A secondary security device identity authentication and anti-cloning system

Abstract

The application discloses a secondary security equipment identity authentication and anti-cloning system and belongs to the technical application field of secondary security system technology, comprising a secondary security terminal device, an authentication management node, a trusted device database and a neighbor cooperation node set; the authentication management node comprises a signal collection preprocessing module, a radio frequency fingerprint extraction module and an authentication decision engine module; an identity authentication control process is executed and comprises a device registration stage and an identity authentication stage; the application is economical and practical, can realize the combination of a double-layer authentication mechanism, that is, the combination of radio frequency fingerprint identification at a physical layer and distributed consensus verification at a network layer, can construct a complete authentication and anti-cloning system from device physical feature identification to network group cooperation verification, and can eliminate the threat of signal interception, tampering and replay; and the application solves the problem that existing authentication credentials and device physical hardware carriers are separated, an authentication process cannot be in-depth to a physical layer, and the risk of physical cloning and signal forgery cannot be fundamentally eliminated.

Description

Technical Field

[0001] This invention relates to the field of secondary security system technology application technology, specifically a secondary security device identity authentication and anti-cloning system. Background Technology

[0002] In secondary security systems, the authenticity and uniqueness of device identities are the cornerstones of ensuring the overall system's security and trustworthiness. Existing technologies primarily rely on security mechanisms deployed at the network protocol or application layer, such as pre-shared keys, MAC address filtering, or public key infrastructure authentication. These methods have inherent security flaws:

[0003] 1) Theft of keys and credentials: Keys or digital certificates are stored as digital information in the device. Once an attacker gains control of the device through physical contact or network intrusion, they can extract these authentication credentials. Using the stolen credentials, the attacker can perfectly impersonate a legitimate device and perform malicious operations on the system, which the existing authentication mechanism cannot distinguish.

[0004] 2) The non-binding of identity and physical entity: Traditional authentication mechanisms verify the correctness of digital identity, rather than the uniqueness of the physical device itself. Cloned devices can be manufactured and burned with firmware, MAC address and key that are exactly the same as the genuine device. From the perspective of network protocol, cloned devices cannot be distinguished from genuine devices, which constitutes a serious physical security threat.

[0005] 3) Vulnerability to man-in-the-middle attacks: Attackers can intercept and replay communication signals from legitimate devices through man-in-the-middle attacks. Even if the signal content is encrypted, replay attacks may still lead to incorrect system status judgments or resource consumption. Existing methods lack the ability to verify the physical source of the signal.

[0006] The root cause of these defects is that the authentication credentials are separate from the physical hardware of the device, and the authentication process fails to penetrate to the physical layer, thus failing to fundamentally eliminate the risks of physical cloning and signal forgery. Summary of the Invention

[0007] The purpose of this invention is to provide a secondary security device identity authentication and anti-cloning system, which can utilize a two-layer authentication mechanism, namely, combining physical layer radio frequency fingerprint recognition with network layer distributed consensus verification, to construct a complete authentication and anti-cloning system from device physical feature recognition to network group collaborative verification, thus solving the problems mentioned in the background art.

[0008] To achieve the above objectives, the present invention provides the following technical solution:

[0009] A secondary security device authentication and anti-cloning system includes:

[0010] The secondary safety terminal equipment is deployed on intelligent safety devices at the power site. Each terminal equipment has a built-in wireless communication module, which is the basis for generating radio frequency fingerprints.

[0011] An authentication management node is used to execute the identity authentication control process; it can be a wireless communication gateway, an aggregation node, or a dedicated authentication server.

[0012] The trusted device database is deployed in the authentication management node or backend server. The database securely stores the digital identity of all registered legitimate devices and their corresponding radio frequency fingerprint reference templates.

[0013] The set of neighboring cooperative nodes is a set of secondary security terminal devices that are within the communication range of the device to be authenticated in the network topology and have been authenticated as trusted.

[0014] Furthermore, the authentication management node includes:

[0015] The signal acquisition and preprocessing module is used to receive wireless signals from the terminal device to be authenticated, and to perform digital sampling and basic signal processing on them;

[0016] The radio frequency fingerprint extraction module is used to extract radio frequency fingerprint feature vectors that can characterize the uniqueness of hardware from the preprocessed signal.

[0017] The authentication decision engine module is used to perform radio frequency fingerprint matching, initiate and process distributed consensus verification results, and make the final authentication decision based on the dual verification results.

[0018] Furthermore, the identity authentication control process includes a device registration phase and an identity authentication phase;

[0019] The device registration phase is used to extract the radio frequency fingerprint of the authentication management node and establish a trusted device database.

[0020] The identity authentication stage is used to make an authentication determination by using the authentication decision engine module and combining the similarity score of physical layer authentication and the aggregate score of network layer consensus.

[0021] Furthermore, the device registration stage includes the following steps:

[0022] S101: Place a new, reliable secondary safety terminal device in an electromagnetically pure and physically safe environment;

[0023] S102: The authentication management node sends an excitation signal to the terminal device, and the terminal device responds and makes multiple wireless transmissions;

[0024] S103: The RF fingerprint extraction module of the authentication management node captures and processes the signal, extracts stable and highly distinguishable RF fingerprint features, calculates their mean and variance, and generates an RF fingerprint reference template for the terminal device.

[0025] S104: Bind the digital identity of the terminal device to the generated radio frequency fingerprint reference template and store it in the trusted device database.

[0026] Furthermore, the identity authentication phase performs the following steps in the actual operating environment:

[0027] S201: The device to be authenticated, with an identity ID, initiates a communication or network access request to the authentication management node;

[0028] S202: The signal acquisition and preprocessing module of the authentication management node captures the wireless signal of this communication, and the radio frequency fingerprint extraction module extracts the radio frequency fingerprint feature vector from the signal in real time.

[0029] S203: The authentication decision engine module retrieves the corresponding radio frequency fingerprint reference template from the trusted device database based on the ID declared by the device to be authenticated, and calculates the similarity score between the real-time fingerprint and the radio frequency fingerprint reference template through an algorithm.

[0030] S204: If the physical layer authentication passes the initial threshold judgment, the authentication decision engine module immediately initiates a consensus query request to the set of neighboring cooperative nodes of the ID in the network topology;

[0031] S205: The neighboring cooperative node verifies the validity of the signal received from the device to be authenticated, and sends the verification result or trust vote back to the authentication management node;

[0032] S206: The authentication decision engine module combines the similarity score of physical layer authentication and the aggregate score of network layer consensus, and makes a final judgment on whether authentication passes or fails based on a two-factor decision mechanism. Devices that fail authentication will be isolated or marked as illegal.

[0033] Furthermore, in S202, when the radio frequency fingerprint extraction module extracts the radio frequency fingerprint feature vector from the signal in real time, each wireless communication chip will produce slight physical differences during the manufacturing process. These differences will manifest as specific distortion modes during signal transmission. The radio frequency fingerprint extraction module constructs the unique feature vector of the device by accurately measuring these distortions.

[0034] Among them, the instantaneous radio frequency fingerprint feature vector of the node device It includes five key dimensions:

[0035] ;

[0036] Wherein, the superscript T denotes matrix transpose, and the instantaneous radio frequency fingerprint feature vector is represented in column vector form;

[0037] The extraction of each feature component corresponds to a specific hardware defect:

[0038] Carrier frequency offset This reflects the frequency accuracy of the device's crystal oscillator; due to slight differences in crystal cutting and packaging, the actual carrier frequency of each device varies slightly.

[0039] The carrier frequency offset Extracted through autocorrelation calculation, the formula is as follows:

[0040] ;

[0041] in, , indicating the sampling period, typically 50ns; This represents the estimated sample size, which is usually set to 1024 to ensure statistical stability. This represents the autocorrelation delay length, and its value is an integer multiple of the symbol period; express The complex conjugate; This represents the baseband complex signal after frequency compensation. Indicates the sampling point index;

[0042] In the formula, arg(·) represents the argument of a complex number, which is used to characterize the phase information of the relevant results;

[0043] The device to be authenticated sends a network access request signal to the authentication management node. The signal acquisition and preprocessing module of the authentication management node immediately starts a high-speed analog-to-digital converter at a sampling rate of [missing information]. The radio frequency signals of the air interface are captured in real time, and the clean baseband signals that reflect the hardware characteristics of the device are extracted from the raw signals full of noise and interference.

