Internet of Things module security authentication method and system

Abstract

The invention relates to an Internet of Things module security authentication method and system, and the method comprises the steps: extracting a hardware feature identifier and an equipment type identifier preset by an Internet of Things module, and generating an equipment authentication parameter; constructing authentication request information containing a request identifier, an authentication hash value and an equipment transmission identifier by using the equipment authentication parameter; carrying out equipment relation binding and cloud verification on the authentication request information to obtain a cloud verification result; and dynamically calling an execution unit of the Internet of Things module according to the cloud verification result to complete equipment access control. According to the invention, a single identifier can be prevented from being counterfeited or tampered, and the reliability and safety of authentication are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of module security authentication, and particularly relates to an Internet of Things module security authentication method and system. BACKGROUND

[0002] With the rapid development of the Internet of Things technology, Internet of Things modules are increasingly widely applied in the fields of smart home, industrial automation, smart city, etc. To ensure the secure access and reliable operation of Internet of Things devices, a security authentication mechanism becomes a key link to guarantee the overall security of the system. At present, the authentication method of Internet of Things modules usually relies on static keys or single hardware identifiers, which is difficult to effectively deal with security threats such as device forgery and man-in-the-middle attacks. SUMMARY

[0003] The main purpose of the present application is to provide an Internet of Things module security authentication method and system, which can avoid forgery or tampering of a single identifier and improve the reliability and security of authentication.

[0004] To achieve the above purpose, the present application provides an Internet of Things module security authentication method, comprising: extracting a hardware feature identifier and a device type identifier pre-stored in an Internet of Things module, and generating a device authentication parameter; constructing authentication request information containing a request identifier, an authentication hash value and a device transmission identifier using the device authentication parameter; performing device relationship binding and cloud verification on the authentication request information to obtain a cloud verification result; dynamically calling an execution unit of the Internet of Things module according to the cloud verification result to complete device access control.

[0005] Further, the extracting a hardware feature identifier and a device type identifier pre-stored in an Internet of Things module, and generating a device authentication parameter, comprises: performing an identifier scanning operation on a pre-stored area of the Internet of Things module to obtain the hardware feature identifier and the device type identifier; binary splicing the hardware feature identifier and the device type identifier to generate a composite identifier sequence; performing identification authentication on the composite identifier sequence according to pre-stored authentication identification parameters to generate a dynamic authentication identifier; integrating the dynamic authentication identifier and the device type identifier to generate the device authentication parameter.

[0006] Further, the binary splicing the hardware feature identifier and the device type identifier to generate a composite identifier sequence, comprises: performing bit width alignment on the hardware feature identifier to obtain a first standardized identifier sequence; Performing parity bit insertion on the device type identifier to obtain a second standardized identifier sequence; According to the preset splicing sequence parameter, the first standardized identifier sequence and the second standardized identifier sequence are cross-spliced to obtain an initial composite sequence; Calculate the redundancy checksum of the initial composite sequence, and append the redundancy checksum to the tail of the initial composite sequence to generate the composite identifier sequence.

[0007] Further, the authentication request information containing the request identifier, the authentication hash value and the device transmission identifier is constructed using the device authentication parameter, comprising: Performing request grouping on the hardware feature identifier to generate a request identifier; Performing three-order iterative diffusion calculation on the device authentication parameter to generate an authentication hash value; Identify the authentication timestamp of the device authentication parameter, and perform dynamic bit field mapping operation with the device type identifier to generate a device transmission identifier; Using a preset random number sequence to perform structured packaging on the request identifier, the authentication hash value and the device transmission identifier to generate the authentication request information.

[0008] Further, the authentication timestamp of the device authentication parameter is identified, and the dynamic bit field mapping operation is performed with the device type identifier to generate a device transmission identifier, comprising: Separate the authentication timestamp of a preset length from the device authentication parameter, and identify the request timestamp by combining the device type identifier; Using the request timestamp and the device type identifier to perform feature mapping to generate device mapping data; Performing security checksum bit segment extraction on the device mapping data to obtain a device feature padding code; Structurally combining the request timestamp, the device mapping data and the device feature padding code to obtain the device transmission identifier.

[0009] Further, the device relationship binding and cloud verification of the authentication request information are performed to obtain a cloud verification result, comprising: Performing authentication analysis on the authentication request information to obtain a device unique code and an authentication timestamp; Querying a preset cloud pre-registration database based on the device unique code to obtain a reference hardware identifier and a reference device type; Combining the preset verification master key and the authentication timestamp to perform device verification on the reference hardware identifier to generate a request end verification identifier; The request end verification identifier is bound and discriminated according to a preset discrimination condition, if the request end verification identifier meets the preset condition, a cloud end binding association is established according to the reference device type, and a cloud end verification result is generated; If the request end verification identifier does not meet the preset condition, a verification failure information is generated.

[0010] Further, the reference hardware identifier is verified by combining the preset verification master key and the authentication timestamp, and a request end verification identifier is generated, including: The reference hardware identifier is implemented segmented identification, and segmented hardware identifier is formed; The millisecond level low bit field of the authentication timestamp is disturbed to obtain a dynamic disturbance factor; The dynamic disturbance factor is verified by the master key to generate time limit verification information; The segmented hardware identifier is implemented signature verification and request association by using the time limit verification information, and the request end verification identifier is obtained.

[0011] Further, the execution unit of the Internet of Things module is dynamically called according to the cloud end verification result, and the device access control is completed, including: The verification status code and device permission identifier of the cloud end verification result are extracted, and instruction matching is performed with the preset execution instruction library to obtain a dynamic execution instruction set; The Internet of Things module is functionally mapped and matched based on the dynamic execution instruction set to determine the execution unit of the Internet of Things module; According to the device permission identifier, the execution unit is allocated with interface resources and connected with the cloud end to obtain a cloud end communication link; The dynamic execution instruction set is sent through the cloud end communication link, and the execution unit is triggered to complete the device access control.

[0012] The application also provides an Internet of Things module security authentication system, which is applied to the Internet of Things module security authentication method described above, and includes: The acquisition module is used for extracting the hardware feature identifier and device type identifier of the Internet of Things module, and generating device authentication parameters; The analysis module is used for constructing authentication request information containing request identifier, authentication hash value and device transmission identifier by using the device authentication parameters; The association module is used for device relationship binding and cloud end verification of the authentication request information to obtain a cloud end verification result; The processing module is used for dynamically calling the execution unit of the Internet of Things module according to the cloud end verification result to complete the device access control.

[0013] The present application has the following beneficial effects: By extracting the hardware feature identifier and the device type identifier of the Internet of Things module, and combining the dynamically generated device authentication parameters, the security risks caused by static key leakage or device cloning are effectively prevented, and the anti-fake ability of the authentication mechanism is improved. The authentication request information is constructed by using the request identifier, the authentication hash value and the device transmission identifier, and the multiple verification is carried out by combining the hardware features and the device types, so that the single identifier is prevented from being forged or tampered, and the reliability and security of the authentication are improved. Through the device relationship binding and the cloud verification, the real-time verification and dynamic strategy adjustment of the device identity are realized, the authentication process is synchronized with the cloud security strategy, and the overall security protection ability of the system is enhanced. According to the cloud verification result, the execution unit of the Internet of Things module is dynamically called, the on-demand enabling or limiting of the device function is realized, unauthorized operation is prevented, and the controllability and security of the device access are improved. Through the cooperative verification of the hardware features, the device types and the cloud strategy, the security requirements of different Internet of Things scenes can be flexibly adapted, and the applicability and reliability of the authentication mechanism in different environments such as smart home and industrial Internet of Things are ensured. BRIEF DESCRIPTION OF DRAWINGS

[0014] Figure 1 is a flow chart of a security authentication method of an Internet of Things module provided by the present application; Figure 2 is a structure diagram of a security authentication system of an Internet of Things module provided by the present application.

