Internet-of-things terminal access method based on virtual identity

Abstract

The invention relates to the technical field of access verification, and particularly discloses an Internet of Things terminal access method based on a virtual identity, which comprises the following steps: after an authentication server receives a data packet containing identification information sent by an Internet of Things terminal, firstly checking whether the Internet of Things terminal is in a white list, and if the Internet of Things terminal is in the white list, directly allowing the Internet of Things terminal to access; if the multi-dimensional attribute information is not in the white list, further extracting the multi-dimensional attribute information of the Internet of Things terminal, and introducing a deep learning-based data processing technology to perform semantic analysis and global context association analysis on the multi-dimensional attribute information of the Internet of Things terminal so as to mine potential behavior patterns and security risk information of the Internet of Things terminal; therefore, accurate identification and access control of the Internet of Things terminal are realized. Therefore, the security state of the Internet of Things terminal can be monitored and evaluated in real time, and the access authority of the Internet of Things terminal is dynamically adjusted accordingly, so that security threats in an Internet of Things environment are effectively handled.

Description

Technical Field

[0001] The present application relates to the field of access verification technology, and more specifically, to a method for accessing an IoT terminal based on a virtual identity. Background Art

[0002] With the rapid development of Internet of Things (IoT) technology, more and more smart devices are connected through the Internet, forming a large and complex network system. These smart devices cover multiple fields from smart homes to industrial automation, providing users with unprecedented convenience and intelligent services. However, security threats in the IoT environment are also increasing, especially illegal access and malicious attacks on IoT terminals, which pose severe challenges to user privacy protection, data security and stable system operation. For example, in some industrial IoT scenarios, once an illegal IoT terminal is connected, it may steal key production data, tamper with equipment control instructions, cause production accidents, and cause huge economic losses; in the smart home environment, the access of malicious IoT terminals may leak users' privacy information, such as illegal control of home cameras, infringing on users' personal privacy.

[0003] Existing IoT terminal access control solutions mainly rely on static authentication mechanisms, such as MAC address or IP address whitelists. Although this method can prevent unauthorized devices from accessing the network to a certain extent, it has obvious limitations. On the one hand, simple whitelist filtering methods may cause normal terminals to be denied access (false positives) due to untimely whitelist updates or misconfiguration. On the other hand, as the scale of the network grows, managing and maintaining large whitelists becomes more and more complex and time-consuming. New devices are constantly added, and old devices may be replaced or upgraded. Traditional static authentication methods are difficult to adapt to such rapid changes and cannot flexibly respond to newly added or changed devices.

[0004] Therefore, an optimized virtual identity-based IoT terminal access method is expected. Summary of the invention

[0005] In order to solve the above technical problems, the present application is proposed. The embodiment of the present application provides an IoT terminal access method based on virtual identity. After the authentication server receives a data packet containing identification information sent by the IoT terminal, it first checks whether the IoT terminal is in the whitelist. If it is in the whitelist, it directly allows access; if it is not in the whitelist, it further extracts the multi-dimensional attribute information of the IoT terminal, and introduces data processing technology based on deep learning to perform semantic parsing and global context association analysis on the multi-dimensional attribute information of the IoT terminal, so as to dig out the potential behavior patterns and security risk information of the IoT terminal, thereby realizing accurate identification and access control of the IoT terminal. In this way, the security status of the IoT terminal can be monitored and evaluated in real time, and its access rights can be dynamically adjusted accordingly, so as to effectively deal with security threats in the IoT environment.

[0006] According to one aspect of the present application, a method for accessing an IoT terminal based on a virtual identity is provided, which includes:

[0007] The IoT terminal sends a data packet containing identification information to the authentication server;

[0008] After receiving the data packet, the authentication server checks whether the IoT terminal is in the whitelist based on the identification information of the IoT terminal;

[0009] In response to the IoT terminal not being in the whitelist, the authentication server collects a set of attribute information of the IoT terminal;

[0010] Performing semantic embedding coding on each piece of attribute information in the set of attribute information to obtain a set of embedded coding vectors of attribute information of IoT devices;

[0011] Performing graph walk autocorrelation gated aggregation analysis on the set of IoT device attribute information embedded coding vectors to obtain a contextual semantic aggregation coding vector of IoT device attribute information;

[0012] Based on the context semantic aggregation coding vector of the IoT device attribute information, a designated result of the access level of the IoT terminal is determined.

[0013] Compared with the prior art, the virtual identity-based IoT terminal access method provided by the present application first checks whether the IoT terminal is in the whitelist after the authentication server receives the data packet containing identification information sent by the IoT terminal. If it is in the whitelist, it is directly allowed to access; if it is not in the whitelist, it further extracts the multi-dimensional attribute information of the IoT terminal, and introduces data processing technology based on deep learning to perform semantic parsing and global context association analysis on the multi-dimensional attribute information of the IoT terminal, so as to mine the potential behavior patterns and security risk information of the IoT terminal, thereby realizing accurate identification and access control of the IoT terminal. In this way, the security status of the IoT terminal can be monitored and evaluated in real time, and its access rights can be dynamically adjusted accordingly, so as to effectively deal with security threats in the IoT environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0015] Figure 1 The present invention is a flowchart of a method for accessing an IoT terminal based on a virtual identity according to an embodiment of the present application.

[0016] Figure 2 The present invention is a data flow diagram of a virtual identity-based IoT terminal access method according to an embodiment of the present application.

[0017] Figure 3 This is a flowchart of sub-step S5 of the method for accessing an IoT terminal based on a virtual identity according to an embodiment of the present application.

[0018] Figure 4 This is a flowchart of sub-step S51 of the method for accessing an IoT terminal based on a virtual identity according to an embodiment of the present application.

