An edge-computing-based internet of things device access authentication method and system

Abstract

The application discloses an Internet of Things device access authentication method and system based on edge computing. The method comprises the following steps: a device sends an access request, and an edge node analyzes a protocol to generate a feature fingerprint; a cloud end performs a first protocol whitelist verification, a second certificate and feature fingerprint verification, matches an authentication strategy according to an environmental parameter, and issues a token; the edge node performs a localized authentication, monitors a state in real time, and dynamically adjusts the strategy; and after the authentication is passed, information is synchronized to the cloud end to complete registration. The system comprises a device access layer, an edge computing layer, an authentication management layer and an interaction interface layer, the edge layer analyzes DALI, BACnet and other protocols, the management layer constructs a three-dimensional strategy mapping table, supports graphical configuration and machine learning optimization of a strategy library. The application discloses an Internet of Things device access authentication method and system based on edge computing, which realizes low-delay, high-flexible access of multi-protocol devices, improves real-time performance, expansibility and security, and is suitable for intelligent building, industrial Internet of Things and other scenes.

Description

Technical Field

[0001] This invention relates to the field of IoT device access technology, specifically to an IoT device access authentication method and system based on edge computing, applicable to mixed access scenarios of multi-protocol devices such as smart buildings and industrial IoT, achieving secure, efficient, and dynamic authentication of devices. Background Technology

[0002] In fields such as smart buildings and industrial automation, the diversity of IoT device protocols poses significant challenges to access authentication. Traditional centralized cloud authentication models suffer from the following drawbacks: High latency and high load: Devices need to upload their raw data completely to the cloud, resulting in network transmission latency (typically >500ms) and excessive server load, failing to meet real-time requirements such as intelligent fire alarm linkage (response time <100ms). Poor protocol compatibility: Customized authentication interfaces are required for different protocols such as DALI, BACnet, and Modbus, leading to device access cycles of 2-3 weeks, with expansion costs increasing exponentially with the number of protocols. Insufficient dynamic adaptability: Lack of real-time awareness of network bandwidth (e.g., a sudden drop from 100Mbps to 10Mbps) and device status (e.g., abnormal data fluctuations) prevents automatic adjustment of authentication strategies, resulting in a success rate of less than 60% in abnormal scenarios. While edge computing has been introduced into IoT architectures, a standardized authentication system for multi-protocol devices has not yet been established. How to leverage the localized processing advantages of edge computing to build a dynamic authentication mechanism that integrates the end-edge-cloud collaboration has become a pressing technical problem. Summary of the Invention

[0003] The purpose of this invention is to provide a low-latency, highly flexible, and adaptive IoT device access authentication method and system. Through edge computing and cloud collaboration, it enables rapid authentication access for multi-protocol devices, improving system real-time performance, scalability, and security.

[0004] To achieve the above objectives, the present invention provides a method for IoT device access authentication based on edge computing, comprising the following steps:

[0005] Step S1: The device to be accessed sends an access request to the edge computing node through a wired or wireless interface. The access request includes the device identifier, protocol type, and initial data.

[0006] Step S2: The edge computing node parses the device protocol, extracts key feature data such as protocol frame format and data interaction frequency, and generates a device feature fingerprint;

[0007] Step S3: The edge computing node sends the device feature fingerprint and access environment parameters such as network bandwidth and real-time load to the cloud authentication server to trigger the hierarchical authentication process;

[0008] Step S4: The cloud authentication server performs Level 1 authentication: it verifies the legality of the device protocol type based on a preset protocol whitelist; if legal, it proceeds to Level 2 authentication.

[0009] Step S5: The cloud authentication server performs secondary authentication: it verifies the device manufacturer's security certificate and historical authentication records based on the device's fingerprint characteristics to verify the device's legitimacy.

[0010] Step S6: The cloud authentication server matches authentication policies from the policy library according to the access environment parameters, generates an authentication token containing data conversion rules and encryption methods, and sends it to the edge computing node;

[0011] Step S7: The edge computing node performs localized authentication based on the authentication token, including converting the original device data into a common format, encrypting it, and verifying data integrity.

