Lightweight identity authentication method for limited equipment under power internet of things

Abstract

The invention relates to the field of security protection of the electric power Internet of Things, in particular to a lightweight identity authentication method for limited equipment under the electric power Internet of Things, which can adapt to a large-scale and widely distributed network environment of the electric power Internet of Things by introducing a lightweight encryption algorithm and an efficient key exchange protocol, ensures the security, and improves the authentication efficiency of the limited equipment under the electric power Internet of Things. The calculation burden and the energy consumption of limited equipment in the power Internet of Things are effectively reduced; a decentralized authentication mechanism is adopted, so that the problems of single-point failure and performance bottleneck in a traditional centralized authentication method are solved, efficient equipment authentication and key exchange are realized, and the expandability of a network is ensured; security threats such as replay attacks and man-in-the-middle attacks are effectively prevented by periodically updating session keys and using digital signatures, and the reliability of network communication and the confidentiality of data are enhanced. By introducing a key exchange protocol and a digital signature technology, the integrity and authenticity of data are guaranteed, tampering behaviors of malicious nodes are prevented, and the overall security of the system is improved.

Description

Technical Field

[0001] This invention relates to the field of security protection for the Internet of Things (IoT) in the power industry, and more particularly to a lightweight authentication method for restricted devices under the IoT in the power industry. Background Technology

[0002] The Internet of Things (IoT) for power systems is a product of the deep integration of traditional power systems and Internet of Things (IoT) technologies. With the digitalization, networking, and intelligentization of power systems, the power IoT is gradually becoming an important component of the next-generation smart grid construction. The power IoT, based on advanced sensing, communication, and computing technologies, collects, transmits, processes, and applies data from power systems to achieve comprehensive digital management and intelligent optimization of the power system. Its ultimate goal is to build a safe, efficient, and reliable energy internet ecosystem.

[0003] The Internet of Things (IoT) for power typically comprises multiple layers, including power equipment, smart terminals, communication networks, and cloud computing platforms. These layers of devices collaborate to provide end-to-end functionality for power data acquisition, transmission, storage, analysis, and decision support. Typical applications of the power IoT include smart meters, distribution automation, transmission line monitoring, distributed energy management, and electric vehicle charging networks.

[0004] However, the widespread application of the power Internet of Things (IoT) has also brought security challenges, especially with the large number of restricted devices deployed in power systems (such as smart meters and sensor nodes). These devices typically have low computing power, limited storage resources, and energy constraints, making it difficult to effectively implement traditional complex encryption algorithms and authentication methods in such devices. Therefore, the research and design of lightweight authentication methods for restricted devices in the power IoT is particularly important.

[0005] In the power Internet of Things (IoT), the authenticity, integrity, and confidentiality of data are core requirements for system security. However, due to limited equipment resources, distributed architecture, and an open network environment, the power IoT faces the following major security challenges:

[0006] Node authentication is a key challenge in the power IoT (Internet of Things) network. It involves verifying the legitimacy of a device within the network. In the power IoT, restricted devices often join the network wirelessly, making them vulnerable to man-in-the-middle attacks and spoofing. If device identity cannot be effectively verified, attackers can impersonate legitimate devices to intrude into the network and compromise system security. Data confidentiality and privacy are also crucial. Data transmitted in the power IoT may include user electricity usage and device status information. If this information is stolen, it could be used for illegal purposes (e.g., stealing user privacy or speculating on energy information). Therefore, measures must be taken to protect the confidentiality of communication data between devices and prevent unauthorized access. Resource constraints also exist. Many devices in the power IoT have limited computing power. Traditional public key infrastructures or complex cryptographic algorithms may overburden the computing system, increasing energy consumption and potentially causing device failure. Therefore, lightweight security protocols are needed to balance computational complexity and security. Finally, authentication complexity in multi-hop networks is critical. In the power IoT, especially in remote monitoring scenarios, communication often requires relaying through multiple nodes (i.e., multi-hop networks). In this network topology, authentication methods need to simultaneously ensure efficiency and scalability, avoiding the introduction of high latency or complex interaction mechanisms in multi-hop communication. Key management is also crucial; the sheer number of nodes in the power IoT makes the secure and efficient management of keys among these nodes a critical issue. Traditional key management methods (such as centralized key distribution) may lead to single points of failure, while fully distributed methods struggle to ensure global consistency.

