An internet of things secure communication method and system based on lightweight identity authentication

Abstract

The application relates to a lightweight identity authentication-based Internet of Things secret communication method and system, which comprises the following steps: collecting and preprocessing multi-behavior data of each Internet of Things device, and constructing dynamic identity credentials according to the processed behavior data; collecting and analyzing context information of each communication scene, judging corresponding risk levels, and selecting corresponding authentication factors according to the risk levels; performing bidirectional authentication on each Internet of Things device based on the dynamic identity credentials and the corresponding authentication factors, verifying corresponding anonymous identities according to the bidirectional authentication results; regularly collecting multi-behavior data of each Internet of Things device, and updating and replacing corresponding dynamic identity credentials. The lightweight identity authentication-based Internet of Things secret communication system comprises an acquisition and processing module, an extraction and generation module, an evaluation and selection module, an authentication negotiation module, an anonymous verification module, a dynamic management module and an encryption transmission module.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) security technology, and in particular to a secure communication method and system for IoT based on lightweight identity authentication. Background Technology

[0002] With the surge in the number of IoT devices, interconnectivity between devices in scenarios such as smart homes, industrial control, and smart healthcare has become the norm. However, IoT devices generally suffer from problems such as low computing power, limited storage resources, and power constraints. At the same time, the long-term online status of devices and massive data interaction also bring security risks. Traditional identity authentication methods are difficult to operate efficiently on resource-constrained devices, and static credentials are easily stolen by attackers, leading to data leakage or illegal control.

[0003] Existing secure communication methods and systems for the Internet of Things (IoT) typically rely on static credentials for authentication. Static credentials are easily stolen or forged by attackers, making it difficult to maintain stable and reliable authentication and risk assessment in complex network environments. Furthermore, existing secure communication methods and systems for the IoT lack dynamic adjustment mechanisms for security levels in different risk environments, and fixed keys used for a long time are threatened with leakage, failing to fully protect communication privacy. To address these issues, we propose a secure communication method and system for the IoT based on lightweight authentication. Summary of the Invention

[0004] Therefore, there is a need to provide a secure communication method and system for the Internet of Things (IoT) based on lightweight identity authentication, in order to solve the problems that existing secure communication methods and systems lack a dynamic adjustment mechanism for security levels in different risk environments, and that long-term used fixed keys are threatened with leakage, thus failing to fully protect communication privacy.

[0005] To achieve the above objectives, the inventors provide a secure communication method for the Internet of Things (IoT) based on lightweight authentication, comprising the following steps:

[0006] Ⅰ: Collect and preprocess multi-behavioral data from various IoT devices, and construct dynamic identity credentials based on the processed behavioral data;

[0007] II: Collect and analyze the context information of each communication scenario, determine the corresponding risk level, and select the appropriate authentication factor based on each risk level;

[0008] III: Based on each dynamic identity credential and its corresponding authentication factor, perform two-way authentication on each IoT device, and verify the corresponding anonymous identity based on the results of each two-way authentication;

[0009] IV: Regularly collect multi-behavioral data from various IoT devices and update and replace the corresponding dynamic identity credentials.

[0010] Furthermore, the specific steps for constructing dynamic identity credentials described in step I are as follows:

[0011] S1.1: Collect multi-behavioral data from various IoT devices, unify the format of each behavioral data, calculate the similarity of each behavioral data collected within the same time window, retain behavioral data with similarity within a preset range, and remove behavioral data with similarity exceeding the preset range. Then, map each behavioral data to the [0,1] interval.

[0012] S1.2: Based on the behavioral characteristics of each IoT device, divide the corresponding multi-dimensional feature extraction framework, obtain the resource constraint data of each IoT device, select the corresponding lightweight algorithm based on the resource constraint data of each IoT device, and then initialize the corresponding algorithm parameter configuration. The lightweight algorithm includes K-means clustering algorithm, lightweight decision tree model or sparse autoencoder.

[0013] S1.3: Based on the selected lightweight algorithm, extract the multi-dimensional features of each behavior data after processing, and then integrate the mined multi-dimensional features to form a corresponding multi-dimensional feature set. At the same time, calculate the variance value of each feature in the multi-dimensional feature set, remove features with variance values ​​lower than the preset threshold, and retain features with variance values ​​exceeding the preset threshold to form the corresponding core feature vector.

