Trusted authentication method and system for large-scale edge computing environment
By building a multi-level partitioned authentication system in a large-scale edge computing environment and using TPM/TEE to generate static metrics and dynamic behavior assessments, the scalability and security policy autonomy issues of existing authentication mechanisms are solved, achieving efficient, real-time, and secure authentication processing.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- MASSCLOUDS
- Filing Date
- 2025-12-31
- Publication Date
- 2026-04-21
AI Technical Summary
In large-scale edge computing environments, existing authentication mechanisms suffer from scalability issues, authentication delays, single points of failure caused by central node failures, insufficient authentication granularity, lack of continuous authentication and dynamic trust assessment, and insufficient autonomy of security policies.
A multi-level, partitioned, and dynamic evaluation mechanism is adopted. A trusted authentication system is built through edge devices, sub-regional authentication nodes, and regional authentication nodes. Static metrics are generated using TPM/TEE, and multi-dimensional trustworthiness assessment is performed by combining dynamic behavior and historical data to achieve hierarchical authentication and continuous trust management.
It improves the scalability and disaster recovery capabilities of the authentication system, supports access from tens of millions of edge nodes, achieves real-time and secure authentication, reduces the overhead of duplicate authentication, and enhances the robustness of the system and the autonomy of security policies.
Smart Images
Figure CN121907540A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data authentication technology, and in particular to a trusted authentication method and system for large-scale edge computing environments. Background Technology
[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.
[0003] With the development of technologies such as the Internet of Things and artificial intelligence, a massive number of terminal devices are deployed at the network edge, forming a complex edge computing environment. In this environment, the number of devices is huge, their distribution is wide, and the network stability varies greatly, while facing a series of security challenges such as device identity forgery, unauthorized access, and malicious control.
[0004] Currently, most mainstream authentication mechanisms adopt PKI (Public Key Infrastructure) or centralized authentication servers to complete device authentication in the cloud or regional servers. However, in large-scale heterogeneous edge computing environments, these authentication mechanisms suffer from serious scalability issues, authentication latency issues, and single points of failure caused by the failure of the central node, making it difficult to meet the needs of large-scale, dynamic, and distributed edge environments.
[0005] An existing authentication proxy mechanism based on edge gateways exists, in which edge devices complete authentication through nearby gateways, and the gateways then report to the cloud authentication service. While this mechanism alleviates the authentication bottleneck for edge devices directly accessing the cloud to some extent, it still has several technical limitations. First, there is a central dependency issue: the edge gateway still relies on a central authentication server and cannot independently make authentication decisions when the central authentication server fails. Second, the authentication granularity is insufficient; the authentication process mainly focuses on the initial device access and lacks continuous authentication and dynamic trust assessment mechanisms. Third, scalability is insufficient; when the number of devices continues to increase or the topology changes frequently, the fixed gateway authentication architecture is difficult to dynamically adjust, resulting in performance bottlenecks. Fourth, there is a lack of security policy autonomy: authentication policies can only be formulated by the central authentication server, and cannot be flexibly adjusted according to the local security situation within the region. Summary of the Invention
[0006] To address the technical problems mentioned above, this invention provides a trusted authentication method and system for large-scale edge computing environments. By constructing a multi-level, partitioned, and dynamic evaluation mechanism, this invention can complete authentication tasks more efficiently, while taking into account security, availability, and real-time performance.
[0007] To achieve the above objectives, the present invention adopts the following technical solution: The first aspect of the present invention provides a trusted authentication method for large-scale edge computing environments.
[0008] A trusted authentication method for large-scale edge computing environments includes: At least one edge device node constructs an authentication request packet and sends the authentication request to the sub-region authentication node; After determining the legitimacy of the authentication request, at least one sub-region authentication node calls the credibility assessment model to calculate the overall credibility. If the credibility is high, authentication is passed directly, a sub-region authentication token is issued, and the result is cached. If the credibility is medium, secondary verification is triggered. If the credibility is low, isolation is performed and an alarm is triggered. At least one sub-region authentication node sends its own authentication result and its own device data to the regional authentication node. At least one regional authentication node verifies the authentication result and identity of the sub-regional authentication node. After the verification is successful, a regional authentication token is issued and the result is cached. The regional authentication node sends the verification result and its own device data to the global authentication center. After successful authentication, the global authentication center issues a global authentication certificate and distributes it to each node in sequence.
