a fixed length through an irreversible hash operation to ensure the uniqueness and non-tamperability of the device hardware fingerprint. Through the setting of the above units, the hardware feature acquisition module can accurately collect the hardware feature information of the device and ensure the consistency of the data when the device is first connected to the network, generate a unique device hardware fingerprint, and provide an accurate and non-tamperable device identification for the subsequent identity authentication process, significantly improving the security and reliability of the device identity authentication system.

[0075] The hardware fingerprint generation unit includes:

[0076] Feature information splicing: Splice the converted device CPU serial number, motherboard identifier and memory identifier into a continuous data string in a predetermined order. Let the spliced ​​data string be D. The expression is: D = CPU serial number | motherboard identifier | memory identifier, where | represents the sequential splicing operation of the string. The splicing operation ensures that all the hardware feature information of the device is included in the final data, providing basic data for subsequent encryption processing;

[0077] Salt value generation: Get a preset salt value S from the authentication server and combine it with the concatenated data string D to enhance the uniqueness and anti-collision of the hardware fingerprint; the salt value S is a random string of fixed length that meets certain complexity requirements to ensure that the hardware fingerprints of different devices have sufficient differences; the combined data is represented as: D s =D∥S;

[0078] Hash encryption: the combined data D s Perform hash operation to generate a unique hardware fingerprint H of fixed length, specifically using the SHA-256 hash algorithm, the formula is: H = SHA-256 (D s), where the SHA-256 hash algorithm outputs a 256-bit hash value through an irreversible operation process, ensuring the uniqueness and security of the hardware fingerprint. This operation ensures that different devices can generate different hardware fingerprints even if they have similar hardware feature information, thereby preventing conflicts;

[0079] Hardware fingerprint simplification: In order to reduce storage space usage, the first 128 bits of the hash value H are used as the final device hardware fingerprint, denoted as H 128 , the expression is: H 128 =H[0:128]; Through the above steps, the hardware fingerprint generation unit can perform effective and irreversible hash encryption processing on the hardware feature information of the device to generate a unique device hardware fingerprint, especially by enhancing the anti-collision performance through the salt value, and using the SHA-256 hash algorithm to ensure uniqueness and security. The hardware fingerprint finally generated provides innovative guarantees in terms of the accuracy and security of device identification, effectively improving the practicality and reliability of the present invention in the field of device identity authentication.

[0080] The binding MAC address generation module includes a key generation unit, a hash operation unit, an address interception unit and an OUI setting unit; wherein:

[0081] Key generation unit: used to generate the encryption key K required for binding the MAC address; specifically, through a secure channel with the authentication server, obtain the preset 128-bit symmetric key K, which is used to ensure the uniqueness and non-tamperability of the bound MAC address;

[0082] Hash operation unit: connected to the key generation unit, used to generate a fixed-length HMAC hash value based on the device hardware fingerprint and the encryption key K; the hash operation unit receives the device hardware fingerprint H 128 The HMAC-SHA256 algorithm is used and the following formula is used for calculation: M = HMAC-SHA256 (K, H 128 ), where M is the generated 256-bit HMAC hash value. The hash operation is irreversible, ensuring that the device hardware fingerprint uniquely corresponds to the generated hash value to prevent tampering;

[0083] Address interception unit: connected to the hash operation unit, used to intercept the valid bits of the bound MAC address from the HMAC hash value; specifically, the first 48 bits of M are used as the main part of the bound MAC address, set to M 48 And ensure that the bound MAC address meets the MAC address length requirements of the IEEE 802 standard, the expression is: M 48 =M[0:48];

[0084] OUI setting unit: connected to the address interception unit, used to set the first 24 bits of the bound MAC address as the preset organizational unique identifier OUI; and append it to the MAC address. 48 The front end generates a complete binding MAC address MA C B , ensuring that the bound MAC address is legal and uniquely corresponds to the device; through the combination of the above units, the bound MAC address generation module can generate a unique and tamper-proof binding MAC address based on the device hardware fingerprint and the preset symmetric key; in particular, the HMAC-SHA256 algorithm is used to ensure the security of the hash value, and the address interception and OUI setting comply with the IEEE 802 standard, so that the generated bound MAC address is both unique and in line with industry specifications, effectively improving the system's anti-counterfeiting and anti-tampering capabilities, and ensuring the reliability and security of device identity authentication.

