Auditable privacy protection authentication method based on Internet of Things access

Abstract

The invention relates to the technical field of Internet of Things access, in particular to an auditable privacy protection authentication method based on Internet of Things access, which comprises the following steps: acquiring an uplink and downlink message extraction field set and verifying consistency, generating a mismatch identifier and screening a protocol candidate set if the uplink and downlink message extraction field set is not consistent, matching an optimal protocol based on the mismatch identifier and generating an instruction, and reconstructing a session collection feature construction vector to obtain a synchronization period, and predicting a trend judgment deviation adjustment period to generate a scheduling strategy. According to the invention, through uplink and downlink message structure field consistency verification and protocol matching score screening, rapid adaptation and dynamic identification of an authentication protocol are realized, a protocol vector model and similarity score are fused to improve multi-protocol authentication elasticity, and delay jitter is introduced to construct a communication dynamic vector. In combination with trend prediction and period adjustment, the key synchronization real-time adaptive ability is enhanced, key refresh is triggered when communication abnormity occurs initially, the key update sensitivity is improved, and the authentication accuracy of equipment access and the privacy protection durability are guaranteed.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of Internet of Things access, in particular to an auditable privacy protection authentication method based on Internet of Things access. BACKGROUND

[0002] The technical field of Internet of Things access relates to connecting a large number of physical devices to an information system through a network to realize remote monitoring, data collection and control management of the devices, and the core matters include device identity identification, communication protocol compatibility, data transmission security, user authentication and permission control, and in actual application, the technical field of Internet of Things access widely covers the fields of smart home, industrial automation, intelligent transportation and smart medical treatment, and requires that the devices can be stably accessed and data is interacted in a heterogeneous network environment, and the devices have a certain degree of security isolation and privacy protection mechanism.

[0003] Among them, the traditional auditable privacy protection authentication method based on Internet of Things access refers to that in the process of Internet of Things terminal device access to the network, an identity authentication mechanism is set to identify the legal device, and a log record is introduced to support subsequent security audit, and traditionally, the identity authentication is usually carried out based on a symmetric key distribution mode, a pre-shared key or a key agreement means is used to establish a trust relationship between the device and the access platform, and in the authentication process, a session token, a random number challenge and the like are used to complete interactive verification, and the timestamp, the device identifier and the request parameter and the like of the authentication transaction are recorded as audit data and saved in a local or remote server for subsequent inspection.

[0004] Since the traditional mechanism relies on fixed protocols and preset interaction processes, when encountering inconsistent device protocol versions or abnormal response structures, the mechanism lacks flexibility, which leads to an increased probability of authentication process interruption or error identification, especially in the scene of heterogeneous device collective access or unstable communication link, the system adaptability problem is more likely to be exposed, and the key synchronization period is usually set according to a static rule, and the dynamic response ability to the actual network condition is poor, if the time delay is abnormal or the data packet is jittered, the synchronization strategy is still maintained according to the original period, which is easy to make the authentication data suffer from a replay attack or the key expire without being updated in time, and then the overall security protection level of the authentication link is weakened. SUMMARY

[0005] The purpose of the application is to solve the problems existing in the prior art, and an auditable privacy protection authentication method based on Internet of Things access is provided.

[0006] In order to achieve the above purpose, the application adopts the following technical scheme: an auditable privacy protection authentication method based on Internet of Things access, comprising the following steps: S1: obtaining an uplink handshake message and a downlink response message, extracting a message structure field set and performing consistency verification, if the verification is inconsistent, generating a protocol mismatch state identifier, and screening an authentication protocol candidate set;

[0007] S2: based on the protocol mismatch state identification, traversing the authentication protocol candidate set, vectorizing the message structure field set of the downlink response message with the preset field model of each protocol, calling a cosine similarity algorithm to calculate a protocol matching degree score, screening an authentication protocol with the highest protocol matching degree score, and generating an optimal matching protocol instruction;

[0008] S3: according to the optimal matching protocol instruction, reconstructing an authentication session, collecting a round-trip delay and a data packet transmission interval, calculating a deviation and a jitter rate, constructing a communication dynamic feature vector, and obtaining a current key synchronization period;

[0009] S4: for the communication dynamic feature vector, a sliding average model is used to predict a trend, a same direction deviation of the deviation and the jitter rate is judged, and a window sliding adjustment is performed on the current key synchronization period to generate an adaptive key refresh scheduling strategy.

[0010] As a further scheme of the application, the protocol mismatch state identification includes a mismatched field type, a field length error and a field bit sequence index offset, the authentication protocol candidate set includes a protocol identifier list, a protocol version number and an associated encryption algorithm specification, the optimal matching protocol instruction specifically is a unique identifier of a selected protocol, a handshake parameter mapping relationship and a key negotiation function pointer, the communication dynamic feature vector includes a deviation of a round-trip delay, a jitter rate of a data packet transmission interval and a measurement timestamp, the current key synchronization period includes a current synchronization timestamp, a period length value and a next expected synchronization point, and the adaptive key refresh scheduling strategy specifically indicates an adjusted synchronization time point, a window sliding direction and a sliding amplitude.

[0011] As a further scheme of the application, the S1 step specifically includes: obtaining original data streams of the uplink handshake message and the downlink response message, parsing and extracting respective message headers, authentication payloads and timestamp fields, and constructing an initial message structure field set;

[0012] A preset protocol field baseline template is called to perform a field-by-field consistency check on the initial message structure field set, and the field type, the field length and the field bit sequence index are compared;

[0013] If the check result is inconsistent, the specific mismatched field position and the error type are recorded, and the protocol mismatch state identification is generated;

[0014] Based on the non-mismatched field information recorded in the protocol mismatch state identification, a search and matching are performed in a local protocol library, all compatible authentication protocols are screened out, and the authentication protocol candidate set is generated.