[0009] Furthermore, at least one edge device node constructs an authentication request data packet; the method includes: at least one edge device node calling TPM / TEE in a trusted startup environment to perform startup chain measurement, generate a hash value list, generate a one-time session identifier, and construct an authentication request data packet.
[0010] Furthermore, the authentication request data packet includes: Device_ID, one-time session identifier, static metric, dynamic metric, historical summary, timestamp, and signature.
[0011] Furthermore, the credibility assessment model is expressed by the following formula:
[0012]
[0013]
[0014]
[0015]
[0016] in, Indicates overall credibility. Represents static metric scores. Indicates dynamic behavior scoring. Indicates historical ratings. , , These represent the weights of the static metric score, dynamic behavior score, and historical record score, respectively, and D represents the number of hash differences. This represents the deduction coefficient for each difference item. Indicates the rate of behavioral deviation. This indicates the acceptable threshold. This represents the deduction factor, and U represents the normal operating time. This indicates the authentication success rate, and F represents the number of failures.
[0017] Furthermore, if it is of high credibility, that is... If it is of medium confidence, that is... If it is of low credibility, that is ;in, This indicates a high confidence threshold. This indicates a low confidence threshold.
[0018] Furthermore, the global authentication certificate is distributed sequentially to each node, including: the global authentication center distributes the global authentication certificate to the regional authentication nodes; the regional authentication nodes cache the global authentication certificate for a first specified duration and distribute the global authentication certificate and the first specified duration to the sub-regional authentication nodes; the sub-regional authentication nodes cache the global authentication certificate and the first specified duration for a second specified duration and distribute the global authentication certificate, the first specified duration, and the second specified duration to the edge device nodes; subsequent authentication directly uses the cached token to accelerate authentication.
[0019] Furthermore, when a certain level of authentication node crashes or becomes unusable due to an attack, the superior node immediately activates the backup authentication node, the authentication process automatically switches the authentication chain path, and at the same time, the previously valid credentials are retrieved in the authentication caching mechanism.
[0020] A second aspect of the present invention provides a trusted authentication system for large-scale edge computing environments.
[0021] A trusted authentication system for large-scale edge computing environments includes: The request unit is used by at least one edge device node to construct an authentication request data packet and send the authentication request to the sub-region authentication node. The first authentication unit is used by at least one sub-region authentication node to call the credibility assessment model to calculate the overall credibility after judging the legitimacy of the authentication request; if the credibility is high, the authentication is passed directly, a sub-region authentication token is issued, and the result is cached; if the credibility is medium, secondary verification is triggered; if the credibility is low, isolation is performed and an alarm is triggered; at least one sub-region authentication node sends its own authentication result and its own device data to the regional authentication node. The second authentication unit is used by at least one regional authentication node to verify the authentication results and identity of the sub-regional authentication node. After the verification is successful, a regional authentication token is issued and the result is cached. The regional authentication node sends the verification result and its own device data to the global authentication center. The third authentication unit is used by the global authentication center to issue a global authentication certificate after the authentication is passed, and then distribute it to each node in sequence.
[0022] A third aspect of the present invention provides a computer device comprising: A processor, adapted to execute computer programs; A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in the trusted authentication method for large-scale edge computing environments as described in the first aspect above.
[0023] A fourth aspect of the present invention provides a computer-readable storage medium storing a computer program adapted to be loaded by a processor and to execute steps in a trusted authentication method for large-scale edge computing environments as described in the first aspect above.