[0085] The authentication code encryption module includes a hash encryption unit, a data combination unit and a symmetric encryption unit; wherein:

[0086] Hash encryption unit: used to perform hash encryption on the device hardware fingerprint and generate an intermediate hash value; specifically, first receive the device hardware fingerprint H 128 , and use the SHA-256 algorithm to perform irreversible hash encryption on it to generate an intermediate hash value H with a length of 256 bits s , the expression is: H s =SHA-256(H 128 ), where the SHA-256 algorithm ensures the uniqueness and security of the intermediate hash value, ensuring that the encryption result of the device hardware fingerprint will not be tampered with;

[0087] Data combination unit: connected to the hash encryption unit, used to generate the intermediate hash value H s Bind MAC address to MAC B Perform data splicing to form combined data D c ; The intermediate hash values ​​H are s Put it in front and bind the MAC address B After that, the expression is: D c =H s ∥MAC B , where ∥ represents sequential concatenation operations, ensuring that the generated combined data contains the encrypted information of the device hardware fingerprint and the complete data of the bound MAC address, providing unified input data for subsequent symmetric encryption;

[0088] Symmetric encryption unit: connected to the data combination unit, used to encrypt the combined data D c Perform symmetric encryption to generate the final device authentication code; the symmetric encryption unit receives the 256-bit symmetric encryption key K preset by the authentication server enc,, and uses the AES-256 algorithm to combine the data D c Perform encryption processing to generate device authentication code E c , its expression is as follows: c =AES-256(K enc , D c ), wherein the AES-256 algorithm performs irreversible encryption on the combined data through symmetric encryption, ensuring that the device authentication code is highly secure and tamper-resistant during transmission and storage; through the double-layer encryption processing of the above units, the authentication code encryption module can effectively protect the security of the device hardware fingerprint and the bound MAC address, and generate a unique and tamper-proof device authentication code, especially first performing hash encryption on the device hardware fingerprint, and then combining the intermediate hash value with the bound MAC address for AES-256 symmetric encryption, which not only improves the security of the data, but also ensures the uniqueness and irreversibility of the authentication code.

[0089] The authentication server communication module includes a secure communication unit, an authentication code sending unit, a verification result receiving unit, and a status updating unit; wherein:

[0090] Secure communication unit: used to establish a secure communication channel between the device and the authentication server; the secure communication unit uses the Transport Layer Security Protocol (TLS) for two-way authentication, encrypts the transmission of device authentication codes, ensures the confidentiality and integrity of data during transmission, and prevents the device authentication codes from being stolen or tampered with;

[0091] Authentication code sending unit: connected to the secure communication unit, used to send the device authentication code to the authentication server through a secure communication channel; in the process, the device authentication code is encapsulated and a data packet is generated according to a predetermined communication protocol format, including the device identity information and the device authentication code, to ensure that the authentication server can correctly identify and parse the received data;

[0092] Verification result receiving unit: connected to the security communication unit, used to receive the verification result returned by the authentication server; the verification result includes the verification status and reason code. When the verification is passed, the verification status is passed and the reason code is 0; when the verification fails, the verification status is failed and the reason code is the corresponding error code, so that the device can identify the cause of the failure;

[0093] Status update unit: connected to the verification result receiving unit, used to update the access status information of the device according to the received verification result; when the verification status is passed, the status update unit sets the access status of the device to the authorized status, allowing the device to access the network normally; when the verification status is failed, the status update unit sets the access status of the device to the denied access status, preventing the device from accessing network resources, and triggering the corresponding prompt information; through the setting of the above units, the authentication server communication module can safely and efficiently complete the transmission of the device authentication code and the reception of the verification result, ensuring the reliability of the device identity authentication process; the use of a secure communication unit ensures the security of data transmission and avoids the leakage of sensitive information; the status update unit updates the device access status in real time according to the verification result, accurately controls the network access rights of the device, and significantly improves the security and management efficiency of the system.

