An online learning-based internet of things device identity authentication method

Abstract

The application provides an online learning-based Internet of Things device identity authentication method, and belongs to the technical field of Internet of Things devices. The application realizes the whole life cycle management of heterogeneous devices through a unified identity authentication framework, eliminates the differences between multiple protocols, fuses physical unclonable (PUF) and lightweight encryption technology, constructs hardware-level security protection, resists side channel attacks, establishes a decentralized cross-domain trust chain based on a blockchain distributed identity (DID) and zero-knowledge proof, and realizes identity change full-process auditability. Finally, a safe closed loop of device trusted access, data tamper-proofing and operation traceability is formed, and the risk resistance and compliance of the Internet of Things terminal in a complex scene are greatly improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet of Things, and in particular to an Internet of Things device identity authentication method based on online learning. BACKGROUND

[0002] The existing Internet of Things device identity authentication method has the following problems:

[0003] 1. Authentication efficiency and security conflict in resource-constrained scenarios:

[0004] The computing power, storage and power of Internet of Things devices (such as sensors and low-power terminals) are limited, and the computing overhead (such as RSA encryption and certificate chain verification) of traditional PKI (Public Key Infrastructure) or dynamic token authentication is difficult to bear, resulting in authentication delay or excessive energy consumption.

[0005] 2. Lack of unified identity management for large-scale heterogeneous devices:

[0006] Internet of Things device manufacturers' protocols are not unified (such as MQTT, CoAP, LoRaWAN), authentication mechanisms are fragmented, cross-platform interoperability is poor, and global identity verification is difficult to achieve.

[0007] 3. Insufficient physical layer security and anti-side channel attack capability:

[0008] Internet of Things devices are easily physically contacted (such as being deployed in public places), and attackers can extract keys or tamper with firmware through side channel attacks (power analysis, electromagnetic radiation).

[0009] 4. Difficulty in tracing trusted identity in decentralized scenarios:

[0010] In edge computing or Ad-hoc networks without central server support, two-way authentication between devices relies on third-party CA, which has the risk of single point of failure and trust chain breakage.

[0011] Therefore, there is an urgent need in the art for a technical solution that can solve the problems existing in the existing Internet of Things device identity authentication method.

[0012] The information disclosed in this BACKGROUND section is only intended to increase an understanding of the general context of the present application and is not to be taken in any way as an acknowledgment or any form of suggestion that this information forms prior art that is already known in the art. SUMMARY

[0013] The purpose of the present application is to provide a technical solution that can solve the problems existing in the existing Internet of Things device identity authentication method.

[0014] To achieve the above-mentioned purpose, the present application provides the following solutions:

[0015] An online learning-based Internet of Things device identity authentication method, comprising:

[0016] Real-time acquisition of device physical layer signal characteristics, communication protocol characteristics and behavior pattern characteristics, construction of high-dimensional spatiotemporal feature tensor;

[0017] Sliding window-based mutual information entropy weight evaluation, dynamic elimination of redundant features, and adoption of streaming t-SNE algorithm to compress feature dimensions to an interpretable low-dimensional space;

[0018] Design of a dual-channel LSTM-GAN network, with the generator simulating the legitimate device feature distribution and the discriminator dynamically updating weights through adversarial training, combined with Focal Loss function to optimize the class imbalance problem;

[0019] Based on the KL divergence, the real-time feature distribution offset is calculated, and the authentication threshold is dynamically adjusted to trigger the model parameter recalibration;

[0020] Utilize blockchain technology to store misjudgment samples, and update the model through the differential privacy protected data back mechanism;

[0021] Develop custom scripts to automatically detect whether the node meets the NVIDIA GPU driver version requirements and verify CUDAToolkit compatibility, outputting a JSON format report;

[0022] Inject dynamic device discovery rules in containerd or Docker configuration files;

[0023] Deploy NFD definition rules to identify GPU models and automatically add labels for subsequent Exporter targeted deployment;

[0024] Based on the NVIDIA DCGM library, build a cross-platform Exporter image, integrate the Prometheus client library and enable the encryption communication module;

[0025] Design a dynamic resource request strategy to automatically adjust the CPU / Memory request of the Exporter Pod according to the number of node GPUs;

[0026] Bind the GPU UUID in the Exporter configuration to collect data independently for each device, avoiding confusion of multi-card node indicators;

[0027] Automatic issuance of Exporter server certificates;

[0028] Local cache persistent storage on the node;

[0029] Custom development of Exporter heartbeat probes;

