Equipment automatic network access method and system based on Internet of Things

Abstract

The invention relates to the technical field of automatic network access of Internet of Things equipment, and discloses an automatic network access method and system for equipment based on the Internet of Things, and the method comprises the steps: collecting and preprocessing physical signals of the equipment, constructing a physical fingerprint feature sequence, and extracting stable and repeated mode paragraphs from the physical fingerprint feature sequence to form a core fingerprint template; performing error correction coding on the core fingerprint aiming at bit flipping caused by noise to obtain stable fingerprint information, and generating an encryption key for identity verification through one-way transformation; performing bit-level matching on the generated secret key and a preset registration secret key to complete equipment legality judgment and generate a network access authorization code; and after the equipment accesses the network, updating a key adjustment parameter according to a real-time physical signal in a dynamic environment, and triggering a key updating process when the key deviation exceeds a tolerance range. According to the method, the problem of insufficient identity verification accuracy in the access process of the Internet of Things equipment can be solved.

Description

Technical Field

[0001] This invention relates to the field of automatic network access technology for Internet of Things (IoT) devices, and in particular to a method and system for automatic network access of IoT-based devices. Background Technology

[0002] With the rapid development of information technology, a large number of heterogeneous devices are interacting through networks, enabling systems to have sensing, analysis, and collaborative control capabilities. However, the rapid increase in the number of devices and the increasing complexity of deployment environments have made the security and reliability issues in the process of IoT device access increasingly prominent. If devices lack an effective identity authentication mechanism during the network access phase, it can easily lead to risks such as unauthorized access, data leakage, or system failure.

[0003] Currently, in existing technologies, IoT device network access often relies on pre-set identity identifiers, fixed keys, or certificates for authentication. In long-term operation or cross-regional deployment scenarios, devices are affected by factors such as hardware aging, environmental noise, and electromagnetic interference, causing changes in their physical characteristics and operating status. This makes it difficult for traditional authentication methods based on static credentials to maintain consistent stability and accuracy. Furthermore, while some solutions attempt to introduce physical fingerprint information as an identity feature, physical fingerprints are susceptible to noise interference during collection, exhibiting instability. This makes it difficult to reliably recover keys generated based on this information, thus affecting the continuity of device authentication.

[0004] Existing technologies have the problem of making it difficult to accurately recover the physical fingerprint of a device and generate a reliable encryption key under conditions of noise interference and changes in device characteristics. Summary of the Invention

[0005] This invention provides a method and system for automatic network access of IoT-based devices to solve the problem of insufficient identity verification accuracy during the IoT device access process.

[0006] Firstly, in order to solve the above-mentioned technical problems, the present invention provides a method for automatic network access of devices based on the Internet of Things, comprising: The physical signal data generated by the acquisition device during operation is collected, and the physical signal data is preprocessed to obtain a physical fingerprint feature sequence. The physical fingerprint feature sequence is clustered and grouped, and the groups that meet the preset judgment conditions are identified as stable mode segments. The mean of each stable mode segment is calculated and a mean feature curve is generated. A fluctuation tolerance envelope is constructed based on the mean feature curve as the core fingerprint template. The core fingerprint template is discretely encoded to obtain an encoded fingerprint sequence. Bit flip error detection is performed on the encoded fingerprint sequence to determine the index coordinates where bit flip errors occur. Error correction decoding is performed on the logic level corresponding to the index coordinates to obtain the error-corrected stable fingerprint information. The stable fingerprint information is extended by salt bit sequence expansion to obtain an extended feature bit matrix. The extended feature bit matrix is ​​then recombined by a preset one-way hash function to obtain a recombined sequence. The recombined sequence is then used to construct a preliminary encryption key as the basis for identity verification credentials. Based on the initial encryption key and the preset device registration key, the number of logic zero levels of the difference features is calculated to determine the bit-level matching degree value. When the bit-level matching degree value exceeds the preset matching degree threshold, the device identity is determined to be legitimate and the network access authorization code is obtained. In response to the network access authorization code, a complex matrix of channel state information containing multipath transmission characteristics is extracted, and a quantization step size is calculated based on the complex matrix of channel state information to obtain an adaptive quantization step size. If the adaptive quantization step size is greater than a preset basic step size, data packet configuration is performed to generate key dynamic adjustment parameters that adapt to environmental changes. If the key dynamic adjustment parameters cause the key deviation to exceed the preset tolerance range, the key update process is triggered to obtain an updated reliable encryption key.

[0007] Secondly, the present invention provides an automatic device network access system based on the Internet of Things, comprising: The data acquisition module is used to acquire physical signal data generated by the device during operation and to preprocess the physical signal data to obtain a physical fingerprint feature sequence. The fingerprint extraction module is used to cluster and group the physical fingerprint feature sequence, determine the group that meets the preset judgment conditions as stable mode segments, calculate the mean for each point of the stable mode segment, generate the mean feature curve, and construct the fluctuation tolerance envelope based on the mean feature curve as the core fingerprint template. The stable fingerprint module is used to perform discrete encoding processing on the core fingerprint template to obtain an encoded fingerprint sequence, perform bit flip error detection on the encoded fingerprint sequence, determine the index coordinates where the bit flip error occurs, and perform error correction decoding on the logic level corresponding to the index coordinates to obtain the error-corrected stable fingerprint information. The preliminary encryption module is used to perform salt bit sequence expansion on the stable fingerprint information to obtain an extended feature bit matrix, combine it with a preset one-way hash function to perform sequence recombination on the extended feature bit matrix to obtain a recombined sequence, and construct the recombined sequence as a preliminary encryption key as the basis for identity verification credentials; The network access authorization module is used to calculate the number of logic zero levels of the difference features based on the preliminary encryption key and the preset device registration key, and determine the bit-level matching degree value. When the bit-level matching degree value exceeds the preset matching degree threshold, the device identity is determined to be legitimate and a network access authorization code is obtained. The dynamic parameter tuning module is used to respond to the network access authorization code, extract the complex matrix of channel state information containing multipath transmission characteristics, and calculate the quantization step size based on the complex matrix of channel state information to obtain an adaptive quantization step size. If the adaptive quantization step size is greater than the preset basic step size value, data packet configuration is performed to generate key dynamic adjustment parameters that adapt to environmental changes. The reliable encryption module is used to trigger a key update process to obtain an updated reliable encryption key if the key deviation exceeds a preset tolerance range due to the dynamic adjustment of the key parameters.

[0008] Compared with the prior art, the present invention has the following beneficial effects: (1) This invention preprocesses and constructs feature sequences from the physical signal data of the device, and further extracts stable and recurring pattern segments from the feature sequences to form a core fingerprint template. Since physical signals generally have high-frequency noise, instantaneous jitter and non-stationary disturbances during the acquisition process, directly using the original fingerprint can easily lead to feature shifts of the same device at different times / under different environments. This invention uses frequency domain transformation to determine the filtering boundary, smooths the signal and extracts stable key points, and uses dominant period segmentation and distance matrix clustering to screen stable patterns. Then, it constructs a fluctuation-tolerant envelope through phase alignment and mean feature curve, thereby converging the "fluctuating original fingerprint" into "repeatable template features". This achieves a more consistent physical fingerprint representation even under noise and slight hardware drift conditions, improving the stability and usability of physical fingerprints for identity verification.

[0009] (2) After obtaining the core fingerprint template, this invention introduces an error correction coding mechanism for bit flipping to encode and verify the fingerprint, outputting the corrected stable fingerprint information, and then performing a one-way transformation to generate a preliminary encryption key. Since the physical fingerprint to binary mapping process is highly sensitive to noise, even minor disturbances can cause bit flipping, making key reconstruction difficult. This invention uses redundant check bits and syntagmatic vectors to locate error indices and correct logic levels, "absorbing" the differences caused by random noise within the error-correctable range. Then, the stable fingerprint is mixed with random salt logic and processed through nonlinear permutation and hashing, ensuring that the output key is determined by fingerprint features and is irreversible. This enhances the attack resistance and unpredictability of key generation while ensuring key reconstructability, thereby improving the security strength of authentication credentials.