[0044] The signal acquisition and preprocessing module first performs digital sampling on the received radio frequency signal to obtain a discrete-time signal sequence. Due to frequency offset and phase error in the real environment, directly processing the raw signal will lead to feature extraction distortion. Therefore, the signal acquisition and preprocessing module executes a carrier frequency recovery algorithm to obtain the baseband complex signal using the following formula:

[0045]

[0046] in: This represents the received radio frequency signal sampling sequence. For sampling point index; This represents the carrier frequency estimate obtained through the maximum likelihood estimation algorithm; This indicates the sampling rate, in Hz, with a typical value of 20MHz. This represents the baseband complex signal after frequency compensation.

[0047] Sampling frequency offset This characteristic stems from the inaccuracy of the analog-to-digital converter clock; even chips produced in the same batch can have ppm-level differences in their ADC clocks.

[0048] The sampling frequency offset The calculation formula is as follows:

[0049] ;

[0050] in, This represents the phase increment between adjacent symbols measured via pilot symbols; The number of sampling points representing the symbol interval is determined by the modulation scheme; Indicates the symbol period, which is related to the data transmission rate;

[0051] Extraction of I / Q imbalance characteristics: Due to differences in device matching, the I and Q paths of the RF front end will have gain and phase imbalance.

[0052] The gain imbalance The formula for calculating the power ratio is as follows:

[0053] ;

[0054] Phase imbalance The orthogonality deviation metric is calculated using the following formula:

[0055] ;

[0056] in, Expressed as the standard deviation of the I-channel and Q-channel signals; This represents the time average over the length of a data packet; Represents the in-phase and quadrature components of the baseband signal;

[0057] Error vector magnitude EVM is a comprehensive indicator that reflects the cumulative effect of various hardware defects, including power amplifier nonlinearity and phase noise.

[0058] The error vector amplitude The calculation formula is as follows:

[0059] ;

[0060] in, Indicates the first One received and equalized symbol; This represents the ideal constellation points mapped based on the demodulation results; This indicates the total number of symbols in the data packet.

[0061] Furthermore, in step S203, the authentication decision engine module calculates the weighted Mahalanobis distance between the real-time fingerprint and the RF fingerprint reference template to obtain the physical layer similarity score, the calculation formula of which is as follows:

[0062] ;

[0063] in, This represents the real-time feature vector during actual device authentication, used to compare with the RF fingerprint reference template. Perform a comparison and calculate the similarity. , which represents the weight matrix formed by the inverse of the covariance matrix, automatically assigning higher weights to stable features; , representing the physical layer similarity score, exhibits an exponentially decaying distribution; when At this point, the physical layer authentication is initially passed, and the system enters the next stage of verification, the threshold of which is... It is usually set to 0.85;

[0064] The authentication decision engine module retrieves the radio frequency fingerprint reference template corresponding to the declared ID of the device to be authenticated from the trusted device database. RF fingerprint reference template The equipment registration process is conducted in a shielded room environment. QUOTE The values ​​were obtained by taking the average of several independent measurements. The calculation formula is as follows:

[0065] ;

[0066] in, This is the feature vector of the m-th measurement during device registration, used to calculate the average value to obtain the RF fingerprint reference template. .

[0067] Furthermore, in S205, each neighbor node that receives the consensus request... Each becomes an independent validator, listening for signals from the device to be authenticated. The response signal is received, and the local verification function is executed. This function takes into account multiple physical layer and link layer metrics:

[0068] ;

[0069] in, This indicates the signal strength received by node $j$, in dBm. It represents the signal-to-noise ratio, reflecting signal quality; Indicates data packet reception rate, and measures link reliability; Indicates response latency, used to detect relay attacks;

[0070] The verification function employs a weighted scoring mechanism:

[0071] ;

[0072] in, This represents the sigmoid function, which maps RSSI to the interval [0, 1]. This indicates the signal strength threshold; a value below this is considered an abnormal device distance. Represents the weighting coefficients, satisfying ; This represents the time delay normalization constant;

[0073] Each neighbor node will calculate the trust ticket. After encryption, the data is sent back to the authentication management node;

[0074] After collecting votes from all neighboring nodes, the authentication decision engine module executes the Byzantine fault-tolerant aggregation algorithm, which uses a weighted median instead of a simple average:

[0075]

[0076] in, This indicates that the authentication management node uses the votes from its neighboring nodes. and their corresponding weights The network layer distributed consensus authentication score is obtained by weighted median aggregation;

[0077] WeightedMedian(·) represents the weighted median operator, which is the vote value that, after sorting by the vote values ​​and weights of each neighboring node, first reaches 50% of the total weight.

[0078] Among them, weight Based on node historical reputation The formula for calculating the physical distance factor is as follows:

[0079] ;

[0080] in, , representing a node Historical credibility is obtained through long-term behavioral assessment; Represents the distance attenuation constant;

[0081] in, To determine the equipment to be certified The set of neighbors is determined according to the following principles:

[0082] ;

[0083] in, Indicates equipment and The physical distance or number of hops between them; Indicates the effective communication radius; Indicate neighboring nodes; Represents a node The current trust status;

[0084] In S206, the two-factor decision mechanism involves the authentication decision engine module employing a strict dual-threshold decision based on the verification results from both the physical and network layers.

[0085] ;

[0086] in, , representing the physical layer authentication threshold; , representing the network layer consensus threshold;

[0087] In the actual operating environment, the identity authentication stage also includes an adaptive threshold adjustment mechanism to cope with feature drift caused by environmental changes and equipment aging. The system continuously monitors the authentication score distribution of authenticated legitimate devices in the background and dynamically updates the threshold using the following formula:

[0088] ;

[0089] ;

[0090] When the average authentication score of legitimate devices within the current time window is lower than the target average score, it indicates that the overall score may have dropped due to device aging or environmental changes. In this case, the adaptive mechanism lowers the authentication threshold. Conversely, when the average authentication score is higher than the target average score, the adaptive mechanism appropriately raises the authentication threshold.

[0091] in, Indicates the first The authentication threshold for each time window; Indicates the first The average authentication score of legitimate devices within a time window; This represents the target average score, typically set to 0.95. This represents the learning rate, which controls the speed at which the threshold is adjusted; a typical value is 0.01.

[0092] The adaptive threshold adjustment mechanism is used to ensure that the system maintains high accuracy and low false alarm rate during long-term operation.

[0093] Furthermore, before the aforementioned authentication decision engine module calculates the weighted Mahalanobis distance between the real-time fingerprint and the RF fingerprint reference template, it also performs an RF feature thermal drift compensation step:

[0094] Obtain the CPU load rate, network transmission rate, and virtual temperature accumulation of the device to be authenticated at the current moment;

[0095] Based on the CPU load rate, the network transmission rate, and the accumulated virtual temperature, the equivalent virtual temperature increment at the current moment is calculated using the following formula:

[0096] ;

[0097] In the formula, Represents the current sampling time; Represents the current sampling time The equivalent virtual temperature increment; Represents the current sampling time Central processing unit load rate; Represents the current sampling time Network transmission rate; Represents the previous sampling time; Represents the previous sampling time The virtual temperature accumulation; Represents the processor heat mapping coefficient; Represents the network transmit / receive heat mapping coefficient; Represents the heat dissipation loss coefficient of the equipment;

[0098] Next, based on the calculated equivalent virtual temperature increment, the feature compensation vector is calculated, and the corresponding calculation formula is as follows:

[0099] ;

[0100] In the formula, Represents the feature compensation vector; The feature drift sensitivity vector, which is pre-stored in the trusted device database, represents the dimension of each element within the feature drift sensitivity vector, which is the dimension of the corresponding RF fingerprint feature component divided by degrees Celsius. Finally, based on the feature compensation vector, the real-time feature vector is reverse-drift corrected to obtain the corrected real-time feature vector. The corresponding calculation formula is as follows:

[0101] ;

[0102] In the formula, This represents the corrected real-time feature vector; This represents the uncorrected real-time feature vector;

[0103] The authentication decision engine module replaces the real-time feature vector with the corrected real-time feature vector and substitutes it into the calculation of the weighted Mahalanobis distance to eliminate feature distortion caused by transient heating under high load of the device.

[0104] Furthermore, to address the security risk of compromised neighbor nodes using historically high reputation to launch slow pollution attacks, the aforementioned authentication decision engine module, after collecting votes from all collaborating neighbor nodes and before executing the aggregation algorithm, also performs a real-time trust state downgrading control step:

[0105] Obtain the heartbeat frequency fluctuation rate and requested resource classification information of all nodes in the neighboring cooperative node set in the most recent communication cycles.

[0106] Based on the heartbeat interaction frequency fluctuation rate and the requested resource classification information, the isolated forest anomaly detection model is used to perform real-time behavior sequence pattern matching on all nodes in the neighboring cooperative node set to obtain the real-time behavior variation evaluation value of each node.

