Pre-verification based anti-dos authentication method and system for iot edge side

Abstract

The application discloses an anti-DoS authentication method and system based on pre-verification on the edge side of an Internet of Things, which comprises the following steps: firstly, a registration institution in the Internet of Things receives a registration request sent by a terminal device for registration and calculates a plurality of group verification points; secondly, the registration institution creates and initializes a dynamic time window Bloom filter, maps the group verification points, and simultaneously, the dynamic time window Bloom filter is sent to an edge server, and the edge server receives a to-be-authenticated message sent by the terminal device and analyzes the to-be-authenticated message; then, the edge server judges whether a timestamp of the terminal device message exists in a current valid time window, and if yes, an aggregated hash value is calculated as a query key for matching query; finally, when the query result is nonexistence, the to-be-authenticated message is an illegal request; otherwise, signature data is subjected to a password school authentication, and message authentication of the terminal device is completed. The application can significantly reduce the probability of illegal requests entering a high-overhead verification stage.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) security technology, specifically to an authentication method and system for resisting DoS (Denial of Service) attacks based on a pre-verification mechanism, deployed at the edge of the IoT. Background Technology

[0002] With the rapid development of IoT technology, massive numbers of terminal devices are being deployed in key areas such as industrial control, smart cities, and intelligent transportation. To ensure the security of these large-scale terminals, edge devices screen them through authentication mechanisms. In this scenario, authentication between the terminal and the edge server is a core element in ensuring the secure operation of the system.

[0003] Current IoT authentication mechanisms primarily rely on cryptographic methods such as digital signatures, hash chains, or key negotiation. While these methods achieve high levels of security, edge server resources are relatively limited in practical deployments, and existing encrypted verification processes typically involve high-overhead cryptographic computations. Attackers can easily launch denial-of-service attacks by forging authentication messages, replaying historical messages, or sending malicious requests in bulk, forcing servers to perform the full authentication process for a massive number of illegal requests, leading to delays in the response to legitimate requests or even system outages. Furthermore, traditional defense methods (such as timestamp verification and static access control lists) have a single judgment dimension and heavily rely on static rules. When attack traffic highly simulates legitimate requests in terms of structure and format, traditional mechanisms struggle to effectively distinguish them in the early stages of authentication, causing a large amount of malicious traffic to directly enter the computationally expensive cryptographic verification stage. In this context, how to build a lightweight, highly efficient filtering mechanism in the early stages of the authentication process while ensuring authentication strength, to quickly identify and block illegal authentication requests, reduce the computational overhead of edge servers in attack scenarios, and improve the overall availability of the system under high concurrency requests, has become a pressing technical bottleneck in the field of IoT security. Summary of the Invention

[0004] The purpose of this invention is to provide a pre-verified authentication method and system for IoT edge-side anti-DoS, which solves the problem of poor message response and real-time performance on the edge side caused by the consumption of computing resources by denial-of-service attacks in edge node authentication scenarios in traditional authentication schemes.

[0005] To solve the above-mentioned technical problems, the design solution of the present invention is as follows:

[0006] A pre-verified authentication method and system for DoS protection at the IoT edge, comprising the following steps:

[0007] S1. The registration authority in the Internet of Things receives the registration request sent by the terminal device, registers the terminal device, generates an initial key and time vector corresponding to the terminal device, and calculates multiple group verification points of the terminal device within its life cycle based on the initial key;

[0008] S2. The registry creates and initializes a dynamic time-window Bloom filter, and the group validation points are mapped by the registry to the dynamic time-window Bloom filter.

[0009] S3. While the dynamic time window Bloom filter is being sent to the edge server, the edge server receives the authentication message sent by the terminal device and parses the timestamp, contribution value and signature data in the authentication message.

[0010] S4. The edge server determines whether the timestamp of the message from the terminal device exists within the current valid time window. If it does, it calculates the aggregate hash value based on the contribution value and uses the aggregate hash value as the query key to perform a matching query in the dynamic time window Bloom filter.