[0019] Figure 5 This is a flowchart of sub-step S52 of the method for accessing an IoT terminal based on a virtual identity according to an embodiment of the present application. DETAILED DESCRIPTION

[0020] As shown in this application and claims, unless the context clearly indicates an exception, the words "a", "an", "an" and / or "the" do not refer to the singular and may also include the plural. Generally speaking, the terms "include" and "comprise" only indicate the inclusion of the steps and elements that have been clearly identified, and these steps and elements do not constitute an exclusive list. The method or device may also include other steps or elements.

[0021] Although the present application makes various references to certain modules in the system according to the embodiments of the present application, any number of different modules can be used and run on the user terminal and / or server. The modules are only illustrative, and different aspects of the system and method can use different modules.

[0022] Flowcharts are used in the present application to illustrate the operations performed by the system according to the embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed accurately in order. On the contrary, various steps may be processed in reverse order or simultaneously as required. Meanwhile, other operations may also be added to these processes, or a certain step or several steps of operations may be removed from these processes.

[0023] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0024] It is worth noting that in this application, all actions to obtain data are carried out in compliance with the relevant data protection laws and policies of the country where the data is located, and with the authorization given by the owner of the corresponding device.

[0025] In response to the technical problems described in the above background technology, this application proposes a method for accessing IoT terminals based on virtual identities. After the authentication server receives a data packet containing identification information sent by the IoT terminal, it first checks whether the IoT terminal is in the whitelist. If it is in the whitelist, it directly allows access; if it is not in the whitelist, it further extracts the multi-dimensional attribute information of the IoT terminal, and introduces data processing technology based on deep learning to perform semantic parsing and global context association analysis on the multi-dimensional attribute information of the IoT terminal, so as to dig out the potential behavior patterns and security risk information of the IoT terminal, thereby realizing accurate identification and access control of the IoT terminal. In this way, the security status of the IoT terminal can be monitored and evaluated in real time, and its access rights can be dynamically adjusted accordingly, so as to effectively deal with security threats in the IoT environment.

[0026] Figure 1 The present invention is a flowchart of a method for accessing an IoT terminal based on a virtual identity according to an embodiment of the present application. Figure 2 Schematic diagram of data flow of the method for accessing IoT terminals based on virtual identities according to an embodiment of the present application. Figure 1 and Figure 2As shown, the virtual identity-based IoT terminal access method includes the following steps: S1, the IoT terminal sends a data packet containing identification information to an authentication server; S2, after receiving the data packet, the authentication server checks whether the IoT terminal is in a whitelist based on the identification information of the IoT terminal; S3, in response to the IoT terminal not being in the whitelist, the authentication server collects a set of attribute information of the IoT terminal; S4, semantically embedding and coding each attribute information in the set of attribute information to obtain a set of IoT device attribute information embedding coding vectors; S5, performing graph walk autocorrelation gated aggregation analysis on the set of IoT device attribute information embedding coding vectors to obtain a contextual semantic aggregation coding vector of IoT device attribute information; S6, determining a designated result of the access level of the IoT terminal based on the contextual semantic aggregation coding vector of the IoT device attribute information.

[0027] In the above-mentioned method for accessing the IoT terminal based on virtual identity, in step S1, the IoT terminal sends a data packet containing identification information to the authentication server. It should be understood that in the IoT environment, the IoT terminal needs to communicate and exchange data with other nodes or servers in the network, and the authentication server, as a key control point for network security, needs to obtain the identification information of the IoT terminal, and use this as a basis to determine whether the terminal has legal access rights. Here, the identification information is usually a unique identifier assigned to the IoT terminal during the production process, such as a device serial number, a preset device ID, etc., which is used to uniquely identify the terminal in the network environment so that the authentication server can accurately identify and distinguish different IoT devices. In a specific implementation, when the IoT terminal is started or attempts to access the network, it establishes a connection with the authentication server through its built-in communication module (such as Wi-Fi, Bluetooth, cellular network module, etc.), and encapsulates its own identification information in a data packet and sends it to the authentication server according to the established communication protocol.

[0028] Specifically, the IoT terminal first needs to prepare information to uniquely identify itself, which may include the device's hardware address (such as MAC address), IP address, device serial number, manufacturer information, model name, etc. For some advanced applications, it may also include pre-assigned identity credentials or certificates, such as X.509 certificates. The identification information should be as detailed and unique as possible so that the authentication server can accurately identify each individual device. In addition, in order to enhance security, it is recommended to encrypt some sensitive information or use a hash algorithm to generate an irreversible identification code.

[0029] Next, the IoT terminal constructs a data packet according to the communication protocol. This involves selecting the appropriate network transport layer protocol (such as TCP / IP, UDP, etc.) and determining the upper layer application protocol (such as HTTP, MQTT, CoAP). Different protocols have their own characteristics and are suitable for different types of IoT application scenarios. In addition to the identification information mentioned above, the data packet should also include fields such as timestamp, message sequence number, and checksum to ensure the integrity and reliability of the data. At the same time, considering the network security requirements, the data packet may also contain encryption keys, signatures, etc. to protect the security of data transmission. When constructing the data packet, the IoT terminal should take measures to ensure the security of the data, use symmetric or asymmetric encryption technology to encrypt the entire data packet or part of the sensitive content therein to prevent man-in-the-middle attacks or other forms of data leakage; ensure that the data has not been tampered with by adding message digests or digital signatures; if conditions permit, embed pre-registered authentication information in the data packet, such as a username / password combination or token, so that the authentication server can quickly verify the identity of the sender at the primary stage; to prevent malicious users from repeatedly sending old messages, introduce a one-time verification code (nonce), timestamp or serial number mechanism to ensure that each communication is fresh and valid.