[0094] The device behavior monitoring module includes a behavior data acquisition unit, a data preprocessing unit, a behavior pattern comparison unit, and an anomaly identification unit; wherein:

[0095] Behavior data collection unit: used to record the behavior data of the device in the network in real time when the device is in the authorized state, including the device's access frequency, geographical location changes and network interaction characteristics; specifically, the access frequency refers to the number of times the device accesses the network resources within a specified time; the geographical location changes are obtained through the network location identification method to obtain the location information changes of the device; the network interaction characteristics include the connection information between the device and other nodes, the data transmission rate and the data packet size;

[0096] Data preprocessing unit: connected to the behavior data collection unit, used to preprocess the collected behavior data, including data cleaning, format conversion and noise filtering, to remove abnormal data points and noise interference in the data collection process; and to uniformly convert the preprocessed behavior data into a standard format to ensure the accuracy and consistency of the data;

[0097] Behavior pattern comparison unit: connected to the data preprocessing unit, used to compare the preprocessed device behavior data with the preset normal behavior pattern; based on the established normal behavior model, analyze the device's access frequency, geographical location changes and network interaction characteristics item by item to determine whether the device behavior conforms to the range of the normal pattern;

[0098] Abnormal identification unit: connected to the behavior pattern comparison unit. When the device behavior data deviates from the set range of the normal behavior pattern on a certain monitoring item, it is judged as a potential abnormality and the abnormal behavior is marked as a risk event. At the same time, the marked abnormal behavior is recorded to provide a basis for subsequent security response. Through the setting of the above units, the device behavior monitoring module can monitor and collect the multi-dimensional behavior data of the device in real time when the device is authorized, and conduct a comprehensive comparison with the preset normal behavior pattern through the behavior pattern comparison unit to accurately identify potential abnormal behaviors. This module dynamically ensures the security of device access during the use of the device and effectively prevents abnormal devices from accessing network resources.

[0099] The behavioral pattern comparison unit includes:

[0100] Access frequency analysis: Calculate the access frequency F of the device within the preset time window and compare it with the access frequency threshold F in the normal behavior model. norm Compare; when the condition F≤F is met norm When , the access frequency is judged to be normal, otherwise it is judged to be abnormal;

[0101] Geographic location change analysis: Get the current geographic location of the device L current , and the previous record position L previous Compare and calculate the position change distance D; when the condition D≤D is met norm When , the geographical location change is judged to be normal, otherwise it is judged to be abnormal; D norm is the maximum position change distance allowed in the normal behavior model;

[0102] Network interaction feature analysis: Extract the network interaction feature parameter set of the device {P 1 , P 2 , ..., P n}, including packet size, connection duration and transmission rate, and compared with the characteristic parameters of the normal behavior model {P 1norm , P 2norm , P nnorm} to compare; calculate the feature difference ΔP, when the condition ΔP≤ΔP is met norm When , the network interaction characteristics are judged to be normal, otherwise it is judged to be abnormal; ΔP norm The feature difference threshold set in the normal behavior model;

[0103] Comprehensive judgment: The above three analysis results are comprehensively judged. If the device's access frequency, geographic location changes and network interaction characteristics are within the set range of the normal behavior model, the device is judged to be in a normal state; if any one of them is marked as a potential abnormality, the device is judged to be in an abnormal state, and the abnormal identification unit is notified for recording and subsequent processing.