[0107] Determine whether there exists a specific neighbor node such that the historical reputation of the specific neighbor node is higher than a preset reputation threshold, and the real-time behavior variation evaluation value of the specific neighbor node is higher than a preset variation threshold.

[0108] If the specific neighbor node exists, it is determined that the specific neighbor node is in a sudden compromise state, thereby activating the consensus pollution circuit breaker prevention strategy.

[0109] The consensus contamination circuit breaker prevention strategy forcibly invalidates the trust votes generated by the specific neighbor node and removes the specific neighbor node from the set of neighbor cooperating nodes, forming a purified set of cooperating nodes.

[0110] Finally, the authentication decision engine module only aggregates the votes of each node within the purified collaborative node set to execute the aggregation algorithm, in order to eliminate consensus verification bias caused by historical reputation lag.

[0111] Compared with the prior art, the beneficial effects of the present invention are:

[0112] This invention strongly binds device identity to the physical micro-features of the wireless communication module. It utilizes the micro-physical differences generated during the manufacturing process of the wireless communication module—the radio frequency fingerprint—as a hardware-level identity card for the device. Combined with distributed consensus verification from neighboring nodes, it constructs a defense-in-depth authentication system from the physical layer to the network layer. Even if an attacker obtains all the software and configuration information of the device, they cannot create a cloned device with the same radio frequency fingerprint. Authentication is determined based on the authentication decision engine module, combining the similarity score of physical layer authentication and the aggregate score of network layer consensus. Through the organic combination of physical layer hardware fingerprint authentication and network layer neighbor consensus verification, a dual security barrier is constructed. Attackers must simultaneously possess the ability to accurately simulate the target device's radio frequency characteristics and deceive the entire neighboring network, resulting in an exponentially increasing attack difficulty. Radio frequency fingerprint verification ensures that the signal truly originates from the claimed hardware device. Combined with a timestamp mechanism, it completely eliminates the threats of signal interception, tampering, and replay. Furthermore, each authentication is an independent, real-time, two-factor verification process, aligning with the zero-trust principle of never trusting and always verifying, providing security guarantees for secondary security systems of critical infrastructure. Attached Figure Description

[0113] Figure 1 This is an architecture diagram of the secondary security device authentication system based on radio frequency fingerprinting and distributed consensus of the present invention;

[0114] Figure 2 This is a flowchart of the registration phase of the secondary security device based on radio frequency fingerprinting and distributed consensus according to the present invention.

[0115] Figure 3 This is a flowchart of the authentication process for secondary security devices based on radio frequency fingerprinting and distributed consensus according to the present invention.

[0116] Figure 4 This is a schematic diagram illustrating the principle of radio frequency fingerprint feature extraction according to the present invention. Detailed Implementation

[0117] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0118] To address the issue that existing authentication credentials are separated from the physical hardware of the device, and the authentication process fails to penetrate to the physical layer, thus failing to fundamentally eliminate the risks of physical cloning and signal forgery, please refer to [link to relevant documentation]. Figures 1-4 This embodiment provides the following technical solution:

[0119] Example 1

[0120] A secondary security device authentication and anti-cloning system includes:

[0121] The secondary safety terminal equipment is deployed on intelligent safety devices at the power site. Each terminal equipment has a built-in wireless communication module, which is the basis for generating radio frequency fingerprints.

[0122] An authentication management node is used to execute the identity authentication control process and can be a wireless communication gateway, an aggregation node, or a dedicated authentication server.

[0123] The trusted device database is deployed in the authentication management node or backend server. The database securely stores the digital identity of all registered legitimate devices and their corresponding radio frequency fingerprint reference templates.

[0124] The set of neighboring cooperative nodes is a set of secondary security terminal devices that are within the communication range of the device to be authenticated in the network topology and have been authenticated as trusted.

[0125] In this embodiment, the authentication management node includes:

[0126] The signal acquisition and preprocessing module is responsible for receiving wireless signals from the terminal device to be authenticated and performing digital sampling and basic signal processing on them.

[0127] The radio frequency fingerprint extraction module is responsible for extracting radio frequency fingerprint feature vectors that can characterize the uniqueness of the hardware from the preprocessed signal.

[0128] The authentication decision engine module is the core computing unit, responsible for performing radio frequency fingerprint matching, initiating and processing distributed consensus verification results, and making the final authentication decision based on the dual verification results.

[0129] In this embodiment, the identity authentication control process includes a device registration phase and an identity authentication phase;

[0130] The device registration stage is used to extract the radio frequency fingerprint of the authentication management node and establish a trusted device database.

[0131] In this embodiment, the device registration stage includes the following steps:

[0132] S101: Place a new, reliable secondary safety terminal device in an electromagnetically pure and physically safe environment;

[0133] S102: The authentication management node sends an excitation signal to the terminal device, and the terminal device responds and makes multiple wireless transmissions;

[0134] S103: The RF fingerprint extraction module of the authentication management node captures and processes the signal, extracts stable and highly distinguishable RF fingerprint features, calculates their mean and variance, and generates an RF fingerprint reference template for the terminal device.

[0135] S104: Bind the digital identity of the terminal device to the generated radio frequency fingerprint reference template and store it in the trusted device database.

[0136] The identity authentication stage is used to make an authentication determination by using the authentication decision engine module and combining the similarity score of physical layer authentication and the aggregate score of network layer consensus.

[0137] In this embodiment, the identity authentication phase performs the following steps in a real operating environment:

[0138] S201: The device to be authenticated, with an identity ID, initiates a communication or network access request to the authentication management node;

[0139] S202: The signal acquisition and preprocessing module of the authentication management node captures the wireless signal of this communication, and the radio frequency fingerprint extraction module extracts the radio frequency fingerprint feature vector from the signal in real time.

[0140] S203: The authentication decision engine module retrieves the corresponding radio frequency fingerprint reference template from the trusted device database based on the ID declared by the device to be authenticated, and calculates the similarity score between the real-time fingerprint and the radio frequency fingerprint reference template through an algorithm.

[0141] S204: If the physical layer authentication passes the initial threshold judgment, the authentication decision engine module immediately initiates a consensus query request to the set of neighboring cooperative nodes of the ID in the network topology;

[0142] S205: The neighboring cooperative node verifies the validity of the signal received from the device to be authenticated, and sends the verification result or trust vote back to the authentication management node;

[0143] S206: The authentication decision engine module combines the similarity score of physical layer authentication and the aggregate score of network layer consensus, and makes a final judgment on whether authentication passes or fails based on a two-factor decision mechanism. Devices that fail authentication will be isolated or marked as illegal.

[0144] Example 2

[0145] The core of this embodiment lies in its innovative two-layer authentication mechanism, which combines physical layer radio frequency fingerprint recognition with network layer distributed consensus verification. Its working principle in actual operation is as follows:

[0146] 1) Hardware identification principle based on radio frequency fingerprint:

[0147] This principle constitutes the first line of defense in this embodiment, corresponding to S202 and S203 in the identity authentication stage of the operation process. When a secondary security terminal device attempts to access the network, each wireless signal it emits carries the unique hardware signature of the terminal device.

[0148] (a) Implementation mechanism of signal sampling and preprocessing:

[0149] In operation procedure S202, the device to be authenticated sends a network access request signal to the authentication management node. At this time, the signal acquisition and preprocessing module of the authentication management node immediately starts the high-speed analog-to-digital converter to achieve a sampling rate of [missing information]. The module performs real-time acquisition of radio frequency signals from the air interface. Its core task is to extract clean baseband signals that reflect the hardware characteristics of the device from the raw signals that are full of noise and interference.

[0150] The signal acquisition and preprocessing module first performs digital sampling on the received radio frequency signal to obtain a discrete-time signal sequence. Due to frequency offset and phase error in the real environment, directly processing the raw signal will lead to feature extraction distortion. Therefore, the signal acquisition and preprocessing module executes a carrier frequency recovery algorithm to obtain the baseband complex signal using the following formula:

[0151] ;

[0152] in, This represents the received radio frequency signal sampling sequence. For sampling point index; This represents the carrier frequency estimate obtained through the maximum likelihood estimation algorithm; This indicates the sampling rate, in Hz, with a typical value of 20MHz. This represents the baseband complex signal after frequency compensation.

[0153] This preprocessing process ensures the accuracy of subsequent feature extraction, laying the signal foundation for hardware identity recognition.

[0154] (b) The underlying mechanism of radio frequency fingerprint feature extraction:

[0155] After preprocessing, the RF fingerprint extraction module takes over the signal processing flow. The design concept of this module is that each wireless communication chip will produce tiny physical differences during the manufacturing process. These differences will manifest as specific distortion modes during signal transmission. The RF fingerprint extraction module constructs a unique feature vector of the device by accurately measuring these distortions.

