A lightweight large-scale node access identity authentication method

Abstract

This invention proposes a lightweight, large-scale node access authentication method, belonging to the fields of wireless communication and information security. It includes steps such as signal reception and multi-user interference cancellation, physical layer feature extraction, single-class support vector machine identity recognition and confidence calculation, and dynamic cross-layer authentication decision. This invention provides a follow-up mechanism for cross-layer authentication, employing a combination of channel features and physical hardware fingerprints. This enriches the information content of feature selection and avoids the problem of physical layer authentication technology failure under similar channel features. It is suitable for the development trends of lightweight cryptographic protocols, decentralized identity management, and cross-layer authentication, achieving an effective balance between security and efficiency.

Description

Technical Field

[0001] This invention relates to the fields of wireless communication and information security, and in particular to an identity authentication method for nodes accessing a network. Background Technology

[0002] In a large-scale drone swarm collaborative communication system, user authentication is the primary step in ensuring the security and reliability of the entire system. This technology verifies the legitimacy of nodes attempting to access the swarm network, preventing unauthorized nodes from intruding or malicious entities from hijacking the network, thus laying a secure foundation for subsequent collaborative decision-making and data sharing.

[0003] The importance of identity authentication lies primarily in: 1) preventing unauthorized access and network penetration; 2) ensuring data integrity and command authenticity; and 3) maintaining system availability and resilience. Currently, mainstream authentication schemes include traditional cryptographic methods (such as digital certificates and hash functions) and emerging technologies (such as physical layer security authentication, blockchain, and implicit certificates). However, large-scale cluster environments face challenges such as limited computing resources, dynamic topology adaptability, and real-time requirements.

[0004] The paper "Machine Learning-Based Physical Layer Security for Detecting Active Eavesdropping Attacks" (DOI 10.1109 / LCOM M.2025.3582157) discloses a physical layer authentication technology. In its implementation, this technology uses the average received power and fluctuation of the received signal as features, combined with the OC-SVM unsupervised learning method, to achieve efficient identification of unauthorized users. However, this paper only focuses on physical layer authentication and suffers from the drawback of physical layer authentication technology failing under conditions of approximate channel characteristics. Summary of the Invention

[0005] In view of this, the present invention proposes a lightweight large-scale node access authentication method, which aims to solve the problems of high computational complexity, poor scalability, and difficulty in balancing authentication accuracy and efficiency in existing multi-user authentication systems.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0007] A lightweight, large-scale node access authentication method includes the following steps:

[0008] Step 1, the base station receives data from... The uplink signal of each user contains uplink signals of length [length missing]. Repeatedly send The pilot sequence of the second time; for the first time to be authenticated The user, using the first A user's exclusive pilot sequence The orthogonality or near-orthogonality of the received mixed signals Interference cancellation was performed to separate the first... Individual signals for each user ;

[0009] Step 2, from independent signals Extract physical layer features for identity authentication, including average received power and average carrier frequency offset.

[0010] Step 3: Train a single-class support vector machine model using the physical layer feature data of legitimate users, and use the trained single-class support vector machine model to obtain the confidence score that the user to be authenticated is a legitimate user. ;

[0011] Step 4, set the upper bound of the confidence level. and confidence lower bound , According to confidence level Determine whether the user to be authenticated is a legitimate user and complete the authentication process.

[0012] Optionally, in step 1, the received mixed signal Interference cancellation was performed to separate the first... Individual signals for each user The specific method is as follows:

[0013] Calculate the first Conjugate of pilot sequences for individual users , will receive signal and Perform a dot product to obtain the compensation signal. ;

[0014] For compensation signal Frequency-domain selective interference suppression is performed to obtain the interference-suppressed signal. ;

[0015] Signal after interference suppression With pilot sequence Dot product, reconstructing the first Individual user's received signal .

[0016] Optionally, in step 2, the average received power is calculated as follows:

[0017] Calculate the output power of the matched filter :

[0018]

[0019] The superscript H indicates conjugate transpose;

[0020] statistics Within one symbol period, the output power of the matched filter average This is the average received power;

[0021] The average carrier frequency offset is calculated as follows:

[0022] Calculate independent signals based on autocorrelation estimation method The components after frequency-domain selective interference suppression The phase difference is then estimated. Average carrier frequency offset within one symbol period .

[0023] Optionally, in step 3, the confidence level that the user to be authenticated is a legitimate user is obtained using the trained single-class support vector machine model. The specific method is as follows:

[0024] The physical layer features of the users to be authenticated extracted in step 2 are combined into a feature vector. The input is fed into the trained single-class support vector machine model;

[0025] The single-class support vector machine model is based on the decision function. Output a decision value; where, For Lagrange multipliers, For kernel function, For support vectors, The offset is N, where N is the total number of samples in the training set.