[0012] Step S8: The edge computing node monitors the device's operating status and network environment in real time. If an anomaly is detected, it sends a policy adjustment request to the cloud and dynamically switches the authentication mode.

[0013] Step S9: After successful authentication, the edge computing node synchronizes the device access information to the cloud management platform to complete the device's full lifecycle registration.

[0014] As a further improvement to the technical solution of the present invention, the protocol whitelist includes DALI, BACnet, ONVIF, Modbus, and MQTT protocols, and the administrator can dynamically add or delete protocol types through a graphical interface.

[0015] As a further improvement to the technical solution of the present invention, the authentication strategy includes two or more authentication modes: the full authentication mode is applicable to scenarios with network bandwidth of not less than 50Mbps, and includes full verification of device certificates and deep encryption of data; the lightweight authentication mode is applicable to scenarios with network bandwidth of less than 50Mbps, and uses hash value for fast verification and simplified encryption algorithm.

[0016] As a further improvement to the technical solution of the present invention, the device feature fingerprint generation process includes performing hash operations on the communication port, data frame header format, and check code rules of the device protocol to generate a unique 128-bit feature code.

[0017] As a further improvement to the technical solution of the present invention, the cloud management platform analyzes historical authentication data based on machine learning algorithms, constructs a device access behavior model, automatically identifies abnormal access patterns, and updates the policy library.

[0018] As a further improvement to the technical solution of the present invention, an IoT device access authentication system based on edge computing includes:

[0019] Device access layer: Supports four access interfaces: RS485, Ethernet, WiFi, and Bluetooth, used to collect device access requests and raw data and transmit them to the edge computing layer;

[0020] Edge computing layer: Deploys distributed edge computing nodes, each node containing:

[0021] The protocol parsing module parses DALI, BACnet, ONVIF, Modbus, and MQTT protocol data and extracts device features to generate fingerprints;

[0022] The local authentication execution unit performs data format conversion, encryption, and real-time verification based on the cloud authentication token, and supports dynamic switching of authentication modes;

[0023] The status monitoring module collects the device operating status and network parameters in real time and triggers policy adjustment signals.

[0024] Authentication management layer: includes cloud-based authentication servers and management platform.

[0025] The hierarchical authentication module performs first-level protocol whitelist verification, second-level certificate and feature fingerprint dual verification, and generates authentication policies.

[0026] The policy library stores authentication policies, including protocol conversion rules, encryption algorithms, and verification processes.

[0027] The adaptive optimization unit dynamically updates the policy library based on the device access behavior model and supports custom authentication rules through a graphical interface.

[0028] Interaction Interface Layer: Provides a visual interface for administrators to view real-time authentication status, device lifecycle information, and exception logs.

[0029] As a further improvement to the technical solution of the present invention, the edge computing node communicates with the cloud authentication server through a standardized interface, supports offline authentication caching of the edge node, stores the most recent 50 authentication records when the network is disconnected, and synchronizes them to the cloud after the network is connected.

[0030] As a further improvement to the technical solution of the present invention, the localized authentication execution unit automatically generates data mapping relationships and conversion rules by dragging and dropping protocol types through a graphical interface.

[0031] As a further improvement to the technical solution of the present invention, the status monitoring module sets multi-level early warning thresholds: the lightweight authentication mode is triggered when the network bandwidth is lower than 30Mbps or the data verification error rate exceeds 5%; the access is automatically blocked and an alarm is sent to the administrator when the device fails to authenticate three times in a row or when a forged device fingerprint is detected.

[0032] As a further improvement to the technical solution of the present invention, the policy library of the authentication management layer includes a three-dimensional policy mapping table of device type, protocol, and environmental parameters. When the device type is a security camera and uses the ONVIF protocol with a network bandwidth greater than 100Mbps, the full certificate verification and video stream compression encryption policy is automatically matched. When the device type is a smart meter and uses the Modbus protocol in a low-power scenario, the lightweight hash verification and timed heartbeat packet authentication policy is automatically matched.