[0007] To address the aforementioned challenges, scholars and research institutions both domestically and internationally have proposed various lightweight authentication methods. However, these methods still have some shortcomings and are insufficient to meet the practical needs of the power Internet of Things (IoT):

[0008] Lightweight authentication methods based on symmetric encryption have been explored in numerous studies attempting to implement lightweight authentication in constrained devices. These methods offer advantages such as high computational efficiency and low resource consumption. However, symmetric encryption algorithms typically require pre-shared keys, posing a significant challenge to key management in large-scale dynamic networks. Furthermore, symmetric encryption methods are relatively weak against replay attacks and spoofing attacks; public-key cryptography-based authentication methods...

[0009] Public-key cryptography, with its high security and flexibility, is widely used in traditional network authentication methods. However, its high computational complexity makes it difficult for constrained devices to withstand the computational burden. Furthermore, public-key cryptography relies on certificate mechanisms, and the generation, distribution, and verification of certificates also face resource and efficiency challenges in large-scale power IoT applications. Hash function-based authentication methods, due to their lower computational overhead, are considered ideal for lightweight authentication. For example, challenge-response authentication methods typically use hash functions to generate random numbers to verify device identity. However, simple hash methods are vulnerable to man-in-the-middle attacks. Decentralized authentication methods, with the rise of blockchain technology, are being introduced into IoT scenarios. Some studies have proposed using blockchain technology to achieve decentralized node authentication, thus avoiding single points of failure. However, blockchain technology has high computational and storage requirements, which constrained devices may find difficult to adapt to. Simultaneously, the consensus mechanism of blockchain networks often introduces high latency, which cannot meet the real-time communication requirements of power IoT applications.

[0010] In light of the challenges and current research status mentioned above, designing a lightweight authentication method suitable for constrained devices in the power Internet of Things (IoT) needs to meet the following key requirements:

[0011] Low computational overhead and low energy consumption: The authentication method should be based on lightweight algorithms to minimize the computational and energy consumption of restricted devices, thereby extending their lifespan. Efficient key management mechanism: The protocol needs to provide an efficient key distribution and update mechanism to ensure the security and flexibility of key exchange between nodes. Strong attack resistance: The protocol should be able to effectively defend against common attack types, such as man-in-the-middle attacks, replay attacks, spoofing attacks, and denial-of-service attacks. Scalability: As the network scales, the authentication method should be able to dynamically adapt to the addition of new devices and nodes, avoiding performance degradation due to complex interaction mechanisms. Compatibility and flexibility: The authentication method should have good compatibility, adapting to different network topologies and communication protocols. Furthermore, the method should be able to flexibly adjust its security level according to application requirements.

[0012] In order to make up for the shortcomings of existing technologies, it is particularly important for those skilled in the art to continuously conduct research and development and update technologies. Summary of the Invention

[0013] To address the problems and shortcomings of the existing technologies, this invention aims to provide a lightweight authentication method for restricted devices in the power Internet of Things (IoT) framework. The technical solution adopted is as follows:

[0014] A lightweight authentication method for restricted devices in a power Internet of Things (IoT) includes the following steps:

[0015] S1. Authentication Request: When a new node attempts to join the power Internet of Things (IoT), it sends an authentication message to an already authenticated node or gateway. If the new node is near the gateway, the gateway will receive the request; otherwise, another authenticated node will process the request. The authentication message contains a random key and the new node's ID.

[0016] S2. Node Authentication: After receiving the authentication message, the authenticated node or gateway decrypts it and verifies the identity of the new node. If the verification is successful, the authenticated node will send a challenge message to the new node, requiring the new node to respond to the challenge. If the challenge response is correct, the node's identity is authenticated. If the verification fails, the entire process ends.

[0017] S3. Session Key Generation: After authentication, the new node and the authenticated node or gateway generate a session key through a key exchange protocol. The two parties exchange public key information, generate a shared session key using their respective private keys, and use the session key to encrypt subsequent communications.

[0018] S4. Key update: To enhance security, a mechanism for periodically updating the session key is adopted. The session key is updated after a certain time interval, and a new session key is calculated using the new public key and private key.

[0019] S5. Digital signature: To ensure message integrity and prevent tampering, each message is signed by the sending node using its private key before transmission, and the receiving node verifies the signature using its public key to confirm the authenticity and integrity of the message.