[0026] Based on the decision function value, through the logical function Calculate the confidence level that the user to be authenticated is a legitimate user. ;in, and These are the parameters obtained through logistic regression.

[0027] Optionally, step 4 can be implemented as follows:

[0028] like If so, the user to be authenticated is directly determined to be a legitimate user, and the authentication is successful;

[0029] like If so, the user to be authenticated is directly determined to be an illegitimate user, and authentication fails.

[0030] like If the above conditions are met, the upper-layer authentication protocol will be triggered to perform auxiliary authentication, and a final judgment will be made based on the result of the upper-layer authentication protocol.

[0031] Optionally, the kernel function is a radial basis function.

[0032] Optionally, the upper-layer authentication protocol is an RSA / ECC authentication protocol based on an asymmetric encryption algorithm.

[0033] The beneficial effects of this invention are as follows:

[0034] 1. Effectively improves authentication efficiency and system capacity in multi-user scenarios: By utilizing the orthogonality of pilot sequences to eliminate multi-user interference, the complex multi-class authentication problem is decomposed into multiple parallel binary classification problems. This method greatly reduces the computational complexity of identity recognition, enabling the system to support large-scale concurrent access and authentication of nodes far exceeding the sequence length, significantly improving the system's scalability.

[0035] 2. Achieved high-precision and robust identity recognition: By extracting the average received power (ARP) and carrier frequency offset (CFO), two lightweight physical layer features insensitive to channel fading and Doppler effects, and combining them with a single-class support vector machine (OC-SVM) for anomaly detection, the scheme can effectively distinguish legitimate users from attackers. This approach achieves authentication accuracy close to that of an ideal single-user scenario, while significantly reducing the false negative rate (PMD) and false alarm rate (PFA) under pilot spoofing attacks.

[0036] 3. Achieving an intelligent dynamic balance between security and resource overhead: By introducing a dynamic cross-layer authentication decision mechanism based on dual thresholds, upper-layer authentication protocols (such as RSA) are only invoked in ambiguous areas where the confidence level of the OC-SVM model is insufficient. This approach significantly reduces the number of calls to computationally intensive encryption algorithms while ensuring security no less than that of traditional single upper-layer authentication schemes. This significantly reduces the overall computational and communication overhead of the system, saves node energy consumption, and is particularly suitable for large-scale drone swarm scenarios with limited computing resources.

[0037] 4. Strong resistance to attacks: This scheme does not rely on preset cryptographic secrets. Its authentication basis comes from the inherent physical characteristics of the wireless channel, making it difficult for attackers to carry out effective attacks through simple eavesdropping or copying. It provides another solid security barrier for identity authentication in open wireless environments. Attached Figure Description

[0038] Figure 1 This is a flowchart of an embodiment of the present invention.

[0039] Figure 2A schematic diagram illustrating the relationship between the reconstruction signal estimation error and SNR for different numbers of users.

[0040] Figure 3 This diagram illustrates the relationship between ARP estimation error and SNR for different numbers of users.

[0041] Figure 4 A schematic diagram illustrating the relationship between CFO estimation error and SNR for different numbers of users.

[0042] Figure 5 A two-dimensional visualization for identifying the identities of both legitimate users and attackers when they simultaneously send signals.

[0043] Figure 6 A two-dimensional visualization of identity verification when only attackers send signals simultaneously. Detailed Implementation

[0044] The present invention will now be described in further detail with reference to the accompanying drawings.

[0045] A lightweight, large-scale node access authentication method, such as Figure 1 As shown, it includes the following steps:

[0046] Step 1, Signal reception and multi-user interference cancellation:

[0047] Base station receives from The uplink signal of each user contains uplink signals of length [length missing]. Repeatedly send The pilot sequence of the second time; for the first time to be authenticated The user, using the first A user's exclusive pilot sequence The orthogonality or near-orthogonality of the received mixed signals Interference cancellation was performed to separate the first... Individual signals for each user ;

[0048] The pilot sequence can be an orthogonal sequence set or a near-orthogonal sequence set, such as a Fourier sequence set, a Hadamard sequence set, or a ZC sequence set.

[0049] Step 2, Physical layer feature extraction:

[0050] From independent signals Extract physical layer features for identity authentication, including average received power and average carrier frequency offset.