[0010] (3) This invention further employs bit-level matching degree threshold judgment to achieve rapid identity legitimacy confirmation and generate network access authorization code, and introduces key dynamic adjustment parameters and key update process based on real-time channel state information for dynamic environments. Due to factors such as cross-regional deployment, channel multipath changes, and temperature and humidity disturbances in IoT device access scenarios, relying solely on one-time key comparison is prone to false rejection or long-term availability degradation; this invention obtains quantifiable matching degree through the statistical analysis of aligned XOR difference vectors and makes judgments based on thresholds, while adaptively adjusting quantization and error correction rules using the statistical characteristics of dynamic phase offset sequences, triggering reconstruction and refresh of authorization status when the deviation exceeds the tolerance range. Thus, without reducing security, it improves the pass rate and continuous authentication reliability of IoT device access process, reduces the risk of service interruption caused by misjudgment, and enhances the system's adaptability to environmental changes. Attached Figure Description

[0011] Figure 1 This is a schematic diagram of the automatic network access method for IoT-based devices provided in the first embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of the Internet of Things-based automatic device network access system provided in the second embodiment of the present invention. Detailed Implementation

[0012] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0013] Reference Figure 1 The first embodiment of the present invention provides a method for automatic network access of devices based on the Internet of Things, including the following steps: S11, Collect physical signal data generated by the device during operation, and preprocess the physical signal data to obtain a physical fingerprint feature sequence; S12, the physical fingerprint feature sequence is clustered and grouped, and the group that meets the preset judgment conditions is determined as a stable mode segment. The mean is calculated point by point for the stable mode segment, and a mean feature curve is generated. Based on the mean feature curve, a fluctuation tolerance envelope is constructed as the core fingerprint template. S13, the core fingerprint template is discretely encoded to obtain an encoded fingerprint sequence. Bit flip error determination is performed on the encoded fingerprint sequence to determine the index coordinates where the bit flip error occurs. Error correction decoding is performed on the logic level corresponding to the index coordinates to obtain the error-corrected stable fingerprint information. S14, perform salt bit sequence expansion on the stable fingerprint information to obtain an extended feature bit matrix, combine a preset one-way hash function to perform sequence recombination on the extended feature bit matrix to obtain a recombined sequence, and construct the recombined sequence as a preliminary encryption key as the basis for identity verification credentials; S15. Based on the preliminary encryption key and the preset device registration key, calculate the number of logic zero levels of the difference features and determine the bit-level matching degree value. When the bit-level matching degree value exceeds the preset matching degree threshold, determine that the device identity is legitimate and obtain the network access authorization code. S16, in response to the network access authorization code, extract the complex matrix of channel state information containing multipath transmission characteristics, and calculate the quantization step size based on the complex matrix of channel state information to obtain an adaptive quantization step size value. If the adaptive quantization step size value is greater than the preset basic step size value, execute data packet configuration to generate key dynamic adjustment parameters that adapt to environmental changes. S17. If the key dynamic adjustment parameters cause the key deviation to exceed the preset tolerance range, the key update process is triggered to obtain the updated reliable encryption key.

[0014] In step S11, it is necessary to collect physical signal data generated by the device during operation and preprocess the physical signal data to obtain a physical fingerprint feature sequence, including: The physical signal data is subjected to frequency domain transformation to obtain spectral distribution information; The cutoff frequency is determined based on the spectral distribution information, and a digital low-pass filter is constructed based on the cutoff frequency; The physical signal data is convolved using the digital low-pass filter to output smooth signal data after filtering out high-frequency noise. Stable key points are extracted from the smoothed signal data, and the stable key points are combined in time sequence to obtain a preliminary clean physical fingerprint feature sequence.

[0015] After a device initiates a network access request, the first step is to collect the raw physical signal data of the IoT terminal. This physical signal can be any signal type that reflects the hardware characteristics of the device, such as acceleration signals, power consumption fluctuation signals, RF preamble responses, or oscillator jitter signals. In engineering implementation, a fixed sampling rate and fixed sampling duration are preferred for data acquisition. For example, a two-second continuous sampling at a sampling rate of 1 kHz yields 2,000 discrete sampling points. Subsequently, a Fast Fourier Transform (FFT) is performed on this discrete signal to convert the time-domain signal into a frequency-domain representation, obtaining the energy distribution corresponding to each frequency component. By observing the spectral distribution, the effective signal concentration range and the high-frequency noise density range can be clearly distinguished, providing a basis for subsequent selection of filtering parameters.

[0016] After obtaining the spectral distribution information, the energy proportion of each frequency component is accumulated and statistically analyzed to determine the frequency range where the main effective signal is located. In engineering, the energy coverage principle can be adopted, that is, energy is accumulated starting from low frequencies. When the accumulated energy reaches about 95% of the total energy, the corresponding frequency is selected as the cutoff frequency. For example, in the case of industrial equipment vibration, if the effective signal energy within 80 Hz has covered more than 96%, the cutoff frequency is set to 80 Hz. A digital low-pass filter is constructed based on this cutoff frequency. A fourth-order Butterworth low-pass filter is preferred because it has a smooth amplitude response and low phase distortion within the passband, and has good attenuation characteristics above the cutoff frequency, making it suitable for real-time operation of embedded devices.

[0017] The constructed digital low-pass filter is applied to the original physical signal data to perform point-by-point filtering. In engineering implementation, the filtering process can be accomplished using a finite impulse response or an infinite impulse response structure derived from a bilinear transform, outputting a filtered result value for each sampling point. After filtering, high-frequency spikes in the original signal caused by electromagnetic interference, mechanical shock, or transient jitter are significantly weakened, and the overall signal waveform becomes continuous and smooth. For example, sharp glitches with abrupt amplitude changes exist in the signal before filtering; after filtering, these glitches essentially disappear, the peak fluctuation amplitude is significantly reduced, but the effective low-frequency trend remains unchanged, thus obtaining smooth signal data after filtering out high-frequency noise.

[0018] After obtaining the smoothed signal data after filtering out high-frequency noise, stable key point extraction processing is performed on the signal to construct a physical fingerprint feature sequence for identity authentication. In the engineering implementation, the smoothed signal data is first traversed and analyzed using a sliding time window of fixed length. Preferably, each sliding window contains 10 consecutive sampling points, and the window step size is set to 1 sampling point to ensure the temporal resolution of key point extraction.

[0019] Within each sliding window, the maximum and minimum values ​​of the sampled values ​​within that window are calculated, and the difference between them is taken as the instantaneous fluctuation amplitude of that window. This fluctuation amplitude is compared with a preset stability threshold. When the fluctuation amplitude is less than the stability threshold, the signal segment corresponding to that sliding window is determined to be in a stable state. The stability threshold is set in a way that is directly related to the signal range. Its specific value is defined as follows: the difference between the global maximum and global minimum values ​​of the smoothed signal in the current acquisition period is used as the reference range, and 5% of this reference range is taken as the stability threshold. This method ensures that the stability criterion is automatically adjusted according to different devices and different signal amplitudes, avoiding inconsistencies caused by manual experience settings.

[0020] When a sliding window is determined to be in a stable state, the sampling point corresponding to the center position of that window is selected as a stable key point, and its time index and amplitude information are recorded. After performing the above sliding window analysis on the entire smooth signal data, all the extracted stable key points are arranged in chronological order, ultimately forming a preliminary clean physical fingerprint feature sequence.

[0021] In step S12, the physical fingerprint feature sequence needs to be clustered and grouped. Groups that meet preset judgment conditions are identified as stable mode segments. The mean of each stable mode segment is calculated point by point, and a mean feature curve is generated. Based on the mean feature curve, a fluctuation tolerance envelope is constructed as the core fingerprint template, including: Periodic analysis is performed on the physical fingerprint feature sequence to obtain the dominant periodic parameters; The physical fingerprint feature sequence is segmented based on the dominant periodic parameter to obtain a candidate waveform unit set. Calculate the distance values ​​between each unit in the candidate waveform unit set, and construct a distance matrix; The candidate waveform unit set is clustered and grouped according to the distance matrix, and the number of waveform units contained in each group is counted. The group that meets the preset repetition judgment condition is determined as the stable mode segment. Phase alignment is performed on the waveform units in the stable mode segment to obtain aligned waveform units, and the mean value is calculated point by point to generate a mean characteristic curve. Based on the mean characteristic curve, the fluctuation tolerance range of each waveform unit is set, and the fluctuation tolerance envelope is constructed as the core fingerprint template.

