Lightweight authentication methods, systems, devices, and readable storage media

Abstract

This invention provides a lightweight identity authentication method, system, device, and readable storage medium. It includes: responding to a registration request from an end device, broadcasting a registration record containing a pseudo-identity identifier, a challenge value, an encrypted response value, and an encrypted first random key in a consortium blockchain shared ledger and returning a registration completion message to the end device; responding to an authentication request from the end device, determining the registration information corresponding to the pseudo-identity identifier carried in the authentication request and the shared ledger, reconstructing the first random key, and verifying the legitimacy of the end device's identity based on the reconstructed first random key; if the verification is successful, selecting a new challenge-response pair corresponding to the end device and sending two-way identity authentication information to the end device. This invention lightweights identity authentication, making it more adaptable and practical.

Description

Technical Field

[0001] This invention belongs to the field of edge computing technology, specifically relating to a lightweight identity authentication method, system, device, and readable storage medium. Background Technology

[0002] Blockchain is widely used in building distributed identity management systems, and researchers have proposed various decentralized authentication protocols based on mechanisms such as smart contracts, public key infrastructure (PKI), zero-knowledge proofs, and one-time passwords. Some solutions improve authentication traceability and non-repudiation capabilities by writing user identities and authentication records into the blockchain, but they still have shortcomings in terms of lightweight design and latency control. Especially in edge computing environments that require high-frequency authentication and heterogeneous trust domain switching, blockchain solutions without effective computational layering and terminal collaboration mechanisms are prone to introducing authentication bottlenecks and even increasing system load.

[0003] In a cloud-edge-device architecture, identity authentication must balance the resource constraints of terminal devices with the need for collaborative verification between edge nodes and cloud services. Some studies have mitigated the communication load between terminals and cloud services by constructing distributed negotiation protocols; others have introduced mechanisms such as fog computing and social IoT to build a third-party identity authentication structure. However, most of these approaches still rely on a central node and cannot handle issues such as dynamic cross-domain switching, making it difficult to meet the multiple demands for flexibility, timeliness, and security in real-world scenarios.

[0004] Therefore, in order to address the above-mentioned technical problems, it is necessary to provide a lightweight identity authentication method, system, device, and readable storage medium.

[0005] The information disclosed in this background section is intended only to enhance the understanding of the overall background of the invention and should not be construed as an admission or in any way implying that the information constitutes prior art known to those skilled in the art. Summary of the Invention

[0006] The purpose of this invention is to provide a lightweight identity authentication method, system, device, and readable storage medium, which can solve the problems of terminals frequently entering and exiting different edge device trust domains in the cloud-edge-device framework, resulting in difficulties in cross-domain authentication, frequent authentication consuming a large amount of computing resources, and difficulty in sharing authentication information.

[0007] To achieve the above objectives, the technical solution provided by the present invention is as follows:

[0008] In a first aspect, the present invention provides a lightweight identity authentication method applied to edge devices, comprising:

[0009] Record the hash function, security key, ID of each terminal device, and PUF challenge-response pair distributed to the terminal devices, and synchronize the initialization information of the terminal devices through a shared ledger in a consortium blockchain among multiple edge devices;

[0010] In response to the registration request from the terminal device, the registration record, which includes the pseudo-identity identifier, challenge value, encrypted response value, and encrypted first random key, is broadcast in the consortium blockchain shared ledger and a registration completion message is returned to the terminal device;

[0011] In response to the authentication request from the terminal device, the registration information corresponding to the pseudo-identity carried in the authentication request is determined by the shared ledger, the first random key is restored, and the identity and legitimacy of the terminal device are verified based on the restored first random key;

[0012] If the verification is successful, a new challenge-response pair corresponding to the terminal device is selected, and two-way authentication information is sent to the terminal device so that the terminal device can use PUF to verify the legality of the new challenge-response pair and complete the authentication of the edge device. The two-way authentication information includes a first two-way authentication payload and a second two-way authentication payload generated by hash obfuscation and XOR operation of the new challenge-response pair.

[0013] After two-way authentication is completed, the edge device and the terminal device generate session keys based on the pseudo-identity, the new challenge-response pair, and dynamic parameters, and write the authentication success information into the consortium blockchain shared ledger to realize authentication information sharing and security auditing among multiple edge devices.

