Power Internet of Things terminal task access security authentication method and system, and storage medium

Abstract

The invention provides a power Internet of Things terminal task access security authentication method, which comprises the following steps of: generating a coding matrix and a modulation symbol by taking multi-dimensional CSI (Channel State Information) as core input; generating a dynamic key by taking symbol energy and a random number as an entropy source; the encryption and signature of the task instruction are driven by the key; and the trusted closed loop of terminal access is realized through signature and decryption re-check. According to the method, channel-key-task triple binding is realized, and the task instruction is ensured to have confidentiality, integrity and replay resistance in the transmission process at the same time; compared with the prior art, the method has the advantages that man-in-the-middle attack and replay counterfeiting behaviors can be effectively resisted, the encryption and authentication process which is light in weight and can be updated online is achieved, the safety robustness of the power Internet of Things terminal in a complex electromagnetic environment is remarkably improved, and a landing engineering solution is provided for constructing an autonomous, controllable, low-time-delay and high-safety-level energy communication network.

Description

Technical Field

[0001] This invention relates to the field of secure communication and access control technology for the Internet of Things (IoT) in the power industry, specifically to a secure authentication method, system, and storage medium for terminal task access in the Internet of Things. Background Technology

[0002] When power IoT terminals, such as protection and control devices, status sensing units, and edge gateways, perform task access and command interaction in 5G private networks / network slices, they face attack surfaces including terminal spoofing, session hijacking, replay attacks, and eavesdropping. Traditional authentication methods relying solely on static certificates or single-factor passwords are insufficient to defend against man-in-the-middle and replay attacks; relying solely on upper-layer encryption while ignoring physical layer channel fingerprints creates attack windows of "same password, different channel." There is an urgent need for a security method that tightly couples Channel Signature Indicator (CSI) encoding with dynamic key negotiation to achieve consistent binding of "terminal-channel-key-task," thereby improving the confidentiality, integrity, and anti-forgery capabilities of task access. Summary of the Invention

[0003] This invention proposes a secure authentication method, system, and storage medium for terminal task access in the power Internet of Things (IoT). Using multidimensional CSI as the core input, an encoding matrix and modulation symbols are generated; a dynamic key is generated using symbol energy and random numbers as entropy sources; the key drives the encryption and signing of task instructions; and a trusted closed loop for terminal access is achieved through signature and decryption verification.

[0004] This invention provides a method for secure authentication of terminal task access in the power Internet of Things (IoT), comprising the following steps:

[0005] S1: Construct a multi-dimensional feature acquisition system for terminals. Collect the channel state information (CSI) matrix, terminal location information, timestamp, and task service load bit stream of the terminal through the radio frequency front end to form a multi-dimensional feature vector. Perform mean and variance normalization on the CSI matrix to suppress noise interference and obtain a standardized channel matrix.

[0006] S2: Based on the normalized channel matrix output by S1, construct the channel coding matrix, then perform OFDM modulation on the coding matrix, calculate each subcarrier symbol, and obtain the frequency domain encrypted carrier symbol sequence;

[0007] S3: Based on the encrypted carrier symbol sequence generated by S2, extract the complex modulus length and mix it with a one-time random number to calculate the hash random factor, which is used as the key negotiation input. The improved Diffie-Hellman algorithm is executed using the negotiation parameters to obtain the dynamic symmetric key.

[0008] S4: Use the dynamic key generated by S3 to encrypt the task service load collected by S1 with AES to obtain the task encryption instruction, and then generate a channel binding signature based on the signature algorithm.

[0009] S5: Based on the encryption result and binding signature generated by S4, the system first performs signature verification using the corresponding public key. If the verification result is true, the key is called to decrypt and restore the task instructions. When the decryption result is consistent with the original task, the system determines that the terminal access authentication is successful and updates the channel state cache, thus realizing a closed loop of task data verification and channel security recovery.