[0156] Instantaneous radio frequency fingerprint feature vector of node device It includes five key dimensions:

[0157] ;

[0158] The extraction of each feature component corresponds to a specific hardware defect:

[0159] Carrier frequency offset Physical meaning and calculation: This feature reflects the frequency accuracy of the device's crystal oscillator; due to slight differences in crystal cutting and packaging, the actual carrier frequency of each device is slightly different. It is extracted through autocorrelation calculation, and the formula is as follows:

[0160] ;

[0161] in, , indicating the sampling period, typically 50ns; This represents the estimated sample size, which is usually set to 1024 to ensure statistical stability. This represents the autocorrelation delay length, and its value is an integer multiple of the symbol period; express The complex conjugate; This represents the baseband complex signal after frequency compensation. Indicates the sampling point index;

[0162] Sampling frequency offset Hardware correlation: This characteristic stems from the inaccuracy of the analog-to-digital converter (ADC) clock; even chips produced in the same batch can have ppm-level differences in their ADC clocks.

[0163] The sampling frequency offset The calculation formula is as follows:

[0164] ;

[0165] in, This represents the phase increment between adjacent symbols measured via pilot symbols; The number of sampling points representing the symbol interval is determined by the modulation scheme; Indicates the symbol period, which is related to the data transmission rate;

[0166] Extraction of I / Q imbalance characteristics: Due to differences in device matching, the I and Q paths of the RF front-end will experience gain and phase imbalances. The formula for calculating the power ratio is as follows:

[0167] ;

[0168] Phase imbalance The orthogonality deviation metric is calculated using the following formula:

[0169] ;

[0170] in, Expressed as the standard deviation of the I-channel and Q-channel signals; This represents the time average over the length of a data packet; Represents the in-phase and quadrature components of the baseband signal;

[0171] Error vector magnitude Comprehensive characterization: EVM is a comprehensive indicator that reflects the cumulative effect of various hardware defects such as nonlinearity and phase noise in a power amplifier.

[0172] The error vector amplitude The calculation formula is as follows:

[0173] ;

[0174] in, Indicates the first One received and equalized symbol; This represents the ideal constellation points mapped based on the demodulation results; Indicates the total number of symbols in the data packet;

[0175] (c) RF fingerprint matching and physical layer authentication decision;

[0176] After feature extraction is completed, the core step of the operation process S203 begins. The authentication decision engine module first retrieves the RF fingerprint reference template corresponding to the declared ID of the device to be authenticated from the trusted device database. This template is used during the device registration phase, conducted in a shielded room environment. Second (usually) The values ​​were obtained by independent measurement and averaging.

[0177] ;

[0178] in, This is the feature vector of the m-th measurement during device registration, used to calculate the average value to obtain the RF fingerprint reference template. ;

[0179] In addition, the database also stores the covariance matrix of each feature component. It is used to measure the stability of a feature.

[0180] The authentication decision engine module calculates the weighted Mahalanobis distance between the real-time fingerprint and the RF fingerprint reference template to obtain the physical layer similarity score. The calculation formula is as follows:

[0181] ;

[0182] in, This represents the real-time feature vector during actual device authentication, used to compare with the RF fingerprint reference template. Perform a comparison and calculate the similarity. , which represents the weight matrix formed by the inverse of the covariance matrix, automatically assigning higher weights to stable features; , representing the physical layer similarity score, exhibits an exponentially decaying distribution; when At this point, the physical layer authentication is initially passed, and the system enters the next stage of verification, the threshold of which is... It is usually set to 0.85.

[0183] 2) Cross-validation principle based on distributed consensus:

[0184] Physical layer authentication only verifies the hardware source of the signal, but it cannot defend against precise simulation attacks performed by advanced attackers using signal generators. Therefore, this embodiment introduces a second line of defense, namely distributed consensus verification, corresponding to S204 and S205 of the operation process.

[0185] (a) Dynamic construction and request initiation of consensus network:

[0186] In S204, the authentication decision engine module does not immediately declare authentication successful, but instead initiates a more rigorous verification process. The authentication decision engine module first queries the network topology database to determine the device to be authenticated. Neighbor set The determination of this set follows these principles:

[0187] ;

[0188] in, Indicates equipment and The physical distance or number of hops between them; Indicates the effective communication radius; Indicate neighboring nodes; Represents a node The current trust status;

[0189] The authentication management node sends a consensus request message to each neighbor node in the set. The message contains the claim ID of the device to be authenticated and a random challenge value. .

[0190] (b) Independent verification process of neighboring nodes:

[0191] In S205, each neighbor node that receives a consensus request Each becomes an independent validator, listening for signals from the device to be authenticated. The response signal is received, and the local verification function is executed. This function takes into account multiple physical layer and link layer metrics:

[0192] ;

[0193] in, This indicates the signal strength received by node $j$, in dBm. It represents the signal-to-noise ratio, reflecting signal quality; Indicates data packet reception rate, and measures link reliability; This indicates the response delay and is used to detect relay attacks.

[0194] The specific verification function employs a weighted scoring mechanism:

[0195] ;

[0196] in, This represents the sigmoid function, which maps RSSI to the interval [0, 1]. This indicates the signal strength threshold; a value below this is considered an abnormal device distance. Represents the weighting coefficients, satisfying ; This represents the time delay normalization constant;

[0197] Each neighbor node will calculate the trust ticket. After encryption, it is sent back to the authentication management node.

[0198] (c) Consensus aggregation and network layer authentication decision:

[0199] After collecting votes from all neighboring nodes, the authentication decision engine module executes the Byzantine fault-tolerant aggregation algorithm. Considering the possibility of malicious nodes, the system uses a weighted median instead of a simple average.

[0200] ;

[0201] in, This indicates that the authentication management node uses the votes from its neighboring nodes. and their corresponding weights The network layer distributed consensus authentication score is obtained by weighted median aggregation;

[0202] WeightedMedian(·) represents the weighted median operator, which is the vote value that, after sorting by the vote values ​​and weights of each neighboring node, first reaches 50% of the total weight.

[0203] Among them, weight Based on node historical reputation The formula for calculating the physical distance factor is as follows:

[0204] ;

[0205] in, , representing a node Historical credibility is obtained through long-term behavioral assessment; Represents the distance attenuation constant;

[0206] 3) The final decision-making mechanism of two-factor authentication:

[0207] S206 is the decision point in the entire authentication process. The authentication decision engine module integrates the verification results from the physical layer and the network layer, and adopts a strict dual-threshold decision:

[0208] ;

[0209] in, , representing the physical layer authentication threshold; , representing the network layer consensus threshold;

[0210] The design philosophy of this two-factor decision-making mechanism is that legitimate devices must simultaneously meet two conditions: correct hardware identity and trustworthy network behavior. Any attack attempting to deceive through a single dimension will be identified and rejected by the system. For devices that fail to authenticate, the system will generate detailed audit logs, record the reasons for the failure (physical layer mismatch or insufficient consensus), and trigger corresponding security response mechanisms, including adding the device ID to a temporary blacklist and sending alarms to maintenance personnel.

[0211] Specifically, the aforementioned modules work together to form a complete authentication and anti-cloning system, from device physical feature identification to network group collaborative verification. It utilizes the microscopic physical differences generated during the manufacturing process of the wireless communication module, namely radio frequency fingerprints, as the hardware-level identity card of the device. At the same time, combined with the distributed consensus verification of neighboring nodes, it constructs a defense-in-depth authentication system from the physical layer to the network layer.

[0212] Example 3

[0213] In this embodiment, to address feature drift caused by environmental changes and equipment aging, an adaptive threshold adjustment mechanism is also provided. The system continuously monitors the authentication score distribution of legitimate devices and dynamically updates the threshold using the following formula:

[0214] ;

[0215] ;

[0216] in, Indicates the first The authentication threshold for each time window; Indicates the first The average authentication score of legitimate devices within a time window; This represents the target average score, typically set to 0.95. This represents the learning rate, which controls the speed at which the threshold is adjusted; a typical value is 0.01.

[0217] When the average authentication score of legitimate devices within the current time window is lower than the target average score, it indicates that the overall score may have dropped due to device aging or environmental changes. In this case, the adaptive mechanism lowers the authentication threshold. Conversely, when the average authentication score is higher than the target average score, the adaptive mechanism appropriately raises the authentication threshold.