[0104] The abnormal behavior recorded in the abnormal identification unit includes device identification information, abnormal type information, abnormal occurrence time, abnormal parameter details and network environment information;

[0105] Device identification information includes the device hardware fingerprint and bound MAC address of the device that has abnormal behavior, in order to clarify the identity of the device;

[0106] Abnormal type information includes abnormal access frequency, abnormal geographical location, and abnormal network interaction characteristics, which facilitates classification management and analysis;

[0107] The abnormality occurrence time is the specific timestamp when it is detected, so as to accurately locate the time when the abnormality occurs;

[0108] The abnormal parameter details are the specific parameter values ​​that lead to the abnormality, including the actual access frequency, location change distance, feature difference, etc., providing the basis for abnormality determination;

[0109] Network environment information refers to the network status information when abnormal behavior occurs, including network load, connection status, etc., providing environmental background for subsequent analysis.

[0110] The security response module includes a security alarm unit, an access rights control unit, and a security policy update unit; wherein:

[0111] The security alarm unit is used to immediately generate security alarm information when abnormal behavior is detected, and send the security alarm information to the system administrator and related security management platforms; the security alarm information includes the identification information of the abnormal device, the abnormal type, the occurrence time and the abnormal parameter details, to ensure that the security incident is paid attention to and handled in time;

[0112] The access control unit is connected to the security alarm unit and is used to score the risk R of abnormal behavior. s Adjust the network access permissions of the device; specifically: s ≤R low When R low <R s ≤R medium When R s >R medium When the device is judged as high risk, the network connection of the device is immediately cut off to prevent it from continuing to access network resources and prevent the spread of potential threats; low and R medium is the preset risk threshold;

[0113] Risk score R sIt is calculated based on the device's access frequency, geographic location changes, and network interaction characteristics. The calculation formula is: R s =w 1 ×F score +w 2 ×D score +w 3 ×P score , where w 1 ,w 2 ,w 3 is the weight coefficient of each score, satisfying w 1 +w 2 +w 3 =1; These weight coefficients are set according to the security requirements of the system to ensure that each score has an appropriate impact on the total score; F score Score the access frequency; D score Score geographic location change; P score score network interaction characteristics;

[0114] Access frequency score F score Used to reflect whether the access frequency of the device exceeds the normal range; the formula is: Where F is the actual access frequency of the device, F norm is the access frequency threshold in the normal behavior model; the higher the score, the greater the deviation of the access frequency from the normal range;

[0115] Geographic location change score D score Used to reflect whether the geographical location change of the device is abnormal; the formula is: Where D is the distance change between the current device location and the previous location, D norm is the maximum location change allowed in the normal behavior model; if the device moves beyond the threshold, the geographic location change score will increase;

[0116] Network interaction feature score P score It is used to reflect the degree to which the network interaction characteristics of the device deviate from the normal mode; the formula is: Among them, ΔP is the difference between the actual network interaction characteristics of the device and the normal behavior model characteristics, ΔP norm is the maximum feature difference threshold allowed; the greater the difference, the higher the score, indicating a higher degree of abnormality in network interaction.

[0117] Security policy update unit: connected to the access permission control unit, used to update the system's security policy based on the detected abnormal behavior; specifically, incorporate new abnormal behavior features into the security policy library, and adjust the risk threshold to improve the system's detection and defense capabilities for similar abnormal behaviors, and enhance the system's adaptability and security; through the settings of the above units, the security response module can respond quickly and take appropriate security measures when abnormal behavior is detected. The access permission control unit determines the risk level of the device based on clear risk scores and thresholds, thereby achieving flexible permission control, ensuring system security while ensuring reasonable resource usage; the security policy update unit continuously improves the policy library based on new security events, and strengthens the dynamic protection capabilities of the device identity authentication system.

[0118] The present invention covers any substitution, modification, equivalent method and scheme made on the essence and scope of the present invention. In order to make the public have a thorough understanding of the present invention, specific details are described in detail in the following preferred embodiments of the present invention, but those skilled in the art can fully understand the present invention without the description of these details. In addition, in order to avoid unnecessary confusion about the essence of the present invention, well-known methods, processes, procedures, components and circuits are not described in detail.