[0015] The implementation, functional features and advantages of the present application will be further described with reference to the accompanying drawings. DETAILED DESCRIPTION

[0016] In order to make the purpose, technical scheme and advantages of the present application more clear, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, and are not used to limit the present application.

[0017] The present application will be further described below with reference to the accompanying drawings and specific embodiments.

[0018] Referring to Figure 1 The present application provides a security authentication method of an Internet of Things module, which comprises: Step S1: extracting the hardware feature identifier and the device type identifier preset in the Internet of Things module, and generating a device authentication parameter; Step S2: using the device authentication parameter to construct authentication request information containing a request identifier, an authentication hash value and a device transmission identifier; Step S3: performing device relationship binding and cloud verification on the authentication request information to obtain a cloud verification result; Step S4: According to the cloud verification result, the execution unit of the Internet of Things module is dynamically called to complete the device access control.

[0019] Based on the above steps, the detailed step process is as follows: Step S1: The hardware feature identifier is extracted from the tamper-proof read-only memory of the Internet of Things module, specifically the physical unique serial number of the chip fuse storage area. The device type identifier is determined by the device model code pre-stored in the secure flash memory partition. Perform length standardization on both: the hardware feature identifier is unified to 64-bit binary sequence, and the insufficient bits are filled with zeros; the device type identifier uses 32-bit industry standard code (such as IEEE device classification code). The two types of identifiers after standardization are concatenated as a 96-bit composite sequence according to the rule of high 32-bit device type identifier and low 64-bit hardware feature identifier. Perform byte-wise XOR accumulation operation on the composite sequence to generate an 8-bit checksum appended to the end of the sequence. Finally, call the 256-bit HMAC key pre-stored in the secure encryption area to perform key hash operation on the generated 104-bit complete sequence, output 128-bit device authentication parameters and store them in the secure memory buffer.

[0020] Step S2: Device authentication parameters as core input items: Request identifier generation: extract the last 16 bits of the hardware feature identifier as an entropy source, and perform bit splicing with the 32-bit millisecond timestamp obtained in real time, then generate a 16-byte request identifier through lightweight AES-128-ECB mode encryption operation; Authentication hash value generation: combine the device authentication parameters and the request identifier as input data stream, perform two times of SHA-256 iteration hash operation, generate a 256-bit fixed length authentication hash value; Device transmission identifier generation: parse the timestamp field in the request identifier, perform bit domain permutation operation on the low 16 bits and the high 16 bits of the device type identifier, and embed the permuted data in a 64-bit field to form a device transmission identifier with time limit feature; The generated request identifier, authentication hash value and device transmission identifier are encapsulated into a 128-byte authentication request information packet according to the TLV (Type-Length-Value) encoding rule, and a 2-byte CRC check code is appended to the packet header to ensure transmission integrity.

[0021] Step S3: The authentication request information is transmitted to the cloud authentication service module and then structured parsing is performed: the encrypted hardware feature code segment in the request identifier is extracted, AES-128-CBC mode reverse decryption is performed through the pre-stored main decryption key, and the original hardware feature identifier and timestamp combination are restored. The cloud pre-registration database is indexed based on the hardware feature identifier, and the pre-recorded reference hardware feature sequence and device type code are obtained. The device type identifier obtained by parsing is subjected to industry standard coding verification to verify its consistency with the reference device type code.

[0022] The timestamp to be verified is compared with the millisecond-level time deviation of the cloud time center, and a time invalidation mark is generated immediately when the deviation exceeds the ±5 second threshold. A 256-bit HMAC main key pre-stored in the cloud security area is used to perform a synchronous hash operation on the reference hardware feature sequence to generate a reference authentication code, and the reference authentication code is compared with the authentication hash value in the authentication request information byte by byte. When the timestamp is valid, the device type matches, and the hash values are consistent, the device unique code, permission level field, and verification status code are combined into a 128-bit verification result data packet; any missing condition triggers an alarm protocol to generate a verification failure response with an error code.

[0023] Step S4: After receiving the cloud verification result data packet, the Internet of Things module performs verification result decoding in the hardware security container: 4-bit binary verification status code and 8-bit device permission identifier are separated. The verification status code is input into the instruction mapping table pre-burned in the ROM, and the mapping table solidifies the machine code of 16 kinds of execution instruction combinations. When the status code is 0b0001, the low 4 bits of the device permission identifier are extracted as an index value to activate the corresponding execution unit enable signal.

[0024] Taking the communication module as an example, when the low 2 bits of the permission identifier are 01, only the UART interface is opened, and when they are 11, the full-duplex wireless communication stack is enabled. The verification status code 0b1000 triggers a fuse mechanism, writes a lock flag bit to the 7th bit of the execution unit control register, and permanently closes the device communication drive circuit power supply.

[0025] For execution units that need to be dynamically connected (such as data acquisition modules), the device permission identifier encrypted data frame is sent to the coprocessor to drive it to allocate a dedicated DMA channel to establish a point-to-point encrypted communication link, realizing hardware-level secure data channel isolation. Finally, the current detection signal is fed back by the physical port of the execution unit until the device access control closed loop is completed according to the instructions.

[0026] The application provides a kind of Internet of Things module security authentication method, by extracting the hardware feature identification and device type identification of Internet of Things module, and combining the dynamically generated device authentication parameter, effectively prevent the security risk caused by static key leakage or device cloning, improve the anti-fake ability of authentication mechanism. Request identifier, authentication hash value and device transmission identifier are used to construct authentication request information, combined with hardware features and device types for multiple verification, avoid single identification being forged or tampered, improve the reliability and security of authentication. Through device relationship binding and cloud verification, real-time verification and dynamic policy adjustment of device identity are realized, ensure that the authentication process is synchronized with the cloud security policy, enhance the overall security protection ability of system. According to the cloud verification result, the execution unit of Internet of Things module is dynamically called, the on-demand activation or restriction of device function is realized, unauthorized operation is prevented, and the controllability and security of device access are improved. Through the cooperative verification of hardware features, device types and cloud strategies, it can flexibly adapt to the security needs of different Internet of Things scenes, and ensure the applicability and reliability of the authentication mechanism in different environments such as smart home and industrial Internet of Things.

[0027] In one embodiment, by extracting the hardware feature identification and device type identification preset by the Internet of Things module, and generating device authentication parameters, including: The hardware feature identification is derived from the physically unclonable function unit in the security area of the Internet of Things module. This unit forms an uncopyable physical structure during wafer manufacturing, and the entropy source output is activated by a special clock driving circuit after power-on. The original entropy value is converted into a binary feature sequence through quantization sampling, and the sampling parameter is preset by the control logic solidified in the hardware read-only memory.

[0028] The feature sequence is compressed through multi-stage linear feedback, and the tap position is set based on the configuration data of the tamper-proof storage unit. The final output is the hardware feature identification. The device type identification is obtained by accessing the device type code library preset in the flash address space through memory mapping. The code library stores the classification coding structure conforming to the industry standard.

[0029] The code contains three logical segments: international device classification identification, manufacturer exclusive field and hardware version information. The extraction operation is performed by the memory management unit in the secure access mode, and the output data is reorganized into the device type identification in the standard byte sequence. The two types of identification are stored in the hardware write-protected memory area, and the physical tamper-proof latch mechanism prevents external illegal modification.