[0014] S1.4: Map each core feature vector to the [0,1] interval and use a weighted summation method to fuse each core feature vector. Then, calculate the corresponding feature value according to the preset feature weight allocation rule. After that, match each feature value with the preset credential generation rule library based on the preset credential generation rule library. Convert each feature value into the corresponding encoding string according to the preset mapping relationship. Combine the behavior cycle identifier of each IoT device to encrypt and obfuscate each encoding string to generate the corresponding dynamic identity credential.

[0015] Furthermore, the specific steps for selecting the corresponding certification factor based on each risk level, as described in step II, are as follows:

[0016] S2.1: Collect context information of communication scenarios of various IoT devices in real time, and use a simple threshold method to remove abnormal data in each context information that exceeds the preset range. Then, use the nearest neighbor data filling method to supplement the missing information in each context information. Finally, based on the processed context information, construct a multi-dimensional environmental risk assessment index system.

[0017] S2.2: Map the indicators of each dimension in the multi-dimensional environmental risk assessment indicator system to a unified assessment range, and use a linear quantification method to convert the raw data of each dimension indicator into corresponding quantitative scores according to the safety threshold range of each dimension indicator. At the same time, select the corresponding lightweight decision model according to the resource constraints of IoT devices. The lightweight decision model includes a simplified logistic regression model, a shallow decision tree, or a lightweight inference model.

[0018] S2.3: The quantified multi-dimensional risk assessment indicator system is integrated with the processed context information to form a corresponding data set. At the same time, based on the selected lightweight decision model, the overall environmental risk score of the context information in each data in the data set is calculated according to the preset decision rules and weights. Then, according to the preset risk threshold range, each overall environmental risk score is divided into the corresponding risk level.

[0019] S2.4: Based on the preset authentication factor library, the risk level of each context information is matched with the authentication factor library. If the risk level is low, a lightweight authentication factor is matched; if the risk level is medium, two or more complementary authentication factors are matched; if the risk level is high, multiple high-security authentication factors are matched.

[0020] Furthermore, the specific steps for performing two-way authentication on each IoT device as described in step III are as follows:

[0021] S3.1: Encapsulate each dynamic identity credential and each selected authentication factor in a preset format to generate the corresponding authentication request data packet, and send each authentication request data packet to the corresponding server through a secure communication link. Then, the corresponding server receives each authentication request data packet and parses out the corresponding dynamic identity credential and authentication factor in a preset format.

[0022] S3.2: Compare the timestamps generated by each dynamic identity credential with the current time difference to see if they are within the preset range, and verify the correctness of each authentication factor through a preset algorithm. Then, match each authentication factor with the baseline data stored on the corresponding server to confirm whether the timestamps of each authentication factor conform to the synchronization time range.

[0023] S3.3: After each server's authentication is successful, the corresponding authentication information is generated, and the authentication information is encrypted based on the elliptic curve cryptography algorithm. At the same time, a corresponding temporary public key is generated. Then, the authentication information, the corresponding temporary public key, and the authentication success result are encapsulated into a corresponding authentication response data packet through an identifier. After that, each authentication response data packet is sent to the corresponding device through the communication link.

[0024] S3.4: The corresponding device receives each authentication response data packet, parses the information of the corresponding server, performs format verification on each temporary public key, checks whether it conforms to the elliptic curve parameter specification, and then verifies the validity of each authentication information through the preset server public key. Based on the elliptic curve cryptography algorithm, it randomly generates temporary private keys for each device and calculates the corresponding temporary public key through elliptic curve dot product operation.

[0025] S3.5: The corresponding server uses the elliptic curve cryptography algorithm to generate the corresponding temporary private key and temporary public key. Each device sends the temporary public key to the corresponding server, and each server synchronously sends the temporary public key to the corresponding device. Each device and the corresponding server use the temporary private key and the received temporary public key to calculate the corresponding shared key through the elliptic curve key exchange algorithm. Then, each shared key is hashed to generate the corresponding session key.