[0020] S6. Protocol Operation: During the authentication and session key generation process, the gateway will receive multiple messages from multiple nodes and needs to use the correct key to decrypt these messages. A message type parameter is used on each message. Nodes can check the received message type and process it with the correct key. Through the decentralized authentication mechanism and session key generation process, the identity of each node is effectively verified, ensuring data security.

[0021] Furthermore, security analysis, through challenge-response mechanisms, key updates, and digital signature technologies, effectively defends against cyberattacks and ensures system security.

[0022] Furthermore, in step S1, sending an authentication message to an authenticated node or gateway means that if the new node is near the gateway, the gateway will receive the request; otherwise, another authenticated node will process the request. The authentication message contains a random key. i The key comes from the pre-shared network key PNK and the ID of the new node, which are encrypted with the key and encryption algorithm.

[0023] Furthermore, the node authentication in step S2 includes the following steps:

[0024] S2.1. Upon receiving this message, the authenticated node or gateway decrypts it using the default network key DNK and checks the random key Key. i Does it exist in its own pre-shared network key PNK? If not, add the new node ID to the rejection list for future reference; if it exists, use the random key Key. i A challenge message is sent to the new node to verify its identity. Once the new node receives the challenge, it must calculate the value and send a challenge response.

[0025] S2.2. Upon receiving the challenge response, the authenticated node or gateway decrypts it and checks if the value is correct. If incorrect, the new node is added to the rejection list. If correct, and the authenticated node received the challenge response, the authenticated node sends a message to the gateway, requesting the gateway to initiate a session with the newly joined node. If correct, and the gateway received the challenge response, the gateway initiates a session with the newly joined node. The message expression is:

[0026]

[0027] In the formula, Key i It is a random key, ID B It is the ID of the new node.

[0028] Further, the challenge message in step S2.1 is expressed as:

[0029]

[0030] In the formula, R1 is a random value generated by the certified node A, and X represents different values.

[0031] Furthermore, step S2.1, calculating the value and sending a challenge response, refers to calculating R1 and X and sending a challenge response.

[0032] Furthermore, X is a variable used to describe the node that sends the challenge message, including a MAC address variable. Variables using timestamps And the random variable R2.

[0033] Furthermore, step S3, session key generation, includes the following steps:

[0034] S3.1. After receiving a request message from a new node, the gateway will execute an algorithm to decrypt the message and save the random key obtained from the new node. iAnd ID; then, using the hard-coded value and its own private key, the public value α is calculated, and the message M is... α Send to the new node;

[0035] S3.2. After receiving the public value from the gateway, the new node first generates a private key and uses this private key and a hard-coded value to calculate the public value β. Additionally, the new node generates a private / public key pair for signing and verifying message signatures. The new node then forwards message M... β The public key is sent to the gateway, and the session key is calculated using the received public value α;

[0036] S3.3. After receiving the public value from the gateway, the new node first generates a private key and uses this private key and a hard-coded value to calculate the public value β. Additionally, the new node generates a private / public key pair for signing and verifying message signatures. The new node then sends message M... β The public key is sent to the gateway, and the session key is calculated using the received public value α;

[0037] Furthermore, the key is obtained by using a small prime number of 256 bits to obtain a 256-bit key.

[0038] A computer device includes a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor executes the computer program to implement the steps of a lightweight authentication method for restricted devices under the power Internet of Things.

[0039] A computer storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of a lightweight authentication method for restricted devices under the power Internet of Things.

[0040] Compared with existing technologies, its advantages are as follows:

[0041] This invention proposes a novel authentication method based on a lightweight algorithm. While meeting the requirements of efficiency, security, and flexibility for the power Internet of Things (IoT), this invention fully considers the resource constraints of limited devices. Furthermore, by introducing a decentralized authentication mechanism, a distributed key management method, and a differentiated security level design, the practicality and market value of the method can be further enhanced.

[0042] This invention, by introducing a lightweight encryption algorithm and an efficient key exchange protocol, can adapt to large-scale, widely distributed power Internet of Things (IoT) network environments, ensuring security while effectively reducing the computational burden and energy consumption of restricted devices in the power IoT. The decentralized authentication mechanism solves the single point of failure and performance bottleneck problems of traditional centralized authentication methods, enabling efficient device authentication and key exchange, and ensuring network scalability. By regularly updating session keys and using digital signatures, it effectively prevents security threats such as replay attacks and man-in-the-middle attacks, enhancing the reliability of network communication and the confidentiality of data. The introduction of the key exchange protocol and digital signature technology ensures the integrity and authenticity of data, prevents tampering by malicious nodes, and further improves the overall security of the system. Attached Figure Description

[0043] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, in which:

[0044] Figure 1 This is a schematic diagram of a lightweight identity authentication protocol method for restricted devices under the power Internet of Things. Detailed Implementation

[0045] To better understand the above-mentioned objectives, features, and advantages of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be noted that, unless otherwise specified, the embodiments of the present invention and the features thereof can be combined with each other.