[0011] S5. When the query result of the dynamic time window Bloom filter is non-existent, the message to be authenticated is determined to be an illegal request and discarded; when the query result is present, cryptographic verification is performed on the signature data to complete the message authentication of the terminal device.

[0012] As a preferred method, the registration of terminal devices by the registration authority includes generating an initial key vector and a time vector, and evolving the key vector and time vector within a predetermined time period L according to certain rules, and finally generating a group verification point.

[0013] As a preferred option, the key evolution and group verification point generation process is as follows:

[0014] S11. For each period of L, the first... Terminal devices calculate Time vector at each time point The time vector contains Each element Through What was obtained For hash operation, where , It is the private key agreed upon by the registration authority and the terminal device.

[0015] S12. Calculate based on the time vector Key vectors at each time point The key vector contains Each element Through Obtained.

[0016] S13. Based on the key vector registration authority, a system can be constructed. Equipment in Contribution value at time points .

[0017] S14. Generate group validation points based on the contribution values ​​of all devices. .

[0018] Preferably, the group verification points correspond one-to-one with multiple time intervals in the preset life cycle of the terminal device, and at a new time point, the historical group verification points are replaced by new group verification points.

[0019] Preferably, the dynamic time window Bloom filter in step S2 is created by a registration authority and consists of multiple sub-Bloom filters, specifically:

[0020] S21. The time window in the dynamic time window Bloom filter defines the currently active sub-Bloom filter, and the time window sliding period is set so that the currently active sub-Bloom filter is updated after exceeding the range.

[0021] S22. The saturation counter in the dynamic time window Bloom filter is configured at the beginning of each sub-Bloom filter to monitor the filled bits of the sub-Bloom filter, reflecting the collision risk of the corresponding sub-Bloom filter. The larger the value, the greater the collision risk.

[0022] S23. The threshold in the dynamic time window Bloom filter is compared with the saturation counter to prevent the saturation counter from exceeding the upper limit.

[0023] Preferably, the time window is a sliding time window, and the edge server dynamically updates the time window according to the current time to detect the timeliness of the authentication message.

[0024] Preferably, the process of mapping the group verification points to the dynamic time window Bloom filter by the registration agency is as follows: select a sub-Bloom filter within the time window, determine whether the saturation counter has reached the set threshold, and if the threshold is reached, select a sub-Bloom filter whose saturation counter value is within the threshold range as the object for mapping the group verification points; if there is no sub-Bloom filter that meets this condition in the current time window, then add a new sub-Bloom filter to the current time window.

[0025] As a preferred approach, the dynamic time window Bloom filter implements a sliding window mechanism at fixed time intervals. Specifically, as time progresses, the time window is automatically slid forward and all bits of expired sub-Bloom filters are cleared. By overwriting the sub-Bloom filter data under the oldest time window that has exceeded its lifespan, storage space is optimized, thereby preventing saturation caused by the accumulation of historical data and ensuring that the system only verifies feature data within the current valid period.

[0026] In another aspect, the present invention also provides a pre-verified IoT edge-side DoS-resistant authentication system for implementing the aforementioned authentication method, comprising the following modules:

[0027] The group verification point generation module is used by the registration authority in the Internet of Things to receive registration requests sent by terminal devices, register the terminal devices, and calculate multiple group verification points of the terminal devices within their life cycle based on the initial key.

[0028] The Dynamic Time Window Bloom Filter module is used by the registry to create and initialize a dynamic time window Bloom filter, and the group validation points are mapped to the dynamic time window Bloom filter by the registry.

[0029] The pending authentication message module is used when the dynamic time window Bloom filter is sent to the edge server, and the edge server receives the pending authentication message sent by the terminal device and parses the timestamp, contribution value and signature data in the pending authentication message.

[0030] The matching query module is used by the edge server to determine whether the timestamp of the terminal device message exists within the current valid time window. If it does, the aggregate hash value is calculated based on the contribution value, and the aggregate hash value is used as the query key to perform a matching query in the dynamic time window Bloom filter.

[0031] The message authentication module is used to determine that the message to be authenticated is an illegal request when the query result of the dynamic time window Bloom filter does not exist; when the query result exists, it performs cryptographic verification on the signature data to complete the message authentication of the terminal device.