[0026] The inventors also provide an IoT secure communication system based on lightweight identity authentication, including a data acquisition and processing module, an extraction and generation module, an evaluation and selection module, an authentication negotiation module, an anonymity verification module, a dynamic management module, and an encrypted transmission module;

[0027] The acquisition and processing module is used to acquire and preprocess multi-behavioral data from various IoT devices and context information of corresponding communication scenarios;

[0028] The extraction and generation module is used to extract multi-dimensional features of each behavioral data after processing, and to construct corresponding dynamic identity credentials based on each dimension feature;

[0029] The assessment and selection module is used to analyze the processed context information, determine the corresponding risk level, and then select the corresponding certification factor based on the corresponding risk level.

[0030] The authentication negotiation module is based on elliptic curve cryptography algorithm to perform two-way authentication on each IoT device and generate corresponding session keys;

[0031] The anonymous verification module is used to anonymously verify the identity information of each IoT device based on the results of each two-way authentication.

[0032] The dynamic management module is used to periodically collect behavioral data from each IoT device and update the corresponding dynamic identity credentials.

[0033] The encrypted transmission module is used to encrypt all communication data based on each session key, forming corresponding ciphertext and transmitting it.

[0034] Furthermore, the specific steps of the anonymous verification module in anonymously verifying the identity information of each IoT device are as follows:

[0035] S4.1: Each device combines the dynamic identity credential, temporary public key and identity information that have passed two-way authentication, and constructs the corresponding zero-knowledge proof according to the preset proof generation rules. Then, the identity information is obfuscated in multiple layers through hash chain technology, and the corresponding core identity features are embedded in the proof structure. At the same time, information directly related to the real identity of the device is removed. After that, each constructed zero-knowledge proof is packaged in a preset format and sent to the corresponding server through the built-in secure communication link.

[0036] S4.2: Each server receives the corresponding zero-knowledge proof, checks whether the data format and length of each zero-knowledge proof conform to the preset specifications, and uses hash algorithm and elliptic curve operation logic to perform layer-by-layer solution and verification of each zero-knowledge proof to confirm whether each device has the characteristics corresponding to a legitimate identity.

[0037] S4.3: Encapsulate each verification result into a concise response packet and send it back to the corresponding device through a secure communication link. If the verification is successful, record the timestamp and proof digest of this anonymous verification. Otherwise, the server returns a verification failure flag. After receiving the successful verification result, each device destroys the corresponding temporary key pair and enters the data transmission stage.

[0038] Unlike existing technologies, the above technical solution has the following advantages: 1. This invention collects multi-behavioral data from various IoT devices and unifies the format. Then, it calculates the similarity of each behavioral data within the same time window. For behavioral data with similarity exceeding a preset range, it maps each behavioral data to the [0, 1] interval. Based on the behavioral characteristics of each IoT device, it divides the corresponding multi-dimensional feature extraction framework. At the same time, it selects the corresponding lightweight algorithm in combination with the resource constraints of each IoT device to extract the multi-dimensional features of each processed behavioral data and integrates them to form a multi-dimensional feature set. Simultaneously, it calculates the variance of each feature in the multi-dimensional feature set, removes features with variance values ​​lower than a preset threshold, obtains the corresponding core feature vector, and maps each core feature vector to the [0, 1] interval. It generates the corresponding feature value through weighted summation and fusion. Then, according to the preset voucher generation rule library, it converts each feature value into an encoded string and combines it with each IoT device. The behavior cycle identifiers of network devices are encrypted and obfuscated to generate corresponding dynamic identity credentials. Then, context information of communication scenarios of each IoT device is collected in real time, abnormal data is removed and missing information is filled, and a multi-dimensional environmental risk assessment index system is constructed. The indicators of each dimension of the multi-dimensional environmental risk assessment index system are mapped to a unified range and quantified and scored. Combined with the resource constraints of IoT devices, an appropriate lightweight decision model is selected. The quantified multi-dimensional risk assessment index system is integrated with the context information, and the corresponding overall environmental risk score is calculated according to preset rules, and the risk level is divided. Finally, the corresponding authentication strategy of the preset authentication factor library is applied. Lightweight factors are used for low risk, multiple complementary factors are used for medium risk, and multiple high-security factors are used for high risk. This can prevent static credentials from being attacked or forged, ensuring the reliability and stability of authentication and risk assessment, ensuring security in high-risk environments, and avoiding resource waste in low-risk scenarios.