[0024] Compared with the prior art, the beneficial effects of the present invention are: This invention fundamentally changes the centralized authentication model by decentralizing authentication permissions and building local decision-making capabilities. Sub-regional authentication nodes can independently complete identity verification and trust calculation for edge devices based on locally stored trusted benchmarks and evaluation models, without continuously relying on real-time instructions from the global authentication center or regional authentication nodes. Even if a higher-level node fails, the continuity of device authentication services within the region can still be guaranteed. Simultaneously, regional nodes can flexibly adjust weight coefficients and threshold parameters in authentication strategies according to the local security situation, breaking the limitation of traditional mechanisms where authentication strategies are entirely centrally determined. This achieves regional autonomy in security strategies and significantly improves the response speed to dynamic security threats in the edge environment.
[0025] This invention constructs a full lifecycle trust assessment system, upgrading authentication from "one-time access verification" to "dynamic and continuous trust management." In terms of authentication data, static metrics (covering the boot chain from BIOS to critical services) are generated through TPM / TEE trusted hardware. These are combined with real-time collected dynamic behavioral indicators (network behavior deviation, behavior pattern matching) and historical operational data (authentication success rate, failure frequency) to form a multi-dimensional trust assessment indicator system. Compared to traditional authentication methods based solely on device certificates, this system offers a more comprehensive security assessment and effectively identifies potential threats. By introducing a quantitative trust calculation model, refined grading of authentication results is achieved: high trust (…). Directly passed, medium credibility ( Triggering secondary verification, low credibility ( Immediately isolate and alert. This tiered processing mechanism avoids security vulnerabilities caused by "one-size-fits-all" authentication, reduces unnecessary authentication overhead, and ensures the real-time nature of trust assessment through continuously updated dynamic indicators and historical summaries. This allows the authentication system to dynamically adapt to changes in device status and improves its adaptability to complex security scenarios in edge environments.
[0026] This invention constructs a security protection mechanism across the entire data chain, from data generation and transmission to verification, ensuring the authenticity and integrity of the authentication process. Edge devices generate metrics via TPM / TEE in a trusted boot environment, fundamentally preventing the invalidation of metric data due to tampering with the boot chain. The authentication request data packet is signed with the device's private key, combined with a one-time session identifier (SID) and a timestamp, effectively resisting common network attacks such as replay attacks and data tampering, ensuring the authenticity of the request source and the integrity of the data. Attached Figure Description
[0027] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.
[0028] Figure 1 This is a structural diagram of a trusted authentication system for large-scale edge computing environments, as shown in an embodiment of the present invention. Figure 2 This is a flowchart illustrating a trusted authentication method for large-scale edge computing environments, as shown in an embodiment of the present invention. Figure 3 This is a flowchart illustrating the edge device authentication process according to an embodiment of the present invention; Figure 4 This is a logic diagram of the authentication failure recovery mechanism shown in an embodiment of the present invention; Figure 5 This is a structural diagram of another embodiment of the trusted authentication system for large-scale edge computing environments shown in this invention. Figure 6 This is a structural diagram of a computer device shown in an embodiment of the present invention. Detailed Implementation
[0029] The present invention will be further described below with reference to the accompanying drawings and embodiments.
[0030] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.
[0031] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.
[0032] As described in the background section, existing edge gateway authentication schemes have several problems: first, in large-scale edge computing environments, traditional centralized authentication mechanisms suffer from performance bottlenecks and insufficient fault tolerance; second, they lack a sustainable dynamic authentication mechanism to cope with the continuous changes in the trusted state of devices; and third, they cannot meet the needs of differentiated security policies and localized authentication autonomy between different regions. To address at least one of these technical problems, this invention provides a trusted authentication method and system for large-scale edge computing environments. Through a multi-level, partitionable trusted authentication process with continuous evaluation capabilities, it achieves a dynamic, secure, and efficient authentication mechanism for edge devices. The following describes the solution in detail through several embodiments.
[0033] Figure 1 This is a structural diagram of a trusted authentication system for large-scale edge computing environments, as shown in an embodiment of the present invention; see reference. Figure 1 The trusted authentication system for large-scale edge computing environments adopts a tree-like hierarchical structure, divided into four levels: L0: Global Authentication Center (cloud-based, responsible for policy definition and root authentication management); L1: Regional authentication node (deployed in provincial or core edge cloud); L2: Sub-regional authentication node (city or park-level edge gateway); L3: Edge device nodes (cameras, sensors, edge servers, etc.).