[0032] This invention has the following characteristics and beneficial effects:

[0033] The aforementioned technical solution employs a hash function-based method for calculating group verification points and deploys a dynamic time-window Bloom filter on the edge server as a pre-filtering mechanism to resist DoS attacks. This solution significantly reduces the probability of illegal requests entering the high-overhead verification stage, thereby ensuring that the edge server can still provide reliable real-time control services to terminal devices even when subjected to denial-of-service attacks. Furthermore, this invention effectively reduces the computational burden on the edge server under DoS attack scenarios without increasing the computational load on terminal devices, improving the overall stability of the system, and is particularly suitable for resource-constrained IoT environments. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 This is a flowchart of the pre-verified IoT edge-side DoS protection authentication method of the present invention;

[0036] Figure 2 This is a schematic diagram of the dynamic time window Bloom filter described in this invention;

[0037] Figure 3 This is a graph showing the change and comparison of the false positive rate under long-term testing according to the present invention;

[0038] Figure 4 This is a diagram illustrating the defensive effect of the present invention in a real-world scenario. Detailed Implementation

[0039] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other.

[0040] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings.

[0041] Conversely, this invention encompasses any substitutions, modifications, equivalent methods, and solutions made within the spirit and scope of the invention as defined in the claims. Furthermore, to provide a better understanding of the invention, certain specific details are described in detail below. However, those skilled in the art will fully understand the invention even without these detailed descriptions.

[0042] This invention provides a pre-verified authentication method and system for DoS protection at the IoT edge, such as... Figure 1As shown, it includes the following steps:

[0043] Step 1: The registration authority receives the registration request sent by the terminal device, registers the terminal device, generates an initial key and time vector corresponding to the terminal device, and calculates multiple group verification points of the terminal device within its life cycle based on the initial key.

[0044] Specifically, the terminal device sends a registration request to the registration authority, which then generates a corresponding time vector for the terminal device. The generation process involves setting the device's lifespan length to L, and the registration authority generating a time vector for each L-th time period. One device calculate Time vector at each time point The time vector contains Each element Through What was obtained For hash operation, where , It is the private key agreed upon by the registration authority and the terminal device.

[0045] Furthermore, the registration agency calculates based on the time vector Key vectors at each time point The key vector contains Each element Through Obtained.

[0046] Furthermore, the registration authority calculates the first key vector based on the generated key vector at each time point. Each terminal device Contribution value at time points The registration authority will calculate the contribution value of the terminal device at all moments in its life cycle to construct the group verification points at all moments.

[0047] Furthermore, the construction of group verification points satisfies It is a credential obtained by aggregating the contribution values ​​of each terminal device to calculate the hash value, and is ultimately used by the edge server to verify the reliability of the message.

[0048] Furthermore, the calculation formula for the group verification point shows that if the terminal device's contribution value participates in the hash calculation of the group verification point, it indicates that the terminal device is online in that state; otherwise, it is offline. Because... At any given time, not all terminal devices will necessarily send messages to the edge server simultaneously. Terminal devices that do not send messages to the edge server will be considered offline during verification, while terminal devices that send messages to the edge server will be considered online. Therefore, there are multiple situations where terminal devices are online or offline within the terminal device group. The registration agency needs to pre-calculate the group verification points of all possible online states of all end-side devices at time t.

[0049] Furthermore, the registration agency is a data processing center or computing cluster with high computing power, used for the rapid calculation of large-scale group verification points and mapping them to a dynamic time window Bloom filter before distributing them to the edge server.

[0050] Furthermore, the group verification points correspond one-to-one with multiple time intervals in the device's preset lifecycle, and within the new time interval, historical verification points are replaced by new group verification points through an update mechanism.

[0051] Step 2: The registry creates and initializes a dynamic time window Bloom filter, and the group validation points are mapped to the dynamic time window Bloom filter by the registry.

[0052] Specifically, the dynamic time window Bloom filter is created by the registry. Figure 2 The composition of a dynamic time window Bloom filter is shown, which includes multiple sub-Bloom filters, time windows, saturation counters, etc.