[0015] As a further scheme of the present application, the S2 step specifically comprises: traversing each authentication protocol in the authentication protocol candidate set, and obtaining the preset field model corresponding to the authentication protocol;

[0016] numerically encoding each field value in the set of message structure fields of the downlink response message to construct a downlink message feature vector;

[0017] numerically encoding the preset field model of the currently traversed authentication protocol to construct a protocol model feature vector;

[0018] calling the cosine similarity algorithm to calculate the vector cosine value of the downlink message feature vector and the protocol model feature vector to obtain an initial protocol matching degree score;

[0019] After completing the traversal calculation of all candidate protocols, sorting all initial protocol matching degree scores, screening out the authentication protocol with the highest protocol matching degree score, and generating the optimal matching protocol instruction.

[0020] As a further scheme of the present application, the S3 step specifically comprises: according to the optimal matching protocol instruction, calling the key negotiation function pointer and inputting the mapped handshake parameter, completing key negotiation with the target device, and rebuilding the encrypted authentication session;

[0021] In the encrypted authentication session, continuously collecting the sending time stamp and the receiving confirmation time stamp of N data packets, calculating N groups of the round-trip delay, and recording the sending time stamp of adjacent data packets to calculate N-1 groups of the data packet transmission interval;

[0022] Based on N groups of the round-trip delay, the offset O of the round-trip delay is calculated by the following formula rtt :

[0023] Wherein, O rtt represents the offset of the round-trip delay, RTT i is the round-trip delay measured for the i-th time, N is the total number of measurements, is the reference round-trip delay according to the historical communication data statistics, and i is the summation index variable;

[0024] Based on N-1 groups of the data packet transmission interval, the sample standard deviation of N-1 groups of the data packet transmission interval is calculated to obtain the jitter rate of the data packet transmission interval;

[0025] Combining the current measurement time stamp, the calculated offset of the round-trip delay and the jitter rate of the data packet transmission interval are combined to construct the communication dynamic feature vector.

[0026] As a further scheme of the present application, the S4 step specifically comprises: for the communication dynamic characteristic vector, obtaining a plurality of the communication dynamic characteristic vectors in a historical time sequence, and inputting to the moving average model;

[0027] Trend prediction is performed on the offset of the round-trip delay and the jitter of the data packet transceiving interval respectively by using the moving average model to generate an offset prediction value and a jitter prediction value at a next time point;

[0028] A deviation reference value is set, and the offset prediction value and the jitter prediction value are compared with the respective deviation reference values respectively to determine whether both are higher than or lower than the respective deviation reference values at the same time, so as to confirm the same direction deviation state;

[0029] If the same direction deviation is confirmed to exist, the current key synchronization period is obtained, and window sliding adjustment is performed on the period length value of the current key synchronization period to generate the adaptive key refresh scheduling strategy.

[0030] As a further scheme of the present application, the calling cosine similarity algorithm calculates the protocol matching degree score, specifically: setting the downlink message characteristic vector as V resp =(r1, r2,..., r k k), and the protocol model characteristic vector as V model =(m1, m2,..., m k k), wherein k is the dimension of the characteristic vector, representing the number of fields participating in comparison;

[0031] The protocol matching degree score S match is calculated by using the following formula: Wherein, S match represents the protocol matching degree score, r i and m i are component values of the downlink message characteristic vector and the protocol model characteristic vector at the i-th dimension respectively, k is the dimension of the characteristic vector, and i is a summation index variable;

[0032] The calculated protocol matching degree score S match is stored in association with the corresponding protocol identifier.

[0033] As a further scheme of the present application, the window sliding adjustment is performed on the period length value of the current key synchronization period, specifically comprising: analyzing the same direction deviation state, if the offset prediction value and the jitter prediction value are both higher than the deviation reference value, it is determined that the communication link is unstable, and it is determined that the window sliding direction is to shorten the period;

[0034] If both the offset prediction value and the jitter rate prediction value are lower than offset reference values, it is determined that the communication link is stable, and the window sliding direction is determined to be extended period;

[0035] The sliding amplitude ΔT is calculated by the following formula slide :

[0036] The original period length value is adjusted according to the determined window sliding direction and the calculated sliding amplitude to obtain an adjusted period length, and the adaptive key refresh scheduling strategy is generated based on the adjusted period length;

[0037] Wherein, ΔT slide represents the sliding amplitude, T max represents the maximum allowed adjustment amplitude, O pred represents the offset prediction value, O base represents the offset reference value, J pred represents the jitter rate prediction value, J base represents the jitter rate reference value, ω o represents the adjustment weight for the offset prediction value, ω j represents the adjustment weight for the jitter rate prediction value, and ω o and ω j sum to 1.

[0038] As a further scheme of the present application, the sliding average model is used to predict the trend, and the same direction deviation of the offset and the jitter rate is judged, specifically including: a time window of a fixed length W is set, the latest W historical communication dynamic feature vectors in the time window are obtained to form an offset observation sequence and a jitter rate observation sequence;

[0039] The arithmetic mean of the offset observation sequence is calculated respectively, and the arithmetic mean is taken as the offset prediction value;

[0040] The arithmetic mean of the jitter rate observation sequence is calculated respectively, and the arithmetic mean is taken as the jitter rate prediction value;

[0041] The offset deviation threshold and the jitter rate deviation threshold are set, when the absolute value of the difference between the offset prediction value and the historical offset mean exceeds the offset deviation threshold, and the absolute value of the difference between the jitter rate prediction value and the historical jitter rate mean exceeds the jitter rate deviation threshold, the same direction deviation judgment logic is triggered, and the deviation direction is judged according to the signs of the two differences.