[0010] Preferably, in step S1, the method for calculating the multidimensional feature vector is as follows:

[0011] Collection of the first A multi-dimensional feature vector is constructed from the channel state information (CSI) matrix, timestamps, and traffic load bitstream of each terminal:

[0012]

[0013] in, For the first CSI amplitude and phase matrix of each terminal; This is a vector representing the terminal's location information. For sampling timestamps; This is the bitstream of the task's workload.

[0014] Further preferably, in step S1, the method for calculating the normalized channel matrix is ​​as follows:

[0015] For multidimensional feature vectors After normalization and noise suppression, the standardized channel matrix is ​​obtained:

[0016]

[0017] in, , These are the CSI mean and standard deviation, respectively.

[0018] Further preferably, in step S2, the frequency domain encrypted carrier symbol sequence calculation method is as follows:

[0019] The normalized channel matrix obtained in S1 Substitute into the encoding matrix generation function:

[0020]

[0021] in, This is the 5G channel weight matrix. , The normalization constant is For unit array;

[0022] The coding matrix is ​​then subjected to OFDM subcarrier modulation:

[0023]

[0024] in, For the first A sequence of encrypted carrier symbols, This represents the number of subcarriers.

[0025] Further preferably, in step S3, the dynamic symmetric key calculation method is as follows:

[0026] Based on S2 frequency domain encrypted carrier symbol sequence Calculate its complex modulus and generate a hash random number:

[0027]

[0028] in, For hash functions, This indicates the XOR operation. A one-time random number;

[0029] Using random numbers With negotiated parameters Perform the improved Diffie-Hellman key negotiation, calculated as follows:

[0030]

[0031] in, The key is dynamically generated. These are the public prime numbers and generator parameters, respectively.

[0032] Further preferably, in step S4, the ASE encryption calculation formula is:

[0033] The dynamically generated key obtained in S3 Substitute the AES encryption function into the task instruction bitstream. Encrypt:

[0034]

[0035] in, This is the encrypted task instruction.

[0036] Further preferably, in step S4, the formula for calculating the channel-bound signature based on the signature algorithm is as follows:

[0037]

[0038] in, Indicates key-based The signature algorithm, This indicates a splicing operation.

[0039] Further preferably, in step S5, the access verification and channel recovery verification steps include:

[0040] The access end received Then, verify the signature using the public key:

[0041]

[0042] If verification passes, decrypt:

[0043]

[0044] in, For the restored task instructions, when At that time, the system determines that the terminal access is safe and valid, and updates the channel state cache.

[0045] This invention also provides a power Internet of Things (IoT) terminal task access security authentication system, comprising:

[0046] Multi-dimensional feature acquisition module: used to collect channel status information (CSI), geographic location information, timestamps and task service data streams of power Internet of Things terminals in real time through 5G communication links, normalize and suppress noise in the collected data, and output a standardized channel matrix;

[0047] Encoding matrix generation module: used to generate a 5G encoding matrix based on a standardized CSI matrix, perform subcarrier modulation, form a unique encrypted symbol sequence for the terminal, and provide input for subsequent dynamic key negotiation;

[0048] Dynamic key negotiation module: used to calculate a hash random number based on the encoded symbol sequence, and execute the improved Diffie-Hellman key exchange algorithm in combination with the base station negotiation parameters to generate a dynamic key shared by the terminal and the access terminal;

[0049] Encryption and Signature Module: Used to encrypt terminal task instruction data with AES using a dynamic key and generate a digital signature based on the channel digest;

[0050] The authentication and channel recovery module is used to verify the legality of digital signatures at the access end, complete decryption and data comparison, determine successful access when the decrypted data is consistent with the original task data, and update the channel cache to realize a closed loop of security authentication.

[0051] The present invention also provides a computer storage medium storing a computer program therein, which, when executed by a processor, implements the method as described in any one of claims 1 to 8.

