IoT device authentication method and internet of things agricultural system

Abstract

This invention provides an IoT device authentication method and an IoT agricultural system. The method acquires the distributed identity identifier and real-time sensor data of the IoT device to be authenticated. Based on the environmental fingerprint generated from the data, the authentication public key is determined from the identity document. Based on the device's historical interaction data, a data reputation score is obtained by weighted calculation of the deviation from a preset time-series model, timestamp jitter, and path deviation. A consensus threshold is set based on the reputation score and the network's global authentication failure rate, and an authentication request is generated. A group of supervisory nodes are selected as verification nodes and send authentication requests to the devices. The devices solve the challenge and return an authentication response after signing it with their private keys. The verification nodes verify the signature using the authentication public key; if the number of nodes that pass verification reaches the consensus threshold, authentication is considered successful. After authentication, the data reputation score is updated based on the verification results, and the authentication response, DID, sensor data, and verification node identity are recorded as new transactions in the distributed ledger.

Description

Technical Field

[0001] This application belongs to the field of certification, and in particular relates to an IoT device certification method and an IoT agricultural system. Background Technology

[0002] Agricultural product quality and safety traceability not only protects consumer rights but also helps enhance brand reputation. The Internet of Things (IoT) technology, by deploying sensor devices at each stage of production, processing, warehousing, and logistics, enables data collection and monitoring of the entire agricultural product circulation process. However, most IoT device authentication schemes adopt authentication models based on public key infrastructure (PKI) or centralized servers. Centralized servers are prone to single points of failure or attack targets; once compromised, the security of the entire system is threatened. Furthermore, authentication using identity credentials cannot assess the trustworthiness of devices in specific scenarios, making it difficult to address the security risks of hijacking or malicious data tampering. In addition, in agricultural product circulation scenarios, the physical location, environment, and behavioral patterns of devices are the basis for judging trustworthiness, but current technologies rarely utilize this information during the authentication process. Authentication strategies cannot adjust the authentication difficulty and security level based on the device's historical behavioral reputation and current risk status, resulting in excessively high authentication costs for trusted devices and insufficient scrutiny of suspicious devices. Therefore, how to develop an authentication method that combines distributed device identity, data reputation, and consensus mechanisms, ensuring security while also meeting the low latency and high concurrency requirements of IoT applications, has become a pressing technical challenge in the field of agricultural product traceability. Summary of the Invention

[0003] This invention proposes an IoT device authentication method to address the lack of an existing authentication method that combines distributed device identity, data reputation, and consensus mechanisms, ensuring security while also meeting the low latency and high concurrency requirements of IoT applications. The method includes:

[0004] Obtain the Distributed Identity Identifier (DID) of the IoT device to be authenticated, along with sensor data containing real-time geographic location and environmental status; and determine the authentication public key used for this authentication from the identity document associated with the DID based on the environmental fingerprint generated from the sensor data.

[0005] Based on historical interaction data associated with the DID, a data reputation score is determined by weighted calculation of the deviation between the interaction data and the preset time series model, timestamp jitter, and path deviation. The computational complexity of the authentication challenge is determined based on the data reputation score, and an authentication request containing the challenge is generated by combining the hash digest of the previous transaction. The consensus threshold is determined by combining the data reputation score and the global authentication failure rate of the network.

[0006] The authentication request is sent to the IoT device to be authenticated, and a group of verification nodes are selected from the supervisory nodes according to the data reputation score; the authentication response generated by the IoT device to be authenticated after solving the authentication challenge and signing it with the private key corresponding to the authentication public key is received; the verification nodes use the authentication public key to verify the signature of the authentication response, and the authentication is deemed successful when the number of nodes that pass the verification is not less than the consensus threshold.

[0007] Upon successful authentication, the data reputation score is updated based on the verification result, and a new transaction record containing the authentication response, DID, sensor data, and the identity of the verification node is recorded in the distributed ledger.

[0008] Furthermore, the present invention also relates to an Internet of Things (IoT) agricultural system, comprising the following modules:

[0009] The determination module is used to obtain the Distributed Identity Identifier (DID) of the IoT device to be authenticated and sensor data containing real-time geographical location and environmental status; and to determine the authentication public key used for this authentication from the identity document associated with the DID based on the environmental fingerprint generated from the sensor data.