[0046] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and therefore the scope of protection of the invention is not limited to the specific embodiments disclosed below.

[0047] The following reference Figure 1 The technical solutions of some embodiments of the present invention are described below.

[0048] Example 1

[0049] This invention provides an embodiment of a lightweight authentication method for restricted devices under the power Internet of Things. To better understand this invention, Table 1 shows the definitions of each variable:

[0050] Table 1 Variable Definitions

[0051]

[0052]

[0053] In this invention, each message exchange, including key establishment, is encrypted using a lightweight encryption algorithm. This invention assumes that nodes will execute multiple processes at different stages. Therefore, at specific execution points, confirmation steps are required. For this purpose, this invention uses message types with different IDs. When an authenticated node or gateway receives a message, it can continue as needed.

[0054] The message types used in this invention are as follows:

[0055] Authentication messages are messages sent by new nodes attempting to join the network to already authenticated nodes or gateways. The message content includes the node ID and the key. i ;

[0056] An authentication response message is a response to an authentication message. It is sent by an authenticated node or gateway and contains a challenge that requires the node seeking authentication to respond.

[0057] The challenge response message contains the response to the challenge and is sent to the authenticated node or gateway that originally sent the challenge;

[0058] The authenticated node sends a request message to the gateway, requesting the gateway to initiate a session key generation process between itself and the newly joined node. The message content includes the ID of the node to be joined and the key used in the authentication process. i ;

[0059] The public value message is eventually sent by each node or gateway. This message contains the parameters (public values) needed by other nodes or gateways to generate the public session key. Nodes or gateways may send other parameters in this message, such as their own ID for authentication purposes and the public key for their digital signature algorithm.

[0060] Session key update message: This message is sent by a node or gateway at specific time intervals. Its content is the same as the public value message. It is intended to notify the gateway to calculate a new session key using the new public value.

[0061] Key refresh time message: This message is sent by the gateway and is used to inform the node that it should refresh the session key if the node does not start the update process itself.

[0062] Confirmation message, sent by the gateway to the node, confirming receipt of the new public value in the session key update message;

[0063] Relay node confirmation message: When an authenticated, out-of-range node needs to communicate with the gateway through another relay node, the node continues to send data messages to the gateway. When this happens, the gateway sends this type of message to the new relay node to notify it that the out-of-range node has been authenticated and can forward its data.

[0064] Example 2

[0065] The present invention provides another embodiment, which is as follows: Figure 1 As shown, a lightweight authentication method for restricted devices under the power Internet of Things includes the following steps:

[0066] S1. Authentication Request: When a new node B attempts to join the power IoT, it sends an authentication message to a nearby authenticated node A or the gateway, requesting authentication for the new node B. If the new node B is close to the gateway, the gateway will receive the request; otherwise, an authenticated node A will process the request. The authentication message contains a random key. i The ID of the new node B comes from the pre-shared network key PNK, which is loaded by the administrator during the node programming phase.

[0067] S2. Node Authentication: After receiving the authentication message, the authenticated node A or gateway decrypts it using the default network key DNK and checks the random key Key. i If the new node B's ID exists in its own pre-shared network key PNK, and if not, the new node B's ID is added to the rejection list for future reference. If it exists, the random key Key is used. i Send a challenge message to new node B to verify its identity. The challenge message is as follows: Where M represents information, R1 is a random value generated by the authenticated node A, and X can be different values, such as variables describing the node that sent the challenge message, like its MAC address. Variables using timestamps Alternatively, a simple random variable R2 can be used. When the new node B receives the challenge information, it must calculate R1 and X, and send a challenge response. Authenticated node A or the gateway must then wait for a challenge response. Algorithms 1 and 2 below describe the authentication process:

[0068] Algorithm 1

[0069]

[0070]

[0071] Algorithm 2

[0072]

[0073] Upon receiving the response, the authenticated node A or the gateway decrypts the message and checks if R1 and X are correct. If incorrect, the new node B is added to the rejection list. If correct, and the authenticated node has received the challenge response, the authenticated node A sends a request message to the gateway, requesting the gateway to initiate a session with the newly joined node through itself; if correct, and the gateway has received the challenge response, the gateway initiates a session with the newly joined node; the key used in the above process is included. i And the node's ID, so that the gateway can compare them later, the expression is:

[0074]

[0075] In the formula, Key i It is a random key, ID B It is the ID of the new node.