[0053] Furthermore, the time window in the dynamic time window Bloom filter defines the currently active sub-Bloom filters. Only active sub-Bloom filters can be mapped and matched. At the same time, setting the sliding period of the time window allows it to be updated after exceeding the range. The dynamic time window Bloom filter automatically slides the time window forward and clears all bits of expired sub-Bloom filters. By overwriting the sub-Bloom filter data under the oldest time window that has exceeded its lifespan, it optimizes storage space, thereby preventing saturation caused by the accumulation of historical data and ensuring that the system only verifies feature data within the current valid period.

[0054] Furthermore, a saturation counter is configured at the beginning of each sub-Bloom filter to monitor the number of filled bits in that row of Bloom filters. This reflects the collision risk of the corresponding sub-Bloom filter, with a larger value indicating a greater collision risk.

[0055] Furthermore, the false positive rate of the dynamic time window is specifically: the probability that the a-th sub-Bloom filter successfully intercepts a malicious request is... , This represents the false positive rate of the sub-filter itself within the time window. The probability that all sub-Bloom filters will successfully intercept simultaneously is Therefore, the probability of a false positive (false positive rate) occurring within the entire dynamic time window is: .

[0056] Furthermore, the threshold is used to compare with the saturation counter to prevent the saturation counter from exceeding the upper limit; its size determines... The value is determined based on the false positive rate formula of the dynamic time window, ensuring that it is within a safe range.

[0057] Specifically, the mapping process of the dynamic time window Bloom filter involves using multiple hash functions to map to multiple corresponding bits and setting them to 1.

[0058] Furthermore, the dynamic time window Bloom filter's behavior in mapping population validation points specifically involves selecting a sub-Bloom filter within the time window and determining whether the saturation counter has reached a set threshold: if the threshold is not reached, the population validation point will be directly mapped to that sub-Bloom filter; if the threshold is reached, a saturation counter value within the threshold range will be selected as the object for insertion. Additionally, if there is no sub-Bloom filter in the current time window that meets this condition, a new sub-Bloom filter will be added to the current time window and used as the mapping object for the population validation point.

[0059] Furthermore, the saturation counter uses a bit transition monitoring mechanism from 0 to 1. It only counts during the process of transitioning from 0 to 1, and it is used to reflect the actual amount of information growth and physical capacity status inside the filter.

[0060] Step 3: While the dynamic time window Bloom filter is being sent to the edge server, the edge server receives the authentication message sent by the terminal device and parses the timestamp, contribution value and signature data in the authentication message.

[0061] Specifically, the time vector and key vector of the terminal device are issued by the registration authority. The time vector and key vector evolve synchronously with the registration authority. At any given moment, the time and key vector obtained by the terminal device are the same as those pre-calculated by the registration authority.

[0062] Furthermore, when the terminal device sends a message at time t, it will generate a corresponding contribution value. ,in These are sub-elements of the key vector, which evolve based on the time vector. Their evolution is the same as that of the registry key and time vector. The contribution value is sent to the edge server along with the signed message.

[0063] Step 4: The edge server determines whether the timestamp of the message from the terminal device exists within the current valid time window. If it does, it calculates the aggregate hash value based on the contribution value and uses the aggregate hash value as the query key to perform a matching query in the dynamic time window Bloom filter.

[0064] Specifically, the dynamic time window Bloom filter is a pre-filtering component for edge servers. It works in conjunction with pre-calculated group verification points by the registry to quickly filter malicious DoS attack messages.

[0065] Specifically, the aggregated hash value is generated by the edge server by concatenating the contribution values ​​of multiple terminal devices and performing a hash operation. It is used as a fast index to determine whether a message is legitimate.

[0066] Specifically, the edge server includes a message receiving module, a time verification module, a fast filtering module, and a password verification module.

[0067] Furthermore, the message receiving module is used to receive authentication messages sent by the terminal device and parse the message content;

[0068] Furthermore, the time verification module is used to determine whether the timestamp in the message to be authenticated is within a valid time window;

[0069] Furthermore, the fast filtering module is used to calculate the aggregate hash value based on the contribution value and execute a matching query through a dynamic Bloom filter;

[0070] Furthermore, the cryptographic verification module is used to perform cryptographic verification on the signature data when the matching query passes, so as to complete the terminal device message authentication.