[0042] Compared with the prior art, the present application has the advantages and positive effects that:

[0043] In the present application, by performing structure field consistency check on uplink and downlink messages in the communication process and performing protocol matching score screening in the inconsistent case, the fast adaptation and dynamic identification of the authentication protocol are realized, the authentication flexibility in the multi-protocol environment is effectively improved by combining the protocol vector model and the similarity score mechanism, the communication dynamic feature vector is further constructed by fusing the delay and jitter characteristics, the real-time adaptive ability of the key synchronization strategy is realized by using the trend prediction and cycle adjustment logic, the key refresh scheduling can be triggered in time at the initial stage of the communication abnormal trend, the robustness of the overall authentication process and the sensitivity of the key update are enhanced, and the accuracy of the authentication process and the persistence of the privacy protection in the device access process are ensured. BRIEF DESCRIPTION OF DRAWINGS

[0044] Figure 1 The overall flowchart of the present application is an auditable privacy protection authentication method based on Internet of Things access.

[0045] Figure 2 The flowchart of the present application is a protocol mismatch state identification and candidate set generation.

[0046] Figure 3 The flowchart of the present application is an optimal matching protocol screening and instruction generation.

[0047] Figure 4 The flowchart of the present application is a communication dynamic feature vector construction.

[0048] Figure 5 The flowchart of the present application is an adaptive key refresh scheduling strategy generation. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme realized by software will be described in detail below in combination with system architecture diagram and embodiments. It should be understood that the specific embodiments described herein are only used to explain the technical scheme of the present application, and do not constitute a limitation on the protection scope.

[0050] In the description of the present application, the system architecture relationship or data processing flow indicated by the terms "level", "module", "interface", "data flow", "client", "server" and the like are defined based on the corresponding architecture diagram or flowchart of the embodiments. This description method is only used to clearly explain the logical relationship of each element in the technical scheme, and is not limited to the physical deployment form. The "multiple" includes two or more technical units, including but not limited to multiple data nodes, processing threads, service instances or functional components, and other expandable elements, and the specific number is determined according to the actual business scenario.

[0051] Please refer to Figure 1 and Figure 2The application provides a technical solution: an auditable privacy protection authentication method based on Internet of Things access, comprising the following steps:

[0052] S1: Obtain the uplink handshake message and the downlink response message, extract the message structure field set and perform consistency check, if the check is inconsistent, generate a protocol mismatch state identifier, and screen the authentication protocol candidate set;

[0053] The S1 step specifically comprises: obtaining the original data stream of the uplink handshake message and the downlink response message, parsing and extracting the respective message header, authentication payload and timestamp field, and constructing the initial message structure field set;

[0054] Call the preset protocol field baseline template to perform field-by-field consistency check on the initial message structure field set, compare the field type, field length and field bit sequence index;

[0055] If the check result is inconsistent, record the specific mismatch field position and error type, and generate a protocol mismatch state identifier;

[0056] Based on the un-mismatched field information recorded in the protocol mismatch state identifier, search and match in the local protocol library to screen out all compatible authentication protocols and generate an authentication protocol candidate set;

[0057] The protocol mismatch state identifier includes the mismatched field type, field length error and field bit sequence index offset;

[0058] The authentication protocol candidate set includes a protocol identifier list, a protocol version number and an associated encryption algorithm specification.

[0059] In a smart agriculture scenario, a soil temperature and humidity sensor (device ID: SN-TH-001) deployed in a farmland attempts to access an Internet of Things platform server. The server first captures the uplink handshake message sent by the sensor and the downlink response message sent by the server itself. The obtained original data stream is a hexadecimal string. The original data stream of the uplink message is

[0060] "0x010x010x1A0x3B0xC40x7E0x080x610x620x630x640x650x660x670x680x1A0x3B0xC40x7E", and the original data stream of the downlink response message is "0x020x010x1A0x3B0xC40x8F0x080x310x320x330x340x350x360x370x380x000x000x1A0x3B0xC40x8F". First, the above two original data streams are parsed to extract the message header, authentication load and timestamp field, and to construct the initial message structure field set. The message header of the uplink message is parsed as 0x01 (representing device request), the authentication load is "abcdefgh", and the timestamp field is 0x1A3BC47E; the message header of the downlink response message is parsed as 0x02 (representing server response), the authentication load is "12345678", and the timestamp field is 0x00001A3BC48F.

[0061] Subsequently, a preset protocol field baseline template is called to perform consistency verification on the two initial message structure field sets field by field. The baseline template is formulated based on statistical analysis of the communication data of more than 1000 soil sensors of the same type of device stably running in the target network environment for 30 consecutive natural days. The common field structure of 95% of the device communication messages is selected as the baseline standard. The specific content of the protocol field baseline template is shown in Table 1.

[0062] Table 1: Protocol field baseline template table

[0063]

[0064] The verification process is as follows: 1. Message header field: the message header field type of the uplink message is UnsignedInt, the length is 1 byte, the bit sequence index is 1, and it is consistent with the template. The message header field type of the downlink message is UnsignedInt, the length is 1 byte, the bit sequence index is 1, and it is consistent with the template. The field verification result is consistent. 2. Protocol version field: the protocol version field (0x01) of the uplink message is UnsignedInt, the length is 1 byte, the bit sequence index is 2, and it is consistent with the template. The protocol version field (0x01) of the downlink message is UnsignedInt, the length is 1 byte, the bit sequence index is 2, and it is consistent with the template.

[0065]

[0066] ​UnsignedInt, length 1 byte, bit sequence index 2, consistent with the template. The field check result is consistent. 3. Session ID field: the Session ID field (0x1A3BC47E) of the uplink message is of the type UnsignedInt, length 4 bytes, bit sequence index 3, consistent with the template. The Session ID field (0x1A3BC48F) of the downlink message is of the type UnsignedInt, length 4 bytes, bit sequence index 3, consistent with the template. The field check result is consistent. 4. Authentication payload field: the Authentication payload field (0x61…68) of the uplink message is of the type Bytes, length 8 bytes, bit sequence index 4, consistent with the template. The Authentication payload field (0x31…38) of the downlink message is of the type Bytes, length 8 bytes, bit sequence index 4, consistent with the template. The field check result is consistent. 5. Timestamp field: the Timestamp field (0x1A3BC47E) of the uplink message is 4 bytes long, consistent with the template. The Timestamp field (0x00001A3BC48F) of the downlink response message is parsed as 6 bytes long, while the length defined in the baseline template is 4 bytes. This field check is inconsistent.