[0022] After obtaining the physical fingerprint feature sequence, a periodic analysis is first performed on the sequence to determine its dominant period parameter. In engineering implementation, autocorrelation analysis is preferred. The physical fingerprint feature sequence is then subjected to delayed correlation calculations on the time axis, and the distribution of the correlation coefficient as a function of time delay is statistically analyzed. The location where the correlation coefficient first shows a significant local peak as the delay time increases corresponds to the dominant period of the physical fingerprint feature sequence.

[0023] For example, in a continuously acquired sequence of equipment vibration characteristics, autocorrelation analysis shows a significant peak at a delay of 1.2 seconds; therefore, 1.2 seconds is determined as the dominant period parameter. Subsequently, the physical fingerprint feature sequence is divided into equal-length segments according to this dominant period parameter, with each segment having a time length of 1.2 seconds, thus obtaining multiple candidate waveform units. Preferably, a sliding segmentation method is used, with the segmentation step size set to one time the dominant period length to ensure that candidate waveform units do not overlap. Through the above processing, a set of candidate waveform units with consistent time lengths and similar structures can be obtained, providing a basis for subsequent stable mode screening.

[0024] After obtaining the set of candidate waveform units, the similarity between each candidate waveform unit is quantitatively evaluated. In engineering implementation, a point-by-point difference accumulation method is preferred to calculate the distance value between any two candidate waveform units. All distance values ​​together constitute the distance matrix of candidate waveform units. This distance matrix reflects the degree of similarity in the overall shape of different candidate waveform units; the smaller the distance value, the more similar the two waveform units are.

[0025] In one implementation, candidate waveform units are grouped using a hierarchical clustering method based on the distance matrix. The clustering threshold is related to the overall fluctuation range of the physical fingerprint feature sequence, and preferably set to 1.5 times the average fluctuation range of the candidate waveform units. After clustering, the number of waveform units in each cluster is counted, and the cluster with the largest number and a proportion exceeding 60% of the total number of candidate waveform units is determined as a stable and recurring pattern segment. The corresponding waveform unit set is selected for subsequent core fingerprint template construction.

[0026] After identifying the stably recurring pattern segments, phase alignment is performed on multiple waveform units belonging to the same pattern segment to eliminate time offset errors between different acquisition cycles. In engineering implementation, it is preferable to use the position of the maximum amplitude value in each waveform unit as the alignment reference point, and translate all waveform units on the time axis to align their reference points.

[0027] After phase alignment, point-by-point averaging is performed on the aligned waveform units to generate a mean characteristic curve. This mean characteristic curve reflects the typical morphological characteristics of the periodic behavior of the equipment under stable operating conditions and can effectively suppress the influence of individual abnormal waveforms on the overall characteristics. For example, after averaging 50 aligned waveform units, the fluctuation amplitude of the peak region is significantly reduced, and the smoothness of the overall curve is significantly improved, thus forming a highly representative mean characteristic curve.

[0028] After generating the mean feature curve, it is necessary to further define a clear fluctuation tolerance range for it in order to construct a core fingerprint template for subsequent matching and error correction. In the engineering implementation, for all waveform units participating in the mean calculation, the deviation amplitude of each waveform unit relative to the mean feature curve is counted at the same time position, and the maximum and minimum deviation values ​​corresponding to that time position are recorded.

[0029] Subsequently, the absolute value of the maximum deviation at this time position is used as the basic fluctuation reference, and the fluctuation tolerance range is determined according to a fixed proportional rule. Preferably, the absolute value of the maximum deviation is multiplied by 1.3 as the final tolerance boundary at this time position. Thus, at this time position of the mean characteristic curve, the tolerance boundary is extended upwards and downwards respectively, forming a clear upper boundary and lower boundary. This proportional coefficient has been verified by multiple sets of equipment in engineering practice. When the value is 1.3, it can effectively cover normal fluctuations caused by environmental disturbances and slight aging of equipment while ensuring fingerprint stability. The coefficients given in this embodiment, such as 1.5 and 1.3, are only examples. Their specific values ​​can be optimized through experimental calibration according to different equipment types, signal characteristics, and tolerance for false positive rates.

[0030] The aforementioned deviation statistics and boundary expansion operations are performed at each time sampling position of the mean characteristic curve, ultimately forming a complete set of fluctuation tolerance envelopes. This envelope is composed of the mean characteristic curve, the upper tolerance boundary curve, and the lower tolerance boundary curve, and is stored and retrieved as a whole as the core fingerprint template.

[0031] It should be noted that in subsequent fingerprint matching and error correction processing, if the value of the new physical fingerprint feature sequence at the corresponding time position falls within the aforementioned fluctuation tolerance envelope, then the feature at that position is determined to be a valid consistent feature; if multiple consecutive positions exceed the range of this envelope, it is determined to be an abnormal offset and an error correction or update process is triggered. This explicit numerical boundary construction method ensures that the core fingerprint template has clear, reproducible, and adjustable judgment criteria in engineering implementation, avoiding the uncertainty caused by fuzzy thresholds.

[0032] In step S13, the core fingerprint template needs to be discretely encoded to obtain an encoded fingerprint sequence. Bit-flip error detection is then performed on the encoded fingerprint sequence to determine the index coordinates where the bit-flip error occurred. Finally, error-corrected decoding is performed on the logic level corresponding to the index coordinates to obtain the corrected stable fingerprint information, including: The core fingerprint template is discretized into discrete sampling point values; The discrete sampling point values ​​are quantized and mapped to the original binary stream; A linear transformation operation is performed on the original binary stream using a preset error correction coding matrix to generate a coded fingerprint sequence containing redundant check bits. For the encoded fingerprint sequence, a bit-flip error mapping is performed using a check matrix orthogonal to the preset error correction coding matrix to generate an adjoint vector indicating error features; The syntactic vector is parsed to determine the index coordinates of the bit flip error, and the logic level corresponding to the index coordinates is used for error location and correction based on the redundancy check bit to obtain the corrected stable fingerprint information.

[0033] After obtaining the core fingerprint template, it is first discretized to prepare for subsequent error correction coding. In the engineering implementation, the core fingerprint template is sampled at a fixed time step to obtain a continuous numerical sequence, for example, containing 256 sampling points. Each sampling point corresponds to a normalized amplitude data. The value of each sampling point is quantized and mapped to an integer representation within a fixed range. For example, each sampling point is mapped to an 8-bit unsigned integer, so each sampling point corresponds to 8 binary bits. By performing this mapping operation on all sampling points sequentially, the core fingerprint template can be converted into a continuous raw binary stream. In this implementation, if the core fingerprint template contains 256 sampling points, the final generated raw binary stream is 2048 bits long. This raw binary stream completely preserves the structural information of the core fingerprint template and serves as the basic input for subsequent error correction coding.

[0034] After obtaining the original binary stream, a clear error correction coding mechanism needs to be introduced to resist bit flip errors caused by residual noise interference. In engineering implementation, the preset error correction coding matrix is ​​fixedly configured during the system initialization phase and stored simultaneously on both the IoT device side and the access authentication side, maintaining complete consistency between the two to ensure symmetrical execution of the encoding and decoding processes.

[0035] It is worth noting that the preset components, such as the pre-set error correction coding matrix, permutation mapping table, and nonlinear substitution table, involved in this invention are designed using techniques known in the art or can follow standard practices. For example, the error correction coding matrix can be a standard (48,32) linear block code generation matrix; the permutation mapping table can be generated in advance using a pseudo-random sequence generator to produce a fixed permutation sequence; the nonlinear substitution table can be generated with reference to the S-box design principles of algorithms such as AES in cryptography; the specific values ​​of these components can be generated and stored once during system initialization; those skilled in the art can select and design suitable preset components according to the system's requirements for error correction capability, computational complexity, and security strength.

[0036] In a preferred embodiment, the preset error correction coding matrix employs a block-based linear error correction structure. Specifically, the original binary stream is divided into blocks of fixed length, with each 32 bits forming a raw data block. For each 32-bit data block, the preset error correction coding matrix expands it into a 48-bit coding block, where the first 32 bits are the original information bits and the last 16 bits are redundancy check bits. This coding structure can detect and correct up to 2 random flip errors within each coding block, and can also detect no more than 4 abnormal flips. When the number of errors exceeds the correctable range, it can be handled through a subsequent key update process.