[0030] Before sending the message, the IoT terminal needs to complete some preparation work to ensure that there are enough resources (such as bandwidth and memory) to support the communication and be prepared to deal with possible errors, such as timeout retransmission strategy. At the same time, record the relevant information of this sending operation, such as sending time, destination address, etc., to facilitate subsequent troubleshooting and auditing. According to the selected communication protocol, try to establish a connection with the authentication server. If it is a TCP-based protocol, it needs to go through a three-way handshake process; while the UDP-based protocol is relatively simple and only needs to send data directly.

[0031] When all preparations are completed, the IoT terminal can officially send the constructed data packet to the authentication server. During the sending process, the IoT terminal should listen to the response from the authentication server so as to adjust the behavior in time. For example, after receiving the confirmation reply, continue to perform the next operation; if an abnormal situation is encountered, follow the predetermined fault handling process, such as waiting for a period of time and trying to send again, or notifying the administrator to intervene.

[0032] It is worth noting that the network conditions in the IoT environment are often complex and changeable, and there may be problems such as high latency and low bandwidth. Therefore, IoT terminals should also have a certain degree of flexibility when sending data packets, and be able to dynamically adjust the sending strategy according to the current network status, such as adjusting the sending frequency, sending large data packets in pieces, etc., to improve the success rate and efficiency of communication.

[0033] In the above-mentioned virtual identity-based IoT terminal access method, in step S2, after receiving the data packet, the authentication server checks whether the IoT terminal is in the whitelist based on the identification information of the IoT terminal. It should be understood that the whitelist mechanism is a simple and effective preliminary access control strategy. By presetting a list of legal IoT terminals (whitelist), devices that have been confirmed to be safe and reliable and authorized to access can be quickly screened out. After receiving the data packet, the authentication server extracts the identification information therein and compares it with the locally stored whitelist. If a completely matching identification is found, it is considered that the IoT terminal is in the whitelist and has the right to directly access the network, thereby avoiding the complicated subsequent verification process for the whitelist device, improving the efficiency and response speed of access control, and reducing the delay effect on the normal access of legal devices.

[0034] Specifically, the authentication server first receives the data packet from the IoT terminal and performs a preliminary analysis on it. During this process, the authentication server extracts the header information and payload in the data packet, including but not limited to the timestamp, message sequence number, checksum and other fields to confirm the integrity and reliability of the data packet. In addition, the authentication server also checks the basic information of the data packet, such as the source address, destination address, and protocol type, to ensure that the data packet does come from the expected communication partner and complies with the established communication rules. If the data packet fails these basic verifications, it will be discarded immediately and will not enter the subsequent processing flow.

[0035] Once the data packet passes the initial verification, the authentication server will focus on extracting the identification information provided by the IoT terminal. This usually involves decrypting encrypted content, especially when sensitive information such as MAC addresses or device serial numbers are encrypted for transmission. The authentication server uses a pre-shared key (PSK), public-private key pairs, or other forms of authentication mechanisms to decrypt this information, ensuring that only the legitimate authentication server can read and understand the true identity of the IoT terminal. This step is critical to preventing man-in-the-middle attacks and other types of eavesdropping.

[0036] The authentication server maintains a dynamically updated whitelist database that contains the identification information of all IoT terminals that are allowed to access the network. This whitelist can be manually configured by the administrator, or entries can be automatically added or removed by automated tools based on specific conditions. In order to ensure the flexibility and responsiveness of the system, the design of the whitelist database often takes into account the need for efficient retrieval, using data structures such as hash tables and B-trees to quickly locate and match specific identification information. In addition, considering the large-scale connection requirements in the IoT environment, the whitelist database must also have good scalability and be able to grow with the addition of new devices without affecting query efficiency.

[0037] After completing the above query, the authentication server will get the result of whether the identification information of the IoT terminal exists in the whitelist. If the answer is yes, the authentication server will continue with the next step of the security verification process; otherwise, if no match is found, it means that the IoT terminal is currently not within the authorized scope.

[0038] In the above-mentioned virtual identity-based IoT terminal access method, in step S3, in response to the IoT terminal not being in the whitelist, the authentication server collects a set of attribute information of the IoT terminal. In a specific example of the present application, the attribute information includes device model, operating system and firmware version, health status, connection history, application list, certificate and key information and traffic characteristics. That is, when the IoT terminal is not in the whitelist, its legitimacy and security cannot be determined by identification information alone. In order to avoid misjudging a legal device as an illegal device, the authentication server will further collect attribute information of the IoT terminal, such as device model, operating system and firmware version, health status, connection history, application list, certificate and key information and traffic characteristics, so as to more comprehensively and deeply understand the security status and behavior pattern of the IoT terminal and make more accurate and reasonable access control decisions. It should be understood that the device model can help determine the type of device and its potential functional scope, the operating system and firmware version are closely related to the security and vulnerability of the device, the health status (such as hardware performance indicators, software operation stability, etc.) can reflect whether the device is operating normally or there may be hidden dangers of failure, the connection history records can help analyze its past communication behavior and access mode, the application list can reveal the software installed on the device, the certificate and key information are used to verify the authenticity of the device's identity and encrypted communication capabilities, and the traffic characteristics can reflect the data transmission mode and behavior of the device in the network. By comprehensively collecting these attribute information, a comprehensive IoT terminal portrait can be constructed to provide sufficient data foundation for subsequent analysis.

[0039] Specifically, for IoT terminals that are not included in the whitelist, by collecting their attribute information, the authentication server can identify whether the IoT terminal may be a new device that is legal but has not yet been registered, or an illegal intruder that is maliciously controlled. According to the type, function and possible impact of the device, the risk level of allowing it to access the network is evaluated, and corresponding monitoring strategies are formulated. Reference data is provided for future whitelist management and system optimization, so that the entire network can better adapt to changing needs.

