An internet of things identity authentication method based on lightweight Falcon signature

Abstract

The application discloses an Internet of Things identity authentication method based on a lightweight Falcon signature, and the Internet of Things comprises a device, an edge gateway and a cloud platform, and comprises the following steps: initializing the device to generate a Falcon-512 key pair, performing sparse compression on the Falcon-512 key pair, and performing fragmented encryption storage; the Falcon-512 key pair comprises a private key sk and a public key pk; sending a registration request CSR to a cloud certificate authority CA through the device to obtain a device certificate Cert; collecting communication data Data through the device, calculating a hash value H(Data||Timestamp) of the communication data Data, wherein Timestamp is a time stamp; inputting the hash value H into an iterative FFT, mapping and storing the hash value H through a plurality of butterfly operations in the iterative FFT to obtain an intermediate result C in the FFT; wherein, based on the independence of the butterfly operation in the iterative FFT, a plurality of butterfly operations are processed in parallel through the SIMD instruction of the ARM Cortex-M processor; and a random integer z conforming to a discrete Gaussian distribution is generated through Gaussian sampling.

Description

Technical Field

[0001] This invention relates to the field of IoT identity authentication technology, and in particular to an IoT identity authentication method based on lightweight Falcon signatures. Background Technology

[0002] With the rapid development of Internet of Things (IoT) technology, more and more devices and systems are connected through networks, enabling real-time data collection, transmission, and processing. However, the widespread application of IoT has also brought serious security challenges, especially in data transmission and communication. Ensuring the confidentiality, integrity, and authenticity of information has become an urgent problem to be solved. Traditional identity authentication protocols now face two major challenges. First, they are vulnerable to the potential threats of quantum computing. Shor's algorithm is a quantum algorithm whose core is to solve number theory problems in polynomial time using quantum Fourier transform. Its time complexity is O(logN). 3 In the expression, N is the integer to be factored. However, Shor's algorithm is only effective for specific mathematical structures: integer factorization (based on the periodicity of multiplicative groups) and discrete logarithm problems (based on the isomorphism of cyclic groups). Therefore, Shor's algorithm cannot be directly applied to SIS / LWE problems in lattice cryptography, because these problems do not rely on number-theoretic group structures but are based on the geometric properties of high-dimensional lattices. Secondly, in resource-constrained environments, such as IoT devices with limited computing power and storage resources, traditional key management is complex and has high communication overhead. Therefore, the Falcon post-quantum signature algorithm, due to its short signature length, low computational overhead, and lattice-based security, has become an ideal choice for IoT. Despite its advantages of short signatures and resistance to quantum attacks, due to the resource-constrained nature of IoT devices and the complexity of network environments, the algorithm still needs to be optimized while ensuring security to further reduce memory and computational overhead, making it more suitable for the current IoT environment and achieving end-to-end authentication and data security. Summary of the Invention

[0003] The purpose of this invention is to provide an IoT identity authentication method based on lightweight Falcon signatures, so as to achieve lower response time and less memory usage when IoT devices perform identity authentication operations.

[0004] This invention provides an IoT identity authentication method based on lightweight Falcon signatures, wherein the IoT includes devices, edge gateways, and a cloud platform, comprising:

[0005] The device is initialized to generate a Falcon-512 key pair. The Falcon-512 key pair is then sparsely compressed and stored in fragmented encrypted form. The Falcon-512 key pair includes a private key sk and a public key pk.

[0006] The device sends a Registration Request (CSR) to the Cloud Certificate Authority (CA) to obtain a device certificate (Cert).

[0007] The device collects communication data Data, calculates the hash value H(Data||Timestamp) of the communication data Data, where Timestamp is a timestamp; inputs the hash value H into an iterative FFT, and maps and stores the hash value H through multiple butterfly operations in the iterative FFT to obtain the intermediate FFT result C; wherein, based on the independence of the butterfly operations in the iterative FFT, multiple butterfly operations are processed in parallel by the SIMD instructions of the ARM Cortex-M processor.

[0008] Generating random integer z that conforms to a discrete Gaussian distribution through Gaussian sampling includes: converting the probability density function ρ of the Gaussian distribution... σ (x)=exp(-x 2 / (2σ 2 The result is converted to a 15-bit fixed-point number for calculation, based on the probability density function ρ. σ (x) Generate multiple random integers z in batches using a random number generator, and simultaneously determine whether the multiple random integers z conform to a discrete Gaussian distribution using multiple comparators; where σ is the signature, x is a random variable, and exp is an exponential function;

[0009] The signature σ is generated through polynomial operations based on the Falcon-512 key pair, the intermediate FFT result C, and the random integer z. d Attach the message authentication code (MAC) and send the message {ID, Cert, Data, Timestamp, σ, MAC} to the edge gateway for edge authentication and extension;

[0010] The expanded message is sent to the cloud platform for aggregation and verification.

