5G terminal security access authentication method based on LR
By applying a logistic regression algorithm in 5G terminal secure access authentication, channel characteristics are mined to judge the credibility of communication nodes, the high overhead, low efficiency and easy-to-solve problems of secure access authentication in the prior art are solved, and more efficient and secure 5G terminal access authentication is achieved.
Patent Information
- Application Number
- CN202411962195.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-30
- Publication Date
- 2025-04-25
AI Technical Summary
The existing 5G terminal secure access authentication methods have problems such as high certification overhead, low efficiency and easy to be cracked, especially in security-sensitive industries such as power plants.
Using a machine learning algorithm based on logistic regression (LR) to mine invariants and depth features in the channel characteristics of 5G terminals, train channel feature vectors, and judge the credibility of communication nodes, thereby realizing secure access authentication.
It improves the security of 5G terminal access, reduces system resource consumption and communication delay, enhances its resistance to malicious attacks, and is suitable for security authentication of large-scale 5G terminals.
Smart Images
Figure BDA0005217453160000021 
Figure BDA0005217453160000022 
Figure BDA0005217453160000051
Abstract
Description
Technical Field
[0001] The present invention relates to the field of communication technologies, and in particular to a 5G terminal secure access authentication method based on LR. Background Art
[0002] As 5G technology continues to mature, more and more 5G terminals are used as wireless connection devices in the production links of power plants and other industries. However, the production links of power plants and other industries are extremely sensitive to network security and information security. When a large number of 5G terminals are connected to the network at the same time, network security becomes an important issue. At present, more upper-layer protocols are used for security authentication, including the terminal pre-implanting the security key of the identity ID or obtaining access permission by interacting with the authentication platform after the terminal is connected. Similar to the traditional authentication method, authenticating each terminal one by one will not only make the authentication overhead too large and the network unbearable, but also its authentication efficiency is unsatisfactory. In addition, the openness of the network brings a large number of access requests and authentication requests, and also generates a large number of complex user rights management issues. The use of traditional security authentication and intrusion detection technology products is no longer enough to reassure users. Therefore, the research on the new generation of secure access technology is particularly important.
[0003] The wireless fading channels transmitted by 5G and other IoT technologies have characteristics such as time-varying, uniqueness, and location heterogeneity. The physical layer information of each terminal is similar to the user's "fingerprint", which is unique and cannot be cloned. We can design algorithms to deeply explore the characteristics of wireless channel information to detect the legitimacy of the current communication equipment. Although the environment will cause changes in the channel, the channel characteristics also contain unchanging characteristics (including large-scale fading factors, signal arrival time, etc.). Channel characteristics have frequency correlation. The correlation of different frequency points is a natural attribute of channel characteristics, and the channel fading experienced by signals sent at different times also has a correlation within the channel correlation distance. However, the current existing technologies all perform security authentication by transmitting keys. The security solution of this method will consume a lot of system resources and increase communication delays; it is also easy to be cracked by malicious attackers with stronger computing power. Summary of the invention
[0004] Therefore, the purpose of the present invention is to provide a 5G terminal security access authentication method based on LR, which uses popular machine learning algorithms to mine invariants in channel characteristics and deep features in channel characteristics, and uses channel characteristics as samples for training to obtain channel feature vectors to determine whether a communication node is a trusted node; to make up for the shortcomings of traditional authentication methods, improve 5G terminal access security, and provide security technical guarantees for the widespread application of 5G terminals in industries such as electricity.
[0005] In order to achieve the above object, a 5G terminal secure access authentication method based on LR of the present invention comprises the following steps:
[0006] S1. Obtaining behavior data with channel characteristics generated when illegal signals and legal signals are transmitted between the 5G terminal and the network as a data set;
[0007] S2. Input the data set into the trained logistic regression model, and use the logistic regression model to extract deep features in the channel; determine whether the behavioral data information of the access terminal is legal;
[0008] S3. The behavior data information of illegal access terminals is marked and isolated through alarm, and legal signals and communication nodes are transmitted.
[0009] Further preferably, the behavioral data with channel characteristics includes all additional information when interactive behavior occurs between the 5G terminal and the network, including: timestamp of the behavior, geographic location, device type, network type, channel quality indicators including: signal strength, bit error rate, signal-to-noise ratio, delay, jitter, packet loss rate, application usage, interactive actions, content consumption, transaction behavior, feedback and evaluation, social interaction, and advertising response.
[0010] Further preferably, the logistic regression model uses a Sigmoid function to process the nonlinear relationship between the independent variable behavior data x and the dependent variable authentication result y;
[0011] The Sigmoid function can be expressed as:
[0012]
[0013] Where z = w T x+b is a linear combination of sample features and weights.