[0051] Step 3, OC-SVM (Single Classification Support Vector Machine) Identity Recognition and Confidence Calculation:

[0052] A single-class support vector machine model is trained using the physical layer feature data of legitimate users. The trained single-class support vector machine model is then used to obtain the confidence score that the user to be authenticated is a legitimate user. ;

[0053] Step 4, Dynamic Cross-Layer Authentication Decision:

[0054] Set an upper bound for the confidence level. and confidence lower bound , According to confidence level Determine whether the user to be authenticated is a legitimate user and complete the authentication process.

[0055] Here is a more specific example:

[0056] Assuming the uplink access process involves a single base station and One user, recorded as Each user is assigned a unique and definite sequence with a sequence length of [length missing]. . The sequences of *n* users are orthogonal (or nearly orthogonal) to each other. Let the *i*th user's sequence be... The sequence of users is Furthermore, this sequence is a unit energy constant mode sequence, i.e. This sequence will be repeatedly sent in the time domain. The total number of sampling points is And the first The sampling point can be decomposed into the th sampling point. The first transmission sequence 1 sequence element, i.e. Assuming the channel is flat and does not change within a single time slot (one sequence is transmitted per time slot), then for the ... In terms of a time slot, the received The signal for each user is given by the following formula:

[0057]

[0058] in, . Indicates the first Average transmission power per user Indicates the first CFO of each user, Indicates the first Individual users in low The channel coefficients for each time slot, wherein the channel coefficients have a mean of 0 and a variance of . The complex Gaussian distribution, It is complex Gaussian white noise. The matrix form of the signals from each user is as follows:

[0059]

[0060] in, , , , .

[0061] In this embodiment, it is assumed that the attacker's actions can take two forms:

[0062] 1) Since the attacker does not know the sequence used by the legitimate user, the attacker can only spoof the signal by brute force or by randomly selecting from the entire set of pilot sequences. This can be described mathematically as follows:

[0063]

[0064] 2) The attacker has captured the sequence used by a certain user, which can be described mathematically as:

[0065]

[0066] In this scenario, the specific steps of this method are as follows:

[0067] Step 1, Signal reception and multi-user interference cancellation:

[0068] The base station needs to separate the mixed signals in order to extract the target user to be authenticated. The signal. This process is achieved through the following sub-steps:

[0069] 1) Sequence compensation: This involves adjusting the received signal vector... Conjugate transpose of the target user pilot sequence Perform a dot product to obtain the compensated signal. :

[0070]

[0071] in, This operation utilizes the orthogonality between sequences to concentrate the signal energy of the target user near the baseband.

[0072] 2) Frequency-domain selective interference suppression: for the compensation signal Digital frequency domain selective interference suppression is performed to filter out most of the broadband interference components from other users, resulting in the interference-suppressed signal. :

[0073]

[0074] in, This indicates the frequency domain selection of the interference suppressor. This indicates multi-user interference after interference suppression.

[0075] 3) Signal reconstruction: Reconstructing the signal after interference suppression Again with pilot sequence Dot product, reconstructing the target user Independent received signal This completes the process of separating a single-user signal from a multi-user mixed signal.

[0076]

[0077] in, This represents Gaussian white noise and residual multi-user interference.

[0078] Step 2, Physical layer feature extraction:

[0079] From the separated single-user signal In the process, the following two physical layer features are extracted:

[0080] 1) Average Received Power (ARP Characteristic): First, calculate the output of the matched filter. This output value reflects the user's... The signal strength. Then, calculate... The average output power within each time slot:

[0081]

[0082] 2) Average carrier frequency offset (CFO feature): Based on the autocorrelation estimation method, the signal components after interference suppression are selected in the frequency domain. (Right now The Calculate the instantaneous CFO estimate using (1 element) Specifically, the phase difference between adjacent sampling points is calculated. Therefore, we get:

[0083]

[0084] Finally, for The average carrier frequency offset is obtained by averaging the estimated values ​​of each time slot:

[0085]

[0086] Step 3, OC-SVM Identity Recognition and Confidence Calculation:

[0087] Model training: In the offline phase, the base station collects a large amount of historical communication data containing only legitimate users and extracts their ARP features. and CFO characteristics This constitutes a set of feature vectors. A single-class support vector machine model is trained using this set. Preferably, the kernel function... Radial basis kernel function is selected.

[0088] Online verification: During the online verification phase, the user to be verified... eigenvectors Input the trained OC-SVM model. The model then uses the decision function... Perform calculations and output decision values. .in, For Lagrange multipliers, For support vectors, This is the offset.

[0089] Confidence mapping: mapping the decision function values Through an S-shaped logic function This is mapped to a confidence level between 0 and 1. This confidence level represents the probability that the user to be authenticated is a legitimate user, where the parameter... and The result is obtained by performing logistic regression fitting on the output of OC-SVM.