[0014] In one or more embodiments of the present invention, the method further includes:

[0015] Based on the end device ID carried in the registration request, the hash function and challenge-response pair corresponding to the end device are determined in the local storage of the edge device;

[0016] Determine the local response value in the edge device's local storage that corresponds to the challenge value carried in the registration request;

[0017] The local response value is encrypted using the hash function. If the local response value encrypted using the hash function is equal to the response value encrypted using the hash function carried in the registration request, a pseudo-identity identifier, an encrypted response value, and an encrypted first random key are generated. A registration record is constructed based on the pseudo-identity identifier, the encrypted response value, and the encrypted first random key for broadcasting in the consortium blockchain shared ledger.

[0018] In one or more embodiments of the present invention, the formula for generating the pseudo-identity identifier, the encrypted response value, and the encrypted first random key is as follows:

[0019]

[0020]

[0021]

[0022] in, For the pseudo identity identifier of the terminal device; End device ID; For security keys; For generated random numbers; For response value; The third random key; This is the encrypted response value; The first random key for encryption; This is a hash function.

[0023] In one or more embodiments of the present invention, after successful two-way authentication, the method further includes:

[0024] Edge devices and terminal devices independently generate session keys based on the pseudo-identity and the hash value of the new challenge-response pair;

[0025] The edge device broadcasts the authentication success information in the consortium blockchain's shared ledger, forming an immutable audit record; the authentication success information includes a pseudo-identity identifier and proposer information.

[0026] In one or more embodiments of the present invention, verifying the identity and legitimacy of the terminal device based on the recovered first random key includes:

[0027] Based on the locally stored security key, the response value is recovered from the encrypted response value through hash and XOR operations;

[0028] Based on the restored response value and the security key, the first random key is restored from the encrypted first random key through hash and XOR operations;

[0029] The edge device uses the recovered first random key and the pseudo-identity identifier to calculate the authentication request payload through hash operation;

[0030] If the calculated authentication request payload is equal to the authentication request payload in the authentication request message, then the end device is legitimate.

[0031] In one or more embodiments of the present invention, generating the two-way authentication information includes:

[0032] After verifying the identity and legitimacy of the terminal device, the edge device calculates the second random key and the terminal device ID based on the authentication request payload in the received authentication request message and the restored first random key.

[0033] Based on the terminal device ID, a new set of challenge values ​​and their corresponding response values ​​are randomly selected for the terminal device from the pre-stored challenge-response pairs;

[0034] Based on the first random key, the new challenge value is encrypted using hash and XOR operations to generate a first two-way authentication payload; based on the pseudo-identity identifier of the terminal device and the first two-way authentication payload, the new response value is encrypted using hash and XOR operations to generate a second two-way authentication payload.

[0035] A two-way authentication message is constructed based on the first two-way authentication payload and the second two-way authentication payload.

[0036] In one or more embodiments of the present invention, the method further includes:

[0037] During the authentication process, both communicating parties include the sender's current timestamp in the message when sending authentication requests, authentication responses, or confirmation messages.

[0038] After receiving the message, the receiver obtains its local current time and calculates the time difference between its local time and the timestamp carried in the message.

[0039] The time difference is compared with a preset threshold. If the time difference exceeds the threshold, the message is determined to be invalid and discarded. The threshold includes a first time threshold for authentication request and response messages, and a second time threshold for determining the validity of registration information. The second time threshold is greater than the first time threshold.

[0040] After receiving an authentication request from a terminal device, the edge device, in addition to verifying the freshness of the authentication request message itself, also needs to read the registration information of the terminal device from the blockchain shared ledger. The registration information includes a timestamp generated during registration. The edge device calculates the difference between the current time and the registration timestamp. If the difference exceeds the second time threshold, it determines that the registration information has expired and requires the terminal device to re-register.

[0041] Secondly, the present invention provides a lightweight identity authentication method applied to an end device, comprising:

[0042] Registration request information is generated based on a set of challenge response pairs, and the registration request information is sent to the edge device;

[0043] Receive the registration completion message sent from the edge device, decrypt and store the first random key;

[0044] A second random key is determined and an authentication request message is generated and sent to the edge device; the authentication request message includes an authentication request payload generated by hashing and XORing the second random key and the first random key, as well as a pseudo-identity identifier corresponding to the edge device;

[0045] After the edge device is verified, in response to the two-way authentication information of the edge device, the challenge-response pair corresponding to the two-way authentication payload is calculated, and the legality of the challenge-response pair corresponding to the two-way authentication payload is verified based on PUF to complete the authentication of the edge device.