[0030] Restrict the access of the Exporter service to only the Prometheus Server IP segment through NetworkPolicy, and enable mutual mTLS authentication;

[0031] Write a custom ServiceMonitor resource to dynamically identify the Exporter endpoint based on node labels, and configure the scraping interval;

[0032] Embed node information in the Exporter, and enhance data analysis dimensions through info-type metrics;

[0033] Precompute key metrics in Prometheus Recording Rules to reduce real-time query overhead;

[0034] Dynamically adjust the sampling rate of node-level metrics, develop a dynamic configuration API for the Exporter, and automatically switch the sampling frequency based on GPU load;

[0035] Synchronize abnormal detection rules in a federation;

[0036] Gradually upgrade the version of the node Exporter;

[0037] Store GPU metrics in a hot and cold hierarchy, configure VictoriaMetrics parameters, migrate historical data to object storage, and reduce local storage costs;

[0038] Verify the integrity of node monitoring data, develop a regular inspection task, compare the output of GPU memory usage, and trigger an alarm when the deviation is ≥3%;

[0039] Limit maximum memory usage and configure OOM Killer priority policy;

[0040] Push Exporter access logs to Elasticsearch and associate them with Kubernetes audit events to generate compliance reports.

[0041] Introduce lightweight encryption algorithms to achieve low-computation and high-security key exchange and signature verification on the device side, reducing CPU and memory consumption;

[0042] Design a dynamic credential hierarchy mechanism to divide the authentication process into device-level and gateway-level, balancing security and resource usage;

[0043] Generate a unique identity using device hardware features to avoid key storage requirements and improve resistance to physical attacks;

[0044] Develop cross-protocol adaptation middleware to support unified registration and authentication interfaces for devices supporting MQTT, CoAP, and LoRaWAN protocols, and to mask differences between heterogeneous networks;

[0045] Implementing a blockchain-based distributed identity system, assigning each device a globally unique DID, and enabling cross-platform identity recognition and permission synchronization through smart contracts.

[0046] Establishing a dynamic device attribute label library, automatically collecting device types, manufacturers, and firmware versions, and supporting dynamic adjustment of authentication policies based on labels.

[0047] Deploying a consortium chain combined with zero-knowledge proof, recording device operation records on-chain, and hiding sensitive data when verifying identity validity through ZKP, ensuring privacy and traceability.

[0048] Building a decentralized identity consortium network, with multiple organization nodes jointly maintaining the identity ledger, supporting cross-domain identity query and verification, and avoiding single-point trust risks.

[0049] Designing a lightweight PKI certificate chain optimization scheme, using certificate revocation list compression technology to reduce communication and computation overhead during certificate verification.

[0050] Implementing a cross-chain identity interoperability protocol, supporting identity mapping and trust transfer between different blockchain networks, and expanding application scope.

[0051] Optionally, automatically deploy the Exporter component on each GPU node through the DaemonSet controller to ensure full coverage of all node monitoring.

[0052] Optionally, integrate the NVIDIA GPU Feature Discovery (GFD) component to dynamically identify GPU models, driver versions, and computing capabilities.

[0053] Optionally, configure the ServiceMonitor resource object to define rules for Prometheus to automatically discover Exporter services.

[0054] Optionally, set alarm rules based on GPU memory utilization indicators, triggering AlertManager notifications when the threshold exceeds 80%.

[0055] Optionally, build a multi-dimensional Dashboard using Grafana to visualize node GPU computing power load, GPU memory occupancy rate, and temperature historical trends.

[0056] Optionally, use the Prometheus Operator to uniformly manage the deployment, configuration updates, and version rollback of Exporter.

[0057] Optionally, dynamically adjust the Kubernetes scheduling strategy based on GPU computing core utilization, prioritizing low-load nodes for allocation.

[0058] Optionally, when the GPU node is continuously high load, triggering Cluster Autoscaler to automatically expand the GPU node pool.

[0059] Optionally, a dynamic adjustment strategy of the GPU metric collection frequency is configured for the Exporter, and the sampling interval is automatically switched according to the load peak period.