[0090] Step 4, Dynamic Cross-Layer Authentication Decision:

[0091] Two decision thresholds are preset: lower bound of confidence. and upper bound of confidence ,satisfy .

[0092] High confidence level pass: If Determine the user You are a legitimate user; authentication has been successful.

[0093] Low confidence rejection: If Determine the user Authentication failed because the user was an unauthorized user (attacker).

[0094] Fuzzy range triggers upper-level authentication: If If the condition is not met, the OC-SVM model is in an "uncertain" state. At this point, a higher-level authentication protocol with higher computational complexity (such as asymmetric encryption authentication based on RSA or ECC) will be triggered to make an auxiliary decision, and the final result of the higher-level protocol will determine whether to allow the user to access the system.

[0095] Through the above steps, dynamic cross-layer identity authentication with high accuracy, low complexity, and strong security can be achieved in large-scale user scenarios.

[0096] The following experiments will verify the effectiveness of this method:

[0097] Experiment 1 demonstrates the performance of multi-user interference cancellation in the embodiments.

[0098] To demonstrate that this method can effectively separate received signals Define the normalized mean square error (NMSE) of the reconstructed signal:

[0099]

[0100]

[0101] in, .

[0102] set up , The random numbers are uniformly distributed and pilot sequence Taken from the SRS sequence set (defined by the 5G-NR standard) and taking into account the number of users. Five scenarios. Here A long set of SRS sequences is defined as:

[0103]

[0104] in, . Figure 2 This demonstrates the frequency-domain selective interference suppressor width of... The mean square error of frequency offset vector estimation.

[0105] Experiment 2 demonstrates the performance of physical layer feature extraction in the embodiments.

[0106] To demonstrate based on the separated single-user signal To improve the accuracy of feature extraction, the NMSE for average received power (ARP) estimation and carrier frequency offset (CFO) estimation is defined as follows:

[0107]

[0108]

[0109] in, .

[0110] set up , The random numbers are uniformly distributed and pilot sequence Taken from the SRS sequence set (defined by the 5G-NR standard) and taking into account the number of users. Five scenarios. Figure 3 and Figure 4This demonstrates the frequency domain selected interference suppressor width of... Performance of mean square error in average received power estimation and mean square error in carrier frequency offset estimation.

[0111] Experiment 3 demonstrates the performance of OC-SVM identity recognition in the embodiments (legitimate user active).

[0112] This example demonstrates the OC-SVM identity recognition performance under attacker behavior where the attacker has captured the sequence used by a user. Let... , , , The random numbers are uniformly distributed and pilot sequence The sequence is taken from the SRS sequence set (defined by the 5G-NR standard), and the legitimate user is active when the attacker launches the attack. Figure 5 The performance of OC-SVM in identity recognition was demonstrated.

[0113] Experiment 4 demonstrates the performance of OC-SVM identity recognition in the embodiments (legitimate users are silent).

[0114] This example demonstrates the OC-SVM identity recognition performance under attacker behavior where the attacker has captured the sequence used by a user. All experimental parameters are the same as in Experiment 3, but the legitimate user remains silent when the attacker launches the attack. Figure 6 The performance of OC-SVM in identity recognition was demonstrated.

[0115] Experiment 5 demonstrates the performance of dynamic cross-layer authentication in the embodiments (with legitimate users active).

[0116] To measure the performance of cross-layer authentication, the following four metrics are defined to measure complexity and error probability:

[0117] 1. Probability of Miss Detection (PMD):

[0118]

[0119] in, Total number of attackers, This represents the number of missed detections.

[0120] 2. Probability of False Alarm (PFA):

[0121]

[0122] in, The total number of legitimate users, These are false alarms.

[0123] 3. Accuracy:

[0124]

[0125] 4. Upper Level Certification (ULA) Savings:

[0126]

[0127] in, To invoke the upper-level authentication count, This represents the total number of authentication attempts.

[0128] Generally, the above indicators and threshold selection have the following relationship:

[0129] 1. Decrease, then Improvement, and reduce;

[0130] 2. Increase, then Improvement, and reduce;

[0131] 3. Increase, then Improvement, and reduce;

[0132] 4. Decrease, then Lower, and promote.

[0133] By understanding the practical needs of these four indicators, appropriate thresholds can be determined. and Table 1 shows the performance of this method in cross-layer authentication based on Experiment 3:

[0134] Table 1 Different confidence thresholds Impact of Experiment 3's accuracy on upper-layer authentication savings

[0135]

[0136] Experiment 6 demonstrates the performance of dynamic cross-layer authentication in the embodiments (legitimate users are silent).