[0046] Thirdly, the present invention provides a lightweight identity authentication system, which applies the aforementioned lightweight identity authentication method and includes:

[0047] The recording module is used to record the hash function, security key, ID of each terminal device, and PUF challenge-response pair distributed to the terminal devices;

[0048] The registration module is used to respond to the registration request from the terminal device by broadcasting the registration record, which includes the pseudo-identity identifier, challenge value, encrypted response value and encrypted first random key, in the consortium blockchain shared ledger and returning a registration completion message to the terminal device.

[0049] The first authentication module is used to respond to the authentication request of the terminal device, determine the registration information corresponding to the pseudo identity carried in the authentication request and the shared ledger, restore the first random key, and verify the identity and legality of the terminal device based on the restored first random key.

[0050] The first request module is used to select a new challenge-response pair corresponding to the end device when the verification is successful, and send two-way authentication information to the end device so that the end device can use PUF to verify the legality of the new challenge-response pair and complete the authentication of the edge device. The two-way authentication information includes the two-way authentication payload generated by hash obfuscation and XOR operation of the new challenge-response pair.

[0051] Fourthly, the present invention provides a lightweight identity authentication system, which applies the aforementioned lightweight identity authentication method and includes:

[0052] The generation module is used to generate registration request information based on a set of challenge responses and send the registration request information to the edge device;

[0053] The decryption module is used to receive the registration completion message sent from the edge device, decrypt it, and store the first random key.

[0054] The second request module is used to determine the second random key and generate an authentication request message to be sent to the edge device; the authentication request message includes an authentication request payload generated by hashing and XORing the second random key and the first random key, as well as a pseudo-identity identifier corresponding to the edge device.

[0055] The second authentication module is used to, after the edge device is verified, respond to the two-way identity authentication information of the edge device, calculate the challenge-response pair corresponding to the two-way identity authentication payload, and verify the legality of the challenge-response pair corresponding to the two-way identity authentication payload based on PUF, so as to complete the authentication of the edge device.

[0056] Compared to existing technologies, the lightweight authentication method provided by this invention uses only hash and XOR operations during the authentication process, combined with the fast response characteristics of physically unclonable functions. This significantly reduces the consumption of terminal battery and processor resources, substantially lowers the computational overhead of terminal devices, and makes them suitable for various resource-constrained scenarios.

[0057] This solution replaces these long fields with hash obfuscation and anonymous identifiers. The transmitted content mainly consists of fixed-length hash values, pseudo-identities, and timestamps, reducing communication bandwidth consumption during the authentication process and improving wireless channel utilization. Due to the significant reduction in computational and communication overhead, and the fact that edge devices can complete local authentication without waiting for complex consensus calculations, the authentication process is extremely fast. It possesses low latency and high concurrency processing capabilities, meeting the real-time requirements of latency-sensitive scenarios such as drone swarms, industrial automation, and connected vehicles.

[0058] By deploying a consortium blockchain across cloud and edge nodes, identity registration information is shared on-chain. When a terminal roams from one edge node to another, the new node does not need to contact the central server; it can directly obtain authentication information from the local shared ledger to complete the verification. This avoids authentication interruptions and high-latency handshakes caused by cross-domain issues in traditional centralized architectures, achieving decentralized trust and seamless cross-domain authentication. It also solves the problems of duplicate registration and trust silos when terminals switch between multiple edge nodes.

[0059] The application of physically unclonable functions ensures that even if an attacker physically accesses the chip, they cannot clone or extract the device's unique identity response, effectively resisting hardware cloning and physical intrusion. All messages in the protocol are bound to dynamic random numbers, and key parameters are transmitted via hash obfuscation. Attackers intercepting messages cannot parse valid information or replay old messages, thus resisting replay attacks and man-in-the-middle attacks. Session key generation relies on temporary parameters rather than long-term keys. Even if the long-term key is leaked, it is impossible to deduce historical or future session keys, ensuring forward and backward security. Abandoning a single authentication server and adopting a blockchain distributed architecture, even if some nodes fail, the remaining nodes can still provide services, significantly improving system robustness. Attached Figure Description

[0060] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0061] Figure 1 This is a schematic diagram illustrating an implementation scenario of the lightweight identity authentication method in one embodiment of the present invention;

[0062] Figure 2 This is a schematic diagram of a blockchain storage structure in a specific embodiment of the present invention;

[0063] Figure 3 This is a flowchart illustrating a lightweight identity authentication method in another embodiment of the present invention;

[0064] Figure 4 This is a structural block diagram of a lightweight identity authentication system according to an embodiment of the present invention;

[0065] Figure 5 This is a structural block diagram of a lightweight identity authentication system according to another embodiment of the present invention;

[0066] Figure 6 This is a structural block diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0067] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this invention.