[0040] Next, the authentication server needs to identify the specific attribute information to be collected and take appropriate measures to actually obtain this data. On the one hand, the authentication server can directly extract some information from the received data packet, such as the identification information and other accompanying fields mentioned earlier. On the other hand, the authentication server may send additional query requests to the IoT terminal, asking the other party to provide more information. Such requests can be in the form of standardized API calls or customized instruction sets for specific device types. In addition, in some cases, the authentication server can also use other resources on the network to assist in collecting information, such as querying a public database to verify the identity of the device, or using nearby sensor nodes to collect location data about the IoT terminal.

[0041] In order to ensure that the collected information is accurate and representative, the authentication server needs to consider several key factors during the collection process. The first is the consistency and integrity of the data, that is, to ensure that all relevant attribute information can be fully collected and consistent between different sources. The second is the security of the data. Especially when sensitive information is involved, appropriate encryption measures must be taken to prevent leakage. Finally, there is the issue of efficiency. Considering that there may be a large number of IoT terminals requesting access at the same time in an IoT environment, the authentication server needs to optimize the data collection process, reduce delays and increase processing speed.

[0042] In the above-mentioned virtual identity-based IoT terminal access method, the step S4 performs semantic embedding coding on each attribute information in the set of attribute information to obtain a set of IoT device attribute information embedding coding vectors. In a specific example of the present application, the step S4 includes: using a semantic embedding encoder based on the Bert model to perform semantic embedding coding on each attribute information in the set of attribute information to obtain a set of IoT device attribute information embedding coding vectors. Specifically, the present application takes into account that the original attribute information usually exists in the form of text or structured data, which is not conducive to direct complex mathematical calculations and model analysis. Therefore, the present application further uses a semantic embedding encoder based on the Bert model to perform semantic embedding coding on each attribute information in the set of attribute information. The Bert model (Bidirectional Encoder Representations from Transformers) is a pre-trained language model that has a strong semantic understanding ability in the field of natural language processing through learning a large amount of text data. It can capture the semantic features of text data and map it to a low-dimensional vector space. In this application, various attribute information of the IoT terminal is input into a semantic embedding encoder based on the Bert model. The Bert model conducts in-depth analysis of the lexical, syntactic and semantic aspects of each attribute information to convert it into a low-dimensional dense vector representation with rich semantic features, thereby obtaining a set of embedded coding vectors of the attribute information of the IoT device. This enables the computer to better understand the semantic meaning of each attribute information while retaining the semantic associations between different attribute information, thereby providing effective data input for subsequent IoT terminal security risk analysis.

[0043] In the above-mentioned virtual identity-based IoT terminal access method, the step S5 performs a graph walk autocorrelation gating aggregation analysis on the set of IoT device attribute information embedded coding vectors to obtain the context semantic aggregation coding vector of the IoT device attribute information. It should be understood that the present application takes into account that there are certain inherent associations and contextual relationships between the various attribute information of the IoT terminal. For example, the device model may affect the choice of its operating system, and the connection history and application list together reveal the common usage scenarios and potential risks of the device. Therefore, in order to fully consider the global attribute information of the IoT terminal, the present application proposes a graph walk autocorrelation gating aggregation analysis method, which uses a graph walk algorithm to capture the association paths and dependencies between various attribute information, and at the same time uses the autocorrelation gating mechanism to dynamically weight each attribute information, strengthen the influence of important attributes, and suppress the interference of noise and redundant information, so as to effectively integrate the multi-dimensional attribute information of the IoT terminal and reveal the potential security risks hidden in the multi-dimensional attribute information. Among them, Figure 3FIG. 5 is a flowchart of sub-step S5 of the method for accessing an IoT terminal based on a virtual identity according to an embodiment of the present application. Figure 3 As shown, the step S5 includes the steps of: S51, performing graph walking context-aware enhancement on the set of IoT device attribute information embedded coding vectors to obtain a set of IoT device attribute information context-aware enhanced feature vectors; S52, based on the feature correlation between the set of IoT device attribute information context-aware enhanced feature vectors and the set of IoT device attribute information embedded coding vectors, performing significance aggregation on the set of IoT device attribute information embedded coding vectors to obtain the IoT device attribute information context semantic aggregation coding vector.

[0044] Figure 4 FIG. 5 is a flowchart of sub-step S51 of the method for accessing an IoT terminal based on a virtual identity according to an embodiment of the present application. Figure 4 As shown, the step S51 includes the steps of: S511, inputting each IoT device attribute information embedded coding vector in the set of IoT device attribute information embedded coding vectors into the hyperbolic space mapper respectively to obtain a set of IoT device attribute information embedded coding vectors after hyperbolic space mapping; S512, extracting the topological structure characteristics of the set of IoT device attribute information embedded coding vectors after hyperbolic space mapping to obtain a graph walk topology feature matrix of IoT device attribute information; S513, inputting the graph walk topology feature matrix of IoT device attribute information and the set of IoT device attribute information embedded coding vectors after hyperbolic space mapping into a global context walk encoder based on a graph convolutional neural network model to obtain a set of context-aware enhanced feature vectors of IoT device attribute information.

[0045] More specifically, the step S511 is expressed as follows:

[0046] V={v1,v2,...,v i ,...,v n}

[0047] h i =W1v i W2

[0048] Where V represents the set of embedded coding vectors of the IoT device attribute information, v1, v2, v i and v n represents the first, second, i-th and n-th IoT device attribute information embedded coding vectors in the set of IoT device attribute information embedded coding vectors, n is the number of IoT device attribute information embedded coding vectors, W1 and W2 represent the first linear mapping matrix and the second linear mapping matrix, respectively, h iRepresents the i-th hyperbolic space mapping IoT device attribute information embedded coding vector in the set of hyperbolic space mapping IoT device attribute information embedded coding vectors.