[0014] Further preferably, the logistic regression model further includes establishing a cost function according to the following formula:
[0015]
[0016] Where i is the number of the current dependent variable and m is the total number of dependent variables.
[0017] Further preferably, the method also includes using a grid search method to solve the optimal model parameters, adjusting the parameters in sequence according to the step size within the specified parameter range, training the learner using the adjusted parameters, finding the parameters with the highest accuracy on the validation set from all the parameters, and trying each possibility among all the candidate parameter selections through a loop traversal to finally select the optimal solution for the model.
[0018] Further preferably, in S3, the marking and alarming of the behavior data information of the illegal access terminal includes: assigning a risk score to each detected event, and determining whether to take action according to the risk level of the event;
[0019] Set different alarm levels according to the risk level of the incident to ensure that key issues can be responded to in a timely manner;
[0020] For low-risk events, isolate suspicious devices or users from the main network and restrict their access rights;
[0021] For medium-risk events, fine-grained access control can be implemented for specific applications or services to block requests from unsafe signals.
[0022] For high-risk incidents, in extreme cases, the suspicious device can be physically disconnected to prevent it from further affecting the network.
[0023] It is further preferred to implement the above-mentioned LR-based 5G terminal secure access authentication method.
[0024] The present invention also provides an electronic device, comprising:
[0025] a memory storing computer program instructions;
[0026] A processor, when the computer program instructions are executed by the processor, implements the steps of the above-mentioned LR-based 5G terminal security access authentication method.
[0027] The present invention also provides a computer-readable storage medium, which is used to store instructions. When the stored instructions are executed on a computer, the computer executes the steps of the above-mentioned LR-based 5G terminal security access authentication method.
[0028] The LR-based 5G terminal security access authentication method and system disclosed in this application adopts a machine learning algorithm to mine the invariants in channel characteristics. Machine learning has strong generalization ability and can extract the same type of features in the data set. The same type of channel features are classified to determine whether the communicating parties are trustworthy or untrustworthy. Among them, the logistic regression algorithm is one of the most classic machine learning algorithms. It has very small calculation amount during classification, fast speed, low storage resources, easy to understand and implement, and is very suitable for algorithm implementation of security authentication of multi-device access in the Internet of Things. Through the deep features in the channel characteristics, the channel features are used as samples for training, and the channel feature vector is obtained through training to determine whether the communication node is a trusted node. It is convenient and quick to apply to batch authentication of large amounts of data.
[0029] The uniqueness of the 5G uplink and downlink channels is selected as the basis for judging the legitimacy of channel transmission. It has strong randomness and is not easy to be cracked, which solves the problem of secure access of 5G terminals in the application of safe production industry.
[0030] The LR model in machine learning is used for data training sample data. The LR model has low computational cost and is easy to understand and implement. LR has low time and memory requirements and low implementation cost. BRIEF DESCRIPTION OF THE DRAWINGS
[0031] Figure 1 The figure is a flow chart of the LR-based 5G terminal security access authentication method of the present invention. DETAILED DESCRIPTION
[0032] The present invention is further described in detail below through the accompanying drawings and specific embodiments.
[0033] As shown in the figure, an embodiment of an aspect of the present invention provides a LR-based 5G terminal secure access authentication method, comprising the following steps:
[0034] S1. Obtain the behavioral data with channel characteristics generated when illegal signals and legal signals are transmitted between the 5G terminal and the network as a data set; the behavioral data with channel characteristics includes all additional information when the interactive behavior occurs between the 5G terminal and the network, including: the timestamp of the behavior, geographic location, device type, network type, channel quality indicators including: signal strength, bit error rate, signal-to-noise ratio, delay, jitter, packet loss rate, application usage, interactive actions, content consumption, transaction behavior, feedback and evaluation, social interaction, and advertising response.
[0035] S2. Input the data set into the trained logistic regression model, and use the logistic regression model to extract deep features in the channel; determine whether the behavioral data information of the access terminal is legal;
[0036] S3. The behavior data information of illegal access terminals is marked and isolated through alarm, and legal signals and communication nodes are transmitted.
[0037] Further preferably, logistic regression is a machine learning method for solving binary classification problems, which is used to estimate the possibility of something. Logistic regression is one of the generalized linear models. This model solves the binary classification problem by assuming that the dependent variable y follows a Bernoulli distribution, and that there is a linear relationship between the independent variable x and the dependent variable y, and using the Sigmoid function to process nonlinear data. The logistic regression model uses the Sigmoid function to process the nonlinear relationship between the independent variable behavior data x and the dependent variable authentication result y;
[0038] The Sigmoid function can be expressed as:
[0039]
[0040] Where z = w T x+b is a linear combination of sample features and weights.