[0071] Step 5: When the query result of the dynamic time window Bloom filter is non-existent, the message to be authenticated is determined to be an illegal request and discarded; when the query result is present, cryptographic verification is performed on the signature data to complete the message authentication of the terminal device.

[0072] Specifically, the query process of a dynamic time window Bloom filter involves using multiple hash functions to map to multiple corresponding bits of the sub-Bloom filter to see if they are not zero.

[0073] Furthermore, the matching query operation of the dynamic time window Bloom filter specifically involves calculating multiple independent hash mapping indexes based on the aggregate hash value and scanning all currently active time windows. A value is considered valid if and only if all hash mapping indexes corresponding to the aggregate hash value are set to 1 in at least one active Bloom filter row.

[0074] Through the above implementation methods, the present invention introduces a hierarchical verification mechanism that combines time window verification with dynamic Bloom filters on the edge server side, which enables a large number of illegal authentication requests to be quickly filtered before cryptographic verification is performed. This significantly reduces the computational burden of the edge server in denial-of-service attack scenarios and improves the response speed to service requests from end-side devices, thereby improving the overall availability and stability of the IoT edge-end system.

[0075] In another aspect, the present invention also provides a pre-verified IoT edge-side DoS-resistant authentication system for implementing the aforementioned authentication method, comprising the following modules:

[0076] The group verification point generation module is used by the registration authority in the Internet of Things to receive registration requests sent by terminal devices, register the terminal devices, and calculate multiple group verification points of the terminal devices within their life cycle based on the initial key.

[0077] The Dynamic Time Window Bloom Filter module is used by the registry to create and initialize a dynamic time window Bloom filter, and the group validation points are mapped to the dynamic time window Bloom filter by the registry.

[0078] The pending authentication message module is used when the dynamic time window Bloom filter is sent to the edge server, and the edge server receives the pending authentication message sent by the terminal device and parses the timestamp, contribution value and signature data in the pending authentication message.

[0079] The matching query module is used by the edge server to determine whether the timestamp of the terminal device message exists within the current valid time window. If it does, the aggregate hash value is calculated based on the contribution value, and the aggregate hash value is used as the query key to perform a matching query in the dynamic time window Bloom filter.

[0080] The message authentication module is used to determine that the message to be authenticated is an illegal request when the query result of the dynamic time window Bloom filter does not exist; when the query result exists, it performs cryptographic verification on the signature data to complete the message authentication of the terminal device.

[0081] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings, but the present invention is not limited to the described embodiments. For those skilled in the art, various changes, modifications, substitutions, and variations can be made to these embodiments, including components, without departing from the principles and spirit of the present invention, and these variations still fall within the protection scope of the present invention.

[0082] This embodiment simulates a high-frequency, continuous data interaction scenario at the edge of the Internet of Things (IoT). The experimental dataset and traffic structure are as follows:

[0083] 1. Simulate a normal terminal device authentication scenario, with the data injection rate set to 100 messages per second (i.e., 100Hz), and continuously updated in 1-second time steps.

[0084] 2. Within a 50-second extreme value test window, a total of 100,000 valid and legal data entries and 100,000 forged and invalid verification data entries were injected.

[0085] To comprehensively evaluate the dynamic adaptability and long-term filtering capabilities of this invention, the experiment selected the following core evaluation metrics and introduced existing mainstream static Bloom filter standards: Standard_BF, Robust_BF, Enhanced_BF, and Multidimensional_Bloom (MBF) as comparative schemes. Simultaneously, to comprehensively evaluate the pre-filtering mechanism of this invention, the experiment tested its effectiveness against DoS attacks in a real physical environment (using an Orange Pi 5 as the edge server and a RadioLink PIX6 as the flight control node).

[0086] 1. False positive rate: This measures the probability that a filter will mistakenly identify an illegal / malicious message as a legitimate message. It is a core indicator for assessing system security.