[0037] The preset error correction coding matrix is ​​stored in a fixed-size binary matrix, with the number of rows corresponding to the number of check constraints and the number of columns corresponding to the length of the coding block. In engineering implementation, this matrix is ​​permanently stored in the non-volatile storage area of ​​the device, such as flash memory or read-only memory, in a lookup table format, and is loaded into memory during system startup to participate in encoding calculations. Due to the fixed matrix structure, the encoding process only involves logical operations and lookup table operations, resulting in low computational complexity and suitability for resource-constrained embedded IoT terminals.

[0038] After sequentially applying the aforementioned preset error correction coding matrix to all data blocks of the original binary stream, the generated multiple 48-bit coded blocks are concatenated in their original order to obtain a coded fingerprint sequence containing redundant check bits. This explicit encoding implementation method ensures that the coded fingerprint sequence maintains the original fingerprint information structure while possessing stable, verifiable, and error-correctable engineering characteristics, providing a reliable foundation for subsequent adjoint vector generation and error correction.

[0039] After generating the coded fingerprint sequence, a consistency check is performed to identify bit-flipping errors. In the engineering implementation, the coded fingerprint sequence is re-divided into multiple coded blocks according to the grouping method of the encoding stage, with each coded block being 48 bits long. For each coded block, a check matrix corresponding one-to-one with the preset error correction coding matrix is ​​called to perform a check operation, outputting a fixed-length check result vector, which is the adjoint vector.

[0040] The synastry vector is 16 bits long, with each bit corresponding to an independent check constraint. When there are no bit-flip errors in the coded block, all 16 bits of the synastry vector are 0; when there are bit-flip errors, at least one bit in the synastry vector is 1. Different non-zero distribution patterns correspond to different combinations of error positions, thus mapping bit-flip errors in the coded block to directly parsable error feature vectors. Synastry vectors are generated sequentially for all coded blocks in the coded fingerprint sequence, and the synastry vectors are associated with the coded block indices for storage, serving as direct input for subsequent error correction.

[0041] After obtaining the syntagmatic vector corresponding to each coding block, it is parsed to determine the specific bit-flip error location. In the engineering implementation, a mapping table of syntagmatic vectors to error indices is pre-stored in the system. This mapping table strictly corresponds to the preset error correction coding matrix and is used to directly map the non-zero patterns of the syntagmatic vectors to the error bit indices within the coding block.

[0042] When the synicidal vector contains only a single non-zero pattern, a unique error bit index is determined according to the mapping table, and a logical flip operation is performed on the bit corresponding to that index. When the synicidal vector corresponds to multiple correctable error indices, no more than two error bits are corrected sequentially according to the priority order given in the mapping table. After correction, a check operation is performed again on the corrected coded block. If all corresponding synicidal vectors are zeroed, the error correction of the coded block is considered complete.

[0043] If a coding block still cannot bring its syntactic vector to zero after completing a 2-bit correction, it is marked as an uncorrectable block, and this status is reported to the subsequent key update determination module. For all coding blocks that pass the verification, redundant parity bits are removed, only valid information bits are retained, and they are reassembled in their original order to finally obtain the corrected stable fingerprint information.

[0044] In step S14, the stable fingerprint information needs to be extended with a salt bit sequence to obtain an extended feature bit matrix. Then, a sequence recombination operation is performed on the extended feature bit matrix using a preset one-way hash function to obtain a recombined sequence. This recombined sequence is then used to construct a preliminary encryption key as the basis for authentication credentials, including: The stable fingerprint information is used to generate a salt value bit sequence according to a preset expansion rule to obtain random salt value data; Perform a bitwise XOR operation on the stable fingerprint information and the random salt value data to generate a salted fingerprint feature stream; The salted fingerprint feature stream is subjected to nonlinear permutation to shuffle the original bit order, thereby obtaining an extended feature bit matrix; By combining a preset one-way hash function, hash calculation is performed on the extended feature bit matrix to generate a message digest sequence; The message digest sequence is formatted and recombined to obtain a recombined sequence, and the recombined sequence is used to construct a preliminary encryption key as the basis for authentication credentials.

[0045] After obtaining the corrected stable fingerprint information, its input length and encoding format are standardized to facilitate subsequent fixed process handling. In the engineering implementation, the stable fingerprint information is fixed as a 2048-bit binary sequence; if the original length is insufficient, it is padded with trailing zeros; if the length exceeds the limit, it is truncated. Random salt value data is then generated, with the salt value length consistent with the stable fingerprint information length, resulting in a 2048-bit random salt value sequence. Salt value generation uses a combination of the device's built-in random source and pseudo-random expansion. First, at least 256 bits of original entropy input are extracted from available noise sources, such as low-order timer jitter sampling, RF receiver idle noise sampling, or analog-to-digital conversion low-order noise sampling, etc. This entropy input is then fed into the pseudo-random expansion module to expand to 2048 bits, obtaining the random salt value data. This salt value data is regenerated for each network access authentication, ensuring that different salt values ​​are generated for multiple authentications of the same device, thereby preventing key reuse or replay analysis.

[0046] To ensure complete consistency in the mixing process of stable fingerprint information and random salt value data between the device and the authentication end, the system adopts a unified and deterministic salt value generation and distribution rule. In a preferred embodiment, random salt value data is centrally generated by the authentication end and sent to the device end through a secure signaling channel. The device end does not generate salt values ​​independently; it is only responsible for receiving and using the salt value in subsequent mixing operations. It should be noted that the salt value generation method, which combines the device's built-in random source with pseudo-random expansion, and the centralized generation by the authentication end, are all effective embodiments for implementing the salt value bit sequence expansion function. The former is suitable for scenarios with low dependence on authentication end communication and reliable random source devices; the latter is beneficial for centralized management of salt value randomness quality, avoiding the risk of insufficient entropy source at the device end. In a practical system, one of the modes can be selected for implementation. The core commonality of the two modes is to ensure that the salt value data used for mixing with stable fingerprint information is unpredictable in each authentication session, and that the salt value used by the device end and the authentication end is strictly consistent.

[0047] Specifically, at the start of each device network access authentication, the authentication terminal generates a set of fixed-length random salt value data. The length of the salt value is consistent with the length of the stable fingerprint information, for example, 2048 bits. This salt value is generated by the authentication terminal using its local high-quality random number generation module and is immediately bound to the current authentication session identifier after generation. The authentication session identifier is generated by combining the device's unique hardware identifier and the current authentication timestamp, and is used to indicate that the salt value is only valid in the current authentication session.

[0048] The authentication endpoint encapsulates the generated random salt value data along with the authentication session identifier into a salt configuration data packet, and sends it to the device through an established secure signaling channel. This secure signaling channel is an encrypted communication channel that has completed preliminary link authentication, ensuring that the salt value is not stolen or tampered with during transmission. Upon receiving the salt configuration data packet, the device first verifies whether the authentication session identifier within it matches the current authentication process; only if the verification passes will the random salt value data be written to a temporary buffer.

[0049] After the salt configuration data packet verification is completed, the device strictly performs a bitwise XOR operation with the received random salt data and the locally generated stable fingerprint information to generate a salted fingerprint feature stream. During this process, the device does not modify, expand, or regenerate the salt content, thus ensuring complete consistency between the device and the authentication end in the use of salt values.

[0050] After the authentication process is completed, regardless of whether the authentication is successful, both the device and the authentication end immediately clear the random salt value data and cache records corresponding to this authentication session to prevent the salt value from being reused.

[0051] After obtaining the salted fingerprint feature stream, it is necessary to further disrupt the linear correlation between bits through nonlinear permutation processing to prevent attackers from restoring the stable fingerprint structure through statistical analysis. In engineering implementation, the salted fingerprint feature stream is first grouped into fixed lengths. For example, a 2048-bit salted fingerprint feature stream is divided into 16 groups, each containing 128 bits of data.

[0052] For each 128-bit block, two levels of non-linear processing are performed sequentially. The first level is position permutation. The system pre-stores a permutation mapping table of fixed length 128 bits, which defines the new position index of each bit within the block. Both the device and the authentication end use the same permutation mapping table to rearrange the bits within the block according to this mapping relationship, thereby shuffling the original bit order. This permutation mapping table is fixed during the system initialization phase and does not change during the authentication process.