[0039] 2. This invention encapsulates each dynamic identity credential and selected authentication factors according to a preset format to generate corresponding authentication request data packets. These packets are then sent to the corresponding servers via a secure communication link. Upon receiving each authentication request data packet, the server parses the corresponding dynamic identity credential and authentication factors, verifies the validity of each dynamic identity credential and the correctness of each authentication factor, and matches each authentication factor with the baseline data stored on the server to confirm identity legitimacy. After successful authentication by each server, the server encrypts each authentication information using an elliptic curve cryptography algorithm to generate a corresponding temporary public key. The server then encapsulates each authentication information, each temporary public key, and each authentication result into a response data packet and sends it to the corresponding device. The device receives and parses each authentication response data packet, verifies the format of each temporary public key and the validity of each server's public key, randomly generates a temporary private key for each device, and calculates the corresponding temporary public key using elliptic curve multiplication. Each device and each server use their own private key and the other party's public key to obtain a shared key through an elliptic curve key exchange algorithm. The system generates corresponding session keys. Subsequently, each device combines the dynamically authenticated identity credentials, temporary public keys, and identity information to construct corresponding zero-knowledge proofs. Hash chain technology is used to obfuscate the identity information in multiple layers, embedding core identity features into the proof structure and removing information directly related to the device's real identity. The constructed zero-knowledge proofs are then encapsulated in a preset format and sent to the corresponding servers via a built-in secure communication link. Each server receives the zero-knowledge proofs, verifies the data format and length, and then verifies the validity of each proof. Simultaneously, elliptic curve and hash algorithms are used to progressively verify the legitimacy of each device's identity. The verification results are encapsulated and fed back to the corresponding devices. If verification passes, an anonymous verification timestamp and proof digest are recorded. Finally, after receiving the verification results, the corresponding temporary key pair is destroyed, and the system enters the secure data transmission phase. This system allows for adjustment of security levels under different risk scenarios, enabling on-demand protection, reducing the risk of long-term key leakage, avoiding static identity leakage, and enhancing communication privacy protection. Attached Figure Description

[0040] Figure 1 This is a flowchart of the IoT secure communication method based on lightweight identity authentication proposed in this invention.

[0041] Figure 2 This is a system block diagram of the IoT secure communication system based on lightweight identity authentication proposed in this invention. Detailed Implementation

[0042] To illustrate the possible application scenarios, technical principles, implementable specific solutions, and achievable objectives and effects of this application in detail, the following description, in conjunction with the listed specific embodiments and accompanying drawings, provides a detailed explanation. The embodiments described herein are merely illustrative of the technical solutions of this application and are therefore intended to limit the scope of protection of this application.

[0043] In this document, the term "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The term "embodiment" appearing in various places throughout the specification does not necessarily refer to the same embodiment, nor does it specifically limit its independence or connection with other embodiments. In principle, in this application, as long as there are no technical contradictions or conflicts, the technical features mentioned in each embodiment can be combined in any way to form corresponding implementable technical solutions.

[0044] Unless otherwise defined, the technical terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the use of related terms herein is merely for the purpose of describing particular embodiments and is not intended to limit this application.

[0045] In the description of this application, the term "and / or" is used to describe the logical relationship between objects, indicating that three relationships can exist. For example, A and / or B means: A exists, B exists, and A and B exist simultaneously. Additionally, the character " / " in this document generally indicates that the preceding and following objects have an "or" logical relationship.

[0046] In this application, terms such as “first” and “second” are used only to distinguish one entity or operation from another, and do not necessarily require or imply any actual quantity, hierarchy or order relationship between these entities or operations.

[0047] Without further limitations, the use of terms such as “comprising,” “including,” “having,” or other similar open-ended expressions in this application is intended to cover non-exclusive inclusion, which does not exclude the presence of additional elements in a process, method, or product that includes the stated elements, such that a process, method, or product that includes a list of elements may include not only those defined elements but also other elements not expressly listed, or elements inherent to such a process, method, or product.

[0048] As understood in the Examination Guidelines, in this application, expressions such as "greater than," "less than," and "exceeding" are understood to exclude the stated number; expressions such as "above," "below," and "within" are understood to include the stated number. Furthermore, in the description of the embodiments in this application, "multiple" means two or more (including two), and similar expressions related to "multiple" are also understood in this way, such as "multiple groups" and "multiple times," unless otherwise explicitly specified.