[0034] Each level of nodes establishes an authentication link through an encrypted channel (such as TLS), and the nodes authenticate each other, avoiding strong dependence on a single node.
[0035] Figure 2 This is a flowchart illustrating a trusted authentication method for large-scale edge computing environments, as shown in an embodiment of the present invention; see reference. Figure 2The trusted authentication method for large-scale edge computing environments described in this embodiment includes: at least one edge device node constructing an authentication request data packet and sending the authentication request to a sub-region authentication node; after determining the validity of the authentication request, at least one sub-region authentication node calls a trustworthiness assessment model to calculate the overall trustworthiness; if the trustworthiness is high, authentication is directly passed, a sub-region authentication token is issued, and the result is cached; if the trustworthiness is medium, secondary verification is triggered; if the trustworthiness is low, isolation and alarm are triggered; at least one sub-region authentication node sends its own authentication result and its own device data to the regional authentication node; at least one regional authentication node reviews the authentication result and identity of the sub-region authentication node, and after the review is passed, issues a regional authentication token and caches the result; the regional authentication node sends the review result and its own device data to the global authentication center; after the authentication is passed, the global authentication center issues a global authentication certificate and distributes it to each node in sequence.
[0036] The trusted authentication method for large-scale edge computing environments described in this embodiment relies on the aforementioned trusted authentication system for large-scale edge computing environments and is applied to that system.
[0037] The following describes in detail the implementation process of the trusted authentication method for large-scale edge computing environments described in this embodiment, including the following steps: Step 1: Edge Device Startup and Metric Generation Edge devices, operating within a trusted boot environment, invoke TPM / TEE to perform boot chain measurements and generate a list of hash values (BIOS, Bootloader, kernel, critical services, etc.). A one-time session identifier (SID) is generated to prevent replay attacks.
[0038] Step 2: Construct the authentication request data packet Data packet structure: {Device_ID, SID, Static Metrics[], Dynamic Metrics[], Historical Summary, Timestamp, Signature}. The authentication request data packet is signed using the edge device's private key to ensure integrity and authenticity of the source.
[0039] Step 3: Edge device node L3 authenticates to sub-region authentication node L2 Figure 3 This is a flowchart illustrating the edge device authentication process according to an embodiment of the present invention; see reference. Figure 3 Edge device node L3 sends an authentication request to sub-region authentication node L2. Sub-region authentication node L2 analyzes the authentication request to determine whether the authentication request is legitimate. If it is, it performs a device trustworthiness assessment; otherwise, it rejects the authentication request.
[0040] The process of device trustworthiness assessment includes: L2 verification of the edge device's public key and signature by the sub-regional authentication node, invoking the trustworthiness assessment model, and calculating the overall trustworthiness. .
[0041] Based on overall credibility Determine if authentication is successful; if successful, issue a sub-region authentication token. And cache the results.
[0042] In this embodiment, the credibility assessment model calculates the overall credibility by introducing multi-dimensional indicators: static metric scores (such as system startup chain), dynamic behavior scores (behavioral pattern matching, network behavior deviation), and historical record scores (normal operation cycle, failure frequency).
[0043] In some embodiments, static metric scoring Calculate using the following formula:
[0044] Where D represents the number of hash differences. This indicates the deduction coefficient for each difference item (e.g., 5 points per item).
[0045] In some embodiments, dynamic behavior scoring Calculate using the following formula:
[0046]
[0047] in, Indicates the rate of behavioral deviation. This indicates the acceptable threshold. This represents the deduction coefficient.
[0048] In some embodiments, historical rating Calculate using the following formula:
[0049] Where U represents uptime. The success rate (%) is represented by F, and the number of failures is represented by F.
[0050] In some embodiments, overall credibility Calculate using the following formula:
[0051] in, , , These represent the weights of static measurement scores, dynamic behavior scores, and historical record scores, respectively. .