[0068] Unless otherwise expressly stated, throughout the specification and claims, the term "comprising" or its variations such as "including" or "comprises" shall be understood to include the stated elements or components without excluding other elements or other components.

[0069] Please refer to Figure 1 The diagram illustrates an application scenario of the lightweight identity authentication method provided by the present invention under one embodiment. The scenario specifically includes: terminal devices, edge devices, cloud servers, and blockchain.

[0070] It should be noted that, in this embodiment of the invention, the terminal device may be a terminal device with limited storage and computing resources, equipped with a PUF device and a communication device, capable of generating unique and unpredictable challenge-response pairs, and capable of communicating with edge devices or cloud servers within the surrounding range; since it is considered an untrusted device, it needs to complete identity authentication before communicating with edge devices.

[0071] An edge device can be a base station facility with certain storage and computing resources and a limited communication range. When a terminal device enters its communication range, it can accept identity registration and authentication requests sent by the terminal device. After successful authentication, frequent communication can be achieved. In addition, the edge device can also broadcast messages to other edge devices in the vicinity to maintain the blockchain network and jointly maintain a trusted ledger of identity authentication information and a ledger of legitimate identities.

[0072] The cloud server can be a trusted and authoritative institution responsible for initialization work, including initializing the storage of identity information for all edge devices and terminal devices, generating the genesis block, maintaining the entire blockchain network, and determining which edge devices can join the blockchain network.

[0073] A blockchain network consists of all edge devices and cloud servers. Each edge device needs the consent of the cloud server to join. All blockchain nodes use a consensus mechanism to jointly maintain a shared ledger, ensuring data immutability, traceability, and supporting automatically running smart contracts. Ledger information includes each device's challenge-response pairs, identity registration information, and a list of legitimate devices, such as... Figure 2 As shown.

[0074] During the initialization phase, the cloud server registers the edge devices' information and agrees to join the blockchain network in a secure communication environment, initializes all terminal devices, and selects and stores relevant keys. During the task execution phase, the cloud server and edge devices form a blockchain network. End devices can dynamically leave and join the coverage area of ​​any edge device. After accepting an authentication request, the edge device can obtain the initialization information of the end device from the blockchain network to complete two-way identity authentication and key negotiation, achieving fast and lightweight identity authentication. Successfully authenticated devices are then broadcast through the blockchain network.

[0075] Please refer to Figure 3 The diagram shown illustrates a lightweight identity authentication process according to an embodiment of the present invention. This lightweight identity authentication method specifically includes the following steps:

[0076] S301: Record the hash function, security key, ID of each terminal device, and PUF challenge-response pair distributed to the terminal device, and synchronize the initialization information of the terminal device through the consortium blockchain shared ledger among multiple edge devices;

[0077] It should be noted that this invention addresses the challenges of limited computing resources and difficult cross-domain authentication in lightweight edge devices by designing and proposing a PUF-based bidirectional lightweight authentication key handshake protocol. This lightweight identity authentication method consists of four stages. In stage one, cloud initialization is completed, with all terminal devices and edge devices initializing with the cloud server. In stage two, terminal devices can send registration requests to any edge device, which completes terminal registration and stores and broadcasts the relevant registration information. In stage three, end-to-edge bidirectional authentication and key negotiation are performed. In stage four, upon completion of edge device authentication, the relevant registration success message is stored and broadcast, forming an immutable chain of evidence.

[0078] Step S301 aims to complete cloud initialization, that is, to initialize all terminal devices and edge devices with the cloud server.

[0079] Specifically, in one exemplary embodiment, all end devices and edge devices need to be initialized at the cloud, whereby the cloud randomly selects a secure hash function for each end device. and generate a security key. The corresponding hash function is distributed to the corresponding terminal device, and the edge device locally stores and records the hash function and security key of each terminal device.

[0080] The terminal device generates a sufficient number of challenge response pairs based on the PUF device. The challenge-response pair consists of a challenge value and its corresponding response value. All edge devices and cloud servers record locally. .