[0049] That is, given that the volume of hyperbolic space grows exponentially compared to Euclidean space, this feature enables it to better accommodate tree or tree-like structures, and is particularly suitable for representing data sets with semantic hierarchy. Therefore, the set of encoding vectors of the IoT device attribute information is first mapped to the hyperbolic space, so as to maintain the hierarchical structure and long-tail distribution state in the high-dimensional data with the help of the unique properties of hyperbolic geometry, thereby enhancing the expression of the relative distance between the semantic features of the IoT device attribute information.

[0050] More specifically, the step S512 includes: first, calculating the Poincare distance between any two hyperbolic space mapped IoT device attribute information embedded coding vectors in the set of hyperbolic space mapped IoT device attribute information embedded coding vectors to obtain the IoT device attribute information graph walk topology matrix, which is expressed as:

[0051]

[0052] Among them, h j represents the jth IoT device attribute information embedded coding vector after hyperbolic space mapping in the set of IoT device attribute information embedded coding vectors after hyperbolic space mapping, ‖·‖ represents the norm of the calculation vector, arccosh(·) represents the inverse cosine function, d P (·,·) represents the Poincare distance metric function, D represents the IoT device attribute information graph walk topology matrix, and D ij Represents the element value at the (i, j)th position in the walk topology matrix of the IoT device attribute information graph.

[0053] That is, by calculating the Poincare distance between the embedded coding vectors of the attribute information of each IoT device after hyperbolic space mapping, the relative semantic proximity between the attribute information of each IoT device is measured, and the walk topology matrix of the IoT device attribute information graph is constructed to reveal the global semantic topological structure of the IoT device attribute information.

[0054] Then, the walk topology matrix of the IoT device attribute information graph is subjected to dilated convolution coding to obtain the walk topology feature matrix of the IoT device attribute information graph, which is expressed as follows:

[0055] D t =DilatedConv(D)

[0056] Among them, DilatedConv(·) represents the dilated convolution operation, D t Represents the topological feature matrix of the IoT device attribute information graph.

[0057] That is, the dilated convolution coding technology is used to perform dilated convolution processing on the walk topology matrix of the IoT device attribute information graph, so as to capture the potential semantic dependency between the attribute information of IoT devices over a long distance with the help of the sparse connection characteristics of the dilated convolution, thereby further enhancing its feature expression ability.

[0058] More specifically, the step S513 is expressed as follows:

[0059]

[0060] Among them, GCN(·,·) represents graph convolutional neural network, s i Indicates the v i The corresponding context-aware enhanced feature vector of IoT device attribute information.

[0061] That is, the attribute information of each IoT device is embedded in the coding vector as a node in the graph structure, and the IoT device attribute information graph walk topological feature matrix is ​​used as the edge of the graph walk. The walk is performed on the entire graph structure through the graph convolution operation, and the information between the attribute information of each IoT device is transferred and accumulated, so that each node can access the information of its multi-hop neighbors, so as to make full use of the contextual information of the global attributes of the IoT device to enhance its feature representation, thereby extracting a set of context-aware enhanced feature vectors of the IoT device attribute information with rich contextual information.

[0062] Figure 5 FIG. 5 is a flowchart of sub-step S52 of the method for accessing an IoT terminal based on a virtual identity according to an embodiment of the present application. Figure 5 As shown, the step S52 includes the steps of: S521, inputting the set of the IoT device attribute information context-aware enhanced feature vectors and each group of corresponding IoT device attribute information context-aware enhanced feature vectors and IoT device attribute information embedded coding vectors in the set of the IoT device attribute information embedded coding vectors into the autocorrelation gating unit to obtain a set of IoT device attribute information autocorrelation gated significant confidence factors; S522, inputting the set of IoT device attribute information autocorrelation gated significant confidence factors into the normalization unit based on the Softmax function to obtain a set of IoT device attribute information autocorrelation gated significant confidence weight factors; S523, based on the set of IoT device attribute information autocorrelation gated significant confidence weight factors, calculating the position-weighted sum of the set of IoT device attribute information embedded coding vectors to obtain the IoT device attribute information context semantic aggregation coding vector.

[0063] More specifically, the step S521 is expressed by the formula:

[0064]

[0065] Among them, c i Indicates the v i The corresponding IoT device attribute information autocorrelation gating significant confidence factor, g(·,·) represents the autocorrelation gating unit, represents positional subtraction, and softmax[·] represents a classifier based on the Softmax function.

[0066] That is, the semantic features of the IoT device attribute information enhanced by context awareness and the original IoT device attribute information semantic features are sent to the autocorrelation gating unit to measure the consistency and correlation between the two. It should be understood that if the original IoT device attribute information features and the feature representation enhanced by context awareness have a high degree of consistency and correlation, it can be considered that the IoT device attribute information has a high degree of credibility and importance in the representation of the IoT device security status. In this way, the relative importance of each IoT device attribute information can be effectively revealed, and a set of IoT device attribute information autocorrelation gating significant confidence factors can be generated to guide the subsequent feature aggregation process.

[0067] More specifically, the step S522 is expressed by the formula:

[0068]

[0069] Among them, exp(·) represents the exponential function with the natural constant as the base, w i Indicates the v i The corresponding IoT device attribute information autocorrelation gated significant confidence weight factor.

[0070] That is, the present application normalizes the set of autocorrelation gated significant confidence factors of the IoT device attribute information so that the sum of the weight factors corresponding to the semantic features of each IoT device attribute information is 1, so as to ensure the rationality and standardization of the weight distribution.

[0071] More specifically, the step S523 is expressed by the formula:

[0072]

[0073] Among them, ⊙ represents the point product by position, v f Represents the contextual semantic aggregation encoding vector of IoT device attribute information.