[0041] The logistic regression model also includes establishing a cost function according to the following formula:
[0042]
[0043] Where i is the current dependent variable number, and m is the total number of dependent variables. Substituting the sample into the cost function, we can calculate the deviation between the measured value and the predicted value of the sample. If the deviation from the predicted value is greater than 0, it is considered a positive sample, that is, safe access data. If the deviation from the predicted value is ≤0, the sample is considered a negative sample, and the access data is unsafe access data.
[0044] Further preferably, the method also includes using a grid search method to solve the optimal model parameters, adjusting the parameters in sequence according to the step size within the specified parameter range, training the learner using the adjusted parameters, finding the parameters with the highest accuracy on the validation set from all the parameters, and trying each possibility among all the candidate parameter selections through a loop traversal to finally select the optimal solution for the model.
[0045] It should be noted that in S3, the marking of the behavior data information of the illegal access terminal and the alarm isolation include: assigning a risk score to each detected event, and determining whether to take action according to the risk level of the event;
[0046] Set different alarm levels according to the risk level of the incident to ensure that key issues can be responded to in a timely manner;
[0047] For low-risk events, isolate suspicious devices or users from the main network and restrict their access rights;
[0048] For medium-risk events, fine-grained access control can be implemented for specific applications or services to block requests from unsafe signals.
[0049] For high-risk incidents, in extreme cases, the suspicious device can be physically disconnected to prevent it from further affecting the network.
[0050] It is further preferred to implement the above-mentioned LR-based 5G terminal secure access authentication method.
[0051] The present invention also provides an electronic device, comprising:
[0052] a memory storing computer program instructions;
[0053] A processor, when the computer program instructions are executed by the processor, implements the steps of the above-mentioned LR-based 5G terminal security access authentication method.
[0054] The present invention also provides a computer-readable storage medium, which is used to store instructions. When the stored instructions are executed on a computer, the computer executes the steps of the above-mentioned LR-based 5G terminal security access authentication method.
[0055] When implementing this application, the behavior data information of illegal access terminals is marked and alarmed and isolated. The following process can be adopted:
[0056] 1. Real-time monitoring and detection
[0057] Intrusion Detection System (IDS) / Intrusion Prevention System (IPS): IDS / IPS are deployed to monitor network traffic in real time and identify abnormal behavior or known attack patterns. These systems can work based on signatures, anomaly detection, or machine learning algorithms.
[0058] Channel quality monitoring: Continuously monitor channel quality indicators (such as RSSI, BER, SNR, etc.) and trigger alarms when these indicators fall below set thresholds.
[0059] Behavioral analytics: User and entity behavioral analytics (UEBA) technology is used to detect abnormal activities by analyzing user behavior patterns, such as unusual login time, geographic location, or access frequency.
[0060] 2. Risk assessment and scoring
[0061] Risk Scoring System: Assigns a risk score to each detected event to determine whether action is required based on the severity and possible impact of the event.
[0062] Context-aware: Combines contextual information (e.g., time, location, device type) and historical data to more accurately assess risk levels.
[0063] 3. Alarm mechanism
[0064] Automated alarm: Once an unsafe signal or high-risk event is detected, an automatic alarm is triggered immediately. The alarm can be sent through multiple channels, such as SMS, email, system notification, etc.
[0065] Gradual alarm: Set different alarm levels according to the risk level of the event to ensure that key issues can be responded to in a timely manner.
[0066] Visual dashboard: Provides a centralized dashboard that displays all alerts and related details, helping administrators quickly understand the current security status.
[0067] 4. Isolation measures
[0068] Network isolation: Isolate suspicious devices or users from the main network and limit their access rights. This can be achieved by configuring firewall rules, VLAN segmentation, or dedicated demilitarized zone (DMZ).
[0069] Application layer isolation: For specific applications or services, fine-grained access controls can be implemented to block requests from unsafe signals, for example, using an API gateway or a web application firewall (WAF).
[0070] Physical isolation: In extreme cases, the suspicious device can be physically disconnected to prevent it from further affecting the network.
[0071] 5. Emergency Response
[0072] Predefined response plan: Develop a detailed emergency response plan that specifies the specific steps to be taken in the event of a security incident, including a list of contacts, communication processes, and recovery strategies.
[0073] Automated response: Configure automation tools to automatically execute predetermined response actions when unsafe signals are detected, such as disconnecting, resetting passwords, or launching backup systems.
[0074] Manual intervention: For complex or uncertain situations, a professional security team is assigned to conduct manual review and processing.
[0075] 6. Logging and Auditing
[0076] Detailed logs: Ensure that all security incidents and response actions are fully recorded for subsequent analysis and auditing.
[0077] Log analysis: Regularly review log files to look for potential security breaches or undetected threats.