[0053] The second level of processing involves non-linear substitution within the group. Specifically, the 128-bit group after position permutation is divided into 16 byte units of 8 bits each, and a pre-defined non-linear substitution table is used to perform mapping and substitution for each byte unit. This non-linear substitution table uniquely maps the input 8-bit value to another set of 8-bit output values; the mapping relationship is one-to-one and irreversible. Through this substitution process, a change in a single bit can affect the output of the entire byte unit, thereby enhancing the diffusion effect.

[0054] After completing the above two-stage processing, a fixed-rule expansion operation is performed on each group. The expansion rule is defined as follows: 16 bits at a preset position are selected from the processing result of the group as expansion bits, and these expansion bits are appended to the end of the group, expanding each group from 128 bits to 144 bits. After performing this expansion operation on all 16 groups in sequence, all groups are concatenated in order to finally obtain an expanded feature bit matrix of length 2304 bits.

[0055] After obtaining the extended feature bit matrix, it is input into a preset one-way hash function module to generate a message digest sequence. In the engineering implementation, the algorithm type, output length, and processing rules of the one-way hash function are fixedly configured in the system, and are completely consistent between the device end and the authentication end, and are not allowed to be dynamically modified during operation.

[0056] Specifically, before performing hash calculation, the extended feature bit matrix is ​​first byte-divided, combining 8 bits into 1 byte and arranging them according to a standardized byte order. The byte sequence is then fed as input into the one-way hash function module. Internally, the hash module processes the input data according to predetermined block rules and generates a fixed-length output result through multiple rounds of compression operations.

[0057] In one embodiment, the extended feature bit matrix is ​​2304 bits long, and after hash calculation, it outputs a 256-bit message digest sequence. This message digest sequence shows significant differences for any tiny changes in the input data, and the original extended feature bit matrix content cannot be recovered by reverse calculation. When the device and the authentication end perform hash calculations on the same extended feature bit matrix, if the inputs are identical, the output message digest sequences will be completely identical; if there are any bit differences in the inputs, the output results will change entirely.

[0058] After the hash calculation is completed, the system retains only the generated message digest sequence as an intermediate result for subsequent key construction, and immediately clears the cached data of the extended feature bit matrix in the running memory to reduce the risk of intermediate feature leakage.

[0059] After obtaining the message digest sequence, it needs to be converted into a preliminary encryption key with a uniform structure and fixed length, which can be directly used for authentication. In the engineering implementation, the message digest sequence is first checked for length and integrity to ensure that its length meets the system's preset requirements. For example, when the message digest sequence length is 256 bits, the subsequent extraction process proceeds directly; if the digest length is abnormal, the authentication process is immediately terminated and a failure status is returned.

[0060] It should be noted that the above method of extracting bits from the message digest to construct the key is only one implementation method; to improve the key strength, a complete 256-bit message digest sequence can also be used directly, or it can be input into a standard key derivation function to generate a key of the required length.

[0061] In a preferred embodiment, valid feature bits are extracted from the message digest sequence according to a fixed-position rule. Specifically, the first 128 consecutive bits of the message digest sequence are selected as the key body, which represents the core identity features of the device's physical fingerprint in the current authentication session. Subsequently, 32 bits are selected from the remaining digest bits as a verification segment to enhance the consistency verification capability of the key structure. The verification segment and the key body are concatenated in a fixed order to form a recombined bit sequence of length 160 bits.

[0062] After completing the bit-level reassembly, the reassembled bit sequence is formatted. The formatting rule is defined as follows: every 8 bits are combined into 1 byte, and arranged in byte order with the most significant bit first, forming a 20-byte key data segment. To distinguish different versions of the processing flow and avoid key misuse, a 1-byte version identifier field is appended before the key data segment, and a 1-byte purpose identifier field is appended after the key data segment. The version identifier field indicates the currently used permutation rule and hash function configuration version; the purpose identifier field clarifies that the key is only used for device network access authentication and not for subsequent session encryption or data encryption. Finally, the version identifier field, key data segment, and purpose identifier field are concatenated in sequence to form a preliminary encryption key of 22 bytes.

[0063] In step S15, based on the initial encryption key and the preset device registration key, the number of logic zero levels of the difference features needs to be calculated to determine the bit-level matching degree value. When the bit-level matching degree value exceeds the preset matching degree threshold, the device identity is determined to be legitimate, and a network access authorization code is obtained, including: The initial encryption key and the preset device registration key are aligned in bit index order to obtain a synchronous binary bit stream pair; For the synchronous binary bit stream pair, an XOR operation is performed to generate a difference feature vector, and the number of logic zero levels in the difference feature vector is counted to determine the bit-level matching degree value. When the bit-level matching degree value exceeds the preset matching degree threshold, a device identity verification signal is generated; In response to the device identity verification signal, a dynamic access token is constructed by combining preset channel parameters and preset device hardware identifier; The dynamic access token is formatted and encapsulated to obtain the network access authorization code.

[0064] After generating the initial encryption key, the preset device registration key corresponding to the current device is read from the device registration information database of the authentication terminal. The preset device registration key is generated during the initial registration or factory initialization stage of the device and is stored in the secure storage area of ​​the authentication terminal after being bound one-to-one with the device's unique hardware identifier.

[0065] In one implementation, the preset device registration key is generated from physical fingerprint information collected by the device under a stable environment during the registration phase, through the same one-way transformation process as step S14. Its key length, format, and field structure are completely identical to the preliminary encryption key, for example, both being 22 bytes. By using the same generation rules, the structural consistency of subsequent bit-level comparisons is ensured. Before performing the comparison, the lengths of the preliminary encryption key and the preset device registration key are first checked. If there is a length discrepancy, padding or truncation is performed according to a unified rule. Then, the two sets of keys are converted into binary bit sequences and arranged one-to-one according to bit index order to form a synchronized binary bit stream pair, providing a unified input for subsequent difference calculations.

[0066] After obtaining the synchronized binary bitstream pair, a bit-by-bit difference calculation is performed to quantify the similarity between the two sets of keys. In the engineering implementation, a logical XOR operation is performed on each pair of corresponding bits in the synchronized binary bitstream pair to generate a difference feature vector. In the difference feature vector, a bit value of 0 indicates that the corresponding key bits are consistent between the two sets, and a bit value of 1 indicates that there is a difference. Subsequently, the difference feature vector is statistically analyzed to calculate the number of logical zero levels, and this number is proportionally converted to the total length of the difference feature vector to obtain a bit-level matching degree value. For example, when the total length of the difference feature vector is 176 bits, and 158 of them are logical zero levels, the bit-level matching degree value corresponds to approximately 89%, reflecting the overall consistency between the current initial encryption key and the device registration key.

[0067] After obtaining the bit-level matching score, it is compared with a pre-set matching score threshold in the system to determine the legitimacy of the device identity. This pre-set matching score threshold is uniformly configured during system deployment or initialization, and its value is based on a joint evaluation of the stability and error correction capabilities of the device's physical fingerprint. During system initialization, at least 100 physical fingerprint acquisition and key generation tests are performed on the same device under standard operating conditions. The initial encryption key generated each time is compared bit-level with the corresponding device registration key, and the matching score distribution range is statistically obtained. Test results show that after error correction processing, the lowest bit-level matching score of the initial encryption key generated by the same device under normal noise and environmental fluctuation conditions consistently falls above 88%, while the highest bit-level matching score between different devices does not exceed 72%. Based on these statistical results, to effectively isolate different devices while ensuring the pass rate of legitimate devices, the system sets the pre-set matching score threshold within a safe interval between the two distribution ranges.

[0068] In a preferred embodiment, the preset matching degree threshold is set to 85%. This value is lower than the minimum matching degree obtained from multiple tests on the same device and significantly higher than the maximum matching degree between different devices, thus forming a clear discrimination boundary in engineering. This threshold also matches the maximum number of correctable bit flips of the aforementioned error correction coding mechanism, which can tolerate a small bit deviation caused by residual noise, quantization error, or channel disturbance without causing misjudgment between different devices.