[0049] In the description of the embodiments of this application, the space-related expressions used, such as "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "vertical," "top," "bottom," "inner," "outer," "clockwise," "counterclockwise," "axial," "radial," and "circumferential," indicate the orientation or positional relationship based on the orientation or positional relationship shown in the specific embodiments or drawings. They are only for the purpose of describing the specific embodiments of this application or for the reader's understanding, and do not indicate or imply that the device or component referred to must have a specific position, a specific orientation, or be constructed or operated in a specific orientation. Therefore, they should not be construed as limitations on the embodiments of this application.

[0050] Unless otherwise expressly specified or limited, the terms "installation," "connection," "linking," "fixing," and "setting," as used in the description of the embodiments of this application, should be interpreted broadly. For example, "connection" can be a fixed connection, a detachable connection, or an integral arrangement; it can be a direct connection or an indirect connection through an intermediate medium; it can be a relationship of two components combined together, an interaction relationship between two components, or a connection within two structures. Those skilled in the art to which this application pertains can understand the specific meaning of the above terms in the embodiments of this application according to the specific circumstances.

[0051] Example 1: Refer to Figure 1 This embodiment discloses a secure communication method for the Internet of Things based on lightweight identity authentication. The specific steps of this communication method are as follows:

[0052] Collect and preprocess multi-behavioral data from various IoT devices, and construct dynamic identity credentials based on the processed behavioral data.

[0053] Specifically, multi-behavioral data from various IoT devices is collected, and the format of each behavioral data is standardized. Then, similarity calculations are performed on the behavioral data collected within the same time window. Behavioral data with similarity within a preset range is retained, while behavioral data with similarity exceeding the preset range is removed. Next, all behavioral data are uniformly mapped to the [0,1] interval. Based on the behavioral characteristics of each IoT device, a corresponding multi-dimensional feature extraction framework is defined. Simultaneously, resource constraint data for each IoT device is acquired, and based on this data, a corresponding lightweight algorithm is selected. The corresponding algorithm parameter configuration is then initialized. According to the selected lightweight algorithm, multi-dimensional features of each processed behavioral data are extracted. Finally, the mined multi-dimensional features are... The system integrates features to form a multi-dimensional feature set. It calculates the variance of each feature in the set, removes features with variance values ​​below a preset threshold, and retains those exceeding the threshold, forming corresponding core feature vectors. These core feature vectors are then mapped to the [0,1] interval and fused using a weighted summation method. Based on preset feature weight allocation rules, corresponding feature values ​​are calculated. Then, based on a preset credential generation rule base, each feature value is matched against the rule base. Following a preset mapping relationship, each feature value is converted into a corresponding encoded string. Finally, combined with the behavioral cycle identifiers of various IoT devices, each encoded string is encrypted and obfuscated to generate a corresponding dynamic identity credential.

[0054] It should be further noted that lightweight algorithms include K-means clustering, lightweight decision tree models, or sparse autoencoders.

[0055] Collect and analyze contextual information for each communication scenario, determine the corresponding risk level, and select the appropriate authentication factor based on each risk level.

[0056] Specifically, context information from communication scenarios of various IoT devices is collected in real time. A simple threshold method is used to remove abnormal data exceeding a preset range from each context. Missing information in each context is then filled in using nearest neighbor data. Based on the processed context information, a multi-dimensional environmental risk assessment index system is constructed. Each dimension of the index is mapped to a unified assessment range, and a linear quantization method is used to convert the raw data of each dimension into corresponding quantitative scores based on the safety threshold range of each dimension. Simultaneously, based on the resource constraints of IoT devices, a corresponding lightweight decision-making model is selected to process the quantified multi-dimensional data. The risk assessment indicator system is integrated with the processed contextual information to form a corresponding dataset. Based on the selected lightweight decision model, and according to the preset decision rules and weights, the overall environmental risk score of the contextual information in each data point in the dataset is calculated. Then, according to the preset risk threshold range, each overall environmental risk score is divided into a corresponding risk level. Based on the preset certification factor library, the risk level of each contextual information is matched with the certification factor library. If it is a low-risk level, a lightweight certification factor is matched; if it is a medium-risk level, two or more complementary certification factors are matched; if it is a high-risk level, multiple high-security certification factors are matched.

[0057] It should be further noted that lightweight decision models include simplified logistic regression models, shallow decision trees, or lightweight inference models.