[0011] Furthermore, the initialization device generates a Falcon-512 key pair, performs sparse compression on the Falcon-512 key pair, and stores it in fragmented encrypted form, including:

[0012] The private key polynomial (f, g) and public key polynomial (F, G) are generated using a random algorithm, and then passed through the NTRU equation. Verification is performed, where q is a large prime number;

[0013] For private key polynomials Sparse compression is performed, and the non-zero coefficient values ​​are Huffman encoded and the position and value of the non-zero coefficients are recorded, where n is the degree of the polynomial and c is the coefficient of the i-th term in the polynomial.

[0014] The storage format of the compressed non-zero coefficient list is: Compressed(f) = {(pos1,c1),(pos2,c2),(pos3,c3),...}, where pos is the position of the i-th non-zero coefficient and c is the value of the i-th non-zero coefficient.

[0015] Furthermore, the device sends a Registration Request (CSR) to a Cloud Certificate Authority (CA) to obtain a device certificate (Certificate), including:

[0016] The device sends a Registration Request (CSR) to the Cloud Certificate Authority (CA), and the CSR includes: Device ID and Public Key pk.

[0017] The cloud certificate authority (CA) uses the Falcon-1024 root private key to sign the registration request (CSR) and generate a device certificate Cert = Sign_CA(Falcon-1024_sk, ID||pk).

[0018] Furthermore, the hash value H is input into an iterative FFT, and the hash value H is mapped and stored through multiple butterfly operations in the iterative FFT to obtain the intermediate FFT result C, including:

[0019] Converting the hash value into a polynomial form includes: dividing the hash value into multiple fixed-length blocks, and mapping each block to a finite field according to the modulus q to obtain a sequence of polynomial coefficients; wherein each block corresponds to the coefficients of the polynomial.

[0020] The coefficient sequence of the polynomial is rearranged in reverse order of the binary bits of the index. The butterfly operation is calculated layer by layer by iterative FFT. At each layer, the rotation factor is obtained from the pre-computation table to calculate the intermediate FFT result C. The intermediate FFT result C is stored using a memory reuse strategy. The memory reuse strategy is to use two arrays, work[] and temp[], to alternately store the intermediate FFT result C.

[0021] Furthermore, the probability density function ρ of the Gaussian distribution σ (x)=exp(-x 2 / (2σ 2 The result is converted to a 15-bit fixed-point number for calculation, based on the probability density function ρ. σ (x) Generate multiple random integers z in batches using a random number generator, and simultaneously determine whether the multiple random integers z conform to a discrete Gaussian distribution using multiple comparators, including:

[0022] The Gaussian probability density function ρ σ (x)=exp(-x 2 / (2σ 2 Mapped to a 15-bit fixed-point number, the probability calculation formula is adjusted to: ρ σ (x) fixed =round(ρ σ (x)×(2 15 )); where σ is the signature, x is a random variable, and exp is an exponential function;

[0023] Multiple random integers z∈[-kσ,kσ] are generated in batches using a random number generator, where k is the truncation parameter;

[0024] The probability values ​​ρ of multiple random integers z are calculated simultaneously using multiple comparators. σ (z) fixed and with random threshold u fixed Comparison, if u fixed ≤ρ σ (z) fixed Then, a random integer z is selected from the generated integers; where u fixed The range is [0, 2]. 15 A random integer of [-1].

[0025] Furthermore, a signature σ is generated through polynomial operations based on the Falcon-512 key pair, the intermediate FFT result C, and the random integer z. d Additional message authentication code (MAC), including:

[0026] Based on the private key polynomial f, the intermediate FFT result C, and the random integer z, generate the signature polynomial s = C·f + z mod(x). n +1);

[0027] The signature polynomial s is compressed to generate a short signature σ. d =Falcon.Sign(sk,H(Data||Timestamp)), and append the message authentication code MAC = Poly1305(K,msg), where K is the pre-shared symmetric key and Poly1305 is a message authentication code algorithm.

[0028] Furthermore, send a message {ID, Cert, Data, Timestamp, σ} d MAC addresses are used for edge authentication and extension to the edge gateway, including:

[0029] Verify whether the device certificate Cert is issued by a trusted cloud certificate authority CA by using the public key of the cloud certificate authority CA.

[0030] Verify signature σ using device public key pk d Does it match the hash value H?

[0031] The message is appended with an edge signature σ using the edge gateway's private key sk_edge. e =Falcon.Sign(sk,H(σ) d ||Edge_ID)) retrieves aggregated data and forwards it to the cloud platform;

[0032] The aggregated data includes: device certificate Cert, device ID, hash value H, signature σ, message authentication code MAC, and edge signature σ. e .