[0033] The present invention has the following beneficial effects:

[0034] Low-latency and high-efficiency authentication: Localized processing at edge nodes reduces cloud data transmission by 60%-80%, and authentication time in typical scenarios is reduced from 500ms to 150-300ms, meeting the real-time linkage requirements of smart buildings.

[0035] Flexible multi-protocol adaptation: Supports dynamic parsing of 20+ mainstream protocols, shortens the device access cycle to 2-3 days, and enables zero-code access through graphical configuration, reducing the technical threshold.

[0036] Dynamic adaptive capability: Based on real-time edge monitoring and cloud-based machine learning, the success rate of authentication in network fluctuation scenarios is improved by 30%, and the accuracy of abnormal access identification reaches over 95%.

[0037] Security and reliability assurance: The three-level security system of end-edge-cloud (feature fingerprint verification, AES encryption, and behavior model analysis) effectively resists attacks such as forged access and data tampering, and complies with the GB / T28181 security standard. Attached Figure Description

[0038] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0039] Figure 1 This is a schematic diagram of the structural framework of an IoT device access authentication system based on edge computing according to the present invention.

[0040] Figure 2 This is a schematic diagram of the process framework of an IoT device access authentication method based on edge computing according to the present invention. Detailed Implementation

[0041] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. The illustrative embodiments and descriptions of the present invention are used to explain the present invention, but are not intended to limit the present invention.

[0042] It should be noted that all directional indicators (such as up, down, left, right, front, back, upper end, lower end, top, bottom, etc.) in the embodiments of the present invention are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicator will also change accordingly.

[0043] In this invention, unless otherwise explicitly specified and limited, the term "connection" should be interpreted broadly. For example, "connection" can be a fixed connection, a detachable connection, or an integral part; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium; it can be the internal communication of two components or the interaction between two components, unless otherwise explicitly limited. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0044] Furthermore, in this invention, descriptions involving "first," "second," etc., are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined with "first" or "second" may explicitly or implicitly include at least one of that feature. Additionally, the technical solutions of various embodiments can be combined with each other, but only on the basis of being achievable by those skilled in the art. If the combination of technical solutions is contradictory or impossible to implement, such a combination should be considered non-existent and not within the scope of protection claimed by this invention.

[0045] The present invention will be further described in detail below with reference to the accompanying drawings.

[0046] Reference Figures 1 to 2 An IoT device access authentication method based on edge computing includes the following steps:

[0047] Step S1: The device to be accessed sends an access request to the edge computing node through a wired or wireless interface. The access request includes the device identifier, protocol type, and initial data.

[0048] Step S2: The edge computing node parses the device protocol, extracts key feature data such as protocol frame format and data interaction frequency, and generates a device feature fingerprint;

[0049] Step S3: The edge computing node sends the device feature fingerprint and access environment parameters such as network bandwidth and real-time load to the cloud authentication server to trigger the hierarchical authentication process;

[0050] Step S4: The cloud authentication server performs Level 1 authentication: it verifies the legality of the device protocol type based on a preset protocol whitelist; if legal, it proceeds to Level 2 authentication.

[0051] Step S5: The cloud authentication server performs secondary authentication: it verifies the device manufacturer's security certificate and historical authentication records based on the device's fingerprint characteristics to verify the device's legitimacy.

[0052] Step S6: The cloud authentication server matches authentication policies from the policy library according to the access environment parameters, generates an authentication token containing data conversion rules and encryption methods, and sends it to the edge computing node;

[0053] Step S7: The edge computing node performs localized authentication based on the authentication token, including converting the original device data into a common format, encrypting it, and verifying data integrity.

[0054] Step S8: The edge computing node monitors the device's operating status and network environment in real time. If an anomaly is detected, it sends a policy adjustment request to the cloud and dynamically switches the authentication mode.

[0055] Step S9: After successful authentication, the edge computing node synchronizes the device access information to the cloud management platform to complete the device's full lifecycle registration.

[0056] Specifically, in this embodiment, the protocol whitelist includes DALI, BACnet, ONVIF, Modbus, and MQTT protocols, and the administrator can dynamically add or delete protocol types through a graphical interface.