[0030] Two types of identification input bit width alignment module performs standardization processing, using zero expansion strategy to expand the device type identification to hardware feature identification bit width. The expanded double channel data input bit sequence control unit performs splicing operation, and the splicing rule is defined by the control parameters pre-recorded in the bit sequence register: the high bit part intercepts the specific high bit segment of the hardware feature identification, the middle bit part intercepts the middle effective bit segment of the device type identification, and the low bit part is generated by the exclusive operation of the last bit field of the two types of identification. The splicing process is completed in the hardware level parallel processing unit, and the output is the initial binary sequence.

[0031] The sequence enters the verification additional module for integrity protection: the standard lightweight verification algorithm is used to process the complete data block, and the verification module configuration parameters are loaded from the secure read-only memory area. The verification result is appended to the tail of the initial sequence to form a composite identification sequence, and finally stored in the buffer register array with parity check function, and the physical position of the register is strictly matched with the data bus width.

[0032] The preset authentication identification parameter is called from the special key slot of the secure encryption storage area. The parameter is injected by the authentication authorization agency in the device initialization stage, and is transmitted to the anti-physical detection memory unit of the Internet of Things module through the hardware security channel. The composite identification sequence is input to the password processor to perform the identification and authentication process: the sequence data flows through the parallel input register and is divided into fixed length data blocks, and the length of each data block is strictly aligned with the data channel bit width of the password processor.

[0033] The processing key expansion module loads the round key derivation of the authentication identification parameter during the processing, and the derivation logic is based on the state machine solidified in the microcode layer of the processor. The data block and the round key are subjected to multi-round nonlinear transformation operation in the password operation unit, and the transformation process includes byte substitution, row displacement and column confusion operation sequence. The operation result is output to the output cache register to form the intermediate authentication code. The intermediate authentication code is further subjected to feedback loop processing with the last segment of the composite identification sequence, and the number of loops is dynamically determined by the clock count bit of the processor state register. The finally generated dynamic authentication identification is stored in the three-state gate output buffer, and the enable signal of the buffer is controlled by the hardware authentication trigger circuit.

[0034] The dynamic authentication identification is transmitted to the parameter integration unit through the secure data bus. The device type identification is re-called from the original storage location for real-time verification, and the verification operation is performed by the device type verifier: the verifier loads the preset device type whitelist comparison code, and performs bit-level matching detection by using the hardware comparison circuit. The device type identification that passes the verification is input into the shift register, which is driven by the clock signal to reorganize the bit sequence. The reorganized device type identification and the dynamic authentication identification are input into the data fusion channel of the parameter integration unit in parallel. The fusion channel includes a combination structure of cross bit selector and multiplexer, and the selection mode is set by the configuration bit of the integration control register.

[0035] The gating logic is set to dynamically authenticate the high-bit segment of the identification and the middle-bit segment of the device type identification, and the remaining bit segments are arranged in an interleaved manner according to the odd and even positions. The base parameter sequence generated by splicing is transmitted to a length extension module for bit padding, and the padding bit value is determined based on the low-bit data of the hash digest of the device type identification. The complete sequence after extension is subjected to one-way compression operation by a secure hash coprocessor, and a fixed-length device authentication parameter is output. The final parameter is written into an output queue buffer after hardware cyclic redundancy check, and the buffer is set as a first-in first-out double buffer structure to match the asynchronous calling requirement of the subsequent authentication request.

[0036] The embodiment extracts the hardware feature identification, combines the device type identification protected by the tamper-proof memory, constructs a non-reproducible device identity root of trust, effectively resists hardware cloning and firmware tampering attacks, and fundamentally improves the reliability of device identity authentication. The identification authentication mechanism using dynamic key binding deeply couples the authentication identification parameter and the composite identification sequence, realizes the timeliness generation of dynamic authentication identification at the hardware level, overcomes the security defect that static credentials are easily replayed, and enhances the active defense capability of the authentication process. Based on the hardware security unit, the device type is verified again, and the physical level integration of the dynamic authentication identification and the device type identification is realized through the cross-gating logic, ensuring that the device authentication parameter has both identity uniqueness and type authenticity verification characteristics, avoiding illegal device impersonation of legal type access to the system.

[0037] In one embodiment, the hardware feature identification and the device type identification are binary spliced to generate a composite identification sequence, including: The hardware feature identification is input to a bit width alignment module for standardization processing. The module includes a preset bit width configuration register and a data expansion logic unit, and the configuration register stores three types of key parameters: target alignment bit width, padding strategy and sign expansion flag. The alignment logic detects whether the actual bit length of the input hardware feature identification is lower than the target alignment bit width.

[0038] When there is a bit width difference, a padding bit sequence is appended at the high-bit end of the identification according to the preset padding strategy, and the padding bit value is determined according to the bit pattern of the padding strategy register. The padding strategy options include all-zero padding, staggered complementary padding or high-effective-bit copy padding, and the specific mode selection is automatically determined by the hardware feature identification source attribute trigger control circuit. For the special scenario where the sign expansion flag is set, the expansion process needs to preserve the most significant bit sign characteristics of the hardware feature identification.

[0039] After filling, the identification sequence import bit interception unit is accurately cut according to the target alignment bit width, and redundant bit segments exceeding the target bit width are removed. The final output sequence is synchronously written into the first buffer register group through the edge detector, and the register port is configured with a bidirectional data verification circuit to monitor the electrical characteristic abnormalities of the data during the register period. The first standardized identification sequence is stored in a special memory area with a write protection lock, which is physically isolated from the general data storage bus.

[0040] The device type identification input verification engine performs structure reinforcement. The verification engine includes a parity generation unit and a bit insertion controller, and the core verification rule is fixed in a finite state machine implemented in a hardware description language. The parity generation unit divides the device type identification into equal-length bit segments, and each segment length corresponds to a preset verification granularity parameter of the state machine.

[0041] The verification bit calculation adopts an odd parity check mechanism, which counts the number of "1" bits in a byte unit and performs parity determination. When the number of "1" bits in the byte unit is even, a logical "1" is generated as the verification bit; when the number of "1" bits is odd, a logical "0" is generated as the verification bit. The bit insertion controller determines the insertion position of the verification bit according to the storage control parameters, including the insertion interval frequency, the position offset, and the priority insertion area identification. The verification bit is inserted into the original sequence of the device type identification at a set interval frequency, and the insertion position is dynamically offset based on the calculation of the position offset.

[0042] The sequence input length regulation unit after completing the insertion of the verification bit ensures that the output sequence bit width is strictly consistent with the target bit width of the standardization processing. Before the output sequence is transmitted to the second buffer register group, double verification is performed: first, whether the original device type identification classification coding segment is tampered with is compared, and second, whether the distribution of the newly inserted verification bit conforms to the pre-burned verification topology is verified. The second standardized identification sequence is physically stored in a static memory array with independent power supply, and the array is provided with an error correction code mechanism.

[0043] The splicing sequence parameters are loaded from the security configuration storage area to the cross splicing controller, and the parameter storage structure includes a bit mapping table and a channel priority flag bit. The cross splicing controller imports the first standardized identification sequence and the second standardized identification sequence into the high-bit data channel and the low-bit data channel respectively, and the channel data bit width is synchronized and aligned through a hardware-level latch.

[0044] The bit mapping table dynamically controls the bit segment gating logic of the input sequence. The specific operation mode is: according to the index order defined by the mapping table, N-bit data segments are alternately intercepted from the high-bit channel and M-bit data segments are alternately intercepted from the low-bit channel, and the interception bit length parameter is fixed in the channel configuration register. The splicing process is executed in beats under the clock driving, and one pair of data segment bit splicing operations are completed in each clock period. The output sequence is temporarily cached through a parallel shift register, and the depth of the shift register strictly corresponds to the total index number of the mapping table.