[0074] That is, based on the generated weight factors, the application performs weighted aggregation processing on the set of embedded coding vectors of the IoT device attribute information to achieve emphasis on key IoT device attribute information and filtering of redundant information, and obtains the contextual semantic aggregation coding vector of IoT device attribute information. In this way, not only the multi-dimensional attribute information of the IoT terminal is comprehensively considered, but also the inherent association and contextual relationship between each attribute information is learned, which further improves the model's recognition accuracy and prediction ability for IoT terminal security risks.

[0075] In the above-mentioned virtual identity-based IoT terminal access method, the step S6 determines the designated result of the access level of the IoT terminal based on the context semantic aggregation coding vector of the IoT device attribute information. In a specific example of the present application, the step S6 includes: inputting the context semantic aggregation coding vector of the IoT device attribute information into the access level intelligent designator based on the classifier to obtain the designated result, and the designated result is used to represent the type label of the access level. Specifically, the classifier is used to learn the security status of the device based on the device attribute information contained in the context semantic aggregation coding vector of the IoT device attribute information, and to determine whether it can be allowed to access the network and to what extent it is allowed to access network resources. Specifically, the classifier constructs a function model that maps the input IoT terminal attribute features to corresponding categories (i.e., access level types) by learning a large amount of labeled training data (in this method, the training data is known IoT terminal attribute information and corresponding access level labels). In practical applications, the classifier will classify and judge the input contextual semantic aggregation coding vector of the IoT device attribute information according to the decision boundaries and classification rules it has learned, so as to obtain the access level type label of the IoT terminal, such as "access allowed", "restricted access" or "access prohibited", etc., so as to achieve precise access control of the IoT terminal.

[0076] More specifically, the context semantic aggregation coding vector of the IoT device attribute information is input into the classifier-based access level intelligent specifier to obtain the designated result, and the designated result is used to represent the type label of the access level, including: using the fully connected layer of the access level intelligent specifier to fully connect the IoT device attribute information context semantic aggregation coding vector to obtain the IoT device attribute information context semantic aggregation fully connected coding vector; inputting the IoT device attribute information context semantic aggregation fully connected coding vector into the Softmax classification function of the access level intelligent specifier to obtain the probability value of the IoT device attribute information context semantic aggregation coding vector belonging to each type label, wherein the type label is the access level; and determining the type label corresponding to the largest of the probability values ​​as the designated result.

[0077] In a preferred example of the present application, the context semantic aggregate coding vector of the IoT device attribute information is passed through a classifier-based access level intelligent designator to obtain a designated result, including:

[0078] First, the median eigenvalue, the maximum eigenvalue and the minimum eigenvalue in the context semantic aggregation coding vector of the IoT device attribute information are determined, and the median eigenvalue is divided by the difference between the maximum eigenvalue and the minimum eigenvalue to obtain the distribution probability value of the context semantic aggregation coding of the IoT device attribute information, which is expressed as follows:

[0079] p=x mid / (x max -x min )

[0080] Among them, p represents the probability value of the contextual semantic aggregation coding distribution of IoT device attribute information, x mid Represents the median eigenvalue in the contextual semantic aggregation encoding vector of IoT device attribute information, x max and x min They respectively represent the maximum eigenvalue and the minimum eigenvalue in the contextual semantic aggregation coding vector of the IoT device attribute information;

[0081] Secondly, the context semantic aggregation coding vector of the IoT device attribute information is normalized to the maximum value to obtain the context semantic aggregation coding probability feature vector of the IoT device attribute information, and the power function of each eigenvalue of the context semantic aggregation coding probability feature vector of the IoT device attribute information is calculated with one minus the distribution probability value of the context semantic aggregation coding of the IoT device attribute information as the exponent to obtain the first IoT device attribute information context semantic aggregation coding convergence feature vector, which is expressed by the formula:

[0082] X1=X ⊙(1-p)

[0083] Where X1 represents the convergence feature vector of the contextual semantic aggregation coding of the first IoT device attribute information, X represents the probability feature vector of the contextual semantic aggregation coding of the IoT device attribute information, (·) ⊙(1-p) It represents the power function of calculating each eigenvalue in the eigenvector by subtracting the distribution probability value of the context semantic aggregation coding of the attribute information of the IoT device from one;

[0084] Next, the power function of each eigenvalue of the difference feature vector between the unit feature vector and the probability feature vector of the contextual semantic aggregation coding of the attribute information of the Internet of Things is calculated with the distribution probability value of the contextual semantic aggregation coding of the attribute information of the Internet of Things as the exponent to obtain the convergence feature vector of the contextual semantic aggregation coding of the attribute information of the second Internet of Things, which is expressed by the formula:

[0085]

[0086] Wherein, X2 represents the contextual semantic aggregation coding convergence feature vector of the attribute information of the second IoT device, I represents the unit feature vector, represents the vector spread, (·) ⊙p It represents that the power function of each eigenvalue in the eigenvector is calculated with the distribution probability value of the context semantic aggregation coding of the attribute information of the IoT device as an exponent;

[0087] Then, the IoT device attribute information context semantic aggregation coding probability feature vector is multiplied by the difference between one minus the IoT device attribute information context semantic aggregation coding distribution probability value to obtain the first IoT device attribute information context semantic aggregation coding limited feature vector, which is expressed as:

[0088] X3=X⊙(1-p)

[0089] Wherein, X3 represents the first IoT device attribute information context semantic aggregation coding limited feature vector, ⊙ represents vector dot product;

[0090] Next, the point difference feature vector is multiplied by the distribution probability value of the contextual semantic aggregation coding of the IoT device attribute information to obtain a second IoT device attribute information contextual semantic aggregation coding limited feature vector, which is expressed as:

[0091]

[0092] Wherein, X4 represents the contextual semantic aggregation coding limiting feature vector of the attribute information of the second IoT device;

[0093] Then, the first IoT device attribute information context semantic aggregation coding convergence feature vector is dot-multiplied with the second IoT device attribute information context semantic aggregation coding convergence feature vector, and then the first IoT device attribute information context semantic aggregation coding limit feature vector and the second IoT device attribute information context semantic aggregation coding limit feature vector are dot-multiplied to obtain the optimized IoT device attribute information context semantic aggregation coding vector, which is expressed as:

[0094] X'=X1⊙X2⊕X3⊕X4

[0095] Among them, X' represents the optimized contextual semantic aggregation coding vector of IoT device attribute information, and ⊕ represents vector dot addition;

[0096] Finally, the optimized contextual semantic aggregation coding vector of the IoT device attribute information is passed through a classifier-based access level intelligent specifier to obtain a specified result.