[0052] In this embodiment, if If so, then authentication is successful; if If so, then two-factor authentication is triggered; if If it does, isolation and an alarm will be triggered; among them, This indicates a high confidence threshold. This indicates a low confidence threshold.
[0053] Step 4: Sub-region authentication node L2 authenticates to region authentication node L1 Sub-region authentication node L2 sends its authentication result and device data to regional authentication node L1. Regional authentication node L1 verifies the identity and evaluation result of sub-region authentication node L2. After successful verification, it issues a regional authentication token. .
[0054] Step 5: Regional authentication node L1 authenticates with global authentication center L0. Regional authentication node L1 aggregates the data and sends it to global authentication center L0, which then issues a global authentication certificate. The data is then distributed to the regional authentication node L1, which in turn distributes it to the sub-regional authentication node L2, and the sub-regional authentication node L2 distributes it to the edge device node L3.
[0055] Step 6: Authentication caching and fast re-authentication The node caches the authentication result for a specified period of time, and subsequent authentications can directly use the cached token to speed up the authentication process. In this embodiment, Figure 4 This is a logic diagram of the authentication failure recovery mechanism shown in an embodiment of the present invention; refer to Figure 4 When a certain level of authentication node crashes or is attacked and becomes ineffective, the superior node immediately activates the backup authentication node, and the authentication process automatically switches the authentication chain path to ensure uninterrupted operation. At the same time, the previously valid credentials are called in the authentication caching mechanism to ensure temporary availability.
[0056] The existing technologies adopted are: (1) blockchain consensus authentication mechanism, which uses decentralized ledger technology to realize node identity registration and verification, but this solution has a performance bottleneck in high real-time scenarios; (2) group signature or zero-knowledge authentication mechanism: can realize anonymous or lightweight identity authentication, but does not have the ability of regional division and continuous authentication; edge federation authentication model: (3) each region sets a master authentication authority and establishes a trust alliance through federation trust, but the construction and maintenance costs are high. This embodiment provides a trusted authentication method and system for large-scale edge computing environments. By constructing a multi-level, partitioned, and dynamic evaluation mechanism, it can complete the authentication task more efficiently, taking into account security, availability and real-time performance.
[0057] This invention significantly enhances the system's authentication scalability, supporting access from tens of millions of edge nodes; it achieves distributed autonomous authentication, improving the system's disaster recovery and regional autonomy capabilities; it supports continuous device status assessment and authentication re-verification, enhancing the overall system security level; the authentication path can be cached and pushed down, reducing performance loss caused by repeated authentication; it has a rapid failover mechanism, enhancing system robustness; and the authentication strategy is flexible and adjustable, supporting the setting of differentiated authentication strategies by region.
[0058] The above combination Figure 2 The trusted authentication method for large-scale edge computing environments provided by the embodiments of the present invention has been described in detail. Next, the trusted authentication system for large-scale edge computing environments provided by the embodiments of the present invention will be described in conjunction with the accompanying drawings.
[0059] Figure 5 This is a schematic diagram illustrating another embodiment of a trusted authentication system for large-scale edge computing environments, as shown in this invention. (Refer to...) Figure 5 The system described in this invention includes: The request unit is used by at least one edge device node to construct an authentication request data packet and send the authentication request to the sub-region authentication node. The first authentication unit is used by at least one sub-region authentication node to call the credibility assessment model to calculate the overall credibility after judging the legitimacy of the authentication request; if the credibility is high, the authentication is passed directly, a sub-region authentication token is issued, and the result is cached; if the credibility is medium, secondary verification is triggered; if the credibility is low, isolation is performed and an alarm is triggered; at least one sub-region authentication node sends its own authentication result and its own device data to the regional authentication node. The second authentication unit is used by at least one regional authentication node to verify the authentication results and identity of the sub-regional authentication node. After the verification is successful, a regional authentication token is issued and the result is cached. The regional authentication node sends the verification result and its own device data to the global authentication center. The third authentication unit is used by the global authentication center to issue a global authentication certificate after the authentication is passed, and then distribute it to each node in sequence.