[0052] The present invention has the following beneficial effects:

[0053] This invention constructs a secure authentication method, system, and storage medium for power Internet of Things (IoT) terminal task access. The method uses multi-dimensional channel measurement data as the core input, combining time, location, and task characteristics to form a reconstructable channel fingerprint feature library. Based on a standardized CSI matrix and a physical layer random entropy source, a reproducible dynamic key generation mechanism is proposed, achieving a triple binding of channel, key, and task. Furthermore, by fusing AES-GCM encryption and HMAC channel signature algorithms, the confidentiality, integrity, and replay resistance of task instructions during transmission are ensured simultaneously. Introducing physical layer randomness into the key negotiation and derivation process effectively resists man-in-the-middle attacks and replay forgery. This invention achieves a lightweight, online-updable encryption and authentication process without relying on external public key infrastructure, with a single key negotiation latency of less than 10ms, meeting the millisecond-level access requirements of power terminals. This method ensures both communication security and reliable access for edge devices while also considering the computational overhead and real-time requirements of resource-constrained terminals. By using a dynamic binding mechanism based on channel characteristics, this invention significantly improves the security robustness of power Internet of Things (IoT) terminals in complex electromagnetic environments, providing a feasible engineering solution for building an autonomous, controllable, low-latency, and high-security energy communication network. Attached Figure Description

[0054] Figure 1 The flowchart illustrates a power Internet of Things (IoT) terminal task access security authentication method provided by this invention. Detailed Implementation

[0055] The principles and features of the present invention will be described in detail below with reference to the accompanying drawings. The embodiments given are only for illustrating the technical solutions of the present invention and are not intended to limit the scope of protection.

[0056] Example

[0057] This embodiment uses a substation of a city's power distribution network as an example. Multiple power Internet of Things (IoT) terminal nodes are deployed in the substation, including circuit breaker control terminals, temperature and humidity sensing terminals, video acquisition terminals, and status data acquisition modules, totaling 64 nodes. The terminals interact with regional edge computing nodes via a 5G industrial private network. To ensure the security of task command issuance and data transmission, the security authentication tool proposed in this invention is used for terminal access and task execution authentication.

[0058] The key system parameters are set as follows:

[0059]

[0060] S1: Construct a multi-dimensional feature acquisition system for terminals. Collect the channel state information (CSI) matrix, terminal location information, timestamp, and task service load bit stream of the terminal through the radio frequency front end to form a multi-dimensional feature vector. Perform mean and variance normalization on the CSI matrix to suppress noise interference and obtain a standardized channel matrix.

[0061] CSI amplitude matrix of acquisition terminal ( structure):

[0062]

[0063] Calculate the mean Standard deviation Substitute

[0064] Obtain the standardized matrix:

[0065]

[0066] S2: Based on the normalized channel matrix output by S1, construct the channel coding matrix, then perform OFDM modulation on the coding matrix, calculate each subcarrier symbol, and obtain the frequency domain encrypted carrier symbol sequence;

[0067] Using the weight matrix issued by the 5G base station:

[0068]

[0069] Pick Substitute into the formula

[0070] have to:

[0071]

[0072] Through matrix multiplication, we obtain:

[0073]

[0074] Then the encoding matrix is ​​processed by the formula

[0075] OFDM modulation is performed to obtain the modulation symbol sequence of the first terminal. Its average power is:

[0076]

[0077] S3: Based on the encrypted carrier symbol sequence generated by S2, extract the complex modulus length and mix it with a one-time random number to calculate the hash random factor, which is used as the key negotiation input. The improved Diffie-Hellman algorithm is executed using the negotiation parameters to obtain the dynamic symmetric key.

[0078] According to the formula

[0079] Calculate the random hash seed:

[0080]

[0081] nonce SHA-256 calculation yields:

[0082]

[0083] Substitute into the formula

[0084] Perform Diffie-Hellman key calculation:

[0085]

[0086] Obtain the dynamic key ;

[0087] S4: Use the dynamic key generated by S3 to encrypt the task service load collected by S1 with AES to obtain the task encryption result, and then generate a channel binding signature based on the signature algorithm.