[0218] The aforementioned adaptive threshold adjustment: The system continuously monitors the distribution of authentication scores of certified legitimate devices in the background, periodically calculates the statistical characteristics of physical layer scores and consensus scores, and dynamically adjusts the authentication threshold based on the deviation of these statistical data from the target value to adapt to feature drift caused by environmental changes and device aging. This adaptive threshold adjustment mechanism ensures that the system maintains high accuracy and low false alarm rate during long-term operation.

[0219] In addition, to further enhance security, each authentication request includes a timestamp. The authentication management node verifies the freshness of the timestamp:

[0220] ;

[0221] in, Indicates the current time of the authentication management node; Indicates the timestamp in the request message; This indicates the maximum permissible time deviation, typically set to 5 seconds.

[0222] Simultaneously, the system maintains a request log within a sliding window to prevent replay attacks within the valid time window; any duplicate requests will be blocked. Triads will be rejected outright.

[0223] Furthermore, before the aforementioned authentication decision engine module calculates the weighted Mahalanobis distance between the real-time fingerprint and the RF fingerprint reference template, it also performs an RF feature thermal drift compensation step:

[0224] Obtain the CPU load rate, network transmission rate, and virtual temperature accumulation of the device to be authenticated at the current moment;

[0225] Based on the CPU load rate, the network transmission rate, and the accumulated virtual temperature, the equivalent virtual temperature increment at the current moment is calculated using the following formula:

[0226] ;

[0227] In the formula, Represents the current sampling time; Represents the current sampling time The equivalent virtual temperature increment; Represents the current sampling time Central processing unit load rate; Represents the current sampling time Network transmission rate; Represents the previous sampling time; Represents the previous sampling time The virtual temperature accumulation; Represents the processor heat mapping coefficient; Represents the network transmit / receive heat mapping coefficient; Represents the heat dissipation loss coefficient of the equipment;

[0228] Next, based on the calculated equivalent virtual temperature increment, the feature compensation vector is calculated, and the corresponding calculation formula is as follows:

[0229] ;

[0230] In the formula, Represents the feature compensation vector; The feature drift sensitivity vector, which is pre-stored in the trusted device database, represents the dimension of each element within the feature drift sensitivity vector, which is the dimension of the corresponding RF fingerprint feature component divided by degrees Celsius. Finally, based on the feature compensation vector, the real-time feature vector is reverse-drift corrected to obtain the corrected real-time feature vector. The corresponding calculation formula is as follows:

[0231] ;

[0232] In the formula, This represents the corrected real-time feature vector; This represents the uncorrected real-time feature vector;

[0233] The authentication decision engine module replaces the real-time feature vector with the corrected real-time feature vector and substitutes it into the calculation of the weighted Mahalanobis distance to eliminate feature distortion caused by transient heating under high load of the device.

[0234] The working principle and beneficial effects of the above technical solution are as follows:

[0235] In this embodiment, the aforementioned authentication decision engine module calculates the uncorrected real-time feature vector. With radio frequency fingerprint reference template Before the weighted Mahalanobis distance, an independent RF feature thermal drift compensation step is performed. It is understandable that when the secondary security terminal device performs routine tasks such as authentication and control message encryption, the central processing unit and RF communication module consume power and generate heat, leading to an increase in the physical temperature of the RF module. Increased ambient temperature causes a shift in the resonant frequency of the built-in crystal oscillator, and causes a drift in the gain and phase parameters of the amplifiers and mixers in the RF front-end link. These changes in physical parameters result in an uncorrected real-time feature vector being extracted. A baseline shift occurs. If the uncorrected real-time feature vector is directly applied... Substituting the data into the distance-based decision model would lead to computational bias in the authentication decision engine module. Therefore, this embodiment constructs a virtual temperature mapping model to address the uncorrected real-time feature vectors. Perform reverse drift correction.

[0236] Specifically, obtain the current CPU load rate of the device to be authenticated. Current network transmission rate And the virtual temperature accumulation of the previous sampling period Current CPU load rate The method for obtaining the value is as follows: read the total number of clock cycles occupied by non-idle threads within the set time window, divide it by the total number of clock cycles in the set time window, and obtain a percentage value. Use the aforementioned percentage value as the CPU load rate at the current moment. Current network transmission rate The method for obtaining the data is as follows: count the total number of payload bit streams in the network protocol stack's transmit buffer, divide by the corresponding sampling time window duration, and obtain the network transmit rate at the current moment in bits per second. The cumulative virtual temperature from the previous sampling period. Iteratively maintained in local memory, with the dimension of Celsius, it is used to characterize the basic thermal energy accumulated in the preceding operation phase.

[0237] Furthermore, based on the current CPU load rate Current network transmission rate And the virtual temperature accumulation of the previous sampling period Calculate the equivalent virtual temperature increment at the current moment. The equivalent virtual temperature increment at the current moment. In the corresponding calculation formula, the equivalent virtual temperature increment at the current moment The unit of measurement is Celsius; the current CPU load rate. A dimensionless parameter; the network transmission rate at the current moment. The unit is bits per second; the virtual temperature accumulation of the previous sampling period. The dimension of the unit is Celsius; in the formula, This is the processor heat mapping coefficient, with the dimension of degrees Celsius; The network transmit / receive heat mapping coefficient is expressed in degrees Celsius per second per bit; the current network transmission rate is expressed in bits per second (bit / s); constant term 1 is a dimensionless unit constant. Equipment heat dissipation loss coefficient. This is a dimensionless proportionality constant. Processor heat mapping coefficient. Mapping coefficient with network transmission and reception heat The processor's heat mapping coefficient was obtained in advance through calibration tests, during which temperature change data were recorded under different computing loads and network transmission rates. Mapping coefficient with network transmission and reception heat Equipment heat dissipation loss coefficient The attenuation time constant is extracted and calculated by recording the cooling curve of the device in standby mode. Specifically, the calibration test and regression algorithm are implemented as follows: the terminal device is placed in a constant temperature chamber, and at a preset reference temperature, the device is controlled to operate under different CPU load rate gradients (e.g., 0%, 25%, 50%, 75%, 100%) and network transmission rate gradients. The steady-state temperature rise data of the device's RF module surface is recorded using thermocouple sensors. The least squares method is used for binary linear regression fitting to obtain the processor heat mapping coefficient. Mapping coefficient between network transmission and reception heat Under typical hardware configurations, The preferred value range is 0.05 to 0.2℃ / %. The preferred value range is... The heat dissipation loss coefficient of the device Following Newton's law of cooling, the specific calculation formula is as follows: ,in, The sampling period of the system is expressed in seconds. The heat dissipation time constant of the device is obtained by recording the physical temperature drop curve of the device after switching from a full-load heating state to an idle standby state, and then fitting an equation. Solving for the results In the formula, here The continuous independent variable representing the duration from the start of the cooling state, with the dimension of seconds; This represents the real-time record during the cooling process at that time. The physical temperature of the device's radio frequency module surface at that time, in degrees Celsius; The calibration temperature for the stable test environment is measured in degrees Celsius. The initial surface temperature at the start of cooling of the equipment, measured in degrees Celsius. Typical... The value ranges from 0.01 to 0.05.

[0238] Next, based on the calculated equivalent virtual temperature increment at the current moment... Calculate the feature compensation vector Feature compensation vector In the corresponding calculation formula, the feature compensation vector A matrix representing the set of temperature offsets along the feature dimension; the equivalent virtual temperature increment at the current moment. The unit of measurement is Celsius; the feature drift sensitivity vector Pre-stored in a trusted device database. Feature drift sensitivity vector. The feature drift sensitivity vector represents the rate of change of the corresponding RF fingerprint feature dimension signal per degree Celsius temperature rise. The dimensions of each internal element are the dimensions of the corresponding RF fingerprint feature components divided by degrees Celsius. The equivalent virtual temperature increment at the current moment. With feature drift sensitivity vector After performing the multiplication operation, the temperature offset corresponding to each feature dimension is output to obtain the feature compensation vector. Wherein, the feature drift sensitivity vector Specific composition and eigenvectors The dimensions correspond one-to-one, that is The feature drift sensitivity vector The data is obtained during the equipment registration or factory calibration phase using a multi-gradient temperature scanning method in a constant temperature chamber. The specific extraction steps are as follows:

[0239] The secondary safety device was placed in a programmable high and low temperature alternating damp heat test chamber, and the reference test temperature was set. (Typical value is 20℃), and set the maximum test temperature. (Typical value is 80℃), temperature change step size Set to 5℃.

[0240] At each temperature step The temperature was kept constant for 15 minutes to ensure internal thermal equilibrium of the device. Then, the device was controlled to send a standard test message, and the transient feature vector at this point was recorded using the RF fingerprint extraction module of the authentication management node. .