[0010] The generation module is used to determine a data reputation score based on historical interaction data associated with the DID by weighted calculation of the deviation between the interaction data and a preset time series model, timestamp jitter, and path deviation; determine the computational complexity of the authentication challenge based on the data reputation score, and generate an authentication request containing the challenge by combining the hash digest of the previous transaction; and determine a consensus threshold by combining the data reputation score and the global authentication failure rate of the network.

[0011] The determination module is used to send the authentication request to the IoT device to be authenticated, and select a group of verification nodes from the supervision nodes according to the data reputation score; receive the authentication response generated by the IoT device to be authenticated after solving the authentication challenge and signing it with the private key corresponding to the authentication public key; the verification nodes use the authentication public key to verify the signature of the authentication response, and when the number of nodes that pass the verification is not less than the consensus threshold, the authentication is determined to be successful;

[0012] The recording module is used to update the data reputation score based on the verification result after successful authentication, and record the new transaction, which includes the authentication response, DID, sensor data and the identity of the verification node, in the distributed ledger.

[0013] This invention combines a device's distributed identity identifier with a real-time perceived environmental fingerprint, selecting a specific public key for authentication. This strongly binds the device's digital identity to its physical environment, enhancing the security of device authentication. By analyzing behavioral deviations, time jitter, and path deviations in historical device interaction data, a continuous assessment of device trustworthiness is provided. Based on the reputation score, authentication challenges with varying computational complexity are set for devices with different levels of trustworthiness. Furthermore, by setting a consensus threshold that combines device reputation and the global network state, and through distributed verification by a group of verification nodes, the fairness and attack resistance of the authentication results are ensured. The entire authentication process is recorded in a distributed ledger, constructing a complete, transparent, and tamper-proof trust chain, guaranteeing the authenticity and reliability of the source of agricultural product traceability information. Attached Figure Description

[0014] Figure 1 A flowchart of the first embodiment;

[0015] Figure 2 This is a diagram illustrating the calculation of data reputation scores;

[0016] Figure 3 This is a diagram illustrating the data reputation rating system.

[0017] Figure 4 A diagram illustrating the determination of the consensus threshold;

[0018] Figure 5 This is a diagram illustrating the selection of verification nodes. Detailed Implementation

[0019] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0020] In the first embodiment, the present invention proposes an IoT device authentication method, such as... Figure 1 ,include:

[0021] S1, Obtain the Distributed Identity Identifier (DID) of the IoT device to be authenticated and sensor data containing real-time geographical location and environmental status; Based on the environmental fingerprint generated from the sensor data, determine the authentication public key used for this authentication from the identity document associated with the DID;

[0022] After collecting data, the GPS module, temperature sensor, and humidity sensor integrated into the IoT device package its own DID (Decentralized Identifier), such as did:farm:t-001, along with real-time GPS coordinates, Celsius temperature, and relative humidity, into a data packet, which is then transmitted wirelessly to the access node in the network. Upon receiving the sensor data, the device concatenates the GPS coordinates, temperature, and humidity values ​​and performs a hash operation to generate a unique hash value as an environmental fingerprint. The device's DID document is parsed; this document pre-stores multiple public keys, each associated with a specific environmental range. For example, public key A corresponds to a refrigerated transport environment with a temperature of 5-10℃, and public key B corresponds to a normal temperature warehouse environment with a temperature of 20-25℃. The current sensor data is matched against these environmental ranges, and the public key within the matching range, i.e., public key A, is selected as the public key used for this authentication.

[0023] In an optional embodiment, determining the authentication public key for this authentication from the identity document associated with the DID based on the environmental fingerprint generated from the sensor data includes:

[0024] The real-time geographic location and environmental status data are combined and hashed to generate an environmental fingerprint;

[0025] Using specific bits of the environmental fingerprint as an index, the authentication public key is selected from the public key list maintained by the identity document.