[0060] Compared with the prior art, the present application has the following beneficial effects:

[0061] The online learning-based Internet of Things device identity authentication method provided by the present application can realize fine monitoring of GPU resources of all nodes by deploying Prometheus Exporter on each GPU node of the Kubernetes cluster, automatically covers all nodes through DaemonSet, collects real-time memory, computing power and other indicators, provides resource utilization analysis and bottleneck positioning basis for AI training tasks, realizes abnormal detection and dynamic scheduling optimization in combination with Prometheus alarm and Grafana visualization, guarantees cluster stability and resource utilization, supports efficient operation and maintenance and elastic expansion and contraction of large-scale GPU workloads. Through a unified identity authentication framework, heterogeneous device lifecycle management is realized, and differences between multiple protocols are eliminated; PUF and lightweight encryption technology are integrated to build a hardware-level security protection to resist side-channel attacks; based on blockchain distributed identity (DID) and zero-knowledge proof, a decentralized cross-domain trust chain is established to realize identity change full-process auditability. Finally, a secure closed loop of device trusted access, data tamper-proofing and operation traceability is formed, which greatly improves the risk resistance and compliance of Internet of Things terminals in complex scenarios. BRIEF DESCRIPTION OF DRAWINGS

[0062] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor under the premise of not deviating from the concept of the present application.

[0063] Figure 1 The method flowchart provided by the present application is shown in the figure. DETAILED DESCRIPTION

[0064] With reference to the accompanying drawings, the technical solutions in the embodiments of the present application will be described clearly and completely. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0065] The present application aims to provide a technical solution capable of solving the problems existing in the current Internet of Things device identity authentication method.

[0066] In order to make the above-mentioned purposes, features and advantages of the present application more apparent and easy to understand, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0067] Embodiment 1:

[0068] The present embodiment provides an Internet of Things device identity authentication method based on online learning, as shown in Figure 1 , comprising:

[0069] Real-time collection of device physical layer signal features, communication protocol features and behavior pattern features, construction of high-dimensional space-time feature tensor;

[0070] Based on the mutual information entropy weight evaluation of the sliding window, the redundant features are dynamically removed, and the flow t-SNE algorithm is used to compress the feature dimension to an interpretable low-dimensional space;

[0071] Design a double-channel LSTM-GAN network, the generator simulates the legal device feature distribution, the discriminator dynamically updates the weight through the adversarial training, and combines the Focal Loss function to optimize the class imbalance problem;

[0072] Based on the KL divergence, the real-time feature distribution offset is calculated, the authentication threshold is dynamically adjusted, and the model parameter recalibration is triggered;

[0073] Use blockchain technology to store misjudgment samples, and update the model through the differential privacy protected data back mechanism;

[0074] Develop a custom script to automatically detect whether the node meets the NVIDIA GPU driver version requirement, and verify the CUDAToolkit compatibility, output a JSON format report;

[0075] Inject dynamic device discovery rules in the containerd or Docker configuration file;

[0076] Deploy the definition rules of NFD, identify the GPU model, and automatically add labels for subsequent Exporter directional deployment;

[0077] Build cross-platform Exporter image based on NVIDIA DCGM library, integrate Prometheus client library and enable encrypted communication module;

[0078] Design dynamic resource request strategy, automatically adjust CPU / Memory request of Exporter Pod according to GPU number of node;

[0079] Bind GPU UUID in Exporter configuration, collect data independently per device to avoid confusion of multi-GPU node metrics;

[0080] Automatic issuance of Exporter server certificate;

[0081] Local cache persistent storage on node;

[0082] Custom development of Exporter heartbeat probe;

[0083] Restrict Exporter service to only allow access from Prometheus Server IP segment through NetworkPolicy, and enable two-way mTLS authentication;

[0084] Write custom ServiceMonitor resource, dynamically identify Exporter endpoint based on node label, and configure scraping interval;

[0085] Embed node information in Exporter, enhance data analysis dimension through info type metrics;

[0086] Precompute key metrics in Prometheus Recording Rules to reduce real-time query overhead;

[0087] Dynamic adjustment of node-level metrics sampling rate, develop Exporter dynamic configuration API, and automatically switch sampling frequency according to GPU load;

[0088] Federal synchronization of anomaly detection rules;

[0089] Gray upgrade of node Exporter version;

[0090] Hot and cold layering of GPU metrics storage, configure VictoriaMetrics parameters, migrate historical data to object storage, and reduce local storage cost;

[0091] Integrity check of node monitoring data, develop periodic inspection task, compare output GPU usage, and trigger alarm when deviation ≥3%;

[0092] Limit maximum memory usage and configure OOM Killer priority policy;

[0093] Push the Exporter access logs to Elasticsearch and correlate them with Kubernetes audit events to generate compliance reports.

[0094] Introduce lightweight encryption algorithms to achieve low-computation and high-security key exchange and signature verification on the device side, reducing CPU and memory consumption.

[0095] Design a dynamic credential hierarchical mechanism to divide the authentication process into device-level and gateway-level, balancing security and resource occupation.