[0241] After traversing all temperature steps, for each component of the eigenvector (offset by carrier frequency) Taking this as an example, we use the least squares method to perform linear regression fitting and calculate the slope of the change with temperature. This slope is the temperature sensitivity coefficient for the corresponding dimension.

[0242] ;

[0243] In the formula, The temperature sensitivity coefficient represents the carrier frequency offset dimension, and its dimension is Hz / ℃; Representing the The current ambient temperature of each temperature test step, in °C; The arithmetic mean temperature of all temperature steps involved in the test, in °C; Represents temperature The transient characteristic value of carrier frequency offset extracted under the given conditions, with the dimension in Hz; This represents the arithmetic mean of the transient eigenvalues ​​of the carrier frequency offset extracted across all temperature gradients, with dimensions in Hz.

[0244] Similarly, the sensitivity coefficients for the other four dimensions were calculated. The feature drift sensitivity vector is formed by combining these elements. And store it in the database. Under typical hardware configurations, The value typically ranges from 0.5 to 2.0 Hz / ℃. The value range is usually between 0.01% and 0.05% / ℃.

[0245] Finally, based on the feature compensation vector For uncorrected real-time feature vectors Perform reverse drift correction to obtain the corrected real-time feature vector. Corrected real-time feature vector In the corresponding calculation formula, the corrected real-time feature vector Represents the feature coordinate matrix after thermal drift correction; uncorrected real-time feature vectors. Represents the original feature coordinate matrix currently captured by the RF fingerprint extraction module; feature compensation vector. This represents the calculated environmental temperature drift offset matrix. The authentication decision engine module uses vector subtraction to subtract the uncorrected real-time feature vectors. Remove feature compensation vector Subsequently, the authentication decision engine module utilizes the corrected real-time feature vector. Replace uncorrected real-time feature vectors and the corrected real-time feature vector This information is then incorporated into the weighted Mahalanobis distance calculation. The above data processing steps eliminate radio frequency characteristic distortion errors caused by the device's own high load and heat generation.

[0246] Furthermore, to address the security risk of compromised neighbor nodes using historically high reputation to launch slow pollution attacks, the aforementioned authentication decision engine module, after collecting votes from all collaborating neighbor nodes and before executing the aggregation algorithm, also performs a real-time trust state downgrading control step:

[0247] Obtain the heartbeat frequency fluctuation rate and requested resource classification information of all nodes in the neighboring cooperative node set in the most recent communication cycles.

[0248] Based on the heartbeat interaction frequency fluctuation rate and the requested resource classification information, the isolated forest anomaly detection model is used to perform real-time behavior sequence pattern matching on all nodes in the neighboring cooperative node set to obtain the real-time behavior variation evaluation value of each node.

[0249] Determine whether there exists a specific neighbor node such that the historical reputation of the specific neighbor node is higher than a preset reputation threshold, and the real-time behavior variation evaluation value of the specific neighbor node is higher than a preset variation threshold.

[0250] If the specific neighbor node exists, it is determined that the specific neighbor node is in a sudden compromise state, thereby activating the consensus pollution circuit breaker prevention strategy.

[0251] The consensus contamination circuit breaker prevention strategy forcibly invalidates the trust votes generated by the specific neighbor node and removes the specific neighbor node from the set of neighbor cooperating nodes, forming a purified set of cooperating nodes.

[0252] Finally, the authentication decision engine module only aggregates the votes of each node within the purified collaborative node set to execute the aggregation algorithm, in order to eliminate consensus verification bias caused by historical reputation lag.

[0253] The working principle and beneficial effects of the above technical solution are as follows:

[0254] In this embodiment, after collecting votes from all neighboring cooperative nodes and before executing the aggregation algorithm, the authentication decision engine module also performs a real-time trust state downgrading control step. It is understood that existing distributed consensus mechanisms primarily rely on the historically accumulated reputation scores of each node. Reputation scores have a time-lag attribute; when a specific node with a high reputation score is externally taken over and sends an illegal vote, the static reputation evaluation mechanism cannot lower the target node's weight within a short observation period. To prevent illegal nodes from using high weight scores to interfere with the consensus determination result, this embodiment introduces an abnormal node communication behavior detection module before vote aggregation.

[0255] Specifically, the system obtains the heartbeat frequency fluctuation rate and requested resource classification information for all nodes in the neighboring cooperative node set over the most recent communication cycles. The steps for obtaining the heartbeat frequency fluctuation rate are: recording the timestamp of the node's heartbeat probe data packet arriving at the receiving interface, calculating the time interval difference between adjacent timestamps; and extracting the heartbeat frequency fluctuation rate by statistically analyzing the variance of multiple time interval differences within a sliding time window. During normal operation, the heartbeat packet transmission time interval exhibits a stable normal distribution; however, if the target node is running a high-load task in the background, task scheduling preemption causes queuing delays in heartbeat packet transmission, increasing the heartbeat frequency fluctuation rate. The steps for obtaining requested resource classification information are: parsing the control message data payload sent by the neighboring cooperative nodes, extracting the resource request instruction type and target address; and converting the resource request sequence into a discrete numerical state feature array based on a preset permission mapping classification rule to obtain quantified requested resource classification information. The preset permission mapping classification rule specifically adopts a static weighted mapping table based on security risk levels. Requested resources in the secondary security system are divided into four security levels and assigned discrete risk weights:

[0256] Level 1 (Routine Heartbeat and Status Reporting): Such as reading its own device operating parameters and sending heartbeat packets, with a risk weight of 0.1;

[0257] Level 2 (Regular Business Data Query): If requesting non-sensitive waveform data or logs, the risk weight is set to 0.3;

[0258] Level 3 (Issuance or modification of critical control parameters): If a request is made to modify protection settings or remote control operation commands, the risk weight is set to 0.8;

[0259] Level 4 (Core Firmware and Key Operations): For requests to upgrade firmware or synchronize keys, the risk weight is set to 1.0.

[0260] The state feature array is constructed by: statistically analyzing the most recent... One (typical value) During the communication cycle, the frequency of node requests for the above four levels of resources. The frequency is then weighted and summed with the corresponding risk weights, and then normalized to form a one-dimensional scalar value or a one-dimensional array, which serves as the input to the anomaly detection model as quantified request resource classification information. These are the request frequency items for the four levels of resources mentioned above, respectively.

[0261] Furthermore, based on the heartbeat interaction frequency volatility and requested resource classification information, the isolated forest anomaly detection model is used to perform real-time behavior sequence pattern matching on all nodes within the neighboring collaborative node set, obtaining the real-time behavior variation evaluation value of each node. The isolated forest anomaly detection model consists of multiple random trees and is suitable for unsupervised anomaly detection. During the operation, the heartbeat interaction frequency volatility and requested resource classification information are used to form multi-dimensional joint feature data, which is then input into the isolated forest anomaly detection model. The isolated forest anomaly detection model randomly generates segmentation values ​​within the feature dimension range to cross-sectionally partition the feature space. Nodes with compliant behavior aggregate their feature data and require multiple segmentations to be assigned to the bottom leaf nodes of the tree; nodes with mutations have increased heartbeat delay variance and jumps in requested resource sequences, exhibiting outlier distribution characteristics and can be isolated with fewer segmentations. The average path length required for the target node to be independently isolated in all random trees of the isolated forest anomaly detection model is calculated.

[0262] Furthermore, the average path length is transformed into a real-time behavior variation evaluation value between zero and a baseline value (typically 1) using an exponential smoothing mapping function. The calculation formula is as follows:

[0263]

[0264] In the formula, Represents the real-time behavioral variation evaluation value, which is dimensionless values ​​between; The average path length (i.e. the expected number of edges traversed) required for a target node to be successfully isolated in multiple random trees of an isolated forest anomaly detection model is a dimensionless value. Represents the total number of a given sample Under the given conditions, the normalization constant of the average path length of a binary search tree is a dimensionless value. This represents the total number of behavioral feature samples within the sliding time window used to construct this isolated forest model.

[0265] Furthermore, the aforementioned normalization constant The calculation formula is:

[0266]

[0267] In the formula, Representative before The harmonic number of the term, its expansion is: (In actual engineering calculations, when) When it is large, it can be approximated as ). Calculated Between between, The shorter the node (i.e., the more outlier the node features, the easier it is to isolate), The closer it is to 1, the greater the magnitude of the change in the target node's behavior from its normal state.

[0268] Next, to determine whether a specific neighbor node exists, the following two logical threshold verification conditions must be met simultaneously:

[0269] (1) The historical reputation of this node Exceeding the preset credit limit ;in, Used to filter core nodes holding high consensus weights, its typical value range is: .