[0033] Furthermore, the cloud platform performs aggregated verification, including:

[0034] The gathering data is separated and reassembled according to the protocol format to obtain the message body. A pre-shared key is used to perform a Poly1305 operation on the message body to verify whether the message authentication code (MAC) matches the calculated MAC value.

[0035] Perform Falcon signature verification s1 = c - s2pk mod q. If the verification passes and the MAC matches, decrypt the aggregated data and store it.

[0036] The present invention has at least the following beneficial effects:

[0037] This invention provides an IoT identity authentication method based on lightweight Falcon signatures. In this scheme, the private key sk is compressed from 1KB to less than 800 bytes using a layered sparse compression technique, reducing memory overhead. By writing the private key sk into a security chip, such as a hardware security module (HSM) or a trusted platform module (TPM), physical attacks or malicious software theft are prevented, thereby improving security.

[0038] This solution replaces the recursive decomposition of the original algorithm with layer-by-layer iteration. Specifically, the FFT is divided into log2n layers, and the butterfly operation is calculated layer by layer. This reduces the memory usage from O(log n) for recursion to O(n), a 30% reduction. It avoids the overhead of the function call stack, thus making it suitable for resource-constrained devices, such as microcontrollers (MCUs) with only 2kb of RAM. Based on the independence of the butterfly operation, this solution introduces SIMD instructions from the ARM Cortex-M processor to enable multiple butterfly operations to be processed in parallel, thereby accelerating the conversion speed, improving the signature speed, and reducing the response time. This can improve the signature speed by up to 2-3 times.

[0039] In this scheme, the probability density function ρ σThe floating-point operations in (x) are converted to 15-bit fixed-point operations, which speeds up the operation, thereby speeding up the signature verification, reducing the response time, and reducing memory usage.

[0040] This solution utilizes a random number generator and multiple comparators, leveraging hardware to accelerate their operation and enable parallel execution. This allows for the simultaneous generation of multiple sampling instances during the Gaussian sampling phase, such as generating multiple random integer z values, thereby further accelerating signature verification and reducing response time.

[0041] The present invention will be further described below with reference to the accompanying drawings and specific embodiments. Attached Figure Description

[0042] Figure 1 This is a flowchart illustrating an IoT identity authentication method based on lightweight Falcon signatures provided by the present invention.

[0043] Figure 2 This is a schematic diagram illustrating the execution efficiency and various performance indicators of the present invention when performing 512-bit Falcon signature;

[0044] Figure 3 This is a comparison chart of the qubit cost consumed by the signature scheme of this invention and other post-quantum signature schemes in resisting quantum attacks. Detailed Implementation

[0045] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0046] In the description of this invention, it should be understood that the terms "upper", "lower", "front", "rear", "left", "right", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0047] Example 1: Combination Figures 1-3 This embodiment is described below.

[0048] This embodiment is an IoT identity authentication method based on lightweight Falcon signatures. The IoT includes devices, edge gateways, and a cloud platform, including:

[0049] The device is initialized to generate a Falcon-512 key pair. The Falcon-512 key pair is then sparsely compressed and stored in fragmented encrypted form. The Falcon-512 key pair includes a private key sk and a public key pk.

[0050] The device sends a Registration Request (CSR) to the Cloud Certificate Authority (CA) to obtain a device certificate (Cert).

[0051] The device collects communication data Data and calculates its hash value H (Data||Timestamp), where Timestamp is a timestamp. The hash value H is used to uniquely identify the data and ensure data integrity. The hash value H is input into an iterative FFT, and multiple butterfly operations within the iterative FFT map and store the hash value H to obtain an intermediate FFT result C. Based on the independence of the butterfly operations in the iterative FFT, multiple butterfly operations are processed in parallel using the SIMD instructions of the ARM Cortex-M processor.

[0052] Generating random integer z that conforms to a discrete Gaussian distribution through Gaussian sampling includes: converting the probability density function ρ of the Gaussian distribution... σ (x)=exp(-x 2 / (2σ 2 The result is converted to a 15-bit fixed-point number for calculation, based on the probability density function ρ. σ (x) Generate multiple random integers z in batches using a random number generator, and simultaneously determine whether the multiple random integers z conform to a discrete Gaussian distribution using multiple comparators; where σ is the signature, x is a random variable, and exp is an exponential function;

[0053] The signature σ is generated through polynomial operations based on the Falcon-512 key pair, the intermediate FFT result C, and the random integer z. d Attach the message authentication code (MAC) and send the message {ID, Cert, Data, Timestamp, σ, MAC} to the edge gateway for edge authentication and extension;

[0054] The expanded message is sent to the cloud platform for aggregation and verification.