[0081] In addition, the cloud server also needs to determine the identity information of the edge devices, enable the edge devices to join the blockchain network, generate the genesis block, and broadcast it to all nodes.

[0082] S302: In response to the registration request from the terminal device, broadcast the registration record containing the pseudo-identity identifier, challenge value, encrypted response value and encrypted first random key in the consortium blockchain shared ledger and return a registration completion message to the terminal device;

[0083] It is understood that this step is the process of registering the end device. In an exemplary embodiment, this step may specifically include: the end device randomly selecting a challenge / response pair. Send registration request message .

[0084] After receiving a registration request, the edge device retrieves the hash function h(·) and the corresponding challenge-response pair from its local storage based on the ID. It then checks whether h(R) is valid against the registration request message sent by the edge device. If it is invalid, the request is discarded.

[0085] Specifically, determining the validity of h(R) and the registration request message sent by the end device can be based on the end device ID carried in the registration request. This involves determining the hash function and challenge-response pair corresponding to the end device in the local storage of the edge device; determining the local response value in the local storage of the edge device that corresponds to the challenge value carried in the registration request; encrypting the local response value using the hash function; and if the local response value encrypted using the hash function is equal to the response value encrypted using the hash function carried in the registration request, then the message is valid.

[0086] If the message is valid, you can continue generating random numbers. ,calculate Generate a random key K,a, obtain the current time, and generate a timestamp. ,calculate Shared ledger records It also broadcasts a registration completion message to the end device. .

[0087] The terminal device decrypts the key K and stores it locally. , used for subsequent identity authentication.

[0088] S303: In response to the authentication request from the terminal device, determine the registration information corresponding to the pseudo-identity carried in the authentication request and the shared ledger, restore the first random key, and verify the identity and legitimacy of the terminal device based on the restored first random key;

[0089] It is understood that the identity authentication in this invention includes authentication between edge devices and end devices, as well as authentication between end devices and edge devices. In the cloud-edge-end architecture, edge devices are legitimate nodes that have been initialized and authenticated by the cloud server and joined the consortium blockchain. They store the shared ledger and pre-set PUF challenge-response pairs, and are therefore considered semi-trusted or trusted execution environments. End devices, on the other hand, are dynamically connected, and their identities are completely unknown and untrusted before authentication. Therefore, in practical application of the technical solution of this invention, edge devices are prioritized to authenticate end devices to quickly filter illegal access requests, nip potential attacks in the bud, and protect the security of edge nodes and the blockchain network.

[0090] Specifically, following the exemplary embodiments described above, the authentication process for the peer device may include: the peer device obtaining the current time and generating a timestamp. Determine if the registration information is fresh ,in The validity period of registration information as defined in the authentication process; when the registration information exceeds... If the registration information is invalid, you will need to register again.

[0091] The terminal device generates a random key Q and calculates... , , The authentication request message is detected and sent to the edge device. After receiving the authentication request, the edge device obtains its local time and calculates the timestamp. First, verify the freshness of the message. ,in The duration of authentication messages defined in the authentication process; once the time difference between received messages exceeds a certain threshold... If the message is deemed unreliable, it is considered unreliable. Once the message freshness verification is passed, proceed to the next step.

[0092] Edge devices read registration messages from the ledger based on their PIDs. ,judge The system will check if the registration information is valid. If it times out, the registration information has expired and you need to register again. Otherwise, proceed to the next step.

[0093] calculate , , ,verify and If the values ​​are equal, the edge device's authentication of the peer device is successful; otherwise, the authentication fails.

[0094] S304: If the verification is successful, a new challenge-response pair corresponding to the terminal device is selected, and two-way authentication information is sent to the terminal device so that the terminal device can use PUF to verify the legality of the new challenge-response pair and complete the authentication of the edge device. The two-way authentication information includes a first two-way authentication payload and a second two-way authentication payload generated by hash obfuscation and XOR operation of the new challenge-response pair.

[0095] Specifically, if the aforementioned end device authentication is successful, edge device authentication can then be performed based on the end device. Edge device computing. , obtain Actively select challenge / response pairs randomly based on ID. ,calculate , Send a message to the end device for two-way authentication. .

[0096] 1) The terminal device receives the response message and generates a session key.

[0097] The terminal device receives the authentication message response and generates a timestamp based on its local time. Determine the freshness of the message The information is reliable; proceed to the next step.