[0069] When the bit-level matching degree value is greater than or equal to the preset matching degree threshold, the system generates a device identity validity confirmation signal; when the bit-level matching degree value is lower than the threshold, the system determines that the device identity is invalid and terminates the current network access authentication process. This explicit threshold determination mechanism ensures noise resistance while preventing fingerprint confusion between different devices.

[0070] After generating a device identity verification signal, the authentication terminal constructs a dynamic access token based on the current communication environment and the device's unique identity information. The preset device hardware identifier and preset channel parameters are obtained from fixed sources and using fixed encoding rules to avoid uncertainties during the authorization process.

[0071] The preset device hardware identifier is determined during the device's manufacturing or initial registration phase and written into the authentication terminal's device registration information database as a unique identifier for the device. In a preferred embodiment, the device hardware identifier is composed of the following fields: a unique serial number for the device chip, a device manufacturing batch number, and a device type identifier. All of these fields originate from the device hardware or factory configuration area and remain unchanged throughout the device's lifecycle. The authentication terminal only accepts hardware identifiers that are completely identical to those recorded in the registration information database for dynamic access token generation.

[0072] The preset channel parameters are communication link characteristic parameters that are measured and discretized in real time by the authentication end in the current authentication session. Their acquisition method and value rules are pre-configured in the system. In one embodiment, the preset channel parameters include at least one of the following three categories or a combination thereof: the first category is signal-to-noise ratio (SNR) level parameters, which map the currently measured SNR value to a discrete level identifier, for example, dividing it into 4 level intervals; The second category is link delay level parameters, which are mapped to discrete delay level identifiers based on round-trip delay measurement results. The third category is channel stability identification parameters, which determine whether the channel is stable or fluctuating based on the fluctuation amplitude of the most recent five channel state sampling results. All of the above channel parameters are represented in discrete coding form, and their coding rules are fixed during the system initialization phase and remain consistent between the device and the authentication end.

[0073] When constructing a dynamic access token, the authentication terminal concatenates the device hardware identifier field with the preset channel parameter field according to a predefined field order to form standardized input data. This input data is then sent to a lightweight random mapping module to generate a dynamic access token uniquely bound to the current authentication session. Because the preset channel parameters change in real time with the communication environment, even if the same device completes authentication at different times, the generated dynamic access tokens will differ, thus effectively preventing the interception and reuse of authorization information in engineering applications.

[0074] After obtaining the dynamic access token, it is encapsulated in a standardized format to generate a network access authorization code that can be directly used for network access control. In the engineering implementation, an authorization type field is appended before the dynamic access token, and a validity period field and an integrity verification field are appended to the end to form structured authorization data.

[0075] The validity period field is used to limit the effective time window of the network access authorization code, for example, set to 300 seconds, after which the authorization code automatically expires. The integrity verification field is used to detect whether the authorization code has been tampered with during transmission. The finally generated network access authorization code is sent to the access control node as the credential for the device's network access request, used to complete the automatic network access control of IoT devices. After the authorization code is generated, the system clears the intermediate matching data generated during this authentication process, retaining only the necessary authorization status records to reduce the risk of sensitive information residue.

[0076] In step S16, in response to the network access authorization code, a complex matrix of channel state information containing multipath transmission characteristics needs to be extracted. Based on this complex matrix, a quantization step size is calculated to obtain an adaptive quantization step size. If the adaptive quantization step size is greater than a preset base step size, data packet configuration is performed to generate dynamic key adjustment parameters that adapt to environmental changes, including: In response to the network access authorization code, extract the complex matrix of channel state information containing multipath transmission characteristics; Perform phase dewinding processing on the complex matrix of the channel state information to obtain a dynamic phase offset sequence; Calculate the standard deviation of the dynamic phase offset sequence, and determine the adaptive quantization step size based on the standard deviation. If the adaptive quantization step size value is greater than the preset base step size value, then a configuration data package containing new quantization rules and error correction rules is generated based on the adaptive quantization step size value. The configuration data package is determined as a key dynamic adjustment parameter to adapt to environmental changes.

[0077] After the device obtains the network access authorization code and completes the link establishment, the authentication terminal and the device enter the environment adaptive monitoring phase. In the engineering implementation, the authentication terminal sends a channel probe command to the device, and the device sends a test signal according to a preset pilot format. The authentication terminal extracts the channel state information of the current communication link based on the received pilot signal. The channel state information is represented in the form of a complex matrix, where the number of rows corresponds to the number of subcarriers and the number of columns corresponds to the number of time samples. For example, in one embodiment, the complex matrix of channel state information contains 64 subcarriers and 10 consecutive sampling results.

[0078] After obtaining the complex matrix of channel state information, the phase information is extracted and phase dewinding is performed. In engineering implementation, for each subcarrier, its corresponding phase sample value is extracted in chronological order, and the discontinuity caused by phase period jumps is eliminated, thereby restoring the continuously changing true phase trajectory.

[0079] After phase dewinding is completed, the phase changes of all subcarriers at the same point in time are aggregated, preferably by averaging or using the median value, to obtain a dynamic phase offset sequence that varies over time. This dynamic phase offset sequence is used to characterize the channel phase disturbance caused by personnel movement, equipment vibration, or changes in obstruction in the current environment.

[0080] After obtaining the dynamic phase shift sequence, the system needs to determine the adaptive quantization step size for subsequent key extraction based on the degree of fluctuation of the sequence within the current observation time window. In engineering implementation, the observation window length is first fixed, for example, selecting 10 consecutive phase sampling results as an evaluation window, and the dispersion of the dynamic phase shift sequence is statistically analyzed within this window.

[0081] During the deployment phase, the system pre-calibrates the relationship between channel fluctuations and quantization errors offline. Specifically, under a standard test environment, at least 200 sets of dynamic phase offset sequence samples are collected from the same device under different manually controlled channel disturbance intensities. Key generation and matching tests are then performed under different quantization step size configurations, and the corresponding bit error rate changes are statistically analyzed. Test results show that when phase fluctuations are small, using a smaller quantization step size can achieve higher key randomness; however, when phase fluctuations increase, if a smaller step size is still used, the bit error rate increases significantly.

[0082] Based on the offline calibration results, the system establishes a fixed correspondence table between phase fluctuation ranges and quantization step sizes. For example, when the fluctuation value of the dynamic phase shift sequence within the observation window is below 0.1, quantization step size 1 is selected; when the fluctuation value is between 0.1 and 0.25, quantization step size 2 is selected; and when the fluctuation value is above 0.25, quantization step size 3 is selected. During operation, the system only uses this pre-established correspondence table for selection, without dynamic inference or empirical adjustment, thus ensuring that the quantization step size determination process has a clear basis and repeatability.

[0083] It should be noted that the correspondence table between the phase fluctuation range and the quantization step size is essentially a mapping strategy to establish the relationship between the channel environment disturbance intensity and the key generation parameters. The interval boundary values, such as 0.1 and 0.25, are determined during the calibration phase by observing the key bit error rate inflection points caused by using different quantization step sizes under different fluctuation levels. In actual deployment, phase fluctuation and bit error rate curve clusters can be plotted by conducting actual measurements in different typical scenarios, such as offices and factory workshops, and selecting fluctuation points with bit error rates that meet system requirements and have the smallest possible step size as interval boundaries, thereby constructing a correspondence table adapted to its own environment.

[0084] The system has a preset base step size value to represent the default quantization configuration of the device under stable environmental conditions. This base step size value is fixed during the system initialization phase and serves as a comparison benchmark for subsequent dynamic adjustments. In a preferred embodiment, the preset base step size value is uniformly set to 1, corresponding to the finest granular quantization configuration.

[0085] The base step size value is set based on test results of the device in a standard static environment. Before system deployment, the device underwent no fewer than 100 physical signal acquisition and key generation tests in an environment with minimal personnel movement, no obstructions, and minimal multipath variations. The results showed that using a quantization step size of 1 in this environment resulted in the highest consistency between the generated key and the authentication end, while also exhibiting good randomness. Therefore, a quantization step size of 1 was fixed as the base step size value.

[0086] During system operation, when the adaptive quantization step size determined in step (3) is greater than the basic step size value, the system determines that the current environment has changed significantly compared to the standard environment and a dynamic adjustment mechanism needs to be activated; when the adaptive quantization step size is equal to the basic step size value, the default configuration is maintained and the adjustment process is not triggered. This comparison rule is a fixed rule and does not change dynamically with the device type or operating status, thereby ensuring that the triggering conditions for dynamic key adjustment are clear and predictable.