[0067] Based on the above check, the specific mismatched field position is recorded as “Timestamp”, the error type is “Field length error”, and the specific performance is that the actual length is 6 bytes and the expected length is 4 bytes. Accordingly, a protocol mismatch state identifier is generated, and its content is: {Mismatched field type: [Timestamp], Field length error: [Expected 4 bytes, Actual 6 bytes], Field bit sequence index offset: []}. According to the un-mismatched field information (message header, protocol version, session ID, authentication payload) recorded in the identifier, a search and match are performed in the local protocol library. The local protocol library stores three protocols: protocol A (version 1.0, encryption algorithm AES-128), protocol B (version 1.1, encryption algorithm AES-256), and protocol C (version 2.0, encryption algorithm SM4). The search logic is: filter out the protocols whose field definitions contain fields (i.e., field type, length, and bit sequence index are all the same) completely consistent with the un-mismatched field information. After matching, both protocol A and protocol B contain the above four consistent fields, while the session ID field length of protocol C is defined as 8 bytes, which is not matched. Therefore, the authentication protocol candidate set filtered out is: {Protocol identifier list: [protocol A, protocol B], Protocol version number: [1.0, 1.1], Associated encryption algorithm specification: [AES-128, AES-256]}.

[0068] See Figure 1 and Figure 3S2: based on the protocol mismatch state identifier, traversing the authentication protocol candidate set, vectorizing the message structure field set of the downlink response message and the preset field model of each protocol, calling the cosine similarity algorithm to calculate the protocol matching degree score, screening the authentication protocol with the highest protocol matching degree score, and generating the optimal matching protocol instruction;

[0069] S2 specifically includes: traversing each authentication protocol in the authentication protocol candidate set, and obtaining the preset field model corresponding to the authentication protocol;

[0070] The field values in the message structure field set of the downlink response message are numerically encoded to construct a downlink message feature vector;

[0071] The preset field model of the currently traversed authentication protocol is numerically encoded in the same way to construct a protocol model feature vector;

[0072] The cosine similarity algorithm is called to calculate the vector angle cosine value of the downlink message feature vector and the protocol model feature vector, and an initial protocol matching degree score is obtained;

[0073] After completing the traversal calculation of all candidate protocols, all initial protocol matching degree scores are sorted, the authentication protocol with the highest protocol matching degree score is screened out, and the optimal matching protocol instruction is generated;

[0074] The cosine similarity algorithm is called to calculate the protocol matching degree score, specifically: the downlink message feature vector is set as V resp =(r1,r2,...,r k ), and the protocol model feature vector is set as V model =(m1,m2,...,m k ), wherein k is the dimension of the feature vector, representing the number of fields participating in comparison;

[0075] The protocol matching degree score S match is calculated using the following formula: Wherein, S match represents the protocol matching degree score, r i and m i are the component values of the downlink message feature vector and the protocol model feature vector at the i-th dimension, respectively, k is the dimension of the feature vector, and i is the summation index variable;

[0076] The calculated protocol matching degree score S match is associated with the corresponding protocol identifier and stored;

[0077] The optimal matching protocol instruction specifically includes the unique identifier of the selected protocol, the handshake parameter mapping relationship, and the key negotiation function pointer.

[0078] Based on the protocol mismatch state identification generated in step S1 and the authentication protocol candidate set, the authentication protocol candidate set is started to be traversed. The candidate set contains protocol A and protocol B. Protocol A is processed first, and its corresponding preset field model is obtained. The data structure of the model is: [{field name: packet header, field type: UnsignedInt, field length: 1}, {field name: protocol version, field type: UnsignedInt, field length: 1}, {field name: session ID, field type: UnsignedInt, field length: 4}, {field name: authentication payload, field type: Bytes, field length: 8}, {field name: timestamp, field type: UnsignedInt, field length: 4}].

[0079] Next, the numerical coding of the packet structure field set of the downlink response message obtained in S1 is performed, and the downlink message feature vector is constructed. The coding rules are as follows: for “field type”, UnsignedInt is coded as 1, and Bytes is coded as 2; for “field length”, the byte value is directly used. According to this, the packet structure field set (packet header, protocol version, session ID, authentication payload, timestamp) of the downlink response message is coded, and the downlink message feature vector V resp is constructed. The dimension component values of each dimension are: packet header type (1), packet header length (1), protocol version type (1), protocol version length (1), session ID type (1), session ID length (4), authentication payload type (2), authentication payload length (8), timestamp type (1), and timestamp length (6). Therefore, V resp =(1,1,1,1,1,4,2,8,1,6). At the same time, the preset field model of the authentication protocol A currently traversed is subjected to the same numerical coding, and the protocol model feature vector V model_A is constructed. According to the model of protocol A, the feature vector is: V model_A =(1,1,1,1,1,4,2,8,1,4).

[0080] Subsequently, the vector angle cosine value of the downlink message feature vector and the protocol model feature vector is calculated. The formula used here is the protocol matching degree score where S match represents the protocol matching degree score, V resp =(r1,r2,...,r k ) is the downlink message feature vector, r i is the component value of the vector in the i-th dimension, V model =(m1,m2,...,m k ) is the protocol model feature vector, and m iwhere V is the vector of the field model of protocol A, V is the vector of the field model of protocol B, r is the i-th component value of vector V in the i-th dimension, k is the dimension of the vector, here k = 10 represents the total number of field types and field lengths participating in the comparison, and i is the summation index variable from 1 to k. The operation logic of this formula is to quantify the similarity of the two vectors in the direction by calculating the dot product of the two vectors and dividing by the product of the respective norms. The dot product reflects the sum of the component products of the two vectors in the corresponding dimensions, while the denominator of the two norms and then the length of the vector is normalized.