[0097] Here, considering that each IoT device attribute information embedding coding vector in the set of IoT device attribute information embedding coding vectors respectively represents the semantic embedding coding features of each attribute information of the IoT terminal, when performing feature aggregation analysis based on graph walk autocorrelation gating, the unbalanced semantic association between each attribute information will cause the IoT device attribute information context semantic aggregation coding vector to have the probability of convergence and divergence of feature sequence interactive aggregation, thereby affecting the accuracy of the designated result obtained by the classifier-based access level intelligent designator.

[0098] Based on this, by using the cross entropy form power series of the distribution analysis probability of the context semantic aggregation coding vector of the attribute information of the Internet of Things as the probability distribution convergence limit, the regression probability convergence approximation is performed on the basis of the combination of the feature set distribution and the probability density distribution of the context semantic aggregation coding vector of the attribute information of the Internet of Things, so as to avoid the conservative convergence control of the fatal potential divergence of the context semantic aggregation coding vector of the attribute information of the Internet of Things, and further use the probability distribution cross entropy of the context semantic aggregation coding vector of the attribute information of the Internet of Things as the objective function to guide the limited recovery strategy, so as to achieve the common agility of the convergence of the probability convergence and divergence of the feature set of the context semantic aggregation coding vector of the attribute information of the Internet of Things to the probability density distribution space, and improve the accuracy of the specified result obtained by the context semantic aggregation coding vector of the attribute information of the Internet of Things through the classifier-based access level intelligent specifier.

[0099] When the authentication server determines the access level of the IoT terminal, a notification message containing the decision is generated and sent to the relevant system components or administrators. This notification not only informs the final access rights, but may also come with explanations to help understand the basis for the decision. At the same time, all data related to the IoT terminal - from the initial attribute information to the final access level - will be fully recorded to form an audit log. These logs are crucial for subsequent troubleshooting, responsibility tracing, and security reviews.

[0100] Based on the determined access level, the authentication server will configure the access control rules in the network accordingly. If it is "allowed access", the IoT terminal is allowed to successfully connect to the required resources and services. For "restricted access", stricter traffic monitoring and filtering rules may be set to limit access to specific applications or services and closely track their activities. As for the IoT terminals with "forbidden access", they are directly added to the blacklist to prevent all attempts to access.

[0101] In order to maintain transparency and promote user cooperation, the authentication server should also provide appropriate user feedback channels. For those IoT terminals that are restricted or prohibited from access, the corresponding users or administrators can be notified by email, SMS or other communication methods to explain the reasons and provide solutions to the problems (such as re-verifying identities, fixing known vulnerabilities, etc.). This kind of communication can not only reduce user confusion and dissatisfaction, but also help to quickly resolve potential security issues.

[0102] In summary, the method for accessing IoT terminals based on virtual identities according to the embodiment of the present application is explained. After the authentication server receives a data packet containing identification information sent by the IoT terminal, it first checks whether the IoT terminal is in the whitelist. If it is in the whitelist, it directly allows access; if it is not in the whitelist, it further extracts the multi-dimensional attribute information of the IoT terminal, and introduces data processing technology based on deep learning to perform semantic parsing and global context association analysis on the multi-dimensional attribute information of the IoT terminal, so as to dig out the potential behavior patterns and security risk information of the IoT terminal, thereby realizing accurate identification and access control of the IoT terminal. In this way, the security status of the IoT terminal can be monitored and evaluated in real time, and its access rights can be dynamically adjusted accordingly, so as to effectively deal with security threats in the IoT environment.

[0103] The basic principle of the present invention is described above in conjunction with specific embodiments. However, it should be pointed out that the advantages, strengths, effects, etc. mentioned in the present invention are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. must be possessed by each embodiment of the present invention. In addition, the specific details of the above embodiments are only for the purpose of illustration and facilitation of understanding, rather than limitation, and the above details do not limit the present invention to being implemented by adopting the above specific details.

[0104] In the above embodiments, the description of each embodiment has its own emphasis. For the parts that are not described or recorded in detail in a certain embodiment, please refer to the relevant description of other embodiments. In the several embodiments provided by the present invention, it should be understood that the disclosed system and method can be implemented in other ways. For example, the system embodiment described above is only schematic. For example, the unit division is only a logical function division, and there may be other division methods in actual implementation. The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0105] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference to a figure in a claim should not be considered as limiting the claim to which it relates.

[0106] In addition, it is obvious that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. The multiple units stated in the system claims can also be implemented by one unit through software or hardware.

[0107] Finally, it should be noted that the above description has been given for the purpose of illustration and description. In addition, the above embodiments are only used to illustrate the technical solution of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention.