[0058] Based on each dynamic identity credential and its corresponding authentication factor, two-way authentication is performed on each IoT device, and the corresponding anonymous identity is verified according to the two-way authentication results.

[0059] Specifically, each dynamic identity credential and selected authentication factor are encapsulated according to a preset format to generate a corresponding authentication request data packet. This data packet is then sent to the appropriate server via a secure communication link. The server receives the data packets, parses out the corresponding dynamic identity credential and authentication factor according to the preset format, compares the time difference between the generation timestamp of each dynamic identity credential and the current time to see if it is within a preset range, verifies the correctness of each authentication factor using a preset algorithm, and matches each authentication factor with the baseline data stored on the server to confirm whether the timestamp of each authentication factor conforms to the synchronization time range. After successful authentication by each server, corresponding authentication information is generated and encrypted using elliptic curve cryptography. A temporary public key is also generated. Finally, the authentication information, the temporary public key, and the authentication result are encapsulated using an identifier to form the corresponding authentication code. The system receives a response data packet, and then each authentication response data packet is sent to the corresponding device via the communication link. The corresponding device receives each authentication response data packet, parses the information of the corresponding server, and performs format verification on each temporary public key to check whether it conforms to the elliptic curve parameter specification. Then, it verifies the validity of each authentication information using the preset server public key. Based on the elliptic curve cryptography algorithm, it randomly generates a temporary private key for each device and calculates the corresponding temporary public key using elliptic curve dot product. The corresponding server uses the elliptic curve cryptography algorithm to generate the corresponding temporary private key and temporary public key. Each device sends its temporary public key to the corresponding server, and each server synchronously sends its temporary public key to the corresponding device. Each device and the corresponding server use their temporary private key and the received temporary public key from the other party, and calculate the corresponding shared key using the elliptic curve key exchange algorithm. Then, they hash each shared key to generate the corresponding session key.

[0060] Regularly collect multi-behavioral data from various IoT devices and update and replace the corresponding dynamic identity credentials.

[0061] Example 2: Refer to Figure 2 This embodiment discloses an IoT secure communication system based on lightweight identity authentication, including a data acquisition and processing module, an extraction and generation module, an evaluation and selection module, an authentication negotiation module, an anonymity verification module, a dynamic management module, and an encrypted transmission module;

[0062] The data acquisition and processing module is used to collect and preprocess multi-behavioral data from various IoT devices and contextual information of corresponding communication scenarios; the data extraction and generation module is used to extract multi-dimensional features of the processed behavioral data and construct corresponding dynamic identity credentials based on the multi-dimensional features.

[0063] The evaluation and selection module analyzes the processed context information and determines the corresponding risk level, then selects the appropriate authentication factor based on the risk level; the authentication negotiation module performs two-way authentication for each IoT device based on the elliptic curve cryptography algorithm and generates the corresponding session key.

[0064] The anonymous verification module is used to anonymously verify the identity information of each IoT device based on the results of each two-way authentication.

[0065] Specifically, each device combines the dynamically authenticated identity credential, temporary public key, and identity information, and constructs corresponding zero-knowledge proofs according to preset proof generation rules. Then, using hash chain technology, the identity information undergoes multi-layered obfuscation, embedding the core identity features into the proof structure while removing information directly associated with the device's real identity. The constructed zero-knowledge proofs are then encapsulated in a preset format and sent to the corresponding servers via a built-in secure communication link. Each server receives the zero-knowledge proofs, verifies their data format and length against preset specifications, and uses hash algorithms and elliptic curve operations to perform layer-by-layer verification, confirming whether each device possesses the features corresponding to a legitimate identity. The verification results are encapsulated into concise response packets and fed back to the corresponding devices via the secure communication link. If verification passes, the timestamp and proof digest of this anonymous verification are recorded; otherwise, the server returns a verification failure flag. After receiving the verification results, each device destroys the corresponding temporary key pair and enters the data transmission phase.

[0066] The dynamic management module is used to periodically collect behavioral data from various IoT devices and update the corresponding dynamic identity credentials; the encrypted transmission module is used to encrypt all communication data based on each session key, forming corresponding ciphertext and transmitting it.