[0026] For example, the real-time geographic location data collected by the vehicle-mounted device at a certain moment is longitude x16.404, latitude y9.915, and timestamp 1678886400. Simultaneously, the environmental sensor collects status data of temperature 15℃ and humidity 45%. This data is concatenated into a unique string, such as x16.404, y9.915, 1678886400, 15, 45. A specific hash algorithm, such as fuzzy hashing, is applied to this string to generate a 256-bit hash value, which is the unique fingerprint of the current environment. To prevent precision loss or changes during data transmission, each value can optionally be bucketed or segmented.

[0027] The device's identity document maintains a public key list, which is an ordered array containing multiple public keys, such as a list of 256 public keys numbered from 0 to 255. Specific bits are extracted from the 256-bit environmental fingerprint generated in the previous step as an index. For example, the first 8 bits of the fingerprint are extracted and converted into a decimal integer. If the 8 bits are 11010010, the corresponding decimal number is 2^10. Using 2^10 as an index, the 210th public key is selected from the public key list as the authentication public key used for this authentication.

[0028] To avoid changes in the authentication public key due to changes in environmental fingerprints, in another embodiment, at least one set of authentication key pairs bound to the DID is obtained from the identity document associated with the DID, wherein each authentication public key is associated with a corresponding key purpose identifier and a validity status identifier; based on the authentication type identifier in the authentication request, the data reputation score, and the current authentication round number, the target key purpose identifier for this authentication is determined; from the set of authentication key pairs, the authentication public key that matches the target key purpose identifier and is in a valid state is selected as the authentication public key for this authentication. For example, when the authentication type identifier indicates periodic access authentication and the data reputation score is higher than a first preset threshold, the target key purpose identifier is determined to be a first-level authentication purpose, and the corresponding first-level authentication public key is selected from the authentication key pair set; when the authentication type identifier indicates abnormal re-authentication, or the data reputation score is lower than a second preset threshold, the target key purpose identifier is determined to be a second-level authentication purpose, and the corresponding second-level authentication public key is selected from the authentication key pair set; wherein, the current authentication round number is used for deterministic selection among multiple authentication public keys corresponding to the same key purpose identifier, so as to avoid reusing the same authentication public key in multiple authentication processes.

[0029] S2, based on the historical interaction data associated with the DID, the data reputation score is determined by weighted calculation of the deviation between the interaction data and the preset time series model, timestamp jitter, and path deviation; the computational complexity of the authentication challenge is determined based on the data reputation score, and an authentication request containing the challenge is generated by combining the hash digest of the previous transaction; the consensus threshold is determined by combining the data reputation score and the network global authentication failure rate.

[0030] Retrieve all records for the past 24 hours of this DID from the distributed ledger. Analyze the timestamp intervals and calculate the standard deviation as the timestamp jitter value. Extract historical GPS coordinates and compare them with a pre-planned route from the farm to the warehouse to calculate the average vertical distance as the path deviation. Compare historical temperature data with a pre-set model that maintains 8℃ and calculate the average difference as the model bias. Calculate the current data reputation score using the formula, for example, Data Reputation Score = 100 - Weight 1 × Model Bias - Weight 2 × Timestamp Jitter - Weight 3 × Path Deviation. Figure 2 When starting a cold boot or with a new device, a preset initial data reputation score is used.

[0031] If the calculated data reputation score is 95, which is considered high trustworthiness, a lower computational complexity is set, requiring the target hash value to have two leading zeros. If the reputation score is 40, which is considered low trustworthiness, the target hash value is required to have five leading zeros. Obtain the hash digest of the latest transaction in the distributed ledger, for example, 00a1b2c3d4e5f6. Concatenate this digest with the device DID, and then add the complexity requirement (the number of leading zeros) to form an authentication challenge, generating an authentication request.

[0032] The network-wide authentication failure rate is calculated as 3% by analyzing the percentage of authentication failures by all devices within the past hour. Assuming a device's current data reputation score is 75 and the basic consensus threshold is 66%, the consensus threshold is calculated using a formula such as threshold = basic consensus threshold + (100 - current data reputation score) × 0.1 + global authentication failure rate × 100 × 0.5, resulting in 70%. This means that at least 70% of the verification nodes must pass authentication.