[0055] When the device is manufactured, the device manufacturer will pre-configure the device's identity key. During device initialization, a Falcon-512 key pair will be generated, which includes a private key sk and a public key pk.

[0056] By compressing the private key sk using layered sparse compression technology, the private key sk is compressed from 1KB to less than 800 bytes, reducing memory overhead. By writing the private key sk into a security chip, such as a hardware security module (HSM) or a trusted platform module (TPM), physical attacks or malware theft are prevented, thereby improving security.

[0057] The device obtains its certificate (Certificate) by sending a registration request (CSR) to the Certificate Authority (CA) of the cloud platform.

[0058] The device collects sensor data (Data), appends a timestamp (Timestamp), and calculates a hash value (H): Hash = H(Data||Timestamp). The hash value H is then input into an iterative FFT to convert it into an intermediate FFT result (C). This solution replaces the recursive decomposition of the original algorithm with a layer-by-layer iterative approach. Specifically, the FFT is divided into log₂n layers, and butterfly operations are calculated layer by layer. This reduces memory usage from O(log₂n) for recursion to O(n), a 30% reduction. It avoids the overhead of the function call stack, thus adapting to resource-constrained devices, such as microcontrollers (MCUs) with only 2KB of RAM. Furthermore, based on the independence of butterfly operations, this solution introduces SIMD instructions from the ARM Cortex-M processor to enable parallel processing of multiple butterfly operations, thereby accelerating the conversion speed, improving signature speed, and reducing response time, potentially increasing signature speed by 2-3 times.

[0059] After the FFT transformation, the generated intermediate FFT result C is combined with a random integer z generated by Gaussian sampling and a Falcon-512 key pair to generate a signature σ through polynomial operations. d The probability density function ρ of the Gaussian distribution σ (x) is: ρ σ (x)=exp(-x 2 / (2σ 2 In this scheme, σ is the signature, x is a random variable, and exp is an exponential function. The probability density function ρ is used in this scheme. σ The floating-point operations in (x) are converted to 15-bit fixed-point operations, which speeds up the operation and thus the signature verification, reduces the response time, and decreases memory usage. The fixed-point number width is set to 16 bits, including 1 sign bit and 15 decimal bits. Then, based on the probability density function ρ... σ(x) Multiple random integers z are generated in batches using a random number generator, and multiple comparators are used to simultaneously determine whether the multiple random integers z conform to a discrete Gaussian distribution. By configuring the random number generator and multiple comparators, hardware can be used to accelerate their operation, enabling them to execute in parallel. This allows for the simultaneous generation of multiple sampling instances during the Gaussian sampling stage, such as generating multiple random integer z values ​​simultaneously, thereby further accelerating signature verification and reducing response time. For example, a dedicated random number generator module and a probability comparison logic array can be set up. The dedicated random number generator module integrates the random number generator circuit to support the simultaneous generation of multiple sets of random numbers. The probability comparison logic array parallelizes the table lookup (pre-calculated probability values) and comparison operations. Specifically, eight parallel sampling channels are deployed in the FPGA, each channel independently generating and comparing random integers z, increasing throughput by eight times.

[0060] After the signature is generated, a message authentication code (MAC) is appended, and a message {ID, Cert, Data, Timestamp, σ, MAC} is sent to the edge gateway for edge verification and extension. Upon receiving the message, the edge node verifies whether the device certificate Cert is issued by a trusted cloud certificate authority (CA) using the public key of the cloud CA, and verifies the signature σ using the device public key (PK). d To determine if the hash value H matches, an edge signature σ is appended to the message using the edge gateway's private key sk_edge. e =Falcon.Sign(sk,H(σ) d The aggregated data, obtained from the Edge_ID, is then forwarded to the cloud platform. The aggregated data includes: Device Certificate (Cert), Device ID, Hash Value (H), Signature (σ), Message Authentication Code (MAC), and Edge Signature (σ). e After receiving the gathering data, the cloud platform aggregates and verifies it. The gathering data is separated and reassembled according to the protocol format to obtain the message body. The pre-shared key is used to perform a Poly1305 operation on the message body to verify whether the message authentication code (MAC) matches the calculated MAC value. Falcon signature verification is performed: s1 = c - s2pk mod q. If the verification passes and the MAC matches, the aggregated data is decrypted and stored.

[0061] In practical use, the user sends a control command through the cloud platform. The cloud platform signs the command with the Falcon-1024 private key and then sends it to the edge node. The edge node verifies the cloud platform's signature, adds its local signature, and then forwards it to the target device. After the target device verifies the legality of the command signature, it executes the operation and returns an acknowledgment message, thus completing the closed-loop communication.