[0087] 2. System resolution frequency (Hz): This measures whether the edge node can maintain the real-time data processing rate required by the flight control system when it is under attack (the benchmark is 10Hz). It is a core indicator for evaluating the system's resilience and availability.

[0088] 3. Attack and defense computation cost (time / µs): Compare the time it takes for an attacker to construct a single malicious packet with the time it takes for the verifier to identify and discard the packet to evaluate whether the system effectively defends against DoS attacks.

[0089] Figure 3 Experiments show that in extreme tests involving processing 100,000 legitimate data entries and 100,000 illegitimate injection data entries simultaneously within 50 seconds, the dynamic time window Bloom filter of this invention only generated 2 to 8 misclassified (false positive) messages. In contrast, the Robust_BF scheme missed as many as 29,390 malicious messages (an error rate of nearly 30%), while Standard_BF and E-BF both had over 6,000 misclassified messages.

[0090] Figure 4Experiments show that during a 100-second system operation monitoring period, the resolution frequency of the flight control attitude packet remained stably at a baseline level of 10 Hz during the normal operation period from 0 to 20 seconds. When a high-frequency DoS burst attack (approximately 15,700 packets / second) occurred from the 20th to the 30th second, the resolution frequency under the architecture of this invention still fluctuated around 10 Hz, and the entire system did not experience any substantial performance degradation or packet processing stagnation. After the attack ended (from the 30th to the 100th second), the system continued to operate stably.

[0091] Static Bloom filters, lacking a discard mechanism, inevitably lead to capacity saturation and defense failure due to the infinite accumulation of historical data. Experimental data strongly demonstrates that the sliding window mechanism employed in this invention can maintain a perfect dynamic balance between data insertion and updating, ensuring that the false positive rate is always locked within a safe boundary during long-term operation, completely eliminating cumulative saturation or performance degradation.

[0092] The results show that the pre-filtering mechanism of this invention can effectively ensure the high availability of the edge control system under extreme attacks. During a continuous high-frequency attack lasting up to 10 seconds, the resolution frequency of the flight control data remained stable at a baseline of 10Hz without significant fluctuations.

Claims

1. A pre-verified authentication method for DoS protection at the IoT edge, characterized in that, Includes the following steps: S1. The registration authority in the Internet of Things receives the registration request sent by the terminal device, registers the terminal device, and calculates multiple group verification points of the terminal device within its life cycle based on the initial key; S2. The registry creates and initializes a dynamic time window Bloom filter, and the group validation points are mapped to the dynamic time window Bloom filter by the registry; The dynamic time window Bloom filter is created by the registry and consists of multiple sub-Bloom filters, specifically: S21. In a dynamic time window Bloom filter, the time window defines the currently active sub-Bloom filter, and the time window sliding period is set so that the currently active sub-Bloom filter is updated after exceeding the range. S22. The saturation counter in the dynamic time window Bloom filter is configured at the beginning of each sub-Bloom filter to monitor the filled bits of the sub-Bloom filter and reflect the collision risk of the corresponding sub-Bloom filter. The larger the value, the greater the collision risk. S23. The threshold in the dynamic time window Bloom filter is compared with the saturation counter to prevent the saturation counter from exceeding the upper limit; S3. While the dynamic time window Bloom filter is being sent to the edge server, the edge server receives the authentication message sent by the terminal device and parses the timestamp, contribution value and signature data in the authentication message. S4. The edge server determines whether the timestamp of the terminal device message exists within the current valid time window. If it does, it calculates the aggregate hash value based on the contribution value and uses the aggregate hash value as the query key to perform a matching query in the dynamic time window Bloom filter. S5. When the query result of the dynamic time window Bloom filter is non-existent, the message to be authenticated is an illegal request; when the query result is present, cryptographic verification is performed on the signature data to complete the message authentication of the terminal device.

2. The pre-verified IoT edge-side DoS-resistant authentication method according to claim 1, characterized in that, The registration of terminal devices by the registration authority includes generating an initial key vector and a time vector, setting a time period L, evolving the key vector and time vector within each time period, and finally generating a group verification point.