[0033] In an optional embodiment, the step of calculating the deviation, timestamp jitter, and path deviation between the interaction data and the preset time series model through weighted calculation includes:

[0034] Calculate the normalized deviation between the current sensor data and the preset time series model. Normalized value of timestamp jitter Normalized value of path deviation ;

[0035] The current data quality metric Q is determined by weighted calculation using the following formula:

[0036]

[0037] in, , , These are preset weights for the deviation value, jitter value, and deviation degree value, respectively. .

[0038] It has a built-in preset time-series model, such as the ARIMA model based on historical data, which can predict sensor readings at a specific point in time. Assuming the model predicts the current temperature to be 20°C, while the actual sensor reading is 21°C, the initial deviation is 1°. If the set normal deviation range is 0° to 5°, then the normalized deviation value... The standard deviation is 0.2. If data should be uploaded every 1 second, but the intervals for the last three uploads were 1.1 seconds, 0.9 seconds, and 1.2 seconds, the jitter value is 0.12 seconds. If the maximum tolerable jitter is set to 0.5 seconds, then the normalized jitter value is... The value is 0.24. If the vehicle's preset navigation path differs from the actual GPS location by 20m, and the maximum permissible deviation distance is 200m, then the normalized deviation is... It is 0.1.

[0039] The ARIMA model structure consists of three parts: Autoregressive (AR), Differential (I), and Moving Average (MA), the specific form of which is determined by the parameters p, d, and q. The AR part represents the linear relationship between the current value and the past p historical values; the I part performs d-order differencing on the time series data to obtain stationarity; and the MA part uses the prediction errors of the past q to correct the current prediction value. The training set consists of historical sensor data accumulated over a long period of operation of a specific device, such as minute-by-minute temperature records from the past few months. The training process determines the optimal combination of p, d, and q parameters through autocorrelation function plots and unit root tests, and uses maximum likelihood estimation to solve for the autoregressive and moving average coefficients within the model, minimizing the Akaike Information Criterion (AIC) value. During operation, the model's input is a set of the latest continuous historical data, such as a temperature sequence from the past 60 minutes, and the output is the predicted temperature value at the current time point.

[0040] After calculating each normalized indicator, a weighted sum is performed to assess the overall data quality. Weights are preset for each indicator to reflect their importance in assessing data quality; for example, the weights are set as follows: Substituting the example data from the previous example, we get Q = 0.822. The current data quality index Q obtained is 0.822, which is a value between 0 and 1. The higher the value, the better the data quality uploaded by the current device.

[0041] In an optional embodiment, the computational complexity of determining the authentication challenge based on the data reputation score includes:

[0042] Based on the data reputation score The computational complexity of the authentication challenge is set to one of several preset levels depending on the different preset score ranges, where each level corresponds to a different hash calculation difficulty.

[0043] Specifically, a hierarchical model is pre-defined to map data reputation scores to computational complexity. For example, three reputation score ranges and corresponding authentication challenge levels are established. The first level is when the data reputation score... When the reputation score is in the high-reputation range of 0.8 to 1.0, the computational complexity of the authentication challenge is set to low. For the second level, when... When the credit rating is in the medium range of 0.5 to 0.8, the complexity is set to medium. The third level, when... When the reputation level is below 0.5, the complexity is set to high.

[0044] When a device initiates an authentication request, its current data reputation score is obtained. Assume a certain device... A score of 0.65 falls into the medium reputation range. Therefore, a medium-level authentication challenge is assigned. This challenge typically manifests as a proof-of-work task, with difficulty and complexity levels corresponding to the challenge level. For example, low complexity might require the device to find a random number such that the hash value resulting from concatenating the random number with the original data has a prefix of 3 zeros; medium complexity requires a prefix of 5 zeros; and high complexity requires a prefix of 7 zeros. For a device with a reputation score of 0.65, the task is to find a random number such that the hash result has a prefix of 5 zeros, which requires more computational resources than a high-reputation device to complete the authentication. Figure 3 .