[0098] End devices calculate based on local storage , Using PUF equipment, calculation and judgment are performed. Is it equal to PUF ( If the values ​​are equal, the authentication is successful; otherwise, the authentication has failed.

[0099] In addition, after the two-way authentication is completed, the method further includes: the edge device and the terminal device independently generate session keys based on the pseudo-identity and the hash value of the new challenge-response pair; the edge device broadcasts the authentication success information in the consortium blockchain shared ledger to form an immutable audit record; the authentication success information includes the pseudo-identity and proposer information.

[0100] That is, by using the above exemplary embodiments, calculations can be performed. Generate session key Send response message The edge device receives the authentication message response and generates a timestamp based on its local time. Determine the freshness of the message The message is reliable; proceed to the next step. Calculate the session key. and will send a successful authentication message Store the shared ledger and broadcast it.

[0101] The edge device receives the authentication message response and generates a timestamp based on its local time. Determine the freshness of the message The information is reliable; proceed to the next step.

[0102] Calculate session key and will send a successful authentication message Store the shared ledger and broadcast it.

[0103] S305: After two-way authentication is completed, the edge device and the terminal device generate session keys based on the pseudo-identity, the new challenge-response pair, and dynamic parameters, and write the authentication success information into the consortium blockchain shared ledger to realize authentication information sharing and security auditing among multiple edge devices.

[0104] Through the above step S305, the present invention not only completes lightweight two-way authentication and session key negotiation, but also makes full use of the distributed trust characteristics of the consortium blockchain to transform the result of a single authentication into a trust asset that can be shared and audited across the entire network, significantly improving the scalability, robustness and security of the identity authentication system under the cloud-edge-device architecture.

[0105] Please refer to Figure 4 As shown, based on the same inventive concept as the aforementioned lightweight identity authentication method, one embodiment of the present invention provides a lightweight identity authentication system 400, including:

[0106] Specifically, the recording module 401 is used to record the hash function, security key, ID corresponding to each terminal device, and PUF challenge-response pair distributed to the terminal device; the registration module 402 is used to respond to the registration request of the terminal device, broadcast the registration record containing the pseudo-identity identifier, challenge value, encrypted response value, and encrypted first random key in the consortium blockchain shared ledger, and return a registration completion message to the terminal device; the first authentication module 403 is used to respond to the authentication request of the terminal device, determine the registration information corresponding to the pseudo-identity identifier carried in the authentication request and the shared ledger, restore the first random key, and verify the identity legitimacy of the terminal device based on the restored first random key; the first request module 404 is used to select a new challenge-response pair corresponding to the terminal device when the verification is successful, and send two-way identity authentication information to the terminal device, so that the terminal device can use PUF to verify the legitimacy of the new challenge-response pair and complete the authentication of the edge device. The two-way identity authentication information includes the two-way identity authentication payload generated by hash obfuscation and XOR operation of the new challenge-response pair.

[0107] Please refer to Figure 5As shown, based on the same inventive concept as the aforementioned lightweight identity authentication method, one embodiment of the present invention provides a lightweight identity authentication system 500, including: a generation module 501, a decryption module 502, a second request module 503, and a second request module 504.

[0108] The generation module 501 is used to generate registration request information based on a set of challenge-response pairs and send the registration request information to the edge device; the decryption module 502 is used to receive the registration completion message sent to the edge device, decrypt and store the first random key; the second request module 503 is used to determine the second random key and generate an authentication request message and send it to the edge device; the authentication request message includes an authentication request payload generated by hashing and XORing the second random key and the first random key and the pseudo-identity identifier corresponding to the edge device; the second authentication module 504 is used to, after the edge device verifies the authentication, respond to the two-way authentication information of the edge device, calculate the challenge-response pair corresponding to the two-way authentication payload, and verify the legality of the challenge-response pair corresponding to the two-way authentication payload based on PUF to complete the authentication of the edge device.

[0109] Please refer to Figure 6 As shown, embodiments of the present invention also provide an electronic device 600, which includes at least one processor 601, a memory 602 (e.g., non-volatile memory), a main memory 603, and a communication interface 604, and the at least one processor 601, memory 602, main memory 603, and communication interface 604 are connected together via an internal bus 605. The at least one processor 601 is used to invoke at least one program instruction stored or encoded in the memory 602, so that the at least one processor 601 performs various operations and functions of the lightweight authentication method described in the various embodiments of this specification.