[0045] After the full index scan is completed, the buffer sequence input bit sequence reorganization unit performs physical position rearrangement: the intermediate sequence formed by the alternate splicing is rearranged in bit sequence according to the mapping table final stage rule, and the reorganization is based on the parity bit balance constraint and the signal integrity threshold parameter. The final generated initial composite sequence is transmitted to the anti-interference output driver, and the driver configures the impedance matching circuit to eliminate high-frequency crosstalk.

[0046] The redundancy check engine receives the initial composite sequence to perform integrity verification. The check engine is implemented by a linear feedback shift register architecture, and the initial value of the register is set according to the random seed generated in the security start-up phase. The sequence data stream is imported into the input end of the shift register in batches, and the batch length and the register order maintain an integer multiple relationship.

[0047] The shift process simultaneously performs two operations: the data bits are subjected to modulo-2 division operation according to the preset polynomial rule, and the output end collects the feedback tap bit state in real time. After all the bits of the sequence are shifted, the intermediate check code is generated by storing the value in the register kernel. The check code is input into the compression module to perform bit width conversion, and the compression logic adopts a pipeline bit extraction strategy: three bit groups are extracted from high to low in a cycle, and each group outputs a single bit value through the majority decision circuit.

[0048] The compressed standard checksum is input into the tail bit adder to perform merging operation, and the adder automatically activates the merging enable signal after reading the sequence termination identifier. The check sum embedding position strictly follows the tail appending rule: the distance from the sequence end is two empty clock periods to ensure stable level. The final composite identification sequence is generated and transmitted to the secure storage area through the tristate bus, and the bus transaction state is supervised by the check result control gate circuit. When the check logic is abnormal, the transmission channel is immediately fused.

[0049] This embodiment realizes the unforgeable binding of device identity and type through the physical level cross splicing and dynamic check mechanism of hardware feature identification and device type identification, and completely eliminates the risk of identity forgery.

[0050] Based on the composite sequence generation process of the preset splicing rule and real-time redundancy check, a lightweight but strong check data processing chain is constructed. The hardware fuse type control mechanism of the verification result to the execution unit establishes a strong physical level association between authentication and hardware operation. The fuse register directly controls the power on-off of the communication driver circuit according to the 4-bit state code, so that the response delay is low. The device type identification performs dynamic parity check insertion and secondary verification before splicing, forming a double insurance for type authenticity.

[0051] In one embodiment, the device authentication parameter is used to construct authentication request information containing a request identifier, an authentication hash value and a device transmission identifier, including: The hardware feature identification input storage address decoder performs physical block division. The decoder divides the identification sequence according to the physical structure of the non-volatile memory unit, and the division parameters are preset in the address remapping register. Each physical block is imported into a silicon-based noise acquisition circuit with an additional random mask, and the acquisition circuit generates a true random bit sequence using substrate thermal noise. The mask sequence and the block data perform bit confusion in an XOR logic array, and the confusion result is stored in a dual-port buffer memory.

[0052] The buffer memory output is connected to a multiplexer for dynamic sorting, and the sorting offset is determined in real time by the drift value provided by the clock jitter acquisition module. The sorted data stream is input into a hash compression module, which has a built-in programmable lookup table structure, and the table index address is driven by the low bit field of the hardware feature identification digest signal. A fixed-length request identifier is generated and transmitted to an asynchronous first-in-first-out queue, and the queue full flag triggers a hardware interrupt signal to notify the subsequent processing stage that it is ready.

[0053] The device authentication parameters are input into a three-stage serial processing architecture through an isolated data bus. The first stage architecture includes a data separator and a bit matrix multiplication logic: the separator divides the parameters into four parallel data paths, and each path is enhanced by a voltage lifting circuit to enhance signal integrity.

[0054] The bit matrix multiplication logic realizes coefficient operation through gate-level combinatorial circuits, and the coefficient matrix is stored in an anti-radiation interference storage array. The second stage architecture integrates a cyclic bit shifter and a column confusion network: the bit shifter realizes dynamic bit offset based on a ring buffer structure, and the offset step value is refreshed by a true random number generator. The column confusion network uses a reconfigurable logic cell array, and the configuration parameters are bound with the device type identification check field. The final stage architecture sets a data merging compressor: eight groups of bit streams output by the previous two stages are input into a majority decision circuit, and an intermediate code is generated according to the bit width compression rule.

[0055] The intermediate code is input into a non-linear substitution box to perform byte substitution, and the substitution box addressing line is connected to the preset substitution table base address register. Finally, an authentication hash value is generated in an accumulation register, and the accumulation process synchronously triggers a hardware voltage monitor to implement power fusing for abnormal power consumption events.

[0056] The device authentication parameters are input into a time stamp separation circuit to extract the authentication time stamp. The circuit is connected to a high-precision clock generator, and the clock signal is input into a shift register chain after being reduced to the operating frequency by a frequency divider. The tail end of the register chain outputs the original data stream of the time stamp, and the valid start and end boundaries of the time stamp are confirmed by an edge detector.

[0057] The valid time stamp is imported into a bit domain mapping array to perform dynamic reconstruction: the mapping array includes an offset memory and a bit position rearrangement logic, and the offset memory loads the low bit segment of the device type identification as the initial offset factor. The bit position rearrangement logic is implemented by a physical multiplexer group, and the selector control end is connected to the clock drift monitoring module.

[0058] The drift monitoring module captures the metastable characteristics of the clock signal in real time to generate a drift correction quantity, which dynamically refreshes the selector routing table. The reconstruction process concatenates the high-bit part of the timestamp with the middle-bit segment of the device type identifier, and inserts the low-bit part into the timestamp parity bit to form a padding area. The final output data stream is input into the anti-collision buffer to generate a device transmission identifier, and the built-in charge balance circuit in the buffer eliminates high-frequency noise interference.

[0059] The preset random number sequence is generated by a physical noise acquisition module, which captures carrier motion noise through a reverse-biased PN junction. The request identifier, authentication hash value, and device transmission identifier are input into a three-channel alignment register in parallel, and the register realizes three-channel data synchronization through a phase-locked loop. The aligned data is input into the packaging logic unit to perform structured processing: the packaging unit integrates a field mapping table and a bit stream assembler, and the field mapping table is stored in an anti-fuse type memory to define the boundary positions of each element.

[0060] The bit stream assembler adopts a shift register chain construction, and each group of shift registers has a depth corresponding to the bit width of the target sub-field. The assembly process loads data in segments according to the mapping table rules: first, embed the high-bit segment of the request identifier into the first end of the register chain, then split the authentication hash value into four segments and insert them into the middle register block, and fill the device transmission identifier into the end register group. The loaded register chain outputs a serial bit stream to the mixing module, which uses a random number sequence to XOR mask the original bit stream to achieve physical encryption. The encrypted bit stream is written into the secure transmission buffer queue after adding the frame header check code and length identifier, and the queue output interface is configured with an impedance matching resistor to ensure signal integrity.