[0045] In an optional embodiment, determining the consensus threshold by combining the data reputation score and the network global authentication failure rate includes:

[0046] The basic threshold is determined according to the following formula. Adjustments are made to determine the consensus threshold. :

[0047]

[0048] in, The data reputation score, To reduce the overall network authentication failure rate, and Each of them represents its own preset impact factor. and These are the preset upper and lower thresholds.

[0049] For example, the base threshold Set to 0.6, authentication typically requires 60% agreement from verification nodes. Data reputation score impact factor. Set to 0.2, global failure rate impact factor Set it to 0.5. To prevent the threshold from being too high or too low, set a lower limit for the threshold. A value of 0.51 ensures at least a majority of consent, representing the upper limit of the threshold. The value is 0.8. These parameters collectively form the basis of the adjusted model. In a specific authentication event, real-time variables are obtained and substituted into the formula for calculation. Assume the current authentication initiator's data reputation score is... With a score of 0.9, it is a high-reputation device. Meanwhile, the network monitoring module also calculates the recent global authentication failure rate. A value of 0.1 indicates a certain level of risk in the network environment. Substituting this data into the core part of the formula, we obtain 0.47. Applying threshold constraints to this result, the minimum (0.8, 0.47) result is 0.47, and the maximum (0.51, 0.47) result is 0.51. Therefore, the consensus threshold for this authentication is... The threshold is 0.51. For the aforementioned high-reputation device, only 51% agreement from the verification nodes is required for authentication. Figure 4 . and These are all dimensionless values, and their impact on the consensus threshold can be adjusted by preset influence factors.

[0050] S3, send the authentication request to the IoT device to be authenticated, and select a group of verification nodes from the supervisory nodes according to the data reputation score; receive the authentication response generated by the IoT device to be authenticated after solving the authentication challenge and signing it with the private key corresponding to the authentication public key; the verification nodes use the authentication public key to verify the signature of the authentication response, and when the number of nodes that pass the verification is not less than the consensus threshold, the authentication is determined to be successful;

[0051] A challenge-based authentication request is sent to the IoT device to be authenticated. Simultaneously, based on a reputation score of 75, 15 nodes are randomly selected from a list of 50 supervisory nodes using a deterministic algorithm as verification nodes for this authentication. If the reputation score is below 50, 30 nodes may be selected to enhance the rigor of the verification.

[0052] After receiving an authentication request, an IoT device begins trying different random nonces. It concatenates the hash of the previous transaction, its own DID, and the nonce to calculate a hash value, continuing until the calculated hash value meets the complexity requirement of having two leading zeros. Once the nonce is found, the device uses the private key corresponding to the previously selected public key A to digitally sign the authentication information containing the nonce and the calculation result, generating an authentication response and sending it back to the network.

[0053] All 15 selected verification nodes received the authentication response. Each node used the public key A specified for this authentication to verify the validity of the digital signature in the response and whether the nonce in the response met the computational complexity requirements of the authentication challenge. After verification, each node broadcast the verification result. If 12 nodes broadcast the verification result as successful, the pass rate is 80%, which is greater than the consensus threshold of 70%. Therefore, the device authentication is considered successful.

[0054] In an optional embodiment, selecting a set of verification nodes from the supervisory nodes based on the data reputation score includes:

[0055] The monitoring nodes are divided into multiple levels based on their historical performance;

[0056] Based on the data reputation score For different preset score ranges, a corresponding number of nodes are selected from the supervision node pool of different levels as verification nodes. Among them, the lower the data reputation score, the wider the range of verification node sources and the greater the number of nodes selected.

[0057] All available monitoring nodes are divided into different pools based on historical verification accuracy, online duration, and response speed performance metrics. For example, they can be divided into three levels: the first level is the top-level node pool, containing the 50 nodes with the best historical performance; the second level is the normal node pool, containing 500 nodes with average performance; and the third level is the basic node pool, containing all other nodes.