Claims

1. A method for accessing an IoT terminal based on a virtual identity, characterized in that: include: The IoT terminal sends a data packet containing identification information to the authentication server; After receiving the data packet, the authentication server checks whether the IoT terminal is in the whitelist based on the identification information of the IoT terminal; In response to the IoT terminal not being in the whitelist, the authentication server collects a set of attribute information of the IoT terminal; Performing semantic embedding coding on each piece of attribute information in the set of attribute information to obtain a set of embedded coding vectors of attribute information of IoT devices; Performing graph walk autocorrelation gated aggregation analysis on the set of IoT device attribute information embedded coding vectors to obtain a contextual semantic aggregation coding vector of IoT device attribute information; Based on the context semantic aggregation coding vector of the IoT device attribute information, a designated result of the access level of the IoT terminal is determined.

2. The method for accessing IoT terminals based on virtual identities according to claim 1, characterized in that: The attribute information includes device model, operating system and firmware version, health status, connection history, application list, certificate and key information and traffic characteristics.

3. The method for accessing IoT terminals based on virtual identities according to claim 2, characterized in that: Semantic embedding coding is performed on each attribute information in the set of attribute information to obtain a set of IoT device attribute information embedding coding vectors, including: A semantic embedding encoder based on the Bert model is used to perform semantic embedding encoding on each attribute information in the set of attribute information to obtain a set of embedded encoding vectors of the attribute information of the Internet of Things device.

4. The method for accessing IoT terminals based on virtual identities according to claim 3, characterized in that: Performing graph walk autocorrelation gated aggregation analysis on the set of IoT device attribute information embedded coding vectors to obtain a contextual semantic aggregation coding vector of IoT device attribute information, including: Performing graph walk context-aware enhancement on the set of IoT device attribute information embedded coding vectors to obtain a set of IoT device attribute information context-aware enhancement feature vectors; Based on the feature correlation between the set of context-aware enhanced feature vectors of the IoT device attribute information and the set of embedded coding vectors of the IoT device attribute information, the set of embedded coding vectors of the IoT device attribute information is significantly aggregated to obtain the context-semantic aggregated coding vector of the IoT device attribute information.

5. The method for accessing IoT terminals based on virtual identities according to claim 4, characterized in that: Performing graph walk context-aware enhancement on the set of IoT device attribute information embedded coding vectors to obtain a set of IoT device attribute information context-aware enhancement feature vectors, including: Inputting each IoT device attribute information embedding coding vector in the set of IoT device attribute information embedding coding vectors into a hyperbolic space mapper to obtain a set of IoT device attribute information embedding coding vectors after hyperbolic space mapping; Extracting the topological structure characteristics of the set of IoT device attribute information embedded coding vectors after the hyperbolic space mapping to obtain a walking topological feature matrix of the IoT device attribute information graph; The IoT device attribute information graph walk topology feature matrix and the set of IoT device attribute information embedded coding vectors after hyperbolic space mapping are input into the global context walk encoder based on the graph convolutional neural network model to obtain the set of context-aware enhanced feature vectors of the IoT device attribute information.

6. The method for accessing IoT terminals based on virtual identities according to claim 5, characterized in that: Extracting the topological structure features of the set of IoT device attribute information embedded coding vectors after the hyperbolic space mapping to obtain a walking topological feature matrix of the IoT device attribute information graph, including: Calculate the Poincare distance between any two IoT device attribute information embedding coding vectors after hyperbolic space mapping in the set of IoT device attribute information embedding coding vectors to obtain a walk topology matrix of the IoT device attribute information graph; The walk topology matrix of the IoT device attribute information graph is subjected to dilated convolution coding to obtain the walk topology feature matrix of the IoT device attribute information graph.

7. The method for accessing IoT terminals based on virtual identities according to claim 6, characterized in that: Based on the feature correlation between the set of the IoT device attribute information context-aware enhanced feature vectors and the set of the IoT device attribute information embedded coding vectors, the set of the IoT device attribute information embedded coding vectors is significantly aggregated to obtain the IoT device attribute information context semantic aggregated coding vector, including: Inputting each corresponding group of the IoT device attribute information context-aware enhanced feature vectors and the IoT device attribute information embedded coding vectors in the set of the IoT device attribute information context-aware enhanced feature vectors and the IoT device attribute information embedded coding vectors into an autocorrelation gating unit to obtain a set of IoT device attribute information autocorrelation gated significant confidence factors; Inputting the set of IoT device attribute information autocorrelation gated significant confidence factors into a normalization unit based on a Softmax function to obtain a set of IoT device attribute information autocorrelation gated significant confidence weight factors; Based on the set of autocorrelation gated significant confidence weight factors of the IoT device attribute information, a position-weighted sum of a set of embedded coding vectors of the IoT device attribute information is calculated to obtain a contextual semantic aggregation coding vector of the IoT device attribute information.

8. The method for accessing IoT terminals based on virtual identities according to claim 7, characterized in that: Determining a designated result of the access level of the IoT terminal based on the context semantic aggregation coding vector of the IoT device attribute information includes: The context semantic aggregate coding vector of the IoT device attribute information is input into the classifier-based access level intelligent specifier to obtain the specified result, and the specified result is used to represent the type label of the access level.

9. The method for accessing IoT terminals based on virtual identities according to claim 8, characterized in that: The context semantic aggregate coding vector of the IoT device attribute information is input into the classifier-based access level intelligent designator to obtain the designation result, which is used to represent the type label of the access level, including: Use the fully connected layer of the access level intelligent designator to perform fully connected encoding on the context semantic aggregation encoding vector of the IoT device attribute information to obtain a context semantic aggregation fully connected encoding vector of the IoT device attribute information; Input the fully connected encoding vector of the contextual semantic aggregation of the IoT device attribute information into the Softmax classification function of the access level intelligent designator to obtain the probability value of the contextual semantic aggregation encoding vector of the IoT device attribute information belonging to each type label, wherein the type label is the access level; The type label corresponding to the largest probability value among the probability values ​​is determined as the designated result.

Images