[0110] In the embodiments of this specification, electronic device 600 may include, but is not limited to: personal computer, server computer, workstation, desktop computer, laptop computer, notebook computer, mobile electronic device, smartphone, tablet computer, cellular phone, personal digital assistant (PDA), handheld device, messaging device, wearable electronic device, consumer electronic device, etc.

[0111] This invention also provides a computer-readable medium carrying computer-executable instructions. When executed by a processor, these instructions can be used to implement various operations and functions of the lightweight authentication method described in the various embodiments of this specification.

[0112] The computer-readable medium in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0113] In this invention, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. This propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wireline, optical fiber, RF, etc., or any suitable combination thereof.

[0114] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0115] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus, systems, and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart...Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0116] The foregoing description of specific exemplary embodiments of the invention is for illustrative and explanatory purposes. These descriptions are not intended to limit the invention to the precise forms disclosed, and it will be apparent that many changes and variations can be made in accordance with the foregoing teachings. The exemplary embodiments were chosen and described in order to explain the specific principles of the invention and its practical application, thereby enabling those skilled in the art to implement and utilize various different exemplary embodiments of the invention, as well as various different choices and variations. The scope of the invention is intended to be defined by the claims and their equivalents.

[0117] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

[0118] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. A lightweight identity authentication method applied to edge devices, characterized in that, include: Record the hash function, security key, ID of each terminal device, and PUF challenge-response pair distributed to the terminal devices, and synchronize the initialization information of the terminal devices through a shared ledger in a consortium blockchain among multiple edge devices; In response to the registration request from the terminal device, the registration record, which includes the pseudo-identity identifier, challenge value, encrypted response value, and encrypted first random key, is broadcast in the consortium blockchain shared ledger and a registration completion message is returned to the terminal device; In response to the authentication request from the terminal device, the registration information corresponding to the pseudo-identity carried in the authentication request is determined by the shared ledger, the first random key is restored, and the identity and legitimacy of the terminal device are verified based on the restored first random key; If the verification is successful, a new challenge-response pair corresponding to the terminal device is selected, and two-way authentication information is sent to the terminal device so that the terminal device can use PUF to verify the legality of the new challenge-response pair and complete the authentication of the edge device. The two-way authentication information includes a first two-way authentication payload and a second two-way authentication payload generated by hash obfuscation and XOR operation of the new challenge-response pair. After two-way authentication is completed, the edge device and the terminal device generate session keys based on the pseudo-identity, the new challenge-response pair, and dynamic parameters, and write the authentication success information into the consortium blockchain shared ledger to realize authentication information sharing and security auditing among multiple edge devices.

2. The lightweight identity authentication method according to claim 1, characterized in that, The method further includes: Based on the end device ID carried in the registration request, the hash function and challenge-response pair corresponding to the end device are determined in the local storage of the edge device; Determine the local response value in the edge device's local storage that corresponds to the challenge value carried in the registration request; The local response value is encrypted using the hash function. If the local response value encrypted using the hash function is equal to the response value encrypted using the hash function carried in the registration request, a pseudo-identity identifier, an encrypted response value, and an encrypted first random key are generated. A registration record is constructed based on the pseudo-identity identifier, the encrypted response value, and the encrypted first random key for broadcasting in the consortium blockchain shared ledger.

3. The lightweight identity authentication method according to claim 1, characterized in that, The formula for generating the pseudo-identity, the encrypted response value, and the first random key for encryption is as follows: in, For the pseudo identity identifier of the terminal device; End device ID; For security keys; For generated random numbers; For response value; The third random key; This is the encrypted response value; The first random key for encryption; This is a hash function.

4. The lightweight identity authentication method according to claim 1, characterized in that, After successful two-way authentication, the method further includes: Edge devices and terminal devices independently generate session keys based on the pseudo-identity and the hash value of the new challenge-response pair; The edge device broadcasts the authentication success information in the consortium blockchain's shared ledger, forming an immutable audit record; the authentication success information includes a pseudo-identity identifier and proposer information.

5. The lightweight identity authentication method according to claim 1, characterized in that, Verifying the identity and legitimacy of the terminal device based on the recovered first random key includes: Based on the locally stored security key, the response value is recovered from the encrypted response value through hash and XOR operations; Based on the restored response value and the security key, the first random key is restored from the encrypted first random key through hash and XOR operations; The edge device uses the recovered first random key and the pseudo-identity identifier to calculate the authentication request payload through hash operation; If the calculated authentication request payload is equal to the authentication request payload in the authentication request message, then the end device is legitimate.