[0119] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A device identity authentication system based on a MAC address, characterized in that: It includes hardware feature collection module, binding MAC address generation module, authentication code encryption module, authentication server communication module, device behavior monitoring module and security response module; among which: Hardware feature collection module: used to collect the hardware feature information of the device when the device is first connected to the network; and pre-process the collected hardware feature information to generate a unique device hardware fingerprint; Binding MAC address generation module: connected to the hardware feature collection module, used to receive the device hardware fingerprint, and map the device hardware fingerprint to a binding MAC address uniquely corresponding to the device based on the HMAC hash mapping algorithm; Authentication code encryption module: connected to the binding MAC address generation module, used to perform double-layer encryption processing on the device hardware fingerprint and the binding MAC address to generate a device authentication code; Authentication server communication module: connected to the authentication code encryption module, used to send the device authentication code to the authentication server for verification, and update the device access status information according to the verification result; when the verification is passed, the device is set to the authorized state; when the verification fails, the device is set to the access denied state; Device behavior monitoring module: connected to the authentication server communication module, used to monitor and collect device behavior data in real time when the device is in an authorized state, including access frequency, geographic location changes and network interaction characteristics; and compare the device behavior data with the preset normal behavior pattern to identify potential abnormal behavior; Security response module: connected to the device behavior monitoring module, used to trigger corresponding security measures when abnormal behavior is detected, including sending security alerts, restricting device network access rights, and updating security policies.

2. The device identity authentication system based on MAC address according to claim 1, characterized in that: The hardware feature acquisition module includes a hardware information extraction unit, a feature data conversion unit and a hardware fingerprint generation unit; wherein: Hardware information extraction unit: used to directly extract the hardware feature information of the device from the device when the device is first connected to the network, the hardware feature information includes the CPU serial number, motherboard identifier and memory identifier of the device; wherein the CPU serial number is extracted by reading the processor unique identification instruction, the motherboard identifier is obtained from the motherboard firmware of the device, and the memory identifier is read from the register of the storage chip; Feature data conversion unit: connected to the hardware information extraction unit, used to convert the data format of the collected hardware feature information, convert the CPU serial number, motherboard identifier and memory identifier into a unified data format, and ensure the consistency of the format of the hardware feature information; Hardware fingerprint generation unit: connected to the feature data conversion unit, used to encrypt the converted hardware feature information through a hash algorithm to generate a unique device hardware fingerprint. The hardware fingerprint generation process generates fingerprint data of a fixed length through an irreversible hash operation to ensure the uniqueness and non-tamperability of the device hardware fingerprint.

3. The device identity authentication system based on MAC address according to claim 2, characterized in that: The hardware fingerprint generating unit comprises: Feature information splicing: Splice the converted device CPU serial number, motherboard identifier and memory identifier into a continuous data string in a predetermined order. Let the spliced ​​data string be D. The expression is: D = CPU serial number | motherboard identifier | memory identifier, where | represents the sequential splicing operation of the string; Salt value generation: Get a preset salt value S from the authentication server and combine it with the concatenated data string D; the salt value S is a random string of fixed length; the combined data is represented as: D s =D∥S; Hash encryption: the combined data D s Perform hash operation to generate a unique hardware fingerprint H of fixed length, specifically using the SHA-256 hash algorithm, the formula is: H = SHA-256 (D s ), where the SHA-256 hash algorithm outputs a 256-bit hash value through an irreversible operation process; Hardware fingerprint simplification: In order to reduce storage space usage, the first 128 bits of the hash value H are used as the final device hardware fingerprint, denoted as H 128 .