[0057] Specifically, in this embodiment, the authentication strategy includes two or more authentication modes: the full authentication mode is suitable for scenarios with network bandwidth of not less than 50Mbps, and includes full verification of device certificates and deep encryption of data; the lightweight authentication mode is suitable for scenarios with network bandwidth of less than 50Mbps, and uses hash value for fast verification and simplified encryption algorithm.

[0058] Specifically, in this embodiment, the device feature fingerprint generation process includes performing hash operations on the communication port, data frame header format, and checksum rules of the device protocol to generate a unique 128-bit feature code.

[0059] Specifically, in this embodiment, the cloud management platform analyzes historical authentication data based on machine learning algorithms, constructs a device access behavior model, automatically identifies abnormal access patterns, and updates the policy library.

[0060] Specifically, in this embodiment, an IoT device access authentication system based on edge computing includes:

[0061] Device access layer: Supports four access interfaces: RS485, Ethernet, WiFi, and Bluetooth, used to collect device access requests and raw data and transmit them to the edge computing layer;

[0062] Edge computing layer: Deploys distributed edge computing nodes, each node containing:

[0063] The protocol parsing module parses DALI, BACnet, ONVIF, Modbus, and MQTT protocol data and extracts device features to generate fingerprints;

[0064] The local authentication execution unit performs data format conversion, encryption, and real-time verification based on the cloud authentication token, and supports dynamic switching of authentication modes;

[0065] The status monitoring module collects the device operating status and network parameters in real time and triggers policy adjustment signals.

[0066] Authentication management layer: includes cloud-based authentication servers and management platform.

[0067] The hierarchical authentication module performs first-level protocol whitelist verification, second-level certificate and feature fingerprint dual verification, and generates authentication policies.

[0068] The policy library stores authentication policies, including protocol conversion rules, encryption algorithms, and verification processes.

[0069] The adaptive optimization unit dynamically updates the policy library based on the device access behavior model and supports custom authentication rules through a graphical interface.

[0070] Interaction Interface Layer: Provides a visual interface for administrators to view real-time authentication status, device lifecycle information, and exception logs.

[0071] Specifically, in this embodiment, the edge computing node communicates with the cloud authentication server through a standardized interface, supports offline authentication caching of the edge node, stores the 50 most recent authentication records when the network is disconnected, and synchronizes them to the cloud after the network is connected.

[0072] Specifically, in this embodiment, the localized authentication execution unit automatically generates data mapping relationships and conversion rules by dragging and dropping protocol types through a graphical interface.

[0073] Specifically, in this embodiment, the status monitoring module sets multi-level early warning thresholds: a lightweight authentication mode is triggered when the network bandwidth is below 30Mbps or the data verification error rate exceeds 5%; access is automatically blocked and an alarm is sent to the administrator when the device fails authentication three times in a row or when a forged device fingerprint is detected.

[0074] Specifically, in this embodiment, the policy library of the authentication management layer contains a three-dimensional policy mapping table of device type, protocol, and environmental parameters. When the device type is a security camera and uses the ONVIF protocol with a network bandwidth greater than 100Mbps, the full certificate verification and video stream compression encryption policy is automatically matched. When the device type is a smart meter and uses the Modbus protocol in a low-power scenario, the lightweight hash verification and timed heartbeat packet authentication policy is automatically matched.

[0075] Example: An IoT device access authentication method based on edge computing, such as... Figure 2 As shown, the method includes the following steps:

[0076] Device access requests and feature extraction:

[0077] The device to be connected sends an access request via an interface such as RS485 or WiFi, including device identification (e.g., MAC address), protocol type (e.g., ONVIF), and initial data. The edge computing node parses the protocol, extracts key features such as communication port P, data frame header format F, and checksum rule C, and generates a device feature fingerprint using a hash function: fingerprint = H(P,F,C)).