[0060] In some embodiments, at least one edge device node constructs an authentication request data packet; including: at least one edge device node invoking TPM / TEE in a trusted startup environment to perform startup chain measurement, generate a hash value list, generate a one-time session identifier, and construct an authentication request data packet.
[0061] In some embodiments, the authentication request data packet includes: Device_ID, one-time session identifier, static metric, dynamic metric, historical summary, timestamp, and signature.
[0062] In some embodiments, the credibility assessment model is expressed by the following formula:
[0063]
[0064]
[0065]
[0066]
[0067] in, Indicates overall credibility. Represents static metric scores. Indicates dynamic behavior scoring. Indicates historical ratings. , , These represent the weights of the static metric score, dynamic behavior score, and historical record score, respectively, and D represents the number of hash differences. This represents the deduction coefficient for each difference item. Indicates the rate of behavioral deviation. This indicates the acceptable threshold. This represents the deduction factor, and U represents the normal operating time. This indicates the authentication success rate, and F represents the number of failures.
[0068] In some embodiments, if the confidence level is high, i.e. If it is of medium confidence, that is... If it is of low credibility, that is ;in, This indicates a high confidence threshold. This indicates a low confidence threshold.
[0069] In some embodiments, and sequentially distributed to each node, the following steps are included: the global authentication center distributes the global authentication certificate to the regional authentication node; the regional authentication node caches the global authentication certificate for a first specified duration and distributes the global authentication certificate and the first specified duration to the sub-regional authentication node; the sub-regional authentication node caches the global authentication certificate and the first specified duration for a second specified duration and distributes the global authentication certificate, the first specified duration, and the second specified duration to the edge device node; subsequent authentication directly uses the cached token to accelerate authentication.
[0070] In some embodiments, when a certain level of authentication node crashes or is attacked and becomes ineffective, the superior node immediately activates the backup authentication node, the authentication process automatically switches the authentication chain path, and at the same time, the last valid credentials are retrieved in the authentication caching mechanism.
[0071] According to embodiments of the present invention, a trusted authentication system for large-scale edge computing environments can correspond to the execution of the methods described in the embodiments of the present invention, and the above and other operations and / or functions of each module of the trusted authentication system for large-scale edge computing environments are respectively implemented to achieve Figure 1 For the sake of brevity, the corresponding processes of each method in the code will not be elaborated here.
[0072] See Figure 6 The diagram illustrates the structure of a computer device, which includes a processor, a communication interface, and a computer-readable storage medium. The processor, communication interface, and computer-readable storage medium are connected via a bus or other means. The communication interface is used to receive and transmit data. The computer-readable storage medium can be stored in the computer device's memory. The computer-readable storage medium stores computer programs, including program instructions, and the processor executes the program instructions stored in the computer-readable storage medium. The processor (or CPU, Central Processing Unit) is the computing and control core of the computer device, adapted to implement one or more instructions, specifically adapted to load and execute one or more instructions to implement the corresponding steps in the trusted authentication method embodiment for large-scale edge computing environments.
[0073] This embodiment provides a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the processing system of the computer device. Furthermore, this storage space also contains one or more instructions suitable for loading and execution by the processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM memory or non-volatile memory, such as at least one disk storage device; optionally, it can also be at least one computer-readable storage medium located remotely from the aforementioned processor.
[0074] In one embodiment, the computer-readable storage medium stores one or more instructions; the processor loads and executes one or more instructions stored in the computer-readable storage medium to implement the corresponding steps in the above-described trusted authentication method embodiment for large-scale edge computing environments.
[0075] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.
[0076] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0077] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0078] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0079] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.
[0080] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.
Claims
1. A trusted authentication method for large-scale edge computing environments, characterized in that, include: At least one edge device node constructs an authentication request packet and sends the authentication request to the sub-region authentication node; After determining the legitimacy of the authentication request, at least one sub-region authentication node invokes the credibility assessment model to calculate the overall credibility. If the credibility is high, authentication is directly granted, a sub-region authentication token is issued, and the result is cached. If the confidence level is medium, then secondary verification is triggered; If the information is of low credibility, it will be isolated and an alert will be issued. At least one sub-regional authentication node sends its own authentication result and its own device data to the regional authentication node; At least one regional authentication node verifies the authentication result and identity of the sub-regional authentication node. After the verification is successful, a regional authentication token is issued and the result is cached. The regional authentication node will send the verification results and its own device data to the global authentication center; After successful authentication, the global authentication center issues a global authentication certificate and distributes it to each node in sequence.