[0081] The score of protocol A is calculated: r i · m i The product of each term is: (1 · 1), (1 · 1), (1 · 1), (1 · 1), (1 · 1), (4 · 4), (2 · 2), (8 · 8), (1 · 1), (6 · 4), i.e., 1, 1, 1, 1, 1, 16, 4, 64, 1, 24. The value of each term is: 1, 1, 1, 1, 1, 16, 4, 64, 1, 36. The value of each term is: 1, 1, 1, 1, 1, 16, 4, 64, 1, 16. The calculated protocol matching score 0.9864 is stored in association with the identifier of protocol A.

[0082] Next, protocol B in the candidate set is processed. The preset field model of protocol B has the same basic structure as protocol A. Upon checking, in the preset field model of protocol B, the defined authentication load type is Security Token, which is encoded as 3 according to the coding rule. Therefore, V model_B is different from V model_B = (1, 1, 1, 1, 1, 4, 3, 8, 1, 4). The score of protocol B is calculated: ∑(r i · m i ) = (1 · 1) + (1 · 1) + (1 · 1) + (1 · 1) + (1 · 1) + (4 · 4) + (2 · 3) + (8 · 8) + (1 · 1) + (6 · 4) = 1 + 1 + 1 + 1 + 1 + 16 + 6 + 64 + 1 + 24 = 116. (Same as above). The score 0.9810 is stored in association with the protocol B. After the traversal is completed, all initial protocol matching degree scores are sorted. The score of the protocol A is 0.9864, and the score of the protocol B is 0.9810. Since 0.9864>0.9810, the authentication protocol with the highest protocol matching degree score is screened out as the protocol A. Accordingly, the optimal matching protocol instruction is generated, and the content is: {protocol unique identifier: "Protocol-A-v1.0", handshake parameter mapping relationship: {source session ID->target session ID, source payload->target payload}, key negotiation function pointer: 0x7FFF1234ABCD}.

[0083] See Figure 1 and Figure 4 , S3: according to the optimal matching protocol instruction, reconstructing the authentication session, collecting the round-trip delay and the data packet transmission interval, calculating the offset and the jitter rate, constructing the communication dynamic feature vector, and obtaining the current key synchronization period;

[0084] The S3 step specifically comprises: according to the optimal matching protocol instruction, calling the key negotiation function pointer and inputting the mapped handshake parameters, completing the key negotiation with the target device, and reconstructing the encrypted authentication session;

[0085] In the encrypted authentication session, the sending time stamp and the receiving confirmation time stamp of N data packets are continuously collected, N groups of round-trip delays are calculated, and the sending time stamps of adjacent data packets are recorded, and N-1 groups of data packet transmission intervals are calculated;

[0086] Based on the N groups of round-trip delays, the offset O of the round-trip delay is calculated by the following formula rtt : Wherein, O rtt represents the offset of the round-trip delay, RTT i is the round-trip delay measured for the i-th time, N is the total number of measurements, is the reference round-trip delay according to the historical communication data statistics, and i is the summation index variable;

[0087] Based on the N-1 groups of data packet transmission intervals, the sample standard deviation of the N-1 groups of data packet transmission intervals is calculated, and the jitter rate of the data packet transmission interval is obtained;

[0088] The calculated offset of the round-trip delay and the jitter rate of the data packet transmission interval are combined in combination with the current measurement time stamp to construct the communication dynamic feature vector;

[0089] The communication dynamic feature vector comprises the offset of the round-trip delay, the jitter rate of the data packet transmission interval, and the measurement time stamp;

[0090] The current key synchronization period comprises a current synchronization time stamp, a period length value, and a next expected synchronization point.

[0091] According to the optimal matching protocol instruction generated in S2, the key negotiation function pointer 0x7FFF1234ABCD specified in the system call instruction is called, and the handshake parameter mapping relationship defined in the instruction is applied to the parameters of the current session. Specifically, the session ID "0x1A3BC48F" and the authentication payload "12345678" in the original packet are taken as inputs to complete key negotiation with the target device (soil temperature and humidity sensor SN-TH-001). After three rounds of key exchange, an authenticated session using the AES-128 encryption algorithm is successfully established.

[0092] In this encrypted authenticated session, network communication data collection begins immediately. The system continuously sends 5 (i.e., N = 5) probe data packets to the sensor and records the sending timestamp of each data packet and the timestamp of receiving its acknowledgement (ACK). The collected data is shown in Table 2.

[0093] Table 2: Network communication dynamic characteristic collection table

[0094]

[0095] According to the data in Table 2, 5 sets of round-trip time (RTT i ) are calculated: 185ms, 205ms, 170ms, 195ms, 180ms. At the same time, according to the sending timestamp, 4 sets (N-1 sets) of data packet transmission intervals are calculated:

[0096] 1662345679000-1662345678000=1000ms, 1662345680000-1662345679000=1000ms, 1662345681000-1662345680000=1000ms, 1662345682000-1662345681000=1000ms.