[0058] Based on the data reputation score of the requesting device To implement a differentiated selection strategy. For example, the strategy specifies: if If the value is ≥0.9, then 5 nodes are randomly selected from the top-level node pool as verification nodes; if... If the value is between 0.6 and 0.9, then 4 nodes are selected from the top-level node pool and 6 nodes are selected from the regular node pool, for a total of 10 verification nodes; if If the score is below 0.6, 3 nodes will be selected from the top-level node pool, 7 from the regular node pool, and 10 from the basic node pool, for a total of 20 verification nodes. For example, if a device with a data reputation score of 0.5 initiates a request, according to the third-tier strategy, 3, 7, and 10 nodes will be randomly selected from the three different levels of node pools respectively to form a large and diverse verification node group, enhancing the scrutiny of low-reputation data. Figure 5 .

[0059] S4. After successful authentication, update the data reputation score based on the verification result, and record the new transaction, which includes the authentication response, DID, sensor data, and the identity of the verification node, in the distributed ledger.

[0060] Due to successful authentication, the device's data reputation score is increased from 75 to 76. A new transaction is created, containing the device's DID, raw GPS and environmental sensor data, the authentication response generated by the device, and a list of the identities of the 12 validating nodes that passed the verification. This new transaction is broadcast to the entire network and packaged into a new block, permanently recorded on the distributed ledger.

[0061] In an optional embodiment, updating the data reputation score based on the verification result includes:

[0062] If authentication is successful, the data reputation score will be increased according to the following formula, based on the current data quality indicator Q:

[0063]

[0064] If authentication fails, the data reputation score will be reduced according to the following formula based on the preset penalty factor P and the current data quality index Q:

[0065]

[0066] in, For the updated data reputation score, R represents the current data reputation score, and R is the preset reward influence factor.

[0067] Assume a device has a current credit score The score is 0.8, the data quality indicator Q submitted this time is 0.9, and the preset reward impact factor R is 0.1. Since the authentication was successful, the reward formula will be applied to update the reputation score. Substitute the data for calculation: Therefore, the device's new reputation score will increase from 0.8 to 0.818, with the reward amount positively correlated with the high-quality data submitted. Another device's current reputation score... The score is 0.7, but the data quality indicator Q submitted this time is only 0.3, resulting in authentication failure. The preset penalty factor P is 0.5. The penalty formula will be applied to update the reputation score. Substitute the data for calculation: The device's reputation score will drop from 0.7 to 0.455. The penalty is increased with poor data quality, i.e., a larger (1-Q) term, thus achieving a severe reputation penalty for submitting low-quality data and causing authentication failure. Optionally, Where k is the adjustment coefficient, This represents the global failure rate.

[0068] In some embodiments, if the signature is invalid, the request is determined to be illegally forged or transmitted incorrectly, the transaction is discarded directly, no reputation deduction is performed, and it is not recorded in the distributed ledger. This prevents malicious attackers from maliciously lowering the reputation score of a target DID by sending forged invalid signatures. The aforementioned penalty is only applied if the signature verification passes, but the authentication fails because the current data quality metric Q is too low and fails to reach the consensus threshold.

[0069] In a second embodiment, the present invention also proposes an Internet of Things (IoT) agricultural system, comprising the following modules:

[0070] The determination module is used to obtain the Distributed Identity Identifier (DID) of the IoT device to be authenticated and sensor data containing real-time geographical location and environmental status; and to determine the authentication public key used for this authentication from the identity document associated with the DID based on the environmental fingerprint generated from the sensor data.

[0071] The generation module is used to determine a data reputation score based on historical interaction data associated with the DID by weighted calculation of the deviation between the interaction data and a preset time series model, timestamp jitter, and path deviation; determine the computational complexity of the authentication challenge based on the data reputation score, and generate an authentication request containing the challenge by combining the hash digest of the previous transaction; and determine a consensus threshold by combining the data reputation score and the global authentication failure rate of the network.

[0072] The determination module is used to send the authentication request to the IoT device to be authenticated, and select a group of verification nodes from the supervision nodes according to the data reputation score; receive the authentication response generated by the IoT device to be authenticated after solving the authentication challenge and signing it with the private key corresponding to the authentication public key; the verification nodes use the authentication public key to verify the signature of the authentication response, and when the number of nodes that pass the verification is not less than the consensus threshold, the authentication is determined to be successful;

[0073] The recording module is used to update the data reputation score based on the verification result after successful authentication, and record the new transaction, which includes the authentication response, DID, sensor data and the identity of the verification node, in the distributed ledger.