[0270] (2) The real-time behavioral variation evaluation value of this node Exceeding the preset variation limit ;in, By collecting a large number of legitimate nodes during normal network operation periods The data is then dynamically set to its 95th percentile, typically between 0.60 and 0.75.

[0271] If and only if a node simultaneously satisfies and At that time, this constitutes the gateway's two-parameter verification logic, determining that the high-reputation node has undergone abnormal mutation behavior.

[0272] If a specific neighbor node exists, it is determined that the specific neighbor node is in a sudden compromise state, thereby generating a hardware-triggered interrupt and activating the consensus pollution circuit breaker prevention strategy.

[0273] The consensus pollution circuit breaker prevention strategy invalidates trust tickets generated by specific neighbor nodes. The invalidation process is as follows: locate the physical address of the trust ticket message of the specific neighbor node in the system's dynamic cache data area, overwrite the bytes by issuing a zeroing command, destroy the corresponding vote payload data, and block the injection of abnormal data into the subsequent aggregation algorithm data pool.

[0274] Simultaneously, the consensus pollution circuit breaker prevention strategy removes specific neighbor nodes from the set of neighbor cooperating nodes, forming a purified set of cooperating nodes. The removal steps are as follows: rewrite the routing table of the local communication module to add the physical address of the specific neighbor node to the blocking list; and issue a port blocking command in the network layer protocol stack to terminate the communication connection session with the specific neighbor node. After removing the specific neighbor node, the remaining normal neighbor cooperating nodes form the purified set of cooperating nodes.

[0275] Finally, the authentication decision engine module only aggregates the votes of each node within the purified set of collaborating nodes to execute the aggregation algorithm. By embedding a communication state audit judgment threshold before the voting data aggregation and calculation processing step, the input path of abnormal nodes is blocked from both the communication connection and voting data aspects, eliminating the consensus verification bias vulnerability caused by the lag characteristics of historical reputation.

[0276] In summary, this invention possesses fundamental anti-cloning capabilities. By strongly binding device identity to the physical microscopic characteristics of the wireless communication module, and because radio frequency fingerprints originate from random physical differences during the manufacturing process, they are uncopyable. Even if an attacker obtains all the software and configuration information of the device, they cannot create a cloned device with the same radio frequency fingerprint. Through the organic combination of physical layer hardware fingerprint authentication and network layer neighbor consensus verification, a dual security barrier is constructed. Attackers must simultaneously possess the ability to accurately simulate the radio frequency characteristics of the target device and the ability to deceive the entire neighbor network, resulting in an exponential increase in attack difficulty. It effectively resists man-in-the-middle and replay attacks. Traditional cryptographic authentication methods cannot distinguish the physical source of a signal. This invention, through radio frequency fingerprint verification, ensures that the signal indeed comes from the claimed hardware device. Combined with a timestamp mechanism, it completely eliminates the threat of signal interception, tampering, and replay. It conforms to the zero-trust network security model, does not rely on any preset trust relationships, and each authentication is an independent, real-time two-factor verification process, perfectly matching the zero-trust concept of never trusting and always verifying, providing military-grade security for secondary security systems of critical infrastructure.

[0277] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0278] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A secondary security device authentication and anti-cloning system, characterized in that, include: The secondary safety terminal equipment is deployed on intelligent safety devices at the power site. Each terminal equipment has a built-in wireless communication module, which is the basis for generating radio frequency fingerprints. An authentication management node is used to execute the identity authentication control process; it can be a wireless communication gateway, an aggregation node, or a dedicated authentication server. The trusted device database is deployed in the authentication management node or backend server. The database securely stores the digital identity of all registered legitimate devices and their corresponding radio frequency fingerprint reference templates. The set of neighboring cooperative nodes is a set of secondary security terminal devices that are within the communication range of the device to be authenticated in the network topology and have been authenticated as trusted.

2. The secondary security device authentication and anti-cloning system according to claim 1, characterized in that, The authentication management node includes: The signal acquisition and preprocessing module is used to receive wireless signals from the terminal device to be authenticated, and to perform digital sampling and basic signal processing on them; The radio frequency fingerprint extraction module is used to extract radio frequency fingerprint feature vectors that can characterize the uniqueness of hardware from the preprocessed signal. The authentication decision engine module is used to perform radio frequency fingerprint matching, initiate and process distributed consensus verification results, and make the final authentication decision based on the dual verification results.

3. The secondary security device identity authentication and anti-cloning system according to claim 2, characterized in that, The identity authentication control process includes the device registration phase and the identity authentication phase; The device registration phase is used to extract the radio frequency fingerprint of the authentication management node and establish a trusted device database. The identity authentication stage is used to make an authentication determination by using the authentication decision engine module and combining the similarity score of physical layer authentication and the aggregate score of network layer consensus.

4. The secondary security device authentication and anti-cloning system according to claim 3, characterized in that, The device registration phase includes the following steps: S101: Place a new, reliable secondary safety terminal device in an electromagnetically pure and physically safe environment; S102: The authentication management node sends an excitation signal to the terminal device, and the terminal device responds and makes multiple wireless transmissions; S103: The RF fingerprint extraction module of the authentication management node captures and processes the signal, extracts stable and highly distinguishable RF fingerprint features, calculates their mean and variance, and generates an RF fingerprint reference template for the terminal device. S104: Bind the digital identity of the terminal device to the generated radio frequency fingerprint reference template and store it in the trusted device database.

5. The secondary security device authentication and anti-cloning system according to claim 4, characterized in that, The identity authentication phase performs the following steps in a real-world operating environment: S201: The device to be authenticated, with an identity ID, initiates a communication or network access request to the authentication management node; S202: The signal acquisition and preprocessing module of the authentication management node captures the wireless signal of this communication, and the radio frequency fingerprint extraction module extracts the radio frequency fingerprint feature vector from the signal in real time. S203: The authentication decision engine module retrieves the corresponding radio frequency fingerprint reference template from the trusted device database based on the ID declared by the device to be authenticated, and calculates the similarity score between the real-time fingerprint and the radio frequency fingerprint reference template through an algorithm. S204: If the physical layer authentication passes the initial threshold judgment, the authentication decision engine module immediately initiates a consensus query request to the set of neighboring cooperative nodes of the ID in the network topology; S205: The neighboring cooperative node verifies the validity of the signal received from the device to be authenticated, and sends the verification result or trust vote back to the authentication management node; S206: The authentication decision engine module combines the similarity score of physical layer authentication and the aggregate score of network layer consensus, and makes a final judgment on whether authentication passes or fails based on a two-factor decision mechanism. Devices that fail authentication will be isolated or marked as illegal.

6. The secondary security device authentication and anti-cloning system according to claim 5, characterized in that, In S202, when the radio frequency fingerprint extraction module extracts the radio frequency fingerprint feature vector from the signal in real time, each wireless communication chip will produce slight physical differences during the manufacturing process. These differences will manifest as specific distortion modes during signal transmission. The radio frequency fingerprint extraction module constructs the unique feature vector of the device by accurately measuring these distortions. Among them, the instantaneous radio frequency fingerprint feature vector of the node device It includes five key dimensions: ； Wherein, the superscript T denotes matrix transpose, and the instantaneous radio frequency fingerprint feature vector is represented in column vector form; The extraction of each feature component corresponds to a specific hardware defect: Carrier frequency offset This reflects the frequency accuracy of the device's crystal oscillator; due to slight differences in crystal cutting and packaging, the actual carrier frequency of each device varies slightly. The carrier frequency offset Extracted through autocorrelation calculation, the formula is as follows: ； in, , indicating the sampling period, typically 50ns; This represents the estimated sample size, which is usually set to 1024 to ensure statistical stability. This represents the autocorrelation delay length, and its value is an integer multiple of the symbol period; express The complex conjugate; This represents the baseband complex signal after frequency compensation. Indicates the sampling point index; In the formula, arg(·) represents the argument of a complex number, which is used to characterize the phase information of the relevant results; The device to be authenticated sends a network access request signal to the authentication management node. The signal acquisition and preprocessing module of the authentication management node immediately starts a high-speed analog-to-digital converter at a sampling rate of [missing information]. The radio frequency signals of the air interface are captured in real time, and the clean baseband signals that reflect the hardware characteristics of the device are extracted from the raw signals full of noise and interference. The signal acquisition and preprocessing module first performs digital sampling on the received radio frequency signal to obtain a discrete-time signal sequence. Due to frequency offset and phase error in the real environment, directly processing the raw signal will lead to feature extraction distortion. Therefore, the signal acquisition and preprocessing module executes a carrier frequency recovery algorithm to obtain the baseband complex signal using the following formula: ； in: This represents the received radio frequency signal sampling sequence. For sampling point index; This represents the carrier frequency estimate obtained through the maximum likelihood estimation algorithm; This indicates the sampling rate, in Hz, with a typical value of 20MHz. This represents the baseband complex signal after frequency compensation. Sampling frequency offset This characteristic stems from the inaccuracy of the analog-to-digital converter clock; even chips produced in the same batch can have ppm-level differences in their ADC clocks. The sampling frequency offset The calculation formula is as follows: ； in, This represents the phase increment between adjacent symbols measured via pilot symbols; The number of sampling points representing the symbol interval is determined by the modulation scheme; Indicates the symbol period, which is related to the data transmission rate; Extraction of I / Q imbalance characteristics: Due to differences in device matching, the I and Q paths of the RF front end will have gain and phase imbalance. The gain imbalance The formula for calculating the power ratio is as follows: ； Phase imbalance The orthogonality deviation metric is calculated using the following formula: ； in, Expressed as the standard deviation of the I-channel and Q-channel signals; This represents the time average over the length of a data packet; Represents the in-phase and quadrature components of the baseband signal; Error vector magnitude EVM is a comprehensive indicator that reflects the cumulative effect of various hardware defects, including power amplifier nonlinearity and phase noise. The error vector amplitude The calculation formula is as follows: ； in, Indicates the first One received and equalized symbol; This represents the ideal constellation points mapped based on the demodulation results; This indicates the total number of symbols in the data packet.