[0097] Next, based on the 5 sets of round-trip time, the offset O rtt of the round-trip time is calculated. The calculation formula is: where O rtt represents the offset of the round-trip time, RTT i is the i-th measured round-trip time, N is the total number of measurements, which is 5 in this case, is the reference round-trip time, and i is the summation index variable from 1 to N. This formula quantifies the overall deviation of RTT by calculating the average of the absolute values of the differences between each measurement and the reference value. The reference round-trip time The setting is based on 10,000 RTT samples collected from 50 sensors of the same type deployed within the same geographical area for 7 consecutive days under normal weather conditions (temperature 15-25°C, humidity 40-60%) and off-peak network hours (2:00-4:00 am). After statistical analysis of these sample data, the arithmetic mean value is calculated after removing the extreme values of the first 5% and the last 5%. After the above experimental verification process, the setting is The data is entered for calculation:

[0098]

[0099]

[0100] Subsequently, based on 4 sets of data packet transmission intervals (1000ms, 1000ms, 1000ms, 1000ms), the sample standard deviation is calculated, and the jitter rate of the data packet transmission interval is obtained. The average value of this group of data is 1000ms. The square of the difference between each sample and the average value is:

[0101] (1000-1000) 2 = 0, (1000-1000) 2 = 0, (1000-1000) 2 = 0, (1000-1000) 2 = 0. The sample variance is The sample standard deviation (jitter rate) is Combined with the current measurement timestamp (take the last packet's sending timestamp, 1662345682000), the offset of the round-trip delay (11ms) and the jitter rate of the data packet transmission interval (0ms) are combined to construct the communication dynamic feature vector: {round-trip delay offset: 11ms, data packet transmission interval jitter rate: 0ms, measurement timestamp: 1662345682000}. Finally, the current key synchronization period is obtained, which contains: {current synchronization timestamp: 1662345600000, period length value: 3600 seconds, next expected synchronization point: 1662349200000}.

[0102] Please refer to Figure 1 and Figure 5 , S4: For the communication dynamic feature vector, a moving average model is used to predict the trend, judge the same deviation of the offset and the jitter rate, and perform window sliding adjustment on the current key synchronization period to generate an adaptive key refresh scheduling strategy;

[0103] S4 step specifically includes: for the communication dynamic feature vector, a plurality of communication dynamic feature vectors in the historical time sequence are obtained and input into the moving average model;

[0104] The moving average model is used to respectively predict the trend of the offset of the round-trip delay and the jitter rate of the data packet transmission interval, and generate the offset prediction value and the jitter rate prediction value at the next time point;

[0105] The offset reference value is set, the offset prediction value and the jitter rate prediction value are compared with the respective offset reference values, and it is judged whether both are higher or lower than the respective offset reference values at the same time, so as to confirm the same direction deviation state;

[0106] If the same direction deviation is confirmed, the current key synchronization period is obtained, and the window sliding adjustment is performed on the period length value of the current key synchronization period to generate an adaptive key refresh scheduling strategy;

[0107] The moving average model is used to predict the trend and judge the same direction deviation of the offset and the jitter rate, which specifically includes: setting a time window with a fixed length W, obtaining the latest W historical communication dynamic feature vectors in the time window, and constructing an offset observation sequence and a jitter rate observation sequence;

[0108] The arithmetic mean value of the offset observation sequence is calculated, and the arithmetic mean value is taken as the offset prediction value;

[0109] The arithmetic mean value of the jitter rate observation sequence is calculated, and the arithmetic mean value is taken as the jitter rate prediction value;

[0110] The offset deviation threshold and the jitter rate deviation threshold are set, when the absolute value of the difference between the offset prediction value and the historical offset mean value exceeds the offset deviation threshold, and the absolute value of the difference between the jitter rate prediction value and the historical jitter rate mean value exceeds the jitter rate deviation threshold, the same direction deviation judgment logic is triggered, and the deviation direction is judged according to the signs of the two differences;

[0111] The window sliding adjustment is performed on the period length value of the current key synchronization period, which specifically includes: analyzing the same direction deviation state, if the offset prediction value and the jitter rate prediction value are both higher than the offset reference value, it is determined that the communication link is unstable, and the window sliding direction is determined to be shortened;

[0112] If the offset prediction value and the jitter rate prediction value are both lower than the offset reference value, it is determined that the communication link is stable, and the window sliding direction is determined to be lengthened;

[0113] The sliding amplitude ΔT is calculated by the following formula slide :

[0114] The original period length value is adjusted according to the determined window sliding direction and the calculated sliding amplitude to obtain the adjusted period length, and an adaptive key refresh scheduling strategy is generated based on the adjusted period length;

[0115] where ΔT slide represents the sliding range, T max represents the maximum allowed adjustment range, O pred represents the offset prediction value, O base represents the offset deviation reference value, J pred represents the jitter rate prediction value, J base represents the jitter rate deviation reference value, ω o represents the adjustment weight for the offset prediction value, ω j represents the adjustment weight for the jitter rate prediction value, and ω o is the sum of ω j and ω

[0116] The adaptive key refresh scheduling strategy specifically refers to the adjusted synchronization time point, window sliding direction, and sliding range.

[0117] For the communication dynamic feature vector {11 ms, 0 ms, 1662345682000} constructed in S3, the system starts the trend prediction and key scheduling adjustment process. First, the latest multiple communication dynamic feature vectors in the historical time series are obtained, and the time window length W = 3 of the moving average model is set. The first two time points have collected and constructed two historical communication dynamic feature vectors, which are {10 ms, 3 ms, 1662345681000} and {13 ms, 4 ms, 1662345680000}. The latest three vectors form the observation sequence used for trend prediction.

[0118] The trend of the offset of the round-trip time and the jitter rate of the data packet transmission interval is predicted by calculating the arithmetic mean of the observation sequence. The offset observation sequence is composed of O obs =(13, 10, 11) (unit: ms). The jitter rate observation sequence is composed of J obs =(4, 3, 0) (unit: ms). The arithmetic mean of the offset observation sequence is calculated as: This value is taken as the offset prediction value O pred at the next time point. The arithmetic mean of the jitter rate observation sequence is calculated as: This value is taken as the jitter rate prediction value J pred at the next time point.

[0119] Next, the deviation reference value and the deviation threshold value are set and compared. The offset deviation reference value O base is set to 8 ms, and the jitter rate deviation reference value J base is set to 2 ms. The setting of O base and J baseThe 50th percentile of the jitter rate sample is calculated as 1.5 ms. The offset deviation threshold is set as 0 base 25%, i.e. 8x0.25=2 ms. The jitter deviation threshold is set as J base 25%, i.e. 1.5x0.25=0.375 ms. The setting of these thresholds aims to identify significant changes beyond the normal fluctuation range.