[0074] In an optional embodiment, determining the authentication public key for this authentication from the identity document associated with the DID based on the environmental fingerprint generated from the sensor data includes:

[0075] The real-time geographic location and environmental status data are combined and hashed to generate an environmental fingerprint;

[0076] Using specific bits of the environmental fingerprint as an index, the authentication public key is selected from the public key list maintained by the identity document.

[0077] In an optional embodiment, the step of calculating the deviation, timestamp jitter, and path deviation between the interaction data and the preset time series model through weighted calculation includes:

[0078] Calculate the normalized deviation between the current sensor data and the preset time series model. Normalized value of timestamp jitter Normalized value of path deviation ;

[0079] The current data quality metric Q is determined by weighted calculation using the following formula:

[0080]

[0081] in, , , These are preset weights for the deviation value, jitter value, and deviation degree value, respectively. .

[0082] In an optional embodiment, the computational complexity of determining the authentication challenge based on the data reputation score includes:

[0083] Based on the data reputation score The computational complexity of the authentication challenge is set to one of several preset levels depending on the different preset score ranges, where each level corresponds to a different hash calculation difficulty.

[0084] In an optional embodiment, determining the consensus threshold by combining the data reputation score and the network global authentication failure rate includes:

[0085] The basic threshold is determined according to the following formula. Adjustments are made to determine the consensus threshold. :

[0086]

[0087] in, The data reputation score, To reduce the overall network authentication failure rate, and Each of them represents its own preset impact factor. and These are the preset upper and lower thresholds.

[0088] In an optional embodiment, selecting a set of verification nodes from the supervisory nodes based on the data reputation score includes:

[0089] The monitoring nodes are divided into multiple levels based on their historical performance;

[0090] Based on the data reputation score For different preset score ranges, a corresponding number of nodes are selected from the supervision node pool of different levels as verification nodes. Among them, the lower the data reputation score, the wider the range of verification node sources and the greater the number of nodes selected.

[0091] In an optional embodiment, updating the data reputation score based on the verification result includes:

[0092] If authentication is successful, the data reputation score will be increased according to the following formula, based on the current data quality indicator Q:

[0093]

[0094] If authentication fails, the data reputation score will be reduced according to the following formula based on the preset penalty factor P and the current data quality index Q:

[0095]

[0096] in, For the updated data reputation score, R represents the current data reputation score, and R is the preset reward influence factor.

[0097] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0098] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. An IoT device authentication method, characterized in that, include: Obtain the Distributed Identity Identifier (DID) of the IoT device to be authenticated, as well as sensor data including real-time geographic location and environmental status; Based on the environmental fingerprint generated from the sensor data, the authentication public key used for this authentication is determined from the identity document associated with the DID; Based on the historical interaction data associated with the DID, the data reputation score is determined by weighted calculation of the deviation between the interaction data and the preset time series model, the timestamp jitter of the interaction data, and the path deviation of the interaction data. The computational complexity of the authentication challenge is determined based on the data reputation score, and an authentication request containing the challenge is generated by combining the hash digest of the previous transaction. Based on the combined data reputation score and the network global authentication failure rate, a consensus threshold is determined; The authentication request is sent to the IoT device to be authenticated, and a set of verification nodes is selected from the supervisory nodes based on the data reputation score; Receive the authentication response generated by the IoT device to be authenticated after solving the authentication challenge and signing it with the private key corresponding to the authentication public key; The verification node uses the authentication public key to verify the signature of the authentication response. When the number of nodes that pass the verification is not less than the consensus threshold, the authentication is deemed successful. Upon successful authentication, the data reputation score is updated based on the verification result, and a new transaction record containing the authentication response, DID, sensor data, and the identity of the verification node is recorded in the distributed ledger.

2. The method according to claim 1, characterized in that, The step of determining the authentication public key for this authentication from the identity document associated with the DID based on the environmental fingerprint generated from the sensor data includes: The real-time geographic location and environmental status data are combined and hashed to generate an environmental fingerprint; Using specific bits of the environmental fingerprint as an index, the authentication public key is selected from the public key list maintained by the identity document.