[0087] After receiving the configuration data packet from the authentication terminal, the device first performs integrity and session consistency checks on the data packet. Integrity checks confirm that the configuration data packet has not been tampered with during transmission; session consistency checks confirm that the configuration data packet is consistent with the authentication session corresponding to the current network access authorization code. The device will only proceed with subsequent processing if both checks pass.

[0088] After successful verification, the device parses the new quantization step size value and the corresponding error correction rule identifier from the configuration data packet and writes them into the operating parameter area of ​​the local key generation module. The operating parameter area is a volatile storage area used to store the key processing parameters valid for the current session, and does not overwrite the device's factory configuration or registration parameters.

[0089] After the operating parameters are written, the device immediately activates the new quantization and error correction rules to perform quantization, fingerprint generation, and error correction processing on the subsequently collected physical signal data. The configuration data packet takes effect immediately from the time it is written and only applies to the current network access authorization period or its corresponding validity period.

[0090] When the network access authorization code expires, the session ends, or the key update process is triggered, the device automatically clears the configuration data packet content in the operating parameter area and restores the basic step size value and default error correction rules. This explicit loading, activation, and clearing mechanism ensures that the configuration data packet is uniquely identified in engineering as a dynamically adjustable key parameter that adapts to environmental changes, while avoiding the cumulative impact of dynamic parameters on subsequent sessions.

[0091] In step S17, if the key dynamic adjustment parameters cause the key deviation to exceed a preset tolerance range, a key update process is triggered to obtain an updated reliable encryption key, including: The key update process includes: re-executing the steps from acquiring physical signal data to generating an initial encryption key; The updated reliable encryption key is used as the new initial encryption key, and the bit-level matching degree comparison is performed to refresh the network access authorization status of the device.

[0092] After the device generates a new initial key based on the key dynamic adjustment parameters in step S16, the system evaluates the consistency between this initial key and the corresponding key of the authentication end. In engineering implementation, the system compares the key bit sequences independently generated by the device and the authentication end within the same session, calculates the proportion of inconsistent bits between them, and uses this proportion as the key deviation evaluation result.

[0093] During the initialization phase, the system pre-sets a tolerance threshold for key deviation, for example, 5%, to represent the maximum deviation range that the system can stably correct under the current quantization and error correction configuration. When the evaluated key deviation does not exceed the tolerance threshold, the system determines that the current key still has sufficient reliability and does not trigger the key update process; when the key deviation exceeds the tolerance threshold, the system determines that the current key is no longer reliable in a dynamic environment and automatically triggers the key update process.

[0094] After the key update process is triggered, the system no longer uses the current key and its corresponding intermediate data, but instead re-executes the complete processing chain from physical signal acquisition to one-way transformation to generate the key. Specifically, it re-acquires the physical signal data of the device in the current environment, and sequentially completes signal preprocessing, core fingerprint template extraction, error correction coding processing, and one-way transformation operation according to the processing flow from steps S11 to S14, thereby generating a new reliable encryption key.

[0095] During this regeneration process, the system automatically applies the currently valid key to dynamically adjust parameters, including the updated quantization step size and error correction rules, to ensure that the newly generated encryption key matches the current environmental conditions. All intermediate data used for the update is limited to use within this update process and does not reuse fingerprints or key results from previous sessions.

[0096] After obtaining the updated reliable encryption key, the system uses it as the new initial encryption key and re-executes the bit-level matching comparison process. In the engineering implementation, the updated reliable encryption key is synchronized and compared bit-level with the preset device registration key stored in the authentication terminal, and the device's identity and legitimacy are re-determined based on the predetermined matching threshold.

[0097] When the updated reliable encryption key passes the matching check, the system refreshes the device's network access authorization status, extending or updating the validity period of the corresponding network access authorization code. If the matching still fails, the system revokes the network access authorization status of the current session and requires the device to re-initiate the network access authentication process. This update and refresh mechanism ensures that the device always completes identity authentication based on the latest and most reliable key in dynamic and complex environments, avoiding authorization invalidation or misjudgment due to sudden environmental changes or long-term drift.

[0098] In summary, this invention relates to the field of automatic network access technology for IoT devices, and more particularly to a method and system for automatic network access of IoT devices. It addresses the problem of insufficient accuracy in identity verification during the IoT device access process.

[0099] Reference Figure 2 The second embodiment of the present invention provides a method system for automatic network access of devices based on the Internet of Things, comprising: The data acquisition module is used to acquire physical signal data generated by the device during operation and to preprocess the physical signal data to obtain a physical fingerprint feature sequence. The fingerprint extraction module is used to cluster and group the physical fingerprint feature sequence, determine the group that meets the preset judgment conditions as stable mode segments, calculate the mean for each point of the stable mode segment, generate the mean feature curve, and construct the fluctuation tolerance envelope based on the mean feature curve as the core fingerprint template. The stable fingerprint module is used to perform discrete encoding processing on the core fingerprint template to obtain an encoded fingerprint sequence, perform bit flip error detection on the encoded fingerprint sequence, determine the index coordinates where the bit flip error occurs, and perform error correction decoding on the logic level corresponding to the index coordinates to obtain the error-corrected stable fingerprint information. The preliminary encryption module is used to perform salt bit sequence expansion on the stable fingerprint information to obtain an extended feature bit matrix, combine it with a preset one-way hash function to perform sequence recombination on the extended feature bit matrix to obtain a recombined sequence, and construct the recombined sequence as a preliminary encryption key as the basis for identity verification credentials; The network access authorization module is used to calculate the number of logic zero levels of the difference features based on the preliminary encryption key and the preset device registration key, and determine the bit-level matching degree value. When the bit-level matching degree value exceeds the preset matching degree threshold, the device identity is determined to be legitimate and a network access authorization code is obtained. The dynamic parameter tuning module is used to respond to the network access authorization code, extract the complex matrix of channel state information containing multipath transmission characteristics, and calculate the quantization step size based on the complex matrix of channel state information to obtain an adaptive quantization step size. If the adaptive quantization step size is greater than the preset basic step size value, data packet configuration is performed to generate key dynamic adjustment parameters that adapt to environmental changes. The reliable encryption module is used to trigger a key update process to obtain an updated reliable encryption key if the key deviation exceeds a preset tolerance range due to the dynamic adjustment of the key parameters.

[0100] It should be noted that the IoT-based automatic device network access system provided in this embodiment of the invention is used to execute all the process steps of the IoT-based automatic device network access method in the above embodiment. The working principles and beneficial effects of the two are one-to-one, so they will not be described again.

[0101] It should be noted that the system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the system embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0102] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.

Claims

1. A method for automatic network access of devices based on the Internet of Things, characterized in that, include: The physical signal data generated by the acquisition device during operation is collected, and the physical signal data is preprocessed to obtain a physical fingerprint feature sequence. The physical fingerprint feature sequence is clustered and grouped, and the groups that meet the preset judgment conditions are identified as stable mode segments. The mean of each stable mode segment is calculated and a mean feature curve is generated. A fluctuation tolerance envelope is constructed based on the mean feature curve as the core fingerprint template. The core fingerprint template is discretely encoded to obtain an encoded fingerprint sequence. Bit flip error detection is performed on the encoded fingerprint sequence to determine the index coordinates where bit flip errors occur. Error correction decoding is performed on the logic level corresponding to the index coordinates to obtain the error-corrected stable fingerprint information. The stable fingerprint information is extended by salt bit sequence expansion to obtain an extended feature bit matrix. The extended feature bit matrix is ​​then recombined by a preset one-way hash function to obtain a recombined sequence. The recombined sequence is then used to construct a preliminary encryption key as the basis for identity verification credentials. Based on the initial encryption key and the preset device registration key, the number of logic zero levels of the difference features is calculated to determine the bit-level matching degree value. When the bit-level matching degree value exceeds the preset matching degree threshold, the device identity is determined to be legitimate and the network access authorization code is obtained. In response to the network access authorization code, a complex matrix of channel state information containing multipath transmission characteristics is extracted, and a quantization step size is calculated based on the complex matrix of channel state information to obtain an adaptive quantization step size. If the adaptive quantization step size is greater than a preset basic step size, data packet configuration is performed to generate key dynamic adjustment parameters that adapt to environmental changes. If the key dynamic adjustment parameters cause the key deviation to exceed the preset tolerance range, the key update process is triggered to obtain an updated reliable encryption key.