[0078] Where H is the SHA-256 hash function, outputting a 128-bit signature. (Hierarchical authentication and policy generation)

[0079] Edge nodes send their feature fingerprints and access environment parameters (network bandwidth B, real-time load L) to the cloud authentication server. The server performs the following authentication steps: Level 1 authentication: Verifies if the protocol type is on the preset whitelist (including DALI, BACnet, etc.); if valid, proceeds to Level 2 authentication; Level 2 authentication: Compares the device's feature fingerprint with the manufacturer's security certificate (containing the public key). (Device ID), the verification formula is:

[0080] After successful authentication, the server matches the authentication policy from the policy library based on B and L, generating an authentication token that includes data transformation rules (such as Modbus to JSON) and encryption algorithms (such as AES-128). Localized authentication execution and dynamic adjustment.

[0081] Edge nodes perform authentication by token: the original data D is converted to a common format D', calculated using the following formula:

[0082] Simultaneously, AES encryption (key) is performed on D'. (Dynamically distributed from the cloud), and a CRC32 checksum V is calculated for integrity verification:

[0083] If B < 50Mbps or the data verification error rate E > 5%, the edge node sends a policy adjustment request to the cloud to switch to a lightweight authentication mode (such as hash verification replacing full certificate verification). Authentication result synchronization and policy optimization are also implemented.

[0084] After successful authentication, the edge node will send the device ID, authentication time T, and policy version V. p Synchronize to the cloud management platform to complete the entire lifecycle registration. The cloud platform is based on historical data. h Train a machine learning model (such as a decision tree algorithm), update the authentication rules of the policy library, and the model training objective function is:

[0085] Where R represents the authentication policy. Input characteristics (device type, protocol, bandwidth). The expected authentication result.

[0086] An IoT device access authentication system based on edge computing, such as Figure 1 As shown, the system includes:

[0087] Device access layer

[0088] It supports interfaces such as RS485, Ethernet, WiFi, and Bluetooth, collects device access requests and transmits them to the edge computing layer, and realizes physical connection of multi-protocol devices.

[0089] Edge computing layer

[0090] Distributed deployment of edge nodes, each node integrating: a protocol parsing module: supporting the parsing of 20+ protocols such as DALI and Modbus, extracting features to generate fingerprints; a localized authentication execution unit: performing data format conversion (conversion efficiency ≥200 records / second), encryption, and verification based on authentication tokens, supporting zero-code configuration (automatically generating mapping rules by dragging and dropping protocol types); and a status monitoring module: real-time collection of device status (such as the number of connection interruptions N) and network parameters (bandwidth B, latency). ), set two levels of early warning thresholds: Level 1 threshold: This triggers lightweight authentication;

[0091] Secondary threshold: If a forged fingerprint is detected, the system will automatically block access and issue an alarm.

[0092] Certification Management

[0093] The cloud-based authentication server and management platform work together: Tiered authentication module: performs two levels of authentication; Level 1 protocol verification takes ≤50ms, and Level 2 certificate matching takes ≤100ms; Policy library: stores a three-dimensional policy mapping table (device type × protocol × environment parameters), for example:

[0094]

[0095] When the device is a "security camera (ONVIF)" and When the policy is in use, it automatically matches the "full certificate verification + H.264 encryption" policy; the adaptive optimization unit dynamically updates the policy based on the device access behavior model (accuracy ≥ 95%), and supports administrators to customize rules through a graphical interface (such as drag-and-drop policy configuration).

[0096] Interaction Interface Layer

[0097] It provides a visual interface that displays the authentication status (success rate, time taken), device lifecycle information (access time, maintenance records), and exception logs (such as statistics on the reasons for authentication failure) in real time.

[0098] Implementation Case 1: Authentication for Multi-Protocol Device Access in Smart Buildings

[0099] Taking the connection of smart community access control cameras (ONVIF protocol) and lighting controllers (DALI protocol) as an example: Device connection and feature extraction

[0100] The camera sends an access request via WiFi. The edge node parses the ONVIF protocol, extracts port 80, frame header format "RTSP / 1.0", and checksum CRC-32, and calculates the feature fingerprint.

[0101] The lighting controller is connected via RS485. The edge node extracts port 1993 of the DALI protocol, frame header "0x01", and parity check code to generate the corresponding fingerprint.