[0078] Compliance check: Ensure that all security measures comply with relevant laws, regulations and industry standards.
[0079] 7. Feedback and Improvement
[0080] Performance Evaluation: Regularly evaluate the performance of alarm and isolation systems to identify and resolve any problems.
[0081] Update rules and models: Continuously update detection rules and machine learning models based on the latest threat intelligence and technology developments to maintain the effectiveness and accuracy of the system.
[0082] User training: Provide security awareness training to relevant personnel to improve their ability to identify and respond to security threats.
[0083] Example 1: Dynamic Isolation in 5G Networks
[0084] In the 5G network environment, network slicing technology and software-defined networking (SDN) can be used to dynamically isolate unsafe terminals. For example, when a terminal's channel quality is detected to drop sharply or exhibit abnormal behavior, the SDN controller can assign it to an isolated network slice according to a preset policy, limiting its access to other resources.
[0085] Example 2: Multi-layered protection of enterprise internal network
[0086] In an enterprise internal network, multiple layers of protection mechanisms can be deployed, including perimeter firewalls, internal network segmentation, endpoint protection, and application-level protection. When an unsafe signal is detected, an alarm is triggered first, and then corresponding isolation measures are taken based on the risk assessment results, such as restricting access to specific IP addresses or disconnecting problematic devices.
[0087] Through the above method, unsafe signals can be effectively alarmed and isolated, thereby protecting the security of the network and system while minimizing the impact on legitimate users and services.
[0088] Obviously, the above embodiments are only examples for clear explanation, and are not intended to limit the implementation methods. For ordinary technicians in the relevant field, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived from them are still within the protection scope of the invention.
Claims
1. A 5G terminal secure access authentication method based on LR, characterized in that: The following steps are involved: S1. Obtaining behavior data with channel characteristics generated when illegal signals and legal signals are transmitted between the 5G terminal and the network as a data set; S2. Input the data set into the trained logistic regression model, and use the logistic regression model to extract deep features in the channel; Determine whether the behavioral data information of the access terminal is legal; S3. The behavior data information of illegal access terminals is marked and isolated through alarm, and legal signals and communication nodes are transmitted.
2. The LR-based 5G terminal secure access authentication method according to claim 1, characterized in that: The behavioral data with channel characteristics includes all additional information when interactive behaviors occur between 5G terminals and the network, including: timestamp of the behavior, geographic location, device type, network type, channel quality indicators including: signal strength, bit error rate, signal-to-noise ratio, delay, jitter, packet loss rate, application usage, interactive actions, content consumption, transaction behavior, feedback and evaluation, social interaction, and advertising response.
3. The LR-based 5G terminal secure access authentication method according to claim 1, characterized in that: The logistic regression model uses the Sigmoid function to process the nonlinear relationship between the independent variable behavior data x and the dependent variable authentication result y; The Sigmoid function can be expressed as: Where z = w T x+b is a linear combination of sample features and weights.
4. The LR-based 5G terminal secure access authentication method according to claim 1, characterized in that: The logistic regression model also includes establishing a cost function according to the following formula: Where i is the number of the current dependent variable and m is the total number of dependent variables.
5. The LR-based 5G terminal secure access authentication method according to claim 1, characterized in that: It also includes using the grid search method to solve the optimal model parameters, adjusting the parameters in steps within the specified parameter range, training the learner with the adjusted parameters, finding the parameters with the highest accuracy on the validation set from all the parameters, and traversing all the candidate parameter choices in a loop to try every possibility and finally select the optimal solution for the model.
6. The LR-based 5G terminal secure access authentication method according to claim 1, characterized in that: In S3, the behavior data information of illegal access terminals is marked and alarmed and isolated, including: assigning a risk score to each detected event, and determining whether action is required based on the risk level of the event; Set different alarm levels according to the risk level of the incident to ensure that key issues can be responded to in a timely manner; For low-risk events, isolate suspicious devices or users from the main network and restrict their access rights; For medium-risk events, fine-grained access control can be implemented for specific applications or services to block requests from unsafe signals. For high-risk incidents, in extreme cases, the suspicious device can be physically disconnected to prevent it from further affecting the network.
7. The LR-based 5G terminal secure access authentication system according to claim 1, characterized in that: Used to implement the LR-based 5G terminal security access authentication method described in any one of claims 1-6 above.
8. An electronic device, characterized in that: include: a memory storing computer program instructions; A processor, when the computer program instructions are executed by the processor, implements the steps of the LR-based 5G terminal security access authentication method as described in any one of claims 1 to 6.
9. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store instructions. When the stored instructions are executed on a computer, the computer executes the steps of the LR-based 5G terminal secure access authentication method as described in any one of claims 1 to 6.