4. The device identity authentication system based on MAC address according to claim 3, characterized in that: The binding MAC address generation module includes a key generation unit, a hash operation unit, an address interception unit and an OUI setting unit; wherein: Key generation unit: used to generate the encryption key K required to bind the MAC address; specifically, obtain the preset 128-bit symmetric key K through a secure channel with the authentication server; Hash operation unit: connected to the key generation unit, used to generate a fixed-length HMAC hash value based on the device hardware fingerprint and the encryption key K; the hash operation unit receives the device hardware fingerprint H 128 The HMAC-SHA256 algorithm is used and the following formula is used for calculation: M = HMAC-SHA256 (K, H 128 ), where M is the generated 256-bit HMAC hash value; Address interception unit: connected to the hash operation unit, used to intercept the valid bits of the bound MAC address from the HMAC hash value; specifically, the first 48 bits of M are used as the main part of the bound MAC address, set to M 48 ; OUI setting unit: connected to the address interception unit, used to set the first 24 bits of the bound MAC address as the preset organizational unique identifier OUI; and append it to the MAC 48 The front end generates a complete binding MAC address MAC B .

5. The device identity authentication system based on MAC address according to claim 4, characterized in that: The authentication code encryption module includes a hash encryption unit, a data combination unit and a symmetric encryption unit; wherein: Hash encryption unit: used to perform hash encryption on the device hardware fingerprint and generate an intermediate hash value; specifically, first receive the device hardware fingerprint H 128 , and use the SHA-256 algorithm to perform irreversible hash encryption on it to generate an intermediate hash value H with a length of 256 bits s ; Data combination unit: connected to the hash encryption unit, used to generate the intermediate hash value H s Bind MAC address to MAC B Perform data splicing to form combined data D c ; The intermediate hash values ​​H are s Put it in front and bind the MAC address B After that, the expression is: D c =H s ∥MAC B , where ∥ represents sequential concatenation operations; Symmetric encryption unit: connected to the data combination unit, used to encrypt the combined data D c Perform symmetric encryption to generate the final device authentication code; the symmetric encryption unit receives the 256-bit symmetric encryption key K preset by the authentication server enc, , and uses the AES-256 algorithm to combine the data D c Perform encryption processing to generate device authentication code E c .

6. The device identity authentication system based on MAC address according to claim 1, characterized in that: The authentication server communication module includes a secure communication unit, an authentication code sending unit, a verification result receiving unit and a status updating unit; wherein: Secure communication unit: used to establish a secure communication channel between the device and the authentication server; the secure communication unit uses the transport layer security protocol for two-way authentication, encrypts the transmission device authentication code, and ensures the confidentiality and integrity of the data during transmission; Authentication code sending unit: connected to the secure communication unit, used to send the device authentication code to the authentication server through a secure communication channel; in the process, the device authentication code is encapsulated and a data packet is generated according to a predetermined communication protocol format, including the device identity information and the device authentication code; Verification result receiving unit: connected to the security communication unit, used to receive the verification result returned by the authentication server; the verification result includes a verification status and a reason code. When the verification is passed, the verification status is passed and the reason code is 0; when the verification fails, the verification status is failed and the reason code is the corresponding error code; Status update unit: connected to the verification result receiving unit, used to update the access status information of the device according to the received verification result; when the verification status is passed, the status update unit sets the access status of the device to the authorized status, allowing the device to access the network normally; when the verification status is failed, the status update unit sets the access status of the device to the denied access status, preventing the device from accessing network resources.