[0102] Tiered authentication and strategy matching

[0103] The cloud authentication server verifies that both ONVIF and DALI are on the protocol whitelist (Level 1 authentication passed). Level 2 authentication compares the camera certificate fingerprint with the calculated fingerprint (legitimate device). The current network bandwidth is 100Mbps, matching the complete authentication policy: the camera video stream is encrypted with AES-256, and the lighting controller data is converted to JSON format with an additional CRC32 checksum.

[0104] Localization Authentication and Dynamic Adjustment

[0105] Edge node authentication: Converts and encrypts the camera RTSP stream to H.264 format, and calculates the CRC32 value of the lighting controller data. If the bandwidth drops to 20Mbps at night, the status monitoring module triggers a policy adjustment, switching newly connected DALI devices to lightweight authentication (hash check instead of full certificate check), reducing authentication time from 300ms to 150ms.

[0106] Results Synchronization and Strategy Optimization

[0107] After successful authentication, the cloud records the device access information. If a DALI controller of a certain brand fails authentication five times consecutively, the cloud model identifies it as "device firmware abnormality," automatically updates the policy library, and adds a "firmware version verification" rule for such devices.

[0108] Implementation Case 2: Identification of Abnormal Access to Industrial IoT Devices

[0109] On the factory production line, a Modbus protocol sensor suddenly experienced a high frequency of access requests (100 times per minute, historical average of 10 times per minute):

[0110] Edge nodes detect access frequency This exceeds the historical average by more than three times, triggering a level-two warning.

[0111] The cloud management platform uses a machine learning model to identify the attack as a "fake device attack," updates the policy library, and enables dual certificate verification (manufacturer certificate + on-site configuration certificate) for such devices.

[0112] When similar devices are subsequently connected, the edge nodes automatically execute an enhanced authentication process, successfully intercepting attacks and ensuring the security of production line data.

[0113] In summary, the present invention has the following beneficial effects:

[0114] Low-latency and high-efficiency authentication: Localized processing at edge nodes reduces cloud data transmission by 60%-80%, and authentication time in typical scenarios is reduced from 500ms to 150-300ms, meeting the real-time linkage requirements of smart buildings.

[0115] Flexible multi-protocol adaptation: Supports dynamic parsing of 20+ mainstream protocols, shortens the device access cycle to 2-3 days, and enables zero-code access through graphical configuration, reducing the technical threshold.

[0116] Dynamic adaptive capability: Based on real-time edge monitoring and cloud-based machine learning, the success rate of authentication in network fluctuation scenarios is improved by 30%, and the accuracy of abnormal access identification reaches over 95%.

[0117] Security and reliability assurance: The three-level security system of end-edge-cloud (feature fingerprint verification, AES encryption, and behavior model analysis) effectively resists attacks such as forged access and data tampering, and complies with the GB / T28181 security standard.

[0118] The technical solutions provided by the embodiments of the present invention have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of the embodiments of the present invention. The descriptions of the embodiments above are only for helping to understand the principles of the embodiments of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the embodiments of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for authenticating IoT device access based on edge computing, characterized in that, Includes the following steps: Step S1: The device to be accessed sends an access request to the edge computing node through a wired or wireless interface. The access request includes the device identifier, protocol type, and initial data. Step S2: The edge computing node parses the device protocol, extracts key feature data such as protocol frame format and data interaction frequency, and generates device feature fingerprint; Step S3: The edge computing node sends the device feature fingerprint and access environment parameters such as network bandwidth and real-time load to the cloud authentication server to trigger the hierarchical authentication process; Step S4: The cloud authentication server performs Level 1 authentication: it verifies the legality of the device protocol type based on a preset protocol whitelist; if legal, it proceeds to Level 2 authentication. Step S5: The cloud authentication server performs secondary authentication: it verifies the device manufacturer's security certificate and historical authentication records based on the device's fingerprint characteristics to verify the device's legitimacy. Step S6: The cloud authentication server matches authentication policies from the policy library according to the access environment parameters, generates an authentication token containing data conversion rules and encryption methods, and sends it to the edge computing node; Step S7: The edge computing node performs localized authentication based on the authentication token, including converting the original device data into a common format, encrypting it, and verifying data integrity. Step S8: The edge computing node monitors the device's operating status and network environment in real time. If an anomaly is detected, it sends a policy adjustment request to the cloud and dynamically switches the authentication mode. Step S9: After successful authentication, the edge computing node synchronizes the device access information to the cloud management platform to complete the device's full lifecycle registration.