[0061] This embodiment converts the hardware feature identifier into a request identifier with physical unpredictability through physical-level block division and silicon-based noise confusion mechanism. This process uses storage medium row address boundaries to segment the identification data, and uses semiconductor thermal noise to achieve bit-level random disturbance, so that attackers cannot deduce the device identity through logical analysis. A three-level processing architecture with dynamic offset column confusion is adopted to generate an authentication hash value that binds the physical characteristics of the device. Bit matrix multiplication is realized through hardware gate circuits, and the anti-radiation characteristics of the coefficient matrix ensure data integrity in high-temperature environments; the column confusion network responds to the dynamic reconstruction logic unit array of the device type identifier, so that the same device generates different hash values at different times. The clock signal metastable characteristics correct the timestamp bit sequence offset in real time, and the middle segment of the device type identifier is physically spliced into the high-bit area of the timestamp.

[0062] In one embodiment, the authentication timestamp identifying the device authentication parameter is dynamically mapped with the device type identifier to generate a device transmission identifier, including: The device authentication parameter input timestamp separation processing logic performs a data extraction operation. The logic integrates a location register and a length comparator circuit, the location register is preset with a timestamp start bit offset parameter. The processing logic activates a synchronization signal sampling device authentication parameter data bus, and the interception enable is triggered when the bus transaction count matches the location register value.

[0063] The interception window duration is determined by the length comparator set value, and the comparator reference value is fixed in the mask programmable memory. The intercepted raw timestamp input calibration unit performs time reference correction: the calibration unit is connected with a temperature compensation clock source, and the frequency of the clock source is adjusted by the feedback of the environment temperature sensor. The calibration process uses a phase interpolation technique to reduce the clock jitter error, and the interpolation offset is dynamically calculated according to the last byte of the device type identifier.

[0064] The corrected timestamp enters the valid time window detector, and the detector compares the timestamp with the time permission interval issued by the current time center. When the timestamp falls within the permission interval, the high 8 bits of the device type identifier are added to the end of the timestamp as the time zone correction factor. Finally, the request timestamp is generated and stored in the anti-radiation memory unit, which uses a three-well isolation structure to prevent data from being disturbed by ionizing radiation during storage.

[0065] The request timestamp and the device type identifier are imported into the feature mapping array to perform spatial reconstruction. The mapping array includes a position switcher and a weight assignment logic, and the position switcher dynamically configures a pin routing table according to the feature value of the device type identifier.

[0066] The routing table divides the timestamp data bit stream into three data segments of high / middle / low, and at the same time, the device type identifier is divided into a check segment and a feature segment. The weight assignment logic is realized in a programmable gate array, and the assignment rule is determined by the mapping template preset in the antifuse memory. The mapping performs a hierarchical processing: in the first stage, the high bit segment of the timestamp and the device type feature segment are subjected to a bit cyclic convolution operation, and the convolution kernel parameters are selected from different versions of the fixed parameter table according to the current temperature value; in the second stage, the middle bit segment of the timestamp and the device type check segment are input into a majority decision circuit for bit binding; in the last stage, the low bit segment of the timestamp is subjected to an odd-even position inversion.

[0067] The three-stage processing result is input into a data aggregation buffer, and the buffer is configured with a dynamic bit width adjustment function. The aggregation result is subjected to an entropy enhancement processing by a linear feedback shift register, and the register tap position is driven by the device type identifier hash value. The output device mapping data is transmitted to a temporary register group waiting for the next stage processing, and the register group is provided with a bus watchdog circuit to prevent unauthorized access.

[0068] The device mapping data is input to a security check engine for integrity reinforcement. The check engine integrates a multi-stage linear feedback architecture and a bit segment filter. The linear feedback architecture is configured with reloadable tap coefficients, and the coefficient values are dynamically loaded from a parameter pool of anti-radiation memory. The data stream is divided into frames and introduced into a feedback shift register chain. The initial state of the register is set by the last byte of the device type identifier.

[0069] A multi-round bit shift accumulation operation is performed under clock driving. The output feedback bit state is collected every time a single-byte bit shift is completed. A modulo-2 division operation is performed by connecting the feedback path to an XOR gate array. When all data bits are shifted, the register kernel value generates the original check code. The bit segment filter immediately performs feature extraction on the check code. The filter is connected to a positioning register and a mask generator. The positioning register specifies the target bit segment start and end offset, and the mask generator outputs the corresponding bit selection mask.

[0070] The extraction operation is implemented through physical gate circuits. The mask bits corresponding to the bit segment to be extracted are set to high, and the remaining bits are grounded for shielding. The output signal is adjusted by a level shifter and then enters the on-chip buffer. The buffer output is the device feature padding code. The padding code is temporarily stored in a dual memory unit with parity check. The unit is configured with a charge balancing circuit to compensate for the leakage effect during data retention.

[0071] The request timestamp, device mapping data, and device feature padding code are input in parallel to a structured combiner for physical integration. The combiner adopts a three-stage pipeline architecture. The first stage is a bit width calibrator, which unifies the bit widths of the three data paths through zero extension or high bit truncation. The second stage is a position cross-coupler, which rearranges the physical positions of the data bits according to the pre-recorded bit sequence topology. The third stage is a field compressor, which uses bit interleaving strategy to reduce the total bit width.

[0072] The combination process strictly follows the predefined protocol. The request timestamp occupies the high bit segment of the transmission identifier, and the bit width calibrator appends an 8-bit version marker to the high bit end. The device mapping data fills the middle bit segment, and the position cross-coupler dynamically adjusts the internal bit sequence according to the hash value of the device type identifier. The device feature padding code locks the low bit segment, and the compressor performs 4:1 bit aggregation compression on it.

[0073] The output data stream enters an integrated packaging unit. A 2-byte cyclic redundancy check frame header identifier is added, and a 1-byte length control field is appended. The packaging structure is fixed in an anti-fuse read-only memory array. The final generated device transmission identifier is written to the transmission queue buffer, which has a bus clock synchronization mechanism to ensure that the identifier transmission timing is strictly phase-locked with the system clock.

[0074] The embodiment constructs a device identity certificate chain through physical level binary splicing of hardware feature identifier and device type identifier and dynamic verification mechanism. The synergistic processing flow of three-order iterative diffusion calculation and dynamic bit field mapping reduces the authentication delay to milliseconds under the premise of ensuring industrial level security strength. The verification result directly drives the hardware fuse control mechanism to establish a physical barrier for device access across the software layer. When the cloud verification is abnormal, the fuse register sends an irreversible locking instruction to the execution unit control port, with a response speed of microseconds.

[0075] In one embodiment, the authentication request information is bound with the device relationship and verified by the cloud to obtain a cloud verification result, including: The authentication request information is securely parsed and structurally decoded. After identifying the valid starting position, the length identifier verifier extracts the frame length field and drives the clock counting module to generate a time window control signal. The data stream input loop shift register chain performs bit alignment, and the register cascade depth matches the maximum protocol frame length. The core fields of the authentication request information are extracted in the alignment process: the device unique code occupies a fixed offset address field, which is activated by the address decoder to output the corresponding register enable; the authentication timestamp is stored in a special timestamp segment with parity, and the time value is captured by the edge trigger latch.

[0076] The device unique code field is input into the redundancy check unit, which performs error detection using a preloaded check polynomial, and the error positioning signal triggers the hardware interrupt mechanism. The timestamp synchronization time center calibration module includes temperature drift compensation and time base drift correction, and the correction value is written to the timestamp reorganization logic. Finally, the device unique code and the calibrated authentication timestamp are written to the dual-port output register, and the register is configured with a hardware write protection lock to prevent bus sniffing attacks.

[0077] The device unique code is transmitted to the cloud query engine in the cloud server through an encrypted physical channel for query. The engine includes an address converter and a hardware acceleration module, the address converter maps the code to the physical address of the database storage unit, and the mapping rule is burned in the anti-fuse configuration memory. The physical address is input into the row and column address decoder to drive the storage unit array, which is implemented using a radiation-hardened storage unit matrix. The unit matrix is configured with a multi-layer error correction code mechanism.