[0076] S3. Session Key Generation: To create session keys between nodes and the gateway, the Diffie-Hellman protocol is used as the key exchange protocol, through a random key. i Encryption is used to resist man-in-the-middle attacks. Each node in the network needs to have the hard-coded values ​​g and p required by the Diffie-Hellman protocol. In this way, the node only needs to calculate a private key to generate the session key.

[0077] After receiving the request message from the new node B, the gateway will execute Algorithm 3 to decrypt the message and save the random key obtained from the new node B. i And ID. Then, using the hard-coded values ​​g and p, along with its own private key a, the public value α is calculated, and the gateway sends message M... α Send to new node B.

[0078] Algorithm 3

[0079]

[0080] After receiving the public value α from the gateway, the new node B first generates a private key b and uses it along with hard-coded values ​​g and p to calculate the public value β. Additionally, the new node B generates a private / public key pair for signing and verifying message signatures. Then, the new node sends message M... β The public key is sent to the gateway, and finally, the session key is calculated using the received public value α.

[0081] Once the gateway receives the message, it will decrypt it and save the public key for verifying the signature for later use. At the same time, it will check whether the ID sent by the new node B along with the public value β matches the ID sent by the previously authenticated node A that authenticated the new node B. If the new node B was directly authenticated by the gateway instead of the previously authenticated node A, this step will be skipped. If the IDs match, the gateway will generate a session key, enabling the new node B to communicate privately with the gateway.

[0082] Algorithm 4 below describes the process of generating session keys:

[0083] Algorithm 4

[0084]

[0085] S4. Session Key Update: The session key employs a periodic update mechanism to extend network lifespan and improve overall security. The required update frequency varies depending on the scenario and environment; careful consideration should be given to determine the appropriate frequency. To update the key, repeat the S3 process, but use the old session key instead of the random key. i For encryption, the gateway does not need to send the public value α from the Diffie-Hellman protocol because it is a constant value (since its private key cannot be changed without administrator intervention). Node B generates a new public value β using a completely new private key b1. 1， Then, the new public key is sent to the gateway using the new public value β1 so that both parties can generate a new session key. During this process, the private / public key pair used by the node for signing is also updated.

[0086] After receiving the message, the gateway generates a new session key and sends an acknowledgment message to Node B to ensure that the new session key can be generated and updated by both parties. Then, both parties discard the old session key and use the new session key to exchange messages.

[0087] However, if a node fails to send a public value, the gateway will initiate a key update process by sending a key refresh time message. If, after a period of time, the node still has not sent a new public value, it will be removed from the gateway's network.

[0088] S5. Digital signatures ensure message integrity and prevent tampering. Before transmission, each message is signed by the sending node using its private key, and the receiving node verifies the signature using its public key to confirm the authenticity and integrity of the message.

[0089] To implement a digital signature mechanism, a node must compute the private / public key pair required to generate and verify a signature, and send the public key along with the public value to the gateway via a public-value message. The node will sign the message using its private key, and the gateway will use the public key received from the node to correctly verify the signed message. The private / public key pair is refreshed with each update of the session key, and the message is signed using the SchnorrQ digital signature algorithm.

[0090] S6. Protocol Operation: During authentication and session key generation, the gateway will receive multiple messages from multiple nodes and needs to use the correct key to decrypt these messages. For example, when the gateway receives a request from authenticated node A to generate a session key with a new node B (a request message to the gateway), it needs to decrypt the request using the session key of authenticated node A and use the random key Key. i Encrypt the public value so that the new node B can correctly decrypt the message to generate the session key.

[0091] To this end, this invention uses a message type parameter on each message. This allows nodes to check the type of the received message and process it using the correct key. Taking the previous example, the gateway will see that the message from authenticated node A is a request to generate a session key with other nodes (a message requesting the gateway), therefore the required key is the session key with authenticated node A. For the next message, since it is a public value message, the gateway must use the key used by authenticated node A and the new node B during the authentication process. i Decryption is performed.