[0062] Furthermore, the initialization device generates a Falcon-512 key pair, performs sparse compression on the Falcon-512 key pair, and stores it in fragmented encrypted form, including:

[0063] The private key polynomial (f, g) and public key polynomial (F, G) are generated using a random algorithm, and then passed through the NTRU equation. The verification is performed, where q is a large prime number; if the NTRU equation does not hold during the verification process, the private key polynomial (f, g) and the public key polynomial (F, G) are regenerated.

[0064] For private key polynomials Sparsity compression is performed, and the non-zero coefficients are Huffman encoded and their positions and values ​​are recorded. Here, n is the degree of the polynomial, and c is the coefficient of the i-th term in the polynomial. Most coefficients in the polynomial are zero, with only a few being non-zero; for example, f(x) = 3x. 10 -2x 50 +5x 100 It has only 3 non-zero coefficients. Huffman coding of these non-zero coefficients reduces their storage space. Specifically, by analyzing the frequency of occurrence (e.g., the distribution of positive and negative numbers), short codes are assigned to high-frequency values, and long codes to low-frequency values, replacing the coefficients with their corresponding Huffman codes. By generating a polynomial that satisfies the NTRU equation and combining sparsity with Huffman coding optimization, the storage requirements of the Falcon-512 private key sk are significantly reduced.

[0065] The compressed list of non-zero coefficients is stored in the format: Compressed(f) = {(pos1,c1),(pos2,c2),(pos3,c3),...}, where pos is the position of the i-th non-zero coefficient and c is the value of the i-th non-zero coefficient. Only the position and value of the non-zero coefficients are recorded. For example, for a polynomial f(x) = 3x... 10 -2x 50 +5x 100 The compressed result is: {(10,3),(50,-2),(100,5)}.

[0066] Furthermore, the device sends a Registration Request (CSR) to a Cloud Certificate Authority (CA) to obtain a device certificate (Certificate), including:

[0067] The device sends a Registration Request (CSR) to the Cloud Certificate Authority (CA), and the CSR includes: Device ID and Public Key pk.

[0068] The cloud certificate authority (CA) uses the Falcon-1024 root private key to sign the registration request (CSR) and generate a device certificate Cert = Sign_CA(Falcon-1024_sk, ID||pk).

[0069] The device obtains a certificate Cert_dev issued by a CA, which contains the device ID, public key pk, and CA signature.

[0070] The device sends a Registration Request (CSR) to the cloud Certificate Authority (CA). The CSR includes the following information: device ID, public key (PK), and other metadata such as device type and production batch.

[0071] The cloud certificate authority (CA) uses its own Falcon-1024 root private key to sign the registration request (CSR) and generate a device certificate Cert = Sign_CA(Falcon-1024_sk, ID||pk). The certificate binds the device ID to the public key sk to ensure the authenticity of the public key sk in subsequent communications.

[0072] Furthermore, the hash value H is input into an iterative FFT, and the hash value H is mapped and stored through multiple butterfly operations in the iterative FFT to obtain the intermediate FFT result C, including:

[0073] Converting the hash value into a polynomial form includes: dividing the hash value into multiple fixed-length blocks, and mapping each block to a finite field according to the modulus q to obtain a sequence of polynomial coefficients; wherein each block corresponds to the coefficients of the polynomial.

[0074] The coefficient sequence of the polynomial is rearranged in reverse order of the binary bits of the index to avoid complex index calculations in recursion. The butterfly operation is calculated layer by layer by iterative FFT. At each layer, the rotation factor is obtained from the pre-computation table to calculate the intermediate FFT result C. The intermediate FFT result C is stored using a memory reuse strategy. The memory reuse strategy is to use two arrays, work[] and temp[], to alternately store the intermediate FFT result C.

[0075] The hash value H is input into an iterative FFT to convert it into an intermediate FFT result C. This scheme replaces the recursive decomposition of the original algorithm with layer-by-layer iteration. Specifically, the FFT is divided into log2n layers, and butterfly operations are calculated layer by layer, reducing the memory usage from O(log n) for recursion to O(n), a 30% reduction. This avoids the overhead of the function call stack, making it adaptable to resource-constrained devices, such as microcontrollers (MCUs) with only 2kb of RAM. Based on the independence of butterfly operations, this scheme pre-calculates the twiddle factor required for the FFT and caches it as a constant table in hardware registers, thereby reducing memory access latency and real-time computation, thus improving the speed of signature verification. By using a memory reuse strategy, only two arrays, work[] and temp[], are used alternately to store the intermediate FFT result C, avoiding frequent dynamic memory allocation. Simultaneously, by introducing SIMD instructions from the ARM Cortex-M processor, multiple butterfly operations are processed in parallel, accelerating the conversion speed and further improving the signature speed by up to 2-3 times.