[0137] Table 2 shows the performance of this method in cross-layer authentication based on Experiment 4:

[0138] Table 2 Different confidence thresholds Impact of Experiment 4's accuracy on upper-layer authentication savings

[0139]

[0140] This invention has the following characteristics:

[0141] 1) By performing dot product (sequence compensation) on the received signal and the pilot sequence of a specific user, and then filtering out broadband interference from other users through frequency domain selective interference suppression, the single-user signal is finally reconstructed, thus transforming the complex multi-user authentication problem into a parallel single-user binary classification problem.

[0142] 2) Combining the physical layer features of average received power (ARP) and carrier frequency offset (CFO), we apply them to a single-class support vector machine (OC-SVM) model to perform UAV identification and confidence calculation.

[0143] 3) Pre-set upper bound for reliability and the lower world Only when the confidence level of the OC-SVM output is at ( Only when the uncertainty range is reached is the upper-layer authentication protocol triggered to make an auxiliary decision, thereby achieving a dynamic balance between security and efficiency.

[0144] In summary, this invention presents a follow-up mechanism for cross-layer authentication, employing a combination of channel features and physical hardware fingerprints to enrich the information content of feature selection and avoid the problem of physical layer authentication technology failure when channel features are similar. This invention assigns a unique orthogonal spreading sequence to each user and utilizes sequence correlation at the receiver to separate multi-user signals, thereby transforming the complex multi-user authentication problem into multiple parallel single-user binary classification problems. Furthermore, by extracting lightweight physical layer features and employing Support Vector Machines (SVM) for classification decisions, the computational complexity is significantly reduced while maintaining near-single-user authentication accuracy, and large-scale user expansion of the system is supported.

[0145] This invention is adapted to the development trend of lightweight cryptographic protocols, decentralized identity management, and cross-layer authentication, and can achieve an effective balance between security and efficiency.

Claims

1. A lightweight, large-scale node access authentication method, characterized in that, Includes the following steps: Step 1, the base station receives data from... The uplink signal of each user contains uplink signals of length [length missing]. Repeatedly send The pilot sequence of the second time; for the first time to be authenticated The user, using the first A user's exclusive pilot sequence The orthogonality or near-orthogonality of the received mixed signals Interference cancellation was performed to separate the first... Individual signals for each user ; Step 2, from independent signals Extract physical layer features for identity authentication, including average received power and average carrier frequency offset. Step 3: Train a single-class support vector machine model using the physical layer feature data of legitimate users, and use the trained single-class support vector machine model to obtain the confidence score that the user to be authenticated is a legitimate user. ; Step 4, set the upper bound of the confidence level. and confidence lower bound , According to confidence level Determine whether the user to be authenticated is a legitimate user and complete the authentication process.

2. The lightweight large-scale node access authentication method according to claim 1, characterized in that, In step 1, the received mixed signal Interference cancellation was performed to separate the first... Individual signals for each user The specific method is as follows: Calculate the first Conjugate of pilot sequences for individual users , will receive signal and Perform a dot product to obtain the compensation signal. ; For compensation signal Frequency-domain selective interference suppression is performed to obtain the interference-suppressed signal. ; Signal after interference suppression With pilot sequence Dot product, reconstructing the first Individual user's received signal .

3. The lightweight large-scale node access authentication method according to claim 1, characterized in that, In step 2, the average received power is calculated as follows: Calculate the output power of the matched filter : The superscript H indicates conjugate transpose; statistics Within one symbol period, the output power of the matched filter average This is the average received power; The average carrier frequency offset is calculated as follows: Calculate independent signals based on autocorrelation estimation method The components after frequency-domain selective interference suppression The phase difference is then estimated. Average carrier frequency offset within one symbol period .

4. The lightweight large-scale node access authentication method according to claim 1, characterized in that, In step 3, the trained single-class support vector machine model is used to obtain the confidence level that the user to be authenticated is a legitimate user. The specific method is as follows: The physical layer features of the users to be authenticated extracted in step 2 are combined into a feature vector. The input is fed into the trained single-class support vector machine model; The single-class support vector machine model is based on the decision function. Output a decision value; where, For Lagrange multipliers, For kernel function, For support vectors, The offset is N, where N is the total number of samples in the training set. Based on the decision function value, through the logical function Calculate the confidence level that the user to be authenticated is a legitimate user. ;in, and These are the parameters obtained through logistic regression.

5. The lightweight large-scale node access authentication method according to claim 1, characterized in that, The specific method for step 4 is as follows: like If so, the user to be authenticated is directly determined to be a legitimate user, and the authentication is successful; like If so, the user to be authenticated is directly determined to be an illegitimate user, and authentication