[0078] The access process starts the hardware acceleration module to perform parallel query: the device unique code is separated into high / low segment address index, the high index activates the memory bank selection signal, and the low index locates the storage unit row address. The hit data is output to the data integrator: the reference hardware identifier is stored in the first storage area of the storage unit array, and the analog feature signal is read by the differential amplifier and converted into a digital signal; the reference device type occupies the second storage area, and the type verifier verifies the validity of the classification code.

[0079] Data output is performed before the physical tamper-proofing verification: the current sensitive circuit monitors the abnormal fluctuations of the discharge current of the storage unit, and the optical sensor detects the integrity of the package. The reference hardware identification and the reference device type are transmitted to the verification processing queue through the serialized output interface, and the interface is configured with an impedance matching network to resist signal integrity attacks.

[0080] The verification master key is called from the physically isolated storage area of the cloud hardware security module, and a dynamic session key is generated through a multi-level key derivation protocol. The reference hardware identification is input into the encryption coprocessor, which divides the identification data into equal-length bit segments and performs an iterative binding operation with the dynamic session key. Each iteration includes three processing cycles: the first cycle generates a mask sequence using the low-bit field of the authentication timestamp; the second cycle performs bit expansion XOR between the reference identification segment and the mask sequence; and the third cycle performs round encryption through the dynamic session key.

[0081] The operation delay and clock jitter deviation are monitored synchronously during processing, and when the deviation exceeds the limit, the fault-tolerant processing program is started to reset the iteration sequence. The output data stream input verification identification generates logic to perform aggregation conversion: the encrypted bit segments are cyclically shifted using a redirecting feedback shift structure, and the bit shift step value is dynamically modulated by the timestamp millisecond count value. The shift result generates an intermediate verification code through an entropy compression unit, which is configured with a majority decision circuit to eliminate single-bit errors. The final generated request end verification identification is stored in an anti-interference output buffer, and the buffer area is configured with a charge rebalancing circuit to ensure the stability of the level.

[0082] The request end verification identification input discriminant logic array performs feature matching. The discriminant logic loads preset threshold parameters and binding rule templates, the threshold parameters are stored in a fuse programmable memory, and the binding rule templates define the migration conditions of the verification state machine. The matching process is performed in stages: the first stage compares the verification domain of the verification identification with the preset fault-tolerant threshold, and a window comparator is used to realize fast interval judgment; the second stage analyzes the binding feature bit segment of the verification identification, and performs topological similarity analysis with the pre-stored device relationship graph.

[0083] The analysis result input condition trigger circuit: when the verification domain matches and the similarity exceeds the activation threshold, the cloud binding engine establishes physical association. The binding engine starts the device relationship storage area access protocol: writes the device unique code, reference device type and current timestamp into the adjacent storage cells of the relationship storage matrix, and the cell address is derived through the device type hash value. After the write operation is completed, a 128-bit verification result data packet is generated, including the binding state word and the resource access token. If any of the discrimination conditions is not met, the error accumulation counter triggers an interrupt, and the fuse programming circuit permanently writes a failure identification code to the error storage area. The failure information is packaged into a response message with an error category code and a timestamp, which is transmitted to the terminal interface through an independent physical channel.

[0084] The embodiment ensures that the extraction process of device unique code and authentication timestamp is not affected by electromagnetic interference through physical level identification analysis and anti-radiation database query mechanism. A multi-level key derivation and fault-tolerant encryption verification identification generation scheme is adopted to establish dynamic protection of the reference hardware identification within nanosecond level delay. The rotation encryption iteration eliminates the risk of timing attack, and the charge rebalancing design ensures the stability of the level. The discrimination execution architecture based on fuse programming forms the irreversible characteristics of the hardware level verification conclusion. The nanosecond level threshold judgment of the window comparator combined with the device relationship graph analysis makes the illegal access behavior produce permanent failure record, and completely blocks the permission control vulnerability. Independent physical channel transmission of verification results forms an end-to-end anti-pollution system. Binding operation and error response are isolated and disposed at the physical layer.

[0085] In one embodiment, the device verification is performed on the reference hardware identification in combination with the preset verification master key and the authentication timestamp, and the request end verification identification is generated, including: The reference hardware identification input row-column address decoder performs physical segmentation operation. The decoder loads the preset segmentation strategy parameters to activate the row-column control signal, and the strategy parameters are fixed in the anti-radiation configuration memory. The hardware identification is divided into equal-length data blocks according to the physical address boundary, and the address boundary value is derived from the low bit field of the identification itself hash digest. Each data block is independently stored in a physical register group with isolated power supply, and the register groups are prevented from data penetration through the hardware barrier circuit.

[0086] The segmentation operation synchronously triggers the timing arbitrator to coordinate the processing rhythm, and the arbitrator dynamically adjusts the register write delay according to the clock frequency. The data block is output to the shift register chain to perform bit reorganization, and the reorganization rule dynamically configures the bit sequence mapping table according to the check bit characteristics of the device type identification. The final generated segmented hardware identification is written into the double-buffer memory array, and the array is configured with a cyclic redundancy check mechanism to ensure storage integrity. The check exception signal is directly connected to the fuse control circuit to trigger the storage unit power-off protection.

[0087] The authentication timestamp input millisecond level extraction circuit separates the low bit field, and the extraction circuit is configured with an edge trigger latch to capture the count value of a specific clock cycle. The low bit field is imported into a disturbance factor generation engine, which includes a noise acquisition unit and a control word generator. The noise acquisition unit is connected to a silicon-based thermal noise sensor, which generates a true random entropy source by real-time acquisition of substrate carrier thermal operation. The entropy source is input into a non-linear converter to perform entropy compression, and the converter output performs bit interleaving operation with the control word generator.

[0088] The control word generator loads the high-order bit field of the authentication timestamp in microseconds, generates a sequence of perturbation control words through a finite state machine. The interleaved result inputs a feedback shift register to perform a cyclic diffusion process, and the register tap position is dynamically set by the first segment data identified by the segmented hardware. The output data stream is adjusted in amplitude by a voltage tuning circuit to form a dynamic perturbation factor and stored in an anti-interference latch. The current balance circuit at the output end of the latch eliminates the charge accumulation effect to ensure the stability of the perturbation factor electric signal.

[0089] The main key is called from the secure storage unit, and the dynamic session key is generated through the key derivation engine. The key binding process is performed by the dynamic perturbation factor input timing verification logic: first, the perturbation factor is divided into high and low bit dual-channel data streams, the high bit stream is imported into the parallel password processor to perform the key expansion operation, and the low bit stream is embedded with the timestamp phase feature through the phase modulator.

[0090] The processing process adopts a triple coupling mechanism: the round key of the password processor is dynamically reconstructed based on the hash digest of the main key; the phase modulation parameter is adaptively adjusted with the change of the environmental temperature; and the dual-channel data performs a cyclic interlocking operation in the cross feedback network. The output data stream is input into the time effectiveness verification module: the verification module includes a window comparator and a drift compensation logic, the comparator verifies whether the phase drift is within the permitted tolerance interval issued by the time center. After the verification is passed, the data is input into the compression register to generate time effectiveness verification information, and the register is configured with a fault code fusing mechanism, which will permanently lock the output channel if the verification fails for three times in a row.

[0091] The time effectiveness verification information is input into the signature engine to generate a digital signature template. The signature engine includes a preset signature algorithm array and a feature mapping unit, the algorithm array loads an anti-quantum computing signature protocol, and the mapping unit reconstructs the mapping topology according to the physical address features identified by the segmented hardware.