[0096] Generate a unique identity using device hardware characteristics to avoid key storage requirements and improve resistance to physical attacks.

[0097] Develop cross-protocol adaptation middleware to support unified registration and authentication interfaces for MQTT, CoAP, and LoRaWAN protocol devices, shielding differences between heterogeneous networks.

[0098] Implement a distributed identity based on blockchain, assigning each device a globally unique DID, and achieve cross-platform identity mutual recognition and permission synchronization through smart contracts.

[0099] Establish a dynamic device attribute label library to automatically collect device types, manufacturers, and firmware versions, and support dynamic adjustment of authentication strategies based on labels.

[0100] Deploy a combination of consortium chain and zero-knowledge proof, record device operation records on the chain, and hide sensitive data when verifying identity validity through ZKP, ensuring privacy and traceability.

[0101] Build a decentralized identity alliance network, with multiple organization nodes jointly maintaining the identity ledger, supporting cross-domain identity query and verification, and avoiding single-point trust risks.

[0102] Design a lightweight PKI certificate chain optimization scheme, using certificate revocation list compression technology to reduce communication and computation overhead during certificate verification.

[0103] Implement a cross-chain identity interoperability protocol to support identity mapping and trust transfer between different blockchain networks, expanding application scope.

[0104] In one embodiment, the DaemonSet controller automatically deploys the Exporter component on each GPU node to ensure full coverage of all node monitoring.

[0105] In one embodiment, the DaemonSet controller automatically deploys the Exporter component on each GPU node to ensure full coverage of all node monitoring.

[0106] In one embodiment, the NVIDIA GPU Feature Discovery (GFD) component is integrated to dynamically identify GPU model, driver version and compute capability.

[0107] In one embodiment, the ServiceMonitor resource object is configured to define the rule for Prometheus to automatically discover the Exporter service.

[0108] In one embodiment, the alert rule is set based on GPU memory utilization metrics, and the AlertManager is triggered when the threshold exceeds 80%.

[0109] In one embodiment, a multi-dimensional Dashboard is built by Grafana to visualize the historical trends of node GPU computing power load, memory occupancy and temperature.

[0110] In one embodiment, the Prometheus Operator is used to uniformly manage the deployment, configuration update and version rollback of the Exporter.

[0111] In one embodiment, the Kubernetes scheduling strategy is dynamically adjusted based on GPU computing core utilization to preferentially allocate low-load nodes.

[0112] In one embodiment, the Cluster Autoscaler is triggered to automatically expand the GPU node pool when the GPU node is continuously high-load.

[0113] In one embodiment, the dynamic adjustment strategy of the GPU metric collection frequency is configured for the Exporter, and the sampling interval is automatically switched according to the load peak period.

[0114] In the specification, each embodiment is described in a progressive manner, and each embodiment focuses on the difference from other embodiments. The same or similar parts between embodiments can be referred to each other. For the system disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the relevant part can be referred to the method part.

[0115] The principles and implementation modes of the present application are described by applying specific examples in this paper. The above embodiment description is only used to help understand the method of the present application and its core idea. For those skilled in the art, according to the idea of the present application, the specific implementation mode and application range will be changed. In summary, the content of the specification should not be understood as a limitation of the present application.