3. The method according to any one of claims 1 and 2, characterized in that, The step of calculating the deviation, timestamp jitter, and path deviation between the interactive data and the preset time series model through weighted calculation includes: Calculate the normalized deviation between the current sensor data and the preset time series model. Normalized value of timestamp jitter Normalized value of path deviation ; The current data quality metric Q is determined by weighted calculation using the following formula: ； in, , , These are preset weights for the deviation value, jitter value, and deviation degree value, respectively. .

4. The method according to claim 1, characterized in that, The computational complexity of determining the authentication challenge based on the data reputation score includes: Based on the data reputation score The computational complexity of the authentication challenge is set to one of several preset levels depending on the different preset score ranges, where each level corresponds to a different hash calculation difficulty.

5. The method according to claim 1, characterized in that, The consensus threshold is determined by combining the data reputation score and the network global authentication failure rate, including: The basic threshold is determined according to the following formula. Adjustments are made to determine the consensus threshold. : ； in, The data reputation score, To reduce the overall network authentication failure rate, and Each of them represents its own preset impact factor. and These are the preset upper and lower thresholds.

6. The method according to claim 1, characterized in that, The step of selecting a set of verification nodes from the supervisory nodes based on the data reputation score includes: The monitoring nodes are divided into multiple levels based on their historical performance; Based on the data reputation score For different preset score ranges, a corresponding number of nodes are selected from the supervision node pool of different levels as verification nodes. Among them, the lower the data reputation score, the wider the range of verification node sources and the greater the number of nodes selected.

7. The method according to claim 3, characterized in that, The step of updating the data reputation score based on the verification result includes: If authentication is successful, the data reputation score will be increased according to the following formula, based on the current data quality indicator Q: ； If authentication fails, the data reputation score will be reduced according to the following formula based on the preset penalty factor P and the current data quality index Q: ； in, For the updated data reputation score, R represents the current data reputation score, and R is the preset reward influence factor.

8. An Internet of Things (IoT) agricultural system, characterized in that, Includes the following modules: The determination module is used to obtain the Distributed Identity Identifier (DID) of the IoT device to be authenticated and sensor data containing real-time geographical location and environmental status; and to determine the authentication public key used for this authentication from the identity document associated with the DID based on the environmental fingerprint generated from the sensor data. The generation module is used to determine the data reputation score based on the historical interaction data associated with the DID by weighted calculation of the deviation between the interaction data and the preset time series model, the timestamp jitter of the interaction data, and the path deviation of the interaction data. The computational complexity of the authentication challenge is determined based on the data reputation score, and an authentication request containing the challenge is generated by combining the hash digest of the previous transaction. Based on the combined data reputation score and the network global authentication failure rate, a consensus threshold is determined; The determination module is used to send the authentication request to the IoT device to be authenticated, and select a group of verification nodes from the supervision nodes based on the data reputation score; Receive the authentication response generated by the IoT device to be authenticated after solving the authentication challenge and signing it with the private key corresponding to the authentication public key; The verification node uses the authentication public key to verify the signature of the authentication response. When the number of nodes that pass the verification is not less than the consensus threshold, the authentication is deemed successful. The recording module is used to update the data reputation score based on the verification result after successful authentication, and record the new transaction, which includes the authentication response, DID, sensor data and the identity of the verification node, in the distributed ledger.

9. The system according to claim 8, characterized in that, The step of determining the authentication public key for this authentication from the identity document associated with the DID based on the environmental fingerprint generated from the sensor data includes: The real-time geographic location and environmental status data are combined and hashed to generate an environmental fingerprint; Using specific bits of the environmental fingerprint as an index, the authentication public key is selected from the public key list maintained by the identity document.

10. The system according to claim 8, characterized in that, The step of calculating the deviation, timestamp jitter, and path deviation between the interactive data and the preset time series model through weighted calculation includes: Calculate the normalized deviation between the current sensor data and the preset time series model. Normalized value of timestamp jitter Normalized value of path deviation ; The current data quality metric Q is determined by weighted calculation using the following formula: ； in, , , These are preset weights for the deviation value, jitter value, and deviation degree value, respectively. .

Images