[0076] Furthermore, multiple random integers z are generated in batches using a random number generator, and multiple comparators are used to simultaneously determine whether the multiple random integers z conform to a discrete Gaussian distribution, including:

[0077] The Gaussian probability density function ρ σ (x)=exp(-x 2 / (2σ 2 Mapped to a 15-bit fixed-point number, the probability calculation formula is adjusted to: ρ σ (x) fixed =round(ρ σ (x)×(2 15 )); where σ is the signature, x is a random variable, and exp is an exponential function;

[0078] Multiple random integers z∈[-kσ,kσ] are generated in batches using a random number generator, where k is the truncation parameter;

[0079] The probability values ​​ρ of multiple random integers z are calculated simultaneously using multiple comparators. σ (z) fixed and with random threshold u fixed Comparison, if u fixed ≤ρ σ (z) fixed Then, a random integer z is selected from the generated integers; where u fixed The range is [0, 2]. 15 A random integer of [-1].

[0080] After the FFT transformation, the generated intermediate FFT result C is combined with a random integer z generated by Gaussian sampling and a Falcon-512 key pair to generate a signature σ through polynomial operations. d The probability density function ρ of the Gaussian distribution σ (x) is: ρ σ (x)=exp(-x 2 / (2σ 2 In this scheme, σ is the signature, x is a random variable, and exp is an exponential function. The probability density function ρ is used in this scheme. σ The floating-point operations in (x) are converted to 15-bit fixed-point operations, which speeds up the operation and thus the signature verification process, while also reducing memory usage. The fixed-point number width is set to 16 bits, including 1 sign bit and 15 decimal bits. Then, the floating-point probability values ​​are mapped to the integer range [0, 2]. 15 -1], adjust the probability calculation formula to: ρ σ (x) fixed =round(ρ σ (x)×(2 15 Based on the adjusted probability density function ρ σ (x) Multiple random integers z are generated in batches using a random number generator, and multiple comparators are used to simultaneously determine whether the multiple random integers z conform to a discrete Gaussian distribution. By configuring the random number generator and multiple comparators, hardware can be used to accelerate their operation, allowing them to run in parallel. This enables the simultaneous generation of multiple sampling instances during the Gaussian sampling stage, such as generating multiple random integer z values ​​simultaneously, thereby further accelerating signature verification. For example, a dedicated random number generator module and a probability comparison logic array can be set up. The dedicated random number generator module integrates the random number generator circuit to support the simultaneous generation of multiple sets of random numbers. The probability comparison logic array parallelizes the table lookup (pre-calculated probability values) and comparison operations. Specifically, eight parallel sampling channels are deployed in the FPGA, each channel independently generating and comparing random integers z, increasing throughput by eight times. It is worth noting that in this solution, a probability value table for commonly used parameters (such as σ = 1.5) is pre-calculated. During runtime, the table is directly looked up to compare random numbers, thus avoiding the calculation of exponential functions, reducing real-time computation, and further accelerating signature verification.

[0081] Furthermore, a signature σ is generated through polynomial operations based on the Falcon-512 key pair, the intermediate FFT result C, and the random integer z. d Additional message authentication code (MAC), including:

[0082] Based on the private key polynomial f, the intermediate FFT result C, and the random integer z, generate the signature polynomial s = C·f + z mod(x). n +1);

[0083] The signature polynomial s is compressed to generate a short signature σ. d =Falcon.Sign(sk,H(Data||Timestamp)), and append the message authentication code MAC = Poly1305(K,msg), where K is the pre-shared symmetric key and Poly1305 is a message authentication code algorithm.

[0084] Furthermore, send a message {ID, Cert, Data, Timestamp, σ} d MAC addresses are used for edge authentication and extension to the edge gateway, including:

[0085] Verify whether the device certificate Cert is issued by a trusted cloud certificate authority CA by using the public key of the cloud certificate authority CA.

[0086] Verify signature σ using device public key pk d To verify the signature σ, the edge gateway extracts the public key pk from the device certificate Cert to check if the hash value H matches. d Check if it is valid; if not, signature verification will fail.

[0087] The message is appended with an edge signature σ using the edge gateway's private key sk_edge. e =Falcon.Sign(sk,H(σ) d ||Edge_ID)) retrieves aggregated data and forwards it to the cloud platform;

[0088] The aggregated data includes: device certificate Cert, device ID, hash value H, signature σ, message authentication code MAC, and edge signature σ. e .