2. The IoT device access authentication method based on edge computing according to claim 1, characterized in that: The protocol whitelist includes DALI, BACnet, ONVIF, Modbus, and MQTT protocols. Administrators can dynamically add or delete protocol types through a graphical interface.

3. The IoT device access authentication method based on edge computing according to claim 1, characterized in that: The authentication strategy includes two or more authentication modes: the full authentication mode is suitable for scenarios with network bandwidth of not less than 50Mbps, and includes full verification of device certificates and deep data encryption; the lightweight authentication mode is suitable for scenarios with network bandwidth of less than 50Mbps, and uses hash value fast verification and simplified encryption algorithm.

4. The IoT device access authentication method based on edge computing according to claim 1, characterized in that: The device fingerprint generation process includes performing hash operations on the device protocol's communication port, data frame header format, and checksum rules to generate a unique 128-bit feature code.

5. The IoT device access authentication method based on edge computing according to claim 1, characterized in that: The cloud management platform analyzes historical authentication data based on machine learning algorithms, builds a device access behavior model, automatically identifies abnormal access patterns, and updates the policy library.

6. A system applying the edge computing-based Internet of Things (IoT) device access authentication method as described in any one of claims 1 to 5, characterized in that, include: Device access layer: Supports four access interfaces: RS485, Ethernet, WiFi, and Bluetooth, used to collect device access requests and raw data and transmit them to the edge computing layer; Edge computing layer: Deploys distributed edge computing nodes, each node containing: The protocol parsing module parses DALI, BACnet, ONVIF, Modbus, and MQTT protocol data and extracts device features to generate fingerprints; The local authentication execution unit performs data format conversion, encryption, and real-time verification based on the cloud authentication token, and supports dynamic switching of authentication modes; The status monitoring module collects the device operating status and network parameters in real time and triggers policy adjustment signals. Authentication management layer: includes cloud-based authentication servers and management platform. The hierarchical authentication module performs first-level protocol whitelist verification, second-level certificate and feature fingerprint dual verification, and generates authentication policies. The policy library stores authentication policies, including protocol conversion rules, encryption algorithms, and verification processes. The adaptive optimization unit dynamically updates the policy library based on the device access behavior model and supports custom authentication rules through a graphical interface. Interaction Interface Layer: Provides a visual interface for administrators to view real-time authentication status, device lifecycle information, and exception logs.

7. The system according to claim 6, characterized in that: The edge computing node communicates with the cloud authentication server through a standardized interface, supports offline authentication caching of the edge node, stores the 50 most recent authentication records when the network is disconnected, and synchronizes them to the cloud after the network is connected.

8. The system according to claim 6, characterized in that: The localized authentication execution unit automatically generates data mapping relationships and conversion rules by dragging and dropping protocol types through a graphical interface.

9. The system according to claim 6, characterized in that: The status monitoring module is set with multiple warning thresholds: the lightweight authentication mode is triggered when the network bandwidth is lower than 30Mbps or the data verification error rate exceeds 5%; the access is automatically blocked and an alarm is sent to the administrator when the device fails to authenticate three times in a row or when a forged device fingerprint is detected.

10. The system according to claim 6, characterized in that: The policy library of the authentication management layer contains a three-dimensional policy mapping table of device type, protocol, and environmental parameters. When the device type is a security camera and uses the ONVIF protocol with a network bandwidth greater than 100Mbps, the full certificate verification and video stream compression encryption policy is automatically matched. When the device type is a smart meter and uses the Modbus protocol in a low-power scenario, the lightweight hash verification and timed heartbeat packet authentication policy is automatically matched.

Images