[0092] Consider a scenario where a new node B communicates with the gateway using an authenticated node A. If, for some reason, authenticated node A goes offline, the new node B will no longer be able to communicate with the gateway. To solve this problem, the new node B must choose another neighbor to communicate with and find another path to the gateway.

[0093] In this scenario, new node B does not need to repeat the authentication and session key generation process. Because it is already a valid node in the network, it can continue sending data messages to the gateway after finding a new relay node. However, a malicious node might exploit this and do the same thing. In this case, since the relay node does not decrypt the data messages, they will be sent directly to the gateway. The gateway verifies the message, and if it is not sent by a valid node, it will discard the message and terminate communication.

[0094] The relay node will continuously receive and resend messages from the malicious node to the gateway. To address this issue, the gateway sends a relay node acknowledgment message. Therefore, the relay node knows it can continue resending messages from that node or cease communication with it.

[0095] Example 3

[0096] The present invention provides another embodiment, which is a method for assessing the risk of malicious command attacks on active power distribution networks that takes into account the characteristics of malicious command behavior.

[0097] Security analysis, through challenge-response mechanisms, key updates, and digital signature technology, effectively defends against cyberattacks and ensures system security.

[0098] The key used in this invention is shared only between the gateway and nodes. Therefore, data cannot be accessed without knowing the encryption key. Only legitimate nodes and the gateway can access the pre-shared network key PNK and the default network key DNK. When a node needs a challenge response, it must know the pre-shared network key PNK and the default network key DNK, because the challenge is randomly generated, and only legitimate nodes can provide the correct challenge response. In the Diffie-Hellman protocol, the difficulty of breaking it (i.e., finding the shared key through the exchange process) increases exponentially with the size of the prime number used. To maintain the lightweight nature of the solution and using the NIST encryption algorithm, this invention uses a 256-bit prime number to obtain a 256-bit key. If the key is calculated using a 256-bit prime number, this means that 2^35 bits are being processed. 256 The value within the range is approximately 1.2 × 10⁻⁶. 77 There are 10 possible values. Among all these values, the number of primes can be estimated using the Prime Number Theorem, which states that the distribution of primes is 10 ... When selecting a common value, there are approximately 1.5 × 10⁻⁶. 75 or 2 250 1 possible prime number, estimated at 2 per second 30 The time required for this brute-force attack to break this value in the next test is approximately 2. 220 seconds or 5.3 × 10 58 It takes years to find the key, so the key is secure within a reasonable timeframe.

[0099] A private / public key pair is used for digital signatures. Nodes use their private key to sign, while gateways use the public key established with the node to verify the signature's validity. Only the node knows its private key, making it the only entity capable of signing its own message. Since the gateway possesses the public key, it can verify the signature's validity using a SchnorrQ algorithm with similar parameters.

[0100] Example 4

[0101] Based on the same inventive concept, embodiments of the present invention also provide a computer device, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor. When the processor executes the computer program, it implements the steps of the lightweight authentication method for restricted devices under the power Internet of Things described in embodiments 1-2.

[0102] Example 5

[0103] Based on the same inventive concept, this embodiment of the invention also provides a computer storage medium storing a computer program, which, when executed by a processor, implements the steps of a lightweight identity authentication method for restricted devices under the power Internet of Things as described in embodiments 1-2.

[0104] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0105] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0106] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0107] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0108] In the description of this specification, the terms "one embodiment," "some embodiments," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0109] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A lightweight authentication method for restricted devices under the power Internet of Things, characterized in that, Includes the following steps: S1. Authentication Request: When a new node attempts to join the power IoT, it sends an authentication message to an already authenticated node or gateway. If the new node is near the gateway, the gateway will receive the request; otherwise, another authenticated node will process the request. The authentication message contains a random key and the new node's ID. S2. Node Authentication: After receiving the authentication message, the authenticated node or gateway decrypts it and verifies the identity of the new node. If the verification is successful, the authenticated node will send a challenge message to the new node, requiring the new node to respond to the challenge. After the challenge response is correct, the node's identity is authenticated. If the verification fails, the entire process ends. S3. Session Key Generation: After authentication, the new node and the authenticated node or gateway generate a session key through a key exchange protocol. The two parties exchange public key information, generate a shared session key using their respective private keys, and use the session key to encrypt subsequent communications. S4. Key update: A mechanism for periodically updating the session key is adopted. The session key is updated after a certain time interval, and a new session key is calculated using the new public key and private key. S5. Digital signature: Each message is signed by the sending node using its private key before transmission, and the receiving node verifies the signature using its public key to ensure the authenticity and integrity of the message. S6. Protocol Operation: During the authentication and session key generation process, the gateway will receive multiple messages from multiple nodes and use the correct key to decrypt these messages. A message type parameter is used on each message. The nodes check the received message type and process it using the correct key. Through the decentralized authentication mechanism and session key generation process, the identity of each node is effectively verified, ensuring data security.