[0092] The signature performs a step-by-step process: first, the segmented identifier is imported into the hash compressor to generate a digest sequence; second, the digest sequence is encrypted at the gate circuit level using the time effectiveness verification information; and third, the encrypted result and the request feature code are interlocked and bound in the association network. The association network is realized by using a multiplexer array: the selector activates a specific path according to the check bit of the device type identifier, and each path is connected with an XOR gate and a majority decision circuit.

[0093] The final output data is input into the verification identifier generator for physical packaging: the generator integrates a bit sequence shuffler and entropy enhancement logic, the shuffling rule is driven by the low bit field of the main key, and the entropy enhancement compensates for randomness by using silicon-based thermal noise. The packaged request end verification identifier is written into the anti-radiation output buffer, and the buffer area is configured with an end-to-end cyclic redundancy check and an anti-power analysis shielding layer.

[0094] The embodiment decomposes the reference hardware identification into physically isolated data blocks and integrates time stamp disturbance through a segmented identification processing and dynamic disturbance factor coordination mechanism, so that the device identity verification has dynamic randomness. The scheme eliminates the risk of replay attacks in the static verification mode and improves the defense capability against forgery attacks. A double-channel processing technology of main key binding time-limited verification is adopted, and a dynamic session key derived from the key is used to perform time sequence shift detection on the disturbance factor. This method avoids complex encryption operations while maintaining high security strength, reduces the verification resource overhead of the cloud, and ensures the verification accuracy of the millisecond-level time window. Based on the encapsulation mechanism of physical level signature verification and request association, the segmented identification digest and time-limited information are deeply bound through gate circuit level encryption operation.

[0095] In one embodiment, the execution unit of the Internet of Things module is dynamically called according to the cloud verification result to complete device access control, including: The cloud verification result input hardware decoding circuit executes signal analysis. The circuit integrates a state code separator and a permission identifier extractor. The state code separator intercepts a fixed length state field according to a preset bit offset rule, and the bit offset parameter is fixed in the anti-fuse configuration memory. The permission identifier extractor activates a multi-selector group to locate the device permission field, and the selector control signal is driven by the verification result frame check sum.

[0096] The extracted verification state code is input into a priority encoder to convert it into a binary execution code. The encoding rule is burned in the anti-radiation read-only memory array. The device permission identifier is imported into the permission analysis logic to perform bit segment reorganization. The reorganization strategy is bound to the last byte of the device type identifier. The execution instruction library is stored in the instruction mapping area of the non-volatile memory. The mapping area is divided into 128-bit instruction units, and the unit address is dynamically indexed by the state execution code hash digest.

[0097] The matching process is implemented by a physical comparator array: the verification state code and the device permission identifier are spliced into an index key value, and the key value and the instruction unit address line perform a voltage comparison operation. When the matching is successful, the enable signal triggers the output buffer to latch the instruction unit data; if the matching fails, the fuse circuit is activated to burn the error instruction storage unit. Finally, the dynamic execution instruction set is stored in the isolated dual-port buffer memory, and the buffer configuration bus monitoring protection mechanism is activated.

[0098] The dynamic execution instruction set is input into the function mapping engine to perform physical binding operation. The engine includes a device tree scanner and a function matching logic. The device tree scanner accesses the hardware topology descriptor pre-stored in the secure storage area. The descriptor structure contains the physical address and interface characteristics of the execution unit.

[0099] Scan process start timing synchronization mechanism: device tree partition clock and instruction set transmission clock phase-locked, eliminate signal delay deviation. Function matching logic using multi-stage gate circuit implementation: first parse the instruction set resource demand field generated function vector; second read the unit characteristics of the topology descriptor generated ability vector; finally through the voltage comparison circuit to execute vector similarity measurement. Comparison results input decision circuit: when the similarity exceeds the activation threshold, the unit enable signal is generated and injected into the configuration register of the target execution unit; when there are multiple candidate units, start power consumption optimization algorithm to select the lowest power path. The determined execution unit physical address is written to the address mapping register, and the register configuration write protection lock prevents tampering. The execution unit activation state is synchronized to the state monitoring bus through the hardware handshake protocol, and the bus abnormal event triggers the execution unit power fuse mechanism.

[0100] Device permission identification input resource arbiter executes physical partition operation. The arbiter integrates bandwidth allocation register and time slot control logic, and the register stores the preset interface resource topology table, and the topology table element contains physical channel number, spectrum bandwidth parameter and time division multiplex frame structure. The control logic parses the bit field characteristics of the permission identification to generate a resource demand vector: the high bits of the vector define the interface type priority, the middle bits specify the minimum safety isolation degree, and the low bits determine the bandwidth compensation factor.

[0101] Resource allocation process starts hardware cascade protocol: first activate the physical channel switch array of the execution unit, and the array control signal is driven by the type priority field; second, configure the frame synchronization parameters of the time slot controller, and the parameter value is calculated dynamically according to the safety isolation degree; finally, call the clock gating unit to allocate timing resources, and the gating enable signal is linearly related to the bandwidth compensation factor.

[0102] Cloud connectivity uses a physical signal modulation strategy: the modulator loads the reference carrier frequency, and the frequency value is locked by the device type identification hash digest; the output signal of the execution unit is embedded with the feature code of the permission identification after passing through the anti-aliasing filter in the quadrature modulation unit. The error rate monitoring is started in the connectivity test stage, and the frequency automatic calibration loop is triggered when it is exceeded. The established cloud communication link is recorded in the link state register group, and the register has a temperature compensation crystal oscillator to maintain the clock accuracy.

[0103] The cloud communication link activates the data transmission state machine, and the state machine switches to the instruction sending mode. The dynamic execution instruction set input frame assembler executes physical packaging: the assembler calls the preset communication protocol template, and the template header inserts the permission identification as the link addressing prefix; the instruction data block is divided into fixed length cells, and each cell is attached with a cyclic redundancy check sequence.

[0104] The encapsulated data stream input high-speed serializer converts parallel data, and the serializer clock source adopts the output of a phase-locked loop driven by the authority identifier. The signal transmission process monitors the link quality in real time: the eye diagram analysis module detects signal integrity, and the jitter measurement unit feeds back the clock drift value. The monitored data input adaptive equalizer dynamically compensates for channel distortion, and the equalization coefficient update rate is positively correlated with the instruction key level.

[0105] After the instruction set successfully arrives at the execution unit, the instruction decoder in the unit starts physical analysis: the authority verification module matches the link prefix with the local identifier; the core instruction segment inputs the programmable logic array reconstruction control signal; and the check bit triggers the gate circuit to activate the execution enable. Finally, the execution unit drives the output interface circuit to complete access control: the power management module turns on and off the load current according to the instruction parameters; the data port configures the terminal impedance matching network to suppress reflected interference; and the security state register writes the operation fuse mark to permanently save the control record.

[0106] The embodiment realizes accurate matching of the interface resources of the execution unit and the device authority identifier through physical partition operation and resource arbitration mechanism of the time slot control hardware. The cloud interconnection technology of embedding the authority feature code by using orthogonal modulation is used to implant the device identity certificate at the physical layer of the communication link. The modulation carrier frequency is locked by the device type hash digest, so that the transmission signal has the dual functions of data bearing and device authentication, and the identity separation vulnerability of the traditional link establishment is eliminated. Through the adaptive equalization transmission mechanism guided by the eye diagram analysis, the integrity of the instruction transmission is maintained in a strong interference environment. The dynamic compensation coefficient is adjusted in real time according to the instruction key level, and the error rate is reduced by orders of magnitude through the cyclic redundancy check sequence, so as to ensure that the key control instruction is zero distortion to the execution unit.