[0120] The logic for determining the same-direction deviation state is as follows: 1. Calculate the absolute value of the difference between the offset prediction value and the historical offset average value: |11.33-8|=3.33 ms. This value 3.33 ms exceeds the offset deviation threshold 2 ms. 2. Calculate the absolute value of the difference between the jitter prediction value and the historical jitter average value: |2.33-1.5|=0.83 ms. This value 0.83 ms exceeds the jitter deviation threshold 0.375 ms. 3. Since both absolute value differences exceed their respective thresholds, the same-direction deviation determination logic is triggered. 4. Determine the deviation direction: the offset prediction value 11.33 ms is higher than the reference value 8 ms, with a positive difference. The jitter prediction value 2.33 ms is also higher than the reference value 1.5 ms, with a positive difference. Since the signs of the two differences are the same, the same-direction deviation condition is met, and the deviation direction is the same direction of increase. The system determines that the communication link is unstable, and determines the window sliding direction to be shortened.

[0121] Next, the sliding amplitude AT slide is calculated, whose formula is: where AT slide represents the sliding amplitude, T max is the maximum allowed adjustment amplitude, O pred is the offset prediction value, O base is the offset deviation reference value, J pred is the jitter prediction value, J base is the jitter deviation reference value, ω o is the adjustment weight for the round-trip delay offset, and ω j is the adjustment weight for the data packet transmission interval jitter, and ω o +ω j =1. Parameter value setting and acquisition: -T max : maximum allowed adjustment amplitude. Through experiments, it is set that, under the premise of not affecting the normal business of the device, the shortest key period should not be lower than 600 seconds, and the longest should not exceed 7200 seconds. If the current period is 3600 seconds, the maximum adjustment amplitude is set to 30% of the current period, i.e. 3600x0.3=1080 seconds. -ω o and ω j: Adjust the weight. In the smart agriculture scene, the stability of network delay (RTT offset) has a greater impact on the integrity of data transmission than the instantaneous jitter, so a higher weight is set for the offset. Through analysis of historical fault data, it is found that 70% of network anomalies are related to a large offset of RTT, and 30% are related to the jitter rate. Accordingly, ω o = 0.7, ω j = 0.3.

[0122] Enter the data for calculation: ΔT slide = 1080·(0.7·0.41625 + 0.3·0.5533) = 1080·(0.291375 + 0.16599) = 1080·0.457365 ≈ 493.95 seconds. Take the integer part to be 494 seconds.

[0123] Adjust the original cycle length value (3600 seconds) according to the determined window sliding direction (shortening) and the calculated sliding amplitude (494 seconds). The adjusted cycle length is 3600-494 = 3106 seconds. Based on the adjusted cycle length, generate an adaptive key refresh scheduling strategy, the specific content of which is: {adjusted synchronization time point: (current time + 3106 seconds), window sliding direction: shortening, sliding amplitude: 494 seconds}.

[0124] The above embodiments demonstrate the preferred embodiments of the present application, and any equivalent adjustment of the technical solutions based on software engineering methods is within the protection scope, including but not limited to: implementing algorithm logic in different programming languages, service-oriented reconstruction of functional modules, adjustment of data interaction protocols, optimization of resource scheduling strategies, etc. Any implementation scheme derived by reasonable modification of the data processing flow, service calling link or system architecture level without deviating from the technical core of the present application shall be considered within the protection scope defined by the claims of the present application.

Claims

1. An auditable privacy-preserving authentication method based on Internet of Things (IoT) access, characterized in that, Includes the following steps: S1: Obtain the uplink handshake message and downlink response message, extract the message structure field set and perform consistency verification. If the verification is inconsistent, generate a protocol mismatch status flag and filter the authentication protocol candidate set. S2: Based on the protocol mismatch status identifier, traverse the authentication protocol candidate set, vectorize the message structure field set of the downlink response message with the preset field model of each protocol, call the cosine similarity algorithm to calculate the protocol matching score, filter the authentication protocol with the highest protocol matching score, and generate the optimal matching protocol instruction. S3: Reconstruct the authentication session according to the optimal matching protocol instruction, collect the round-trip delay and data packet transmission interval, calculate the offset and jitter rate, construct the communication dynamic feature vector, and obtain the current key synchronization period; S4: For the communication dynamic feature vector, a moving average model is used to predict the trend, determine the deviation of the offset from the jitter rate in the same direction, and perform window sliding adjustment on the current key synchronization period to generate an adaptive key refresh scheduling strategy.

2. The auditable privacy-preserving authentication method based on IoT access according to claim 1, characterized in that, The protocol mismatch status identifier includes mismatch field type, field length error, and field position index offset. The authentication protocol candidate set includes a protocol identifier list, protocol version number, and associated encryption algorithm specification. The optimal matching protocol instruction specifically includes a unique identifier of the selected protocol, handshake parameter mapping relationship, and key negotiation function pointer. The communication dynamic feature vector includes round-trip delay offset, data packet transmission interval jitter rate, and measurement timestamp. The current key synchronization period includes the current synchronization timestamp, period length value, and next expected synchronization point. The adaptive key refresh scheduling strategy specifically refers to the adjusted synchronization time point, window sliding direction, and sliding amplitude.

3. The auditable privacy-preserving authentication method based on IoT access according to claim 1, characterized in that, The S1 step specifically includes: obtaining the original data streams of the uplink handshake message and the downlink response message, parsing and extracting their respective message headers, authentication payloads and timestamp fields, and constructing an initial message structure field set; The preset protocol field baseline template is invoked to perform a field-by-field consistency check on the initial message structure field set, comparing the field type, field length, and field position index. If the verification result is inconsistent, the specific mismatch field location and error type are recorded, and the protocol mismatch status identifier is generated. Based on the non-mismatch field information recorded in the protocol mismatch status identifier, a search and matching is performed in the local protocol library to filter out all compatible authentication protocols and generate the authentication protocol candidate set.