7. The secondary security device authentication and anti-cloning system according to claim 6, characterized in that, In step S203, the authentication decision engine module calculates the weighted Mahalanobis distance between the real-time fingerprint and the RF fingerprint reference template to obtain the physical layer similarity score. The calculation formula is as follows: ； in, This represents the real-time feature vector during actual device authentication, used to compare with the RF fingerprint reference template. Perform a comparison and calculate the similarity. , which represents the weight matrix formed by the inverse of the covariance matrix, automatically assigning higher weights to stable features; , representing the physical layer similarity score, exhibits an exponentially decaying distribution; when At this point, the physical layer authentication is initially passed, and the system enters the next stage of verification, the threshold of which is... It is usually set to 0.85; The authentication decision engine module retrieves the radio frequency fingerprint reference template corresponding to the declared ID of the device to be authenticated from the trusted device database. RF fingerprint reference template The equipment registration process is conducted in a shielded room environment. The values ​​were obtained by taking the average of several independent measurements. The calculation formula is as follows: ； in, This is the feature vector of the m-th measurement during device registration, used to calculate the average value to obtain the RF fingerprint reference template. .

8. The secondary security device authentication and anti-cloning system according to claim 7, characterized in that, In step S205, each neighbor node that receives the consensus request Each becomes an independent validator, listening for signals from the device to be authenticated. The response signal is received, and the local verification function is executed. This function takes into account multiple physical layer and link layer metrics: ； in, This indicates the signal strength received by node $j$, in dBm. It represents the signal-to-noise ratio, reflecting signal quality; Indicates data packet reception rate, and measures link reliability; Indicates response latency, used to detect relay attacks; The verification function employs a weighted scoring mechanism: ； in, This represents the sigmoid function, which maps RSSI to the interval [0, 1]. This indicates the signal strength threshold; a value below this is considered an abnormal device distance. Represents the weighting coefficients, satisfying ; This represents the time delay normalization constant; Each neighbor node will calculate the trust ticket. After encryption, the data is sent back to the authentication management node; After collecting votes from all neighboring nodes, the authentication decision engine module executes the Byzantine fault-tolerant aggregation algorithm, which uses a weighted median instead of a simple average: ； in, This indicates that the authentication management node uses the votes from its neighboring nodes. and their corresponding weights The network layer distributed consensus authentication score is obtained by weighted median aggregation; WeightedMedian(·) represents the weighted median operator, which is the vote value that, after sorting by the vote values ​​and weights of each neighboring node, first reaches 50% of the total weight. Among them, weight Based on node historical reputation The formula for calculating the physical distance factor is as follows: ； in, , representing a node Historical credibility is obtained through long-term behavioral assessment; Represents the distance attenuation constant; in, To determine the equipment to be certified The set of neighbors is determined according to the following principles: ； in, Indicates equipment and The physical distance or number of hops between them; Indicates the effective communication radius; Indicate neighboring nodes; Represents a node The current trust status; In S206, the two-factor decision mechanism involves the authentication decision engine module employing a strict dual-threshold decision based on the verification results from both the physical and network layers. ； in, , representing the physical layer authentication threshold; , representing the network layer consensus threshold; In the actual operating environment, the identity authentication stage also includes an adaptive threshold adjustment mechanism to cope with feature drift caused by environmental changes and equipment aging. The system continuously monitors the authentication score distribution of authenticated legitimate devices in the background and dynamically updates the threshold using the following formula: ； ； When the average authentication score of legitimate devices within the current time window is lower than the target average score, it indicates that the overall score may have dropped due to device aging or environmental changes. In this case, the adaptive mechanism lowers the authentication threshold. Conversely, when the average authentication score is higher than the target average score, the adaptive mechanism appropriately raises the authentication threshold. in, Indicates the first The authentication threshold for each time window; Indicates the first The average authentication score of legitimate devices within a time window; This represents the target average score, typically set to 0.

95. This represents the learning rate, which controls the speed at which the threshold is adjusted; a typical value is 0.

01. The adaptive threshold adjustment mechanism is used to ensure that the system maintains high accuracy and low false alarm rate during long-term operation.

9. The secondary security device authentication and anti-cloning system according to claim 7, characterized in that, Before the aforementioned authentication decision engine module calculates the weighted Mahalanobis distance between the real-time fingerprint and the RF fingerprint reference template, it also performs an RF feature thermal drift compensation step: Obtain the CPU load rate, network transmission rate, and virtual temperature accumulation of the device to be authenticated at the current moment; Based on the CPU load rate, the network transmission rate, and the accumulated virtual temperature, the equivalent virtual temperature increment at the current moment is calculated using the following formula: ； In the formula, Represents the current sampling time; Represents the current sampling time The equivalent virtual temperature increment; Represents the current sampling time Central processing unit load rate; Represents the current sampling time Network transmission rate; Represents the previous sampling time; Represents the previous sampling time The virtual temperature accumulation; Represents the processor heat mapping coefficient; Represents the network transmit / receive heat mapping coefficient; Represents the heat dissipation loss coefficient of the equipment; Next, based on the calculated equivalent virtual temperature increment, the feature compensation vector is calculated, and the corresponding calculation formula is as follows: ； In the formula, Represents the feature compensation vector; This represents a feature drift sensitivity vector pre-stored in a trusted device database; Finally, based on the feature compensation vector, the real-time feature vector is reverse-shifted to obtain the corrected real-time feature vector. The corresponding calculation formula is as follows: ； In the formula, This represents the corrected real-time feature vector; This represents the uncorrected real-time feature vector; The authentication decision engine module replaces the real-time feature vector with the corrected real-time feature vector and substitutes it into the calculation of the weighted Mahalanobis distance to eliminate feature distortion caused by transient heating under high load of the device.

10. A secondary security device authentication and anti-cloning system according to claim 8, characterized in that, To address the security risk of compromised neighbor nodes using historically high reputation to launch slow poisoning attacks, the aforementioned authentication decision engine module, after collecting votes from all collaborating neighbor nodes and before executing the aggregation algorithm, also performs a real-time trust state downgrading control step: Obtain the heartbeat frequency fluctuation rate and requested resource classification information of all nodes in the neighboring cooperative node set in the most recent communication cycles. Based on the heartbeat interaction frequency fluctuation rate and the requested resource classification information, the isolated forest anomaly detection model is used to perform real-time behavior sequence pattern matching on all nodes in the neighboring cooperative node set to obtain the real-time behavior variation evaluation value of each node. Determine whether there exists a specific neighbor node such that the historical reputation of the specific neighbor node is higher than a preset reputation threshold, and the real-time behavior variation evaluation value of the specific neighbor node is higher than a preset variation threshold. If the specific neighbor node exists, it is determined that the specific neighbor node is in a sudden compromise state, thereby activating the consensus pollution circuit breaker prevention strategy. The consensus contamination circuit breaker prevention strategy forcibly invalidates the trust votes generated by the specific neighbor node and removes the specific neighbor node from the set of neighbor cooperating nodes, forming a purified set of cooperating nodes. Finally, the authentication decision engine module only aggregates the votes of each node within the purified collaborative node set to execute the aggregation algorithm, in order to eliminate consensus verification bias caused by historical reputation lag.

Images