6. The lightweight identity authentication method according to claim 1, characterized in that, Generating the two-way authentication information includes: After verifying the identity and legitimacy of the terminal device, the edge device calculates the second random key and the terminal device ID based on the authentication request payload in the received authentication request message and the restored first random key. Based on the terminal device ID, a new set of challenge values ​​and their corresponding response values ​​are randomly selected for the terminal device from the pre-stored challenge-response pairs; Based on the first random key, the new challenge value is encrypted using hash and XOR operations to generate a first two-way authentication payload; based on the pseudo-identity identifier of the terminal device and the first two-way authentication payload, the new response value is encrypted using hash and XOR operations to generate a second two-way authentication payload. A two-way authentication message is constructed based on the first two-way authentication payload and the second two-way authentication payload.

7. The lightweight identity authentication method according to claim 1, characterized in that, The method further includes: During the authentication process, both communicating parties include the sender's current timestamp in the message when sending authentication requests, authentication responses, or confirmation messages. After receiving the message, the receiver obtains the local current time and calculates the time difference between the local time and the timestamp carried in the message. The time difference is compared with a preset threshold. If the time difference exceeds the threshold, the message is determined to be invalid and discarded. The threshold includes a first time threshold for authentication request and response messages, and a second time threshold for determining the validity of registration information. The second time threshold is greater than the first time threshold. After receiving an authentication request from a terminal device, the edge device, in addition to verifying the freshness of the authentication request message itself, also needs to read the registration information of the terminal device from the blockchain shared ledger. The registration information includes a timestamp generated during registration. The edge device calculates the difference between the current time and the registration timestamp. If the difference exceeds the second time threshold, it determines that the registration information has expired and requires the terminal device to re-register.

8. A lightweight identity authentication method, applied to an end device, characterized in that, include: Registration request information is generated based on a set of challenge response pairs, and the registration request information is sent to the edge device; Receive the registration completion message sent from the edge device, decrypt and store the first random key; A second random key is determined and an authentication request message is generated and sent to the edge device; the authentication request message includes an authentication request payload generated by hashing and XORing the second random key and the first random key, as well as a pseudo-identity identifier corresponding to the edge device; After the edge device is verified, in response to the two-way authentication information of the edge device, the challenge-response pair corresponding to the two-way authentication payload is calculated, and the legality of the challenge-response pair corresponding to the two-way authentication payload is verified based on PUF to complete the authentication of the edge device.

9. A lightweight identity authentication system, employing the lightweight identity authentication method as described in any one of claims 1-7, characterized in that, include: The recording module is used to record the hash function, security key, ID of each terminal device, and PUF challenge-response pair distributed to the terminal devices; The registration module is used to respond to the registration request from the terminal device by broadcasting the registration record, which includes the pseudo-identity identifier, challenge value, encrypted response value and encrypted first random key, in the consortium blockchain shared ledger and returning a registration completion message to the terminal device. The first authentication module is used to respond to the authentication request of the terminal device, determine the registration information corresponding to the pseudo identity carried in the authentication request and the shared ledger, restore the first random key, and verify the identity and legality of the terminal device based on the restored first random key. The first request module is used to select a new challenge-response pair corresponding to the end device when the verification is successful, and send two-way authentication information to the end device so that the end device can use PUF to verify the legality of the new challenge-response pair and complete the authentication of the edge device. The two-way authentication information includes the two-way authentication payload generated by hash obfuscation and XOR operation of the new challenge-response pair.

10. A lightweight identity authentication system, applied to the lightweight identity authentication method as described in claim 8, characterized in that, include: The generation module is used to generate registration request information based on a set of challenge responses and send the registration request information to the edge device; The decryption module is used to receive the registration completion message sent from the edge device, decrypt it, and store the first random key. The second request module is used to determine the second random key and generate an authentication request message to be sent to the edge device; the authentication request message includes an authentication request payload generated by hashing and XORing the second random key and the first random key, as well as a pseudo-identity identifier corresponding to the edge device. The second authentication module is used to, after the edge device is verified, respond to the two-way identity authentication information of the edge device, calculate the challenge-response pair corresponding to the two-way identity authentication payload, and verify the legality of the challenge-response pair corresponding to the two-way identity authentication payload based on PUF, so as to complete the authentication of the edge device.

Images