2. The lightweight identity authentication method for restricted devices under the power Internet of Things according to claim 1, characterized in that, In step S1, sending an authentication message to an authenticated node or gateway means that if the new node is near the gateway, the gateway will receive the request; otherwise, another authenticated node will process the request. The authentication message contains a random key. i The key comes from the pre-shared network key PNK and the ID of the new node, which is encrypted with the key and encryption algorithm.

3. The lightweight identity authentication method for restricted devices under the power Internet of Things according to claim 1, characterized in that, The node authentication in step S2 includes the following steps: S2.

1. Upon receiving this message, the authenticated node or gateway decrypts it using the default network key DNK and checks the random key Key. i Does it exist in its own pre-shared network key PNK? If not, add the new node ID to the rejection list for future reference; if it exists, use the random key Key. i A challenge message is sent to the new node to verify its identity. Once the new node receives the challenge, it must calculate the value and send a challenge response. S2.

2. Upon receiving a challenge response, the authenticated node or gateway decrypts it and checks if the value is correct; if incorrect, the new node is added to the rejection list. If correct, and the authenticated node receives the challenge response, the authenticated node sends a message to the gateway, requesting the gateway to initiate a session with the newly joined node through itself; If correct, and the gateway receives the challenge response, then the gateway initiates a session with the newly joined node; the message expression is: In the formula, Key i It is a random key, ID B It is the ID of the new node.

4. The lightweight identity authentication method for restricted devices under the power Internet of Things according to claim 3, characterized in that, The challenge message in step S2.1 is expressed as: In the formula, R1 is a random value generated by the certified node A, and X represents different values.

5. A lightweight identity authentication method for restricted devices under the power Internet of Things according to claim 3, characterized in that, Step S2.1, calculating the value and sending a challenge response, refers to calculating R1 and X and then sending a challenge response.

6. A lightweight authentication method for restricted devices under a power Internet of Things according to any one of claims 3-5, characterized in that, X is a variable used to describe the node that sends the challenge message, including the MAC address variable. Variables using timestamps And the random variable R2.

7. A lightweight authentication method for restricted devices under the power Internet of Things according to claim 1, characterized in that, Step S3, session key generation, includes the following steps: S3.

1. After receiving a request message from a new node, the gateway executes the algorithm to decrypt the message and saves the random key obtained from the new node. i And ID; then, using the hard-coded value and its own private key, the public value α is calculated, and the message M is... α Send to the new node; S3.

2. After receiving the public value from the gateway, the new node first generates a private key and uses this private key and a hard-coded value to calculate the public value β. Additionally, the new node generates a private / public key pair for signing and verifying message signatures. The new node then forwards message M... β The public key is sent to the gateway, and the session key is calculated using the received public value α; S3.

3. Upon receiving the message, the gateway will decrypt it and save the public key for verification of the signature for subsequent use. At the same time, it will check whether the ID sent by the new node along with the public value matches the ID sent by the previously authenticated node that authenticated the new node. If the new node was directly authenticated by the gateway instead of by the previously authenticated node, this step will be skipped. If the IDs match, the gateway will generate a session key to enable the new node to communicate privately with the gateway.

8. A lightweight authentication method for restricted devices under the power Internet of Things according to claim 1, characterized in that, The key is obtained by using a small prime number of 256 bits to obtain a 256-bit key.

9. A computer device, comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of a lightweight authentication method for restricted devices under the power Internet of Things as described in any one of claims 1-8.

10. A computer storage medium, characterized in that, The computer storage medium contains a computer program, which, when executed by a processor, implements the steps of a lightweight authentication method for restricted devices under the power Internet of Things as described in any one of claims 1-8.

Images