[0067] Finally, it should be noted that although the above embodiments have been described in the text and drawings of this application, this should not limit the scope of patent protection of this application. Any technical solutions that are based on the essential concept of this application and utilize the content described in the text and drawings of this application, resulting in equivalent structural or procedural substitutions or modifications, as well as the direct or indirect application of the technical solutions of the above embodiments to other related technical fields, are all included within the scope of patent protection of this application.

Claims

1. A secure communication method for the Internet of Things (IoT) based on lightweight identity authentication, characterized in that, Includes the following steps: Ⅰ: Collect and preprocess multi-behavioral data from various IoT devices, and construct dynamic identity credentials based on the processed behavioral data; II: Collect and analyze the context information of each communication scenario, determine the corresponding risk level, and select the appropriate authentication factor based on each risk level; III: Based on each dynamic identity credential and its corresponding authentication factor, perform two-way authentication on each IoT device, and verify the corresponding anonymous identity based on the results of each two-way authentication; IV: Regularly collect multi-behavioral data from various IoT devices and update and replace the corresponding dynamic identity credentials.

2. The IoT secure communication method based on lightweight identity authentication according to claim 1, characterized in that: The specific steps for constructing dynamic identity credentials described in step I are as follows: S1.1: Collect multi-behavioral data from various IoT devices, unify the format of each behavioral data, calculate the similarity of each behavioral data collected within the same time window, retain behavioral data with similarity within a preset range, and remove behavioral data with similarity exceeding the preset range. Then, map each behavioral data to the [0,1] interval. S1.2: Based on the behavioral characteristics of each IoT device, divide the corresponding multi-dimensional feature extraction framework, obtain the resource constraint data of each IoT device, select the corresponding lightweight algorithm based on the resource constraint data of each IoT device, and then initialize the corresponding algorithm parameter configuration. The lightweight algorithm includes K-means clustering algorithm, lightweight decision tree model or sparse autoencoder. S1.3: Based on the selected lightweight algorithm, extract the multi-dimensional features of each behavior data after processing, and then integrate the mined multi-dimensional features to form a corresponding multi-dimensional feature set. At the same time, calculate the variance value of each feature in the multi-dimensional feature set, remove features with variance values ​​lower than the preset threshold, and retain features with variance values ​​exceeding the preset threshold to form the corresponding core feature vector. S1.4: Map each core feature vector to the [0,1] interval and use a weighted summation method to fuse each core feature vector. Then, calculate the corresponding feature value according to the preset feature weight allocation rule. After that, match each feature value with the preset credential generation rule library based on the preset credential generation rule library. Convert each feature value into the corresponding encoding string according to the preset mapping relationship. Combine the behavior cycle identifier of each IoT device to encrypt and obfuscate each encoding string to generate the corresponding dynamic identity credential.

3. The IoT secure communication method based on lightweight identity authentication according to claim 1, characterized in that: The specific steps for selecting the corresponding certification factor based on each risk level, as described in Step II, are as follows: S2.1: Collect context information of communication scenarios of various IoT devices in real time, and use a simple threshold method to remove abnormal data in each context information that exceeds the preset range. Then, use the nearest neighbor data filling method to supplement the missing information in each context information. Finally, based on the processed context information, construct a multi-dimensional environmental risk assessment index system. S2.2: Map the indicators of each dimension in the multi-dimensional environmental risk assessment indicator system to a unified assessment range, and use a linear quantification method to convert the raw data of each dimension indicator into corresponding quantitative scores according to the safety threshold range of each dimension indicator. At the same time, select the corresponding lightweight decision model according to the resource constraints of IoT devices. The lightweight decision model includes a simplified logistic regression model, a shallow decision tree, or a lightweight inference model. S2.3: The quantified multi-dimensional risk assessment indicator system is integrated with the processed context information to form a corresponding data set. At the same time, based on the selected lightweight decision model, the overall environmental risk score of the context information in each data in the data set is calculated according to the preset decision rules and weights. Then, according to the preset risk threshold range, each overall environmental risk score is divided into the corresponding risk level. S2.4: Based on the preset authentication factor library, the risk level of each context information is matched with the authentication factor library. If the risk level is low, a lightweight authentication factor is matched; if the risk level is medium, two or more complementary authentication factors are matched; if the risk level is high, multiple high-security authentication factors are matched.