Claims

1.A method for online learning based authentication of Internet of Things (IoT) device identity, the method comprising: Comprise: Real-time acquisition of device physical layer signal features, communication protocol features, and behavior pattern features to construct a high-dimensional spatiotemporal feature tensor; Sliding window-based mutual information entropy weight evaluation to dynamically eliminate redundant features and use the streaming t-SNE algorithm to compress feature dimensions to an interpretable low-dimensional space; Design of a dual-channel LSTM-GAN network, with the generator simulating the legitimate device feature distribution and the discriminator dynamically updating weights through adversarial training, combined with the Focal Loss function to optimize the class imbalance problem; Based on the KL divergence to calculate the feature distribution offset, dynamically adjust the authentication threshold, and trigger the model parameter recalibration; Use blockchain technology to store misjudgment samples and update the model through a differential privacy-protected data feedback mechanism; Develop custom scripts to automatically detect whether nodes meet the NVIDIA GPU driver version requirements and verify CUDAToolkit compatibility, outputting a JSON format report; Inject dynamic device discovery rules into containerd or Docker configuration files; Deploy NFD definition rules to identify GPU models and automatically add labels for subsequent Exporter targeted deployment; Based on the NVIDIA DCGM library, build cross-platform Exporter images, integrate Prometheus client libraries, and enable encrypted communication modules; Design a dynamic resource request strategy to automatically adjust the CPU / Memory requests of Exporter Pods based on the number of GPUs on the node; Bind GPU UUID in Exporter configuration to collect data independently for each device, avoiding index confusion on multi-card nodes; Exporter server certificate automatic issuance; Local cache persistent storage on nodes; Custom development of Exporter heartbeat probes; Restrict the Exporter service to only allow access from the Prometheus Server IP segment through NetworkPolicy and enable two-way mTLS authentication; Write custom ServiceMonitor resources to dynamically identify Exporter endpoints based on node labels and configure the scraping interval; Embed node information in Exporter to enhance data analysis dimensions through info-type metrics; Precompute key metrics in Prometheus Recording Rules to reduce real-time query overhead; Dynamic adjustment of node-level metric sampling rate, development of Exporter dynamic configuration API, and automatic switching of sampling frequency based on GPU load; Federal synchronization of anomaly detection rules; Gray upgrade of node Exporter version; Hot and cold layering of GPU metrics storage, configuration of VictoriaMetrics parameters, migration of historical data to object storage, and reduction of local storage costs; Node monitoring data integrity verification, development of periodic inspection tasks, comparison of output video memory usage, and triggering of alarms when the deviation is ≥3%; Limit maximum memory usage and configure OOM Killer priority policy; Pushing the Exporter access logs to Elasticsearch and correlating them with Kubernetes audit events to generate compliance reports; Introducing lightweight encryption algorithms to achieve low-computation and high-security key exchange and signature verification on devices, reducing CPU and memory consumption; Designing a dynamic credential hierarchical mechanism to separate authentication processes into device-level and gateway-level, balancing security and resource occupation; Generating a unique identity based on device hardware characteristics to avoid key storage requirements and improve resistance to physical attacks; Developing cross-protocol adaptation middleware to support unified registration and authentication interfaces for devices using MQTT, CoAP, and LoRaWAN protocols, shielding differences between heterogeneous networks; Implementing a distributed identity based on blockchain, assigning each device a globally unique DID, and enabling cross-platform identity mutual recognition and permission synchronization through smart contracts; Establishing a dynamic device attribute label library to automatically collect device types, manufacturers, and firmware versions, supporting dynamic adjustment of authentication strategies based on labels; Deploying a combination of consortium chains and zero-knowledge proofs to record device operation records on-chain, hide sensitive data when verifying identity validity through ZKP, and ensure privacy and traceability; Building a decentralized identity alliance network with multiple organizational nodes maintaining the identity ledger, supporting cross-domain identity query and verification, and avoiding single-point trust risks; Designing a lightweight PKI certificate chain optimization scheme using certificate revocation list compression techniques to reduce communication and computation overhead during certificate verification; Implementing cross-chain identity interoperability protocols to support identity mapping and trust transfer between different blockchain networks, expanding application scope. 2.The online learning based authentication of IoT device identity method of claim 1, wherein, Automatically deploying the Exporter component on each GPU node through the DaemonSet controller to ensure full coverage of all nodes. 3.The online learning based authentication of IoT device identity method of claim 1, wherein, Integrating the NVIDIA GPU Feature Discovery component to dynamically identify GPU models, driver versions, and computing capabilities. 4.The online learning based authentication of IoT device identity method of claim 1, wherein, Configuring the ServiceMonitor resource object to define rules for Prometheus to automatically discover the Exporter service. 5.The online learning based authentication of IoT device identity method of claim 1, wherein, Setting alarm rules based on GPU memory utilization indicators, triggering AlertManager notifications when the threshold exceeds 80%. 6.The online learning based authentication of IoT device identity method of claim 1, wherein, Building multi-dimensional Dashboards using Grafana to visualize node GPU computing power load, memory occupancy rate, and temperature historical trends. 7.The online learning based authentication of IoT device identity method of claim 1, wherein, Using the Prometheus Operator to uniformly manage the deployment, configuration updates, and version rollback of Exporters. 8.The online learning based authentication of IoT device identity method of claim 1, wherein, Adjusting Kubernetes scheduling strategies based on GPU computing core utilization to preferentially allocate low-load nodes. 9.The online learning based authentication of IoT device identity method of claim 1, wherein, Triggering Cluster Autoscaler to automatically scale the GPU node pool when GPU nodes are continuously under high load. 10.The online learning based authentication of IoT device identity method of claim 1, wherein, Configuring dynamic adjustment strategies for the GPU metric collection frequency of Exporters to automatically switch sampling intervals based on load peak periods.

Images