[0088] The task to be performed during the sampling period is "upload transformer oil temperature and coil current data", corresponding to the instruction bitstream. ;

[0089] Encrypt this bitstream using AES-256:

[0090]

[0091] Calculate the channel digest signature:

[0092]

[0093] Output signature hash:

[0094]

[0095] S5: Based on the encryption result and binding signature generated by S4, the signature verification is first performed using the corresponding public key. If the verification result is true, the key is called to decrypt and restore the task instructions. When the decryption result is consistent with the original task, the system determines that the terminal access authentication is successful and updates the channel state cache, thus realizing a closed loop of task data verification and channel security recovery.

[0096] Edge nodes receive data packets Then, perform signature verification:

[0097]

[0098] After successful verification, proceed with decryption:

[0099]

[0100] Right now Authentication successful.

[0101] In this embodiment, the channel feature-driven coding matrix realizes terminal uniqueness mapping and improves the non-forgeability of authentication; the dynamic key and hash random negotiation mechanism ensures key time-varying nature and communication confidentiality; encryption and signature collaborative verification ensure the integrity and traceability of task data; compared with the traditional ECC single-key authentication scheme, the authentication speed is improved by about 41% and the communication security level is improved by about 60%.

[0102] In summary, the proposed secure authentication method for power IoT terminal access achieves unified identity trust, data encryption, and channel binding during terminal access through five core steps: constructing a multi-dimensional channel measurement system, standardizing channel features, dynamic key negotiation, AES-GCM task encryption, and HMAC channel signature. Compared to traditional access authentication methods relying on static keys or centralized certificates, this invention introduces physical layer dynamic features to participate in key derivation, significantly enhancing the randomness and uniqueness of keys and effectively resisting security threats such as man-in-the-middle attacks, signal replay, and fake base station intrusion. This method requires no additional hardware overhead and can be lightweightly implemented in existing 5G communication modules and TEE security environments, with a single key negotiation latency of less than 10ms, meeting the millisecond-level access requirements of power terminals. Through adaptive channel feature updates and periodic key rotation mechanisms, this invention balances security and real-time performance, providing a replicable and scalable engineering solution for trusted access and data protection in multi-terminal, high-concurrency, and high-security scenarios for power IoT.

[0103] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Any equivalent adjustments and extensions made to algorithm parameters, coding structures, authentication mechanisms, or protocol flows within the spirit and principles of the present invention should be considered to fall within the protection scope of the present invention.

Claims

1. A method for secure authentication of terminal task access in the power Internet of Things, characterized in that, Includes the following steps: S1: Construct a multi-dimensional feature acquisition system for terminals. Collect the channel state information (CSI) matrix, terminal location information, timestamp, and task service load bit stream of the terminal through the radio frequency front end to form a multi-dimensional feature vector. Perform mean and variance normalization on the CSI matrix to suppress noise interference and obtain a standardized channel matrix. S2: Based on the normalized channel matrix output by S1, construct the channel coding matrix, then perform OFDM modulation on the coding matrix, calculate each subcarrier symbol, and obtain the frequency domain encrypted carrier symbol sequence; S3: Based on the encrypted carrier symbol sequence generated by S2, extract the complex modulus length and mix it with a one-time random number to calculate the hash random factor, which is used as the key negotiation input. The improved Diffie-Hellman algorithm is executed using the negotiation parameters to obtain the dynamic symmetric key. S4: Use the dynamic key generated by S3 to encrypt the task service load collected by S1 with AES to obtain the task encryption instruction, and then generate a channel binding signature based on the signature algorithm. S5: Based on the encryption result and binding signature generated by S4, the system first performs signature verification using the corresponding public key. If the verification result is true, the key is called to decrypt and restore the task instructions. When the decryption result is consistent with the original task, the system determines that the terminal access authentication is successful and updates the channel state cache, thus realizing a closed loop of task data verification and channel security recovery.