3. The pre-verified IoT edge-side DoS-resistant authentication method according to claim 2, characterized in that, The process of generating group verification points is as follows: S11. For each period of L, the first... Terminal devices calculate Time vector at each time point The time vector contains Each element Through get, For hash operation, where , It is the private key agreed upon by the trusted institution and the terminal device; S12. Calculate based on the time vector Key vectors at each time point The key vector contains Each element Through get; S13. Construct based on the key vector registration authority Equipment in Contribution value at time points ; S14. Generate group verification points based on the contribution values ​​of all terminal devices. .

4. The pre-verified IoT edge-side DoS-resistant authentication method according to claim 3, characterized in that, The group verification points correspond one-to-one with multiple time intervals in the preset life cycle of the terminal device, and at the new time point, the historical group verification points are replaced by the new group verification points.

5. The pre-verified IoT edge-side DoS-resistant authentication method according to claim 4, characterized in that, The time window is a sliding time window, which is dynamically updated by the edge server according to the current time to detect the timeliness of authentication messages.

6. The pre-verified IoT edge-side DoS-resistant authentication method according to claim 5, characterized in that, The process of mapping the group verification points to the dynamic time window Bloom filter by the registration agency is as follows: select a sub-Bloom filter within the time window, determine whether the saturation counter has reached the set threshold, and if the threshold is reached, select a sub-Bloom filter whose saturation counter value is within the threshold range as the object to map the group verification points; if there is no sub-Bloom filter that meets this condition in the current time window, then add a new sub-Bloom filter to the current time window. The saturation counter uses a bit transition monitoring mechanism from 0 to 1, and only this process from 0 to 1 is counted; it is used to reflect the actual amount of information growth and physical capacity status inside the sub-Bloom filter.

7. The pre-verified IoT edge-side DoS-resistant authentication method according to claim 6, characterized in that, The dynamic time window Bloom filter executes a sliding window mechanism at fixed time intervals. Specifically, as time progresses, the time window is automatically slid forward and all bits of expired sub-Bloom filters are cleared. Storage space is optimized by overwriting the sub-Bloom filter data under the oldest time window that has exceeded its lifespan, and only data within the current valid period is verified.

8. The pre-verified IoT edge-side DoS-resistant authentication method according to claim 7, characterized in that, The aggregated hash value is generated by the edge server by concatenating the contribution values ​​of multiple terminal devices and performing a hash operation. It is used as a fast index to determine whether a message is legitimate.

9. The pre-verified IoT edge-side DoS-resistant authentication method according to claim 8, characterized in that, The matching query operation of the dynamic time window Bloom filter is as follows: calculate multiple independent hash mapping indexes based on the aggregate hash value, and scan all currently active time windows; determine that the aggregate hash value exists and is valid if and only if all hash mapping indexes corresponding to the aggregate hash value are set to 1 in at least one active Bloom filter row.

10. A pre-verified IoT edge-side DoS-resistant authentication system, used to implement the authentication method according to any one of claims 1 to 9, characterized in that, Includes the following modules: The group verification point generation module is used by the registration authority in the Internet of Things to receive registration requests sent by terminal devices, register the terminal devices, and calculate multiple group verification points of the terminal devices within their life cycle based on the initial key. The Dynamic Time Window Bloom Filter module is used by the registry to create and initialize a dynamic time window Bloom filter, and the group validation points are mapped to the dynamic time window Bloom filter by the registry. The pending authentication message module is used so that when the dynamic time window Bloom filter is sent to the edge server, the edge server receives the pending authentication message sent by the terminal device and parses the timestamp, contribution value and signature data in the pending authentication message. The matching query module is used by the server to determine whether the timestamp of the terminal device message exists in the current valid time window. If it exists, the aggregate hash value is calculated based on the contribution value, and the aggregate hash value is used as the query key to perform a matching query in the dynamic time window Bloom filter. The message authentication module is used to determine that the message to be authenticated is an illegal request when the query result of the dynamic time window Bloom filter does not exist; when the query result exists, it performs cryptographic verification on the signature data to complete the message authentication of the terminal device.

Images