[0107] Referring to Figure 2 The application also provides an Internet of Things module security authentication system, which is applied to the Internet of Things module security authentication method. The acquisition module is used for extracting the hardware feature identifier and the device type identifier pre-stored in the Internet of Things module, and generating a device authentication parameter; The analysis module is used for constructing authentication request information containing a request identifier, an authentication hash value and a device transmission identifier by using the device authentication parameter; The association module is used for performing device relationship binding and cloud verification on the authentication request information, and obtaining a cloud verification result; The processing module is used for dynamically calling the execution unit of the Internet of Things module according to the cloud verification result, and completing device access control.

[0108] It should be noted that the skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system and each module described above can refer to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0109] The application provides a kind of Internet of Things module security authentication system, by extracting the hardware characteristic mark and equipment type mark of Internet of Things module, and in combination with the dynamic generation of equipment authentication parameter, effectively prevent the security risk caused by static key leakage or equipment cloning, improve the anti-fake ability of authentication mechanism.Construct authentication request information using request identifier, authentication hash value and device transmission identifier, multiple verification is carried out in combination with hardware characteristics and equipment type, avoid single identification to be forged or tampered with, improve the reliability and security of authentication.Combining with cloud verification through device relationship binding, realize the real-time check and dynamic strategy adjustment of equipment identity, ensure that the authentication process and cloud security policy are synchronous, enhance the overall security protection ability of system.According to the cloud verification result, the execution unit of Internet of Things module is dynamically called, the on-demand activation or restriction of device function is realized, unauthorized operation is prevented, and the controllability and security of device access are improved.The cooperative verification of hardware characteristics, equipment type and cloud strategy can flexibly adapt to the security requirements of different Internet of Things scenes, ensure the applicability and reliability of authentication mechanism in different environments such as smart home and industrial Internet of Things.

[0110] The above is only the preferred embodiment of the application, and does not limit the patent scope of the application, any equivalent structure or equivalent process transformation using the content of the specification and drawings, or direct or indirect application in other related technical fields, are also included in the patent protection scope of the application.

Claims

1.A method for security authentication of an Internet of Things module, characterized in that, The method comprises the following steps: extracting the hardware feature identifier and the device type identifier preset by the Internet of Things module, and generating a device authentication parameter; constructing authentication request information containing a request identifier, an authentication hash value and a device transmission identifier using the device authentication parameter; performing device relationship binding and cloud verification on the authentication request information to obtain a cloud verification result; dynamically calling an execution unit of the Internet of Things module according to the cloud verification result to complete device access control. 2.The method of claim 1, wherein, The method of extracting the hardware feature identifier and the device type identifier preset by the Internet of Things module, and generating a device authentication parameter comprises the following steps: performing an identifier scanning operation on a preset storage area of the Internet of Things module to obtain the hardware feature identifier and the device type identifier; splicing the hardware feature identifier and the device type identifier in binary to generate a composite identifier sequence; performing identification authentication on the composite identifier sequence according to a preset authentication identification parameter to generate a dynamic authentication identifier; integrating the dynamic authentication identifier and the device type identifier to generate the device authentication parameter. 3.The method of claim 2, wherein, The method of splicing the hardware feature identifier and the device type identifier in binary to generate a composite identifier sequence comprises the following steps: performing bit width alignment on the hardware feature identifier to obtain a first standardized identifier sequence; performing parity check bit insertion on the device type identifier to obtain a second standardized identifier sequence; performing cross splicing processing on the first standardized identifier sequence and the second standardized identifier sequence according to a preset splicing order parameter to obtain an initial composite sequence; calculating a redundancy checksum of the initial composite sequence and appending the redundancy checksum to the tail of the initial composite sequence to generate the composite identifier sequence. 4.The method of claim 1, wherein, The method of constructing authentication request information containing a request identifier, an authentication hash value and a device transmission identifier using the device authentication parameter comprises the following steps: performing request grouping on the hardware feature identifier to generate a request identifier; performing three-order iteration diffusion calculation on the device authentication parameter to generate an authentication hash value; identifying an authentication timestamp of the device authentication parameter and performing dynamic bit domain mapping operation on the device type identifier to generate a device transmission identifier; performing structured packaging on the request identifier, the authentication hash value and the device transmission identifier using a preset random number sequence to generate the authentication request information. 5.The method of claim 4, wherein, The method of identifying an authentication timestamp of the device authentication parameter and performing dynamic bit domain mapping operation on the device type identifier to generate a device transmission identifier comprises the following steps: separating a preset length of the authentication timestamp from the device authentication parameter and identifying the request timestamp by combining the device type identifier; performing feature mapping on the request timestamp and the device type identifier to generate device mapping data; performing security checksum and bit segment extraction on the device mapping data to obtain a device feature padding code; performing structured combination on the request timestamp, the device mapping data and the device feature padding code to obtain the device transmission identifier. 6.The method of claim 1, wherein, The method of performing device relationship binding and cloud verification on the authentication request information to obtain a cloud verification result comprises the following steps: The authentication request information is subjected to authentication analysis to obtain a device unique code and an authentication timestamp; The device unique code is used to query a preset cloud pre-registration database to obtain a reference hardware identifier and a reference device type; The reference hardware identifier is subjected to device verification based on a preset verification master key and the authentication timestamp to generate a request end verification identifier; The request end verification identifier is subjected to binding discrimination according to a preset discrimination condition, and if the request end verification identifier meets the preset condition, a cloud end binding association is established according to the reference device type to generate a cloud end verification result; If the request end verification identifier does not meet the preset condition, a verification failure information is generated. 7.The method of claim 6, wherein, The reference hardware identifier is subjected to device verification based on a preset verification master key and the authentication timestamp to generate a request end verification identifier, including: The reference hardware identifier is subjected to segmented identification to form a segmented hardware identifier; A dynamic disturbance factor is obtained by disturbance construction according to a millisecond level low bit field of the authentication timestamp; The dynamic disturbance factor is subjected to device timing verification based on the master key to generate time effectiveness verification information; The segmented hardware identifier is subjected to signature verification and request association using the time effectiveness verification information to obtain the request end verification identifier. 8.The method of claim 1, wherein, The cloud end verification result is used to dynamically call the execution unit of the Internet of Things module to complete device access control, including: The verification status code and the device permission identifier of the cloud end verification result are extracted, and instruction matching is performed with a preset execution instruction library to obtain a dynamic execution instruction set; The Internet of Things module is subjected to function mapping matching based on the dynamic execution instruction set to determine the execution unit of the Internet of Things module; The execution unit is subjected to interface resource allocation and cloud end connection according to the device permission identifier to obtain a cloud end communication link; The dynamic execution instruction set is sent through the cloud end communication link, and the execution unit is triggered to complete device access control. 9.A system for secure authentication of an Internet of Things module, the system comprising: The method is applied to the Internet of Things module security authentication method in any one of claims 1-8, including: A collection module is used to extract the preset hardware characteristic identifier and the device type identifier of the Internet of Things module and generate device authentication parameters; An analysis module is used to use the device authentication parameters to construct authentication request information containing a request identifier, an authentication hash value and a device transmission identifier; An association module is used to perform device relationship binding and cloud end verification on the authentication request information to obtain a cloud end verification result; A processing module is used to dynamically call the execution unit of the Internet of Things module according to the cloud end verification result to complete device access control.

Images