2. The power Internet of Things terminal task access security authentication method according to claim 1, characterized in that, In step S1, the method for calculating the multidimensional feature vector is as follows: Collection of the first A multi-dimensional feature vector is constructed from the channel state information (CSI) matrix, timestamps, and traffic load bitstream of each terminal: in, For the first CSI amplitude and phase matrix of each terminal; This is a vector representing the terminal's location information. For sampling timestamps; This is the bitstream of the task's workload.

3. The power Internet of Things terminal task access security authentication method according to claim 1, characterized in that, In step S1, the method for calculating the normalized channel matrix is ​​as follows: For multidimensional feature vectors After normalization and noise suppression, the standardized channel matrix is ​​obtained: in, , These are the CSI mean and standard deviation, respectively.

4. The power Internet of Things terminal task access security authentication method according to claim 1, characterized in that, In step S2, the frequency domain encrypted carrier symbol sequence calculation method is as follows: The normalized channel matrix obtained in S1 Substitute into the encoding matrix generation function: in, This is the 5G channel weight matrix. , The normalization constant is For unit array; The coding matrix is ​​then subjected to OFDM subcarrier modulation: in, For the first A sequence of encrypted carrier symbols, This represents the number of subcarriers.

5. The method according to claim 1, characterized in that, In step S3, the dynamic symmetric key calculation method is as follows: S2 frequency domain encrypted carrier symbol sequence Calculate its complex modulus and generate a hash random number: in, For hash functions, This indicates the XOR operation. A one-time random number; Using random numbers With negotiated parameters Perform the improved Diffie-Hellman key negotiation, calculated as follows: in, The key is dynamically generated. These are the public prime numbers and generator parameters, respectively.

6. The power Internet of Things terminal task access security authentication method according to claim 1, characterized in that, In step S4, the ASE encryption calculation formula is as follows: The dynamically generated key obtained in S3 Substitute the AES encryption function into the task instruction bitstream. Encrypt: in, This is the encrypted task instruction.

7. The power Internet of Things terminal task access security authentication method according to claim 1, characterized in that, In step S4, the formula for calculating the channel-bound signature based on the signature algorithm is as follows: in, Indicates key-based The signature algorithm, This indicates a splicing operation.

8. The power Internet of Things terminal task access security authentication method according to claim 1, characterized in that, In step S5, the access verification and channel recovery verification steps include: The access end received Then, verify the signature using the public key: If verification passes, decrypt: in, For the restored task instructions, when At that time, the system determines that the terminal access is safe and valid, and updates the channel state cache.

9. A power Internet of Things (IoT) terminal task access security authentication system, characterized in that, include: Multi-dimensional feature acquisition module: used to collect channel status information (CSI), geographic location information, timestamps and task service data streams of power Internet of Things terminals in real time through 5G communication links, normalize and suppress noise in the collected data, and output a standardized channel matrix; Encoding matrix generation module: used to generate a 5G encoding matrix based on a standardized CSI matrix, perform subcarrier modulation, form a unique encrypted symbol sequence for the terminal, and provide input for subsequent dynamic key negotiation; Dynamic key negotiation module: used to calculate a hash random number based on the encoded symbol sequence, and execute the improved Diffie-Hellman key exchange algorithm in combination with the base station negotiation parameters to generate a dynamic key shared by the terminal and the access terminal; Encryption and Signature Module: Used to encrypt terminal task instruction data with AES using a dynamic key and generate a digital signature based on the channel digest; The authentication and channel recovery module is used to verify the legality of digital signatures at the access end, complete decryption and data comparison, determine successful access when the decrypted data is consistent with the original task data, and update the channel cache to realize a closed loop of security authentication.

10. A computer storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method as described in any one of claims 1 to 8.

Images