4. The auditable privacy-preserving authentication method based on IoT access according to claim 1, characterized in that, The S2 step specifically includes: traversing each authentication protocol in the authentication protocol candidate set and obtaining the preset field model corresponding to the authentication protocol; The values ​​of each field in the message structure field set of the downlink response message are numerically encoded to construct a downlink message feature vector; The preset field models of the currently traversed authentication protocols are encoded using the same numerical encoding to construct protocol model feature vectors; The cosine similarity algorithm is invoked to calculate the cosine of the angle between the downlink message feature vector and the protocol model feature vector, thereby obtaining an initial protocol matching score. After completing the traversal and calculation of all candidate protocols, the matching scores of all initial protocols are sorted, the authentication protocol with the highest matching score is selected, and the optimal matching protocol instruction is generated.

5. The auditable privacy-preserving authentication method based on IoT access according to claim 1, characterized in that, The S3 step specifically includes: according to the optimal matching protocol instruction, calling the key negotiation function pointer and passing in the mapped handshake parameters, completing key negotiation with the target device, and reconstructing the encrypted authentication session; In the encrypted authentication session, the sending timestamps and receiving acknowledgment timestamps of N data packets are continuously collected to calculate N sets of round-trip delays, and the sending timestamps of adjacent data packets are recorded to calculate N-1 sets of data packet sending and receiving intervals. Based on the round-trip delays described in N sets, the offset O of the round-trip delays is calculated using the following formula. rtt : Among them, O rtt The offset representing the round-trip time delay, RTT i Let N be the round-trip time delay for the i-th measurement, and N be the total number of measurements. Let i be the baseline round-trip delay calculated based on historical communication data, and let i be the summation index variable. Based on the data packet transmission and reception intervals of the N-1 groups, the sample standard deviation of the data packet transmission and reception intervals of the N-1 groups is calculated to obtain the jitter rate of the data packet transmission and reception intervals; By combining the current measurement timestamp, the calculated round-trip delay offset is combined with the jitter rate of the data packet transmission and reception interval to construct the communication dynamic feature vector.

6. The auditable privacy-preserving authentication method based on IoT access according to claim 1, characterized in that, The S4 step specifically includes: for the communication dynamic feature vector, obtaining multiple communication dynamic feature vectors in the historical time series and inputting them into the moving average model; The moving average model is used to predict the trends of the round-trip delay offset and the jitter rate of the data packet transmission interval, respectively, to generate the offset prediction value and jitter rate prediction value for the next time point. Set a deviation reference value, compare the predicted offset value and the predicted jitter rate value with their respective deviation reference values, and determine whether the two are simultaneously higher or lower than their respective deviation reference values, thereby confirming the same deviation state. If the aforementioned deviation is confirmed, the current key synchronization period is obtained, and the period length value of the current key synchronization period is adjusted by window sliding to generate the adaptive key refresh scheduling strategy.

7. The auditable privacy-preserving authentication method based on IoT access according to claim 4, characterized in that, The process of using the cosine similarity algorithm to calculate the protocol matching score specifically involves: setting the downlink message feature vector as V. resp =(r1,r2,...,r k The feature vector of the protocol model is V. model =(m1,m2,...,m k ), where k is the dimension of the feature vector, representing the number of fields involved in the comparison; The protocol matching score S is calculated using the following formula. match : Among them, S match r represents the protocol matching score. i and m i These are the component values ​​of the downlink message feature vector and the protocol model feature vector in the i-th dimension, respectively, where k is the dimension of the feature vector and i is the summation index variable; The calculated protocol matching score S match It is associated with and stored in relation to the corresponding protocol identifier.

8. The auditable privacy-preserving authentication method based on IoT access according to claim 6, characterized in that, The step of performing window sliding adjustment on the period length value of the current key synchronization period specifically includes: analyzing the same-direction deviation state; if both the offset prediction value and the jitter rate prediction value are higher than the deviation reference value, then the communication link is determined to be unstable, and the window sliding direction is determined to be shortening the period. If both the predicted offset value and the predicted jitter rate value are lower than the deviation from the reference value, the communication link is determined to be stable, and the window sliding direction is determined to be an extended period. The sliding amplitude ΔT is calculated using the following formula. slide : The original period length value is adjusted according to the determined window sliding direction and the calculated sliding amplitude to obtain the adjusted period length, and the adaptive key refresh scheduling strategy is generated based on the adjusted period length. Where, ΔT slide T represents the sliding amplitude. max O represents the maximum allowable adjustment range. pred O represents the predicted offset value. base J represents the offset from the reference value. pred J represents the predicted jitter rate. base This represents the jitter rate deviating from the baseline value, ω o ω represents the adjustment weight for the predicted offset value. j This represents the adjustment weight for the jitter rate prediction value, and ω o With ω j The sum of is 1.

9. The auditable privacy-preserving authentication method based on IoT access according to claim 6, characterized in that, The method of using a moving average model to predict trends and determine the deviation of the offset from the jitter rate in the same direction specifically includes: setting a time window of fixed length W, obtaining the latest W historical communication dynamic feature vectors within the time window, and constructing an offset observation sequence and a jitter rate observation sequence. Calculate the arithmetic mean of the offset observation sequences respectively, and use the arithmetic mean as the offset prediction value; Calculate the arithmetic mean of the jitter rate observation sequences respectively, and use the arithmetic mean as the jitter rate prediction value; Set an offset deviation threshold and a jitter rate deviation threshold. When the absolute value of the difference between the predicted offset value and the historical average offset value exceeds the offset deviation threshold, and the absolute value of the difference between the predicted jitter rate value and the historical average jitter rate value exceeds the jitter rate deviation threshold, the same-direction deviation judgment logic is triggered, and the deviation direction is determined according to the positive or negative sign of the two differences.

Images