2. The method for automatic network access of IoT-based devices according to claim 1, characterized in that, The acquisition device generates physical signal data during operation, and preprocesses the physical signal data to obtain a physical fingerprint feature sequence, including: The physical signal data is subjected to frequency domain transformation to obtain spectral distribution information; The cutoff frequency is determined based on the spectral distribution information, and a digital low-pass filter is constructed based on the cutoff frequency; The physical signal data is convolved using the digital low-pass filter to output smooth signal data after filtering out high-frequency noise. Stable key points are extracted from the smoothed signal data, and the stable key points are combined in time sequence to obtain a preliminary clean physical fingerprint feature sequence.

3. The method for automatic network access of IoT-based devices according to claim 1, characterized in that, The process of clustering the physical fingerprint feature sequence, identifying groups that meet preset criteria as stable pattern segments, calculating the mean for each point in the stable pattern segment, generating a mean feature curve, and constructing a fluctuation tolerance envelope based on the mean feature curve as the core fingerprint template includes: Periodic analysis is performed on the physical fingerprint feature sequence to obtain the dominant periodic parameters; The physical fingerprint feature sequence is segmented based on the dominant periodic parameter to obtain a candidate waveform unit set. Calculate the distance values ​​between each unit in the candidate waveform unit set, and construct a distance matrix; The candidate waveform unit set is clustered and grouped according to the distance matrix, and the number of waveform units contained in each group is counted. The group that meets the preset repetition judgment condition is determined as the stable mode segment. Phase alignment is performed on the waveform units in the stable mode segment to obtain aligned waveform units, and the mean value is calculated point by point to generate a mean characteristic curve. Based on the mean characteristic curve, the fluctuation tolerance range of each waveform unit is set, and the fluctuation tolerance envelope is constructed as the core fingerprint template.

4. The method for automatic network access of IoT-based devices according to claim 1, characterized in that, The process involves discrete encoding of the core fingerprint template to obtain an encoded fingerprint sequence, performing bit-flip error detection on the encoded fingerprint sequence to determine the index coordinates where bit-flip errors occur, and performing error-corrected decoding on the logic level corresponding to the index coordinates to obtain error-corrected stable fingerprint information, including: The core fingerprint template is discretized into discrete sampling point values; The discrete sampling point values ​​are quantized and mapped to the original binary stream; A linear transformation operation is performed on the original binary stream using a preset error correction coding matrix to generate a coded fingerprint sequence containing redundant check bits. For the encoded fingerprint sequence, a bit-flip error mapping is performed using a check matrix orthogonal to the preset error correction coding matrix to generate an adjoint vector indicating error features; The syntactic vector is parsed to determine the index coordinates of the bit flip error, and the logic level corresponding to the index coordinates is used for error location and correction based on the redundancy check bit to obtain the corrected stable fingerprint information.

5. The method for automatic network access of IoT-based devices according to claim 1, characterized in that, The stable fingerprint information is extended by a salt bit sequence to obtain an extended feature bit matrix. A preset one-way hash function is then used to perform sequence recombination on the extended feature bit matrix to obtain a reconstructed sequence. This reconstructed sequence is then used to construct a preliminary encryption key as the basis for authentication credentials, including: The stable fingerprint information is used to generate a salt value bit sequence according to a preset expansion rule to obtain random salt value data; Perform a bitwise XOR operation on the stable fingerprint information and the random salt value data to generate a salted fingerprint feature stream; The salted fingerprint feature stream is subjected to nonlinear permutation to shuffle the original bit order, thereby obtaining an extended feature bit matrix; By combining a preset one-way hash function, hash calculation is performed on the extended feature bit matrix to generate a message digest sequence; The message digest sequence is formatted and recombined to obtain a recombined sequence, and the recombined sequence is used to construct a preliminary encryption key as the basis for authentication credentials.

6. The method for automatic network access of IoT-based devices according to claim 1, characterized in that, The step involves calculating the number of logic zero levels of the difference features based on the initial encryption key and the preset device registration key, determining the bit-level matching degree value, and when the bit-level matching degree value exceeds the preset matching degree threshold, determining that the device identity is legitimate and obtaining the network access authorization code, including: The initial encryption key and the preset device registration key are aligned in bit index order to obtain a synchronous binary bit stream pair; For the synchronous binary bit stream pair, an XOR operation is performed to generate a difference feature vector, and the number of logic zero levels in the difference feature vector is counted to determine the bit-level matching degree value. When the bit-level matching degree value exceeds the preset matching degree threshold, a device identity verification signal is generated; In response to the device identity verification signal, a dynamic access token is constructed by combining preset channel parameters and preset device hardware identifier; The dynamic access token is formatted and encapsulated to obtain the network access authorization code.

7. The method for automatic network access of IoT-based devices according to claim 1, characterized in that, The response to the network access authorization code extracts a complex matrix of channel state information containing multipath transmission characteristics, and calculates the quantization step size based on the complex matrix of channel state information to obtain an adaptive quantization step size. If the adaptive quantization step size is greater than a preset base step size, data packet configuration is performed to generate key dynamic adjustment parameters that adapt to environmental changes, including: In response to the network access authorization code, extract the complex matrix of channel state information containing multipath transmission characteristics; Perform phase dewinding processing on the complex matrix of the channel state information to obtain a dynamic phase offset sequence; Calculate the standard deviation of the dynamic phase offset sequence, and determine the adaptive quantization step size based on the standard deviation. If the adaptive quantization step size value is greater than the preset base step size value, then a configuration data package containing new quantization rules and error correction rules is generated based on the adaptive quantization step size value. The configuration data package is determined as a key dynamic adjustment parameter to adapt to environmental changes.

8. The method for automatic network access of IoT-based devices according to claim 1, characterized in that, If the key dynamic adjustment parameters cause the key deviation to exceed the preset tolerance range, a key update process is triggered to obtain an updated reliable encryption key, including: The key update process includes: re-executing the steps from acquiring physical signal data to generating an initial encryption key; The updated reliable encryption key is used as the new initial encryption key, and the bit-level matching degree comparison is performed to refresh the network access authorization status of the device.

9. An automatic device network access system based on the Internet of Things, characterized in that, include: The data acquisition module is used to acquire physical signal data generated by the device during operation and to preprocess the physical signal data to obtain a physical fingerprint feature sequence. The fingerprint extraction module is used to cluster and group the physical fingerprint feature sequence, determine the group that meets the preset judgment conditions as stable mode segments, calculate the mean for each point of the stable mode segment, generate the mean feature curve, and construct the fluctuation tolerance envelope based on the mean feature curve as the core fingerprint template. The stable fingerprint module is used to perform discrete encoding processing on the core fingerprint template to obtain an encoded fingerprint sequence, perform bit flip error detection on the encoded fingerprint sequence, determine the index coordinates where the bit flip error occurs, and perform error correction decoding on the logic level corresponding to the index coordinates to obtain the error-corrected stable fingerprint information. The preliminary encryption module is used to perform salt bit sequence expansion on the stable fingerprint information to obtain an extended feature bit matrix, combine it with a preset one-way hash function to perform sequence recombination on the extended feature bit matrix to obtain a recombined sequence, and construct the recombined sequence as a preliminary encryption key as the basis for identity verification credentials; The network access authorization module is used to calculate the number of logic zero levels of the difference features based on the preliminary encryption key and the preset device registration key, and determine the bit-level matching degree value. When the bit-level matching degree value exceeds the preset matching degree threshold, the device identity is determined to be legitimate and a network access authorization code is obtained. The dynamic parameter tuning module is used to respond to the network access authorization code, extract the complex matrix of channel state information containing multipath transmission characteristics, and calculate the quantization step size based on the complex matrix of channel state information to obtain an adaptive quantization step size. If the adaptive quantization step size is greater than the preset basic step size value, data packet configuration is performed to generate key dynamic adjustment parameters that adapt to environmental changes. The reliable encryption module is used to trigger a key update process to obtain an updated reliable encryption key if the key deviation exceeds a preset tolerance range due to the dynamic adjustment of the key parameters.

Images