4. The IoT secure communication method based on lightweight identity authentication according to claim 1, characterized in that: The specific steps for performing two-way authentication on each IoT device as described in step III are as follows: S3.1: Encapsulate each dynamic identity credential and each selected authentication factor in a preset format to generate the corresponding authentication request data packet, and send each authentication request data packet to the corresponding server through a secure communication link. Then, the corresponding server receives each authentication request data packet and parses out the corresponding dynamic identity credential and authentication factor in a preset format. S3.2: Compare the timestamps generated by each dynamic identity credential with the current time difference to see if they are within the preset range, and verify the correctness of each authentication factor through a preset algorithm. Then, match each authentication factor with the baseline data stored on the corresponding server to confirm whether the timestamps of each authentication factor conform to the synchronization time range. S3.3: After each server's authentication is successful, the corresponding authentication information is generated, and the authentication information is encrypted based on the elliptic curve cryptography algorithm. At the same time, a corresponding temporary public key is generated. Then, the authentication information, the corresponding temporary public key, and the authentication success result are encapsulated into a corresponding authentication response data packet through an identifier. After that, each authentication response data packet is sent to the corresponding device through the communication link. S3.4: The corresponding device receives each authentication response data packet, parses the information of the corresponding server, performs format verification on each temporary public key, checks whether it conforms to the elliptic curve parameter specification, and then verifies the validity of each authentication information through the preset server public key. Based on the elliptic curve cryptography algorithm, it randomly generates temporary private keys for each device and calculates the corresponding temporary public key through elliptic curve dot product operation. S3.5: The corresponding server uses the elliptic curve cryptography algorithm to generate the corresponding temporary private key and temporary public key. Each device sends the temporary public key to the corresponding server, and each server synchronously sends the temporary public key to the corresponding device. Each device and the corresponding server use the temporary private key and the received temporary public key to calculate the corresponding shared key through the elliptic curve key exchange algorithm. Then, each shared key is hashed to generate the corresponding session key.

5. A secure communication system for the Internet of Things based on lightweight identity authentication, characterized in that: It includes a data acquisition and processing module, an extraction and generation module, an evaluation and selection module, an authentication negotiation module, an anonymity verification module, a dynamic management module, and an encrypted transmission module; The acquisition and processing module is used to acquire and preprocess multi-behavioral data from various IoT devices and context information of corresponding communication scenarios; The extraction and generation module is used to extract multi-dimensional features of each behavioral data after processing, and to construct corresponding dynamic identity credentials based on each dimension feature; The assessment and selection module is used to analyze the processed context information, determine the corresponding risk level, and then select the corresponding certification factor based on the corresponding risk level. The authentication negotiation module is based on elliptic curve cryptography algorithm to perform two-way authentication on each IoT device and generate corresponding session keys; The anonymous verification module is used to anonymously verify the identity information of each IoT device based on the results of each two-way authentication. The dynamic management module is used to periodically collect behavioral data from each IoT device and update the corresponding dynamic identity credentials. The encrypted transmission module is used to encrypt all communication data based on each session key, forming corresponding ciphertext and transmitting it.

6. The IoT secure communication system based on lightweight identity authentication according to claim 5, characterized in that: The specific steps of the anonymous verification module to anonymously verify the identity information of each IoT device are as follows: S4.1: Each device combines the dynamic identity credential, temporary public key and identity information that have passed two-way authentication, and constructs the corresponding zero-knowledge proof according to the preset proof generation rules. Then, the identity information is obfuscated in multiple layers through hash chain technology, and the corresponding core identity features are embedded in the proof structure. At the same time, information directly related to the real identity of the device is removed. After that, each constructed zero-knowledge proof is packaged in a preset format and sent to the corresponding server through the built-in secure communication link. S4.2: Each server receives the corresponding zero-knowledge proof, checks whether the data format and length of each zero-knowledge proof conform to the preset specifications, and uses hash algorithm and elliptic curve operation logic to perform layer-by-layer solution and verification of each zero-knowledge proof to confirm whether each device has the characteristics corresponding to a legitimate identity. S4.3: Encapsulate each verification result into a concise response packet and send it back to the corresponding device through a secure communication link. If the verification is successful, record the timestamp and proof digest of this anonymous verification. Otherwise, the server returns a verification failure flag. After receiving the successful verification result, each device destroys the corresponding temporary key pair and enters the data transmission stage.

Images