[0089] Furthermore, the cloud platform performs aggregated verification, including:

[0090] The message is separated and reassembled according to the protocol format to obtain the message body. The pre-shared key is used to perform a Poly1305 operation on the message body to verify whether the message authentication code (MAC) matches the calculated message authentication code (MAC) value.

[0091] Perform Falcon signature verification s1 = c - s2pk mod q. If the verification passes and the MAC matches, decrypt the aggregated data and store it.

[0092] like Figure 2As shown, mean represents the average execution time across all runs; median represents the median execution time of the test function; stddev represents the standard deviation of the execution time of the test function; cv is the ratio of the standard deviation to the mean, representing the dispersion of the data; and Items per second (IPS) represents the number of requests or transactions processed per second, used to measure the system throughput. Using the IoT authentication method based on lightweight Falcon signatures provided by this invention, for generating a 512-bit signature, an average of over 2,000 signatures and over 44,000 verifications can be performed within 1 second. The verification phase exhibits the best performance, with the lowest average time, median time, and standard deviation, indicating that the execution time of the verification operation is very stable and fast, capable of processing a large number of requests per second. Simultaneously, the execution time of a single signature stage is relatively stable and fast, also capable of processing a large number of requests per second. Experimental results show that the optimized Falcon signature generation and verification time complexity is reduced, making it suitable for resource-constrained IoT devices.

[0093] like Figure 3 As shown, the Falcon algorithm has a significantly lower qubit cost compared to the post-quantum algorithm Dilithium in terms of resistance to quantum attacks. For example, according to analysis in the NIST PQC project, the Falcon algorithm requires fewer qubits to provide the same or higher level of security. Specifically, the post-quantum algorithm Dilithium requires approximately 158 qubits to break at a 128-bit security level, while Falcon requires approximately 230 qubits. Under attack, the Falcon algorithm's higher qubit cost compared to the post-quantum algorithm Dilithium improves the security of this method. Furthermore, the shorter public key and signature length of the Falcon algorithm make the lightweight Falcon signature-based IoT authentication method provided in this invention more advantageous for IoT device authentication.

[0094] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Terms such as "first," "second," etc., are used to denote names and do not indicate any particular order. The invention and its embodiments have been described above illustratively, and this description is not restrictive. The invention can be implemented in other specific forms without departing from its spirit or essential characteristics. The accompanying drawings are only one embodiment of the invention, and the actual structure is not limited thereto. No reference numerals in the claims should limit the scope of the claims. Therefore, if a person skilled in the art, inspired by this description, designs a similar structure and embodiment without departing from the spirit of the invention, such design should fall within the scope of protection of this patent.

Claims

1. A method for IoT identity authentication based on lightweight Falcon signature, the IoT comprising a device, an edge gateway and a cloud platform, characterized in that, Compressing and storing the Falcon-512 key pair generated by the device, including a private key sk and a public key pk, in a sparse compressed and encrypted fragmented manner; Sending a registration request CSR to a cloud certificate authority CA by the device to obtain a device certificate Cert; Collecting communication data Data by the device, calculating a hash value H(Data||Timestamp) of the communication data Data, where Timestamp is a time stamp, inputting the hash value H into an iterative FFT, mapping and storing the hash value H through multiple butterfly operations in the iterative FFT to obtain an FFT intermediate result C, and processing the multiple butterfly operations in parallel through a SIMD instruction of an ARM Cortex-M processor based on the independence of the butterfly operations in the iterative FFT; Sending the extended message to the cloud platform for aggregation verification. Generating a random integer z conforming to a discrete Gaussian distribution through Gaussian sampling, comprising: converting a probability density function p σ (x) of the Gaussian distribution into a 15-bit fixed-point number for calculation, the probability density function p 2 (x) being exp(-x 2 / (2σ 2 )) Generating a plurality of random integers z in batches through a random number generator based on the probability density function p σ (x), and simultaneously judging whether the plurality of random integers z conform to a discrete Gaussian distribution through a plurality of comparators; wherein σ is a signature, x is a random variable, and exp is an exponential function. The signature σ is generated by polynomial operation based on Falcon-512 key pair, FFT intermediate result C and random integer z d , an additional message authentication code MAC, and sends the message {ID, Cert, Data, Timestamp, σ, MAC} to the edge gateway for edge verification and expansion; Compressing and storing the Falcon-512 key pair generated by the device, including a private key sk and a public key pk, in a sparse compressed and encrypted fragmented manner, including: 2.The IoT identity authentication method based on lightweight Falcon signature of claim 1, wherein, The storage format of the compressed non-zero coefficient list is: Compressed(f)={(pos1,c1),(pos2,c2),(pos3,c3),...}, where pos is the position of the i-th non-zero coefficient, and c is the value of the i-th non-zero coefficient. A random algorithm is used to generate a private key polynomial (f,g) and a public key polynomial (F,G), and the NTRU equation is verified, where q is a large prime number; Sparse private key polynomial Sparse compression is performed, and the non-zero coefficient values are Huffman coded and the position and value of the non-zero coefficients are recorded, where n is the degree of the polynomial and c is the coefficient of the i-th term in the polynomial. Sending a registration request CSR to a cloud certificate authority CA by the device to obtain a device certificate Cert, including: 3.The IoT identity authentication method based on lightweight Falcon signature of claim 2, wherein, Sending a registration request CSR to a cloud certificate authority CA by the device, wherein the registration request CSR contains a device ID and a public key pk; The cloud certificate authority CA signs the registration request CSR using a Falcon-1024 root private key to generate a device certificate Cert=Sign_CA(Falcon-1024_sk,ID||pk).