2. The trusted authentication method for large-scale edge computing environments according to claim 1, characterized in that, At least one edge device node constructs an authentication request data packet; the method includes: at least one edge device node calling TPM / TEE in a trusted startup environment to perform startup chain measurement, generate a hash value list, generate a one-time session identifier, and construct an authentication request data packet.
3. The trusted authentication method for large-scale edge computing environments according to claim 1 or 2, characterized in that, The authentication request data packet includes: Device_ID, one-time session identifier, static metric, dynamic metric, historical summary, timestamp, and signature.
4. The trusted authentication method for large-scale edge computing environments according to claim 1, characterized in that, The credibility assessment model is expressed by the following formula: in, Indicates overall credibility. Represents static metric scores. Indicates dynamic behavior scoring. Indicates historical ratings. , , These represent the weights of the static metric score, dynamic behavior score, and historical record score, respectively, and D represents the number of hash differences. This represents the deduction coefficient for each difference item. Indicates the rate of behavioral deviation. This indicates the acceptable threshold. This represents the deduction factor, and U represents the normal operating time. This indicates the authentication success rate, and F represents the number of failures.
5. The trusted authentication method for large-scale edge computing environments according to claim 4, characterized in that, If it is of high credibility, that is If it is of medium confidence, that is... If it is of low credibility, that is ;in, This indicates a high confidence threshold. This indicates a low confidence threshold.
6. The trusted authentication method for large-scale edge computing environments according to claim 1, characterized in that, The global authentication certificate is then distributed sequentially to each node, including: the global authentication center distributes the global authentication certificate to the regional authentication nodes; the regional authentication nodes cache the global authentication certificate for a first specified duration and distribute the global authentication certificate and the first specified duration to the sub-regional authentication nodes; the sub-regional authentication nodes cache the global authentication certificate and the first specified duration for a second specified duration and distribute the global authentication certificate, the first specified duration, and the second specified duration to the edge device nodes; subsequent authentication directly uses the cached token to accelerate authentication.
7. The trusted authentication method for large-scale edge computing environments according to claim 1, characterized in that, When a certain level of authentication node crashes or becomes unusable due to an attack, the superior node immediately activates the backup authentication node, the authentication process automatically switches the authentication chain path, and at the same time, the previously valid credentials are retrieved in the authentication caching mechanism.
8. A trusted authentication system for large-scale edge computing environments, characterized in that, include: The request unit is used by at least one edge device node to construct an authentication request data packet and send the authentication request to the sub-region authentication node. The first authentication unit is used by at least one sub-region authentication node to call the credibility assessment model to calculate the overall credibility after determining that the authentication request is legitimate; if the credibility is high, the authentication is passed directly, a sub-region authentication token is issued, and the result is cached. If the confidence level is medium, then secondary verification is triggered; If the information is of low credibility, it will be isolated and an alert will be issued. At least one sub-regional authentication node sends its own authentication result and its own device data to the regional authentication node; The second authentication unit is used by at least one regional authentication node to verify the authentication results and identity of the sub-regional authentication node. After the verification is successful, a regional authentication token is issued and the result is cached. The regional authentication node will send the verification results and its own device data to the global authentication center; The third authentication unit is used by the global authentication center to issue a global authentication certificate after the authentication is passed, and then distribute it to each node in sequence.
9. A computer device, characterized in that, A processor, adapted to execute computer programs; A computer-readable storage medium storing a computer program that, when executed by the processor, implements the steps of the trusted authentication method for large-scale edge computing environments as described in any one of claims 1-7.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted to be loaded by a processor and to execute the steps of the trusted authentication method for large-scale edge computing environments as described in any one of claims 1-7.