7. The device identity authentication system based on MAC address according to claim 1, characterized in that: The device behavior monitoring module includes a behavior data acquisition unit, a data preprocessing unit, a behavior pattern comparison unit and an abnormality identification unit; wherein: Behavior data collection unit: used to record the behavior data of the device in the network in real time when the device is in the authorized state, including the device's access frequency, geographical location changes and network interaction characteristics; specifically, the access frequency refers to the number of times the device accesses the network resources within a specified time; the geographical location changes are obtained through the network location identification method to obtain the location information changes of the device; the network interaction characteristics include the connection information between the device and other nodes, the data transmission rate and the data packet size; Data preprocessing unit: connected to the behavior data acquisition unit, used to preprocess the collected behavior data, including data cleaning, format conversion and noise filtering, so as to remove abnormal data points and noise interference in the data acquisition process; and convert the preprocessed behavior data into a standard format; Behavior pattern comparison unit: connected to the data preprocessing unit, used to compare the preprocessed device behavior data with the preset normal behavior pattern; based on the established normal behavior model, analyze the access frequency, geographical location change and network interaction characteristics of the device item by item to determine whether the device behavior conforms to the range of the normal pattern; Abnormal identification unit: connected to the behavior pattern comparison unit. When the device behavior data deviates from the set range of the normal behavior pattern on a certain monitoring item, it is judged as a potential abnormality and the abnormal behavior is marked as a risk event. At the same time, the marked abnormal behavior is recorded to provide a basis for subsequent security response.

8. The device identity authentication system based on MAC address according to claim 7, characterized in that: The behavior pattern comparison unit comprises: Access frequency analysis: Calculate the access frequency F of the device within the preset time window and compare it with the access frequency threshold F in the normal behavior model. norm Compare; when the condition F≤F is met norm When , the access frequency is judged to be normal, otherwise it is judged to be abnormal; Geographic location change analysis: Get the current geographic location of the device L current , and the previous record position L previous Compare and calculate the position change distance D; when the condition D≤D is met norm When , the geographical location change is judged to be normal, otherwise it is judged to be abnormal; D norm is the maximum position change distance allowed in the normal behavior model; Network interaction feature analysis: Extract the network interaction feature parameter set {P1, P2, ..., P n }, including packet size, connection duration and transmission rate, and compared with the characteristic parameters of the normal behavior model {P 1norm , P 2norm , P nnorm } to compare; calculate the feature difference ΔP, when the condition ΔP≤ΔP is met norm When , the network interaction characteristics are judged to be normal, otherwise it is judged to be abnormal; ΔP norm The feature difference threshold set in the normal behavior model; Comprehensive judgment: The above three analysis results are comprehensively judged. If the device's access frequency, geographic location changes, and network interaction characteristics are all within the set range of the normal behavior model, the device is judged to be in a normal state; if any one of them is marked as a potential anomaly, the device is judged to be in an abnormal state.

9. The device identity authentication system based on MAC address according to claim 8, characterized in that: The abnormal behavior recorded in the abnormal identification unit includes device identification information, abnormal type information, abnormal occurrence time, abnormal parameter details and network environment information; The device identification information includes a device hardware fingerprint and a bound MAC address of the device that records the abnormal behavior; The abnormal type information includes abnormal access frequency, abnormal geographical location and abnormal network interaction characteristics; The abnormality occurrence time is the specific timestamp when it is detected; The abnormal parameter details are the specific parameter values ​​that lead to the abnormal determination, including actual access frequency, location change distance, and feature difference; The network environment information is the network status information when the abnormal behavior occurs, including network load and connection status.

10. The device identity authentication system based on MAC address according to claim 1, characterized in that: The security response module includes a security alarm unit, an access rights control unit and a security policy update unit; wherein: A security alarm unit is used to immediately generate security alarm information when abnormal behavior is detected, and send the security alarm information to the system administrator and the relevant security management platform; the security alarm information includes the identification information of the abnormal device, the abnormal type, the occurrence time and the abnormal parameter details; The access control unit is connected to the security alarm unit and is used to score the risk R of abnormal behavior. s Adjust the network access permissions of the device; specifically: s ≤R low When R low <R s ≤R medium When R s >R medium When the device is judged as high risk, the network connection of the device is immediately cut off to prevent it from continuing to access network resources; low and R medium is the preset risk threshold; Security policy update unit: connected to the access permission control unit, used to update the system's security policy based on the detected abnormal behavior; specifically, incorporate new abnormal behavior features into the security policy library and adjust the risk threshold to improve the system's defense capabilities against similar abnormal behaviors.

Images