4. The Internet of Things identity authentication method based on lightweight Falcon signature according to claim 3, characterized in that: Inputting the hash value H into an iterative FFT, mapping and storing the hash value H through multiple butterfly operations in the iterative FFT to obtain an FFT intermediate result C, including: Converting the hash value into a polynomial form, including dividing the hash value into multiple fixed-length blocks, mapping each block to a finite field according to a modulus q to obtain a coefficient sequence of the polynomial; wherein each block corresponds to a coefficient of the polynomial; Rearranging the coefficient sequence of the polynomial in the reverse order of the binary bits of the index, calculating the butterfly operation layer by layer through the iterative FFT, obtaining the FFT intermediate result C from a pre-computed table at each layer, and storing the FFT intermediate result C using a memory reuse strategy; the memory reuse strategy is to use two arrays work[] and temp[] to store the FFT intermediate result C alternately. Generating multiple generated random integers z∈[-kσ,kσ] in batches through a random number generator, where k is a truncation parameter; 5. The lightweight Falcon signature-based IoT identity authentication method of claim 4, wherein, The probability density function ρ of the Gaussian distribution σ (x)=exp(-x 2 / (2σ 2 The result is converted to a 15-bit fixed-point number for calculation, based on the probability density function ρ. σ (x) Generate multiple random integers z in batches using a random number generator, and simultaneously determine whether the multiple random integers z conform to a discrete Gaussian distribution using multiple comparators, including: A Gaussian probability density function p σ (x) = exp(-x 2 / (2σ 2 )) is mapped to a 15-bit fixed point number, and the probability calculation formula is adjusted as follows: p σ (x) fixed = round(p σ (x) * (2 15 )); where s is a signature, x is a random variable, and exp is an exponential function. ​ Simultaneously calculating probability values ρ of multiple random integers z by multiple comparators σ (z) fixed and comparing with a random threshold u fixed , if u fixed ≤ ρ σ (z) fixed , then the generated random integer z is selected; wherein u fixed represents a random integer in the range [0, 2 15 -1].

6. The lightweight Falcon signature-based Internet of Things identity authentication method according to claim 5, characterized in that, The signature σ is generated by polynomial operations based on the Falcon-512 key pair, the FFT intermediate result C, and a random integer z d , an additional message authentication code MAC, comprising: Based on the private key polynomial f, the FFT intermediate result C and the random integer z, a signature polynomial s = C f + z mod (x n +1); compressing the signature polynomial s to generate a short signature σ d = Falcon. Sign(sk, H(Data || Timestamp)), and attach the message authentication code MAC = Poly1305(K, msg), where K is a pre-shared symmetric key and Poly1305 is a message authentication code algorithm.

7. The lightweight Falcon signature-based Internet of Things identity authentication method according to claim 6, characterized in that, Send a packet {ID, Cert, Data, Timestamp, σ d , MAC} to the edge gateway for edge verification and extension, including: verify whether the device certificate Cert is issued by a trusted cloud certificate authority CA through the public key of the cloud certificate authority CA; Verify signature σ by device public key pk d Whether the hash value H matches; appending edge signature σ to the packet using edge gateway private key sk_edge e = Falcon. Sign(sk, H(σ d ||Edge_ID)) to get aggregated data and forward to cloud platform; The aggregated data includes: a device certificate Cert, a device ID, a hash value H, a signature σ, a message authentication code MAC, and an edge signature σ e .

8. The lightweight Falcon signature-based Internet of Things identity authentication method according to claim 7, characterized in that, the cloud platform performs aggregation verification, comprising: separating the aggregation data and recombining the aggregation data into a message body according to a protocol format, performing Poly1305 operation on the message body using a pre-shared key to verify whether the message authentication code MAC matches the calculated message authentication code MAC value; performing Falcon signature verification s1 = c-s2pk mod q, if the verification is passed and the MAC matches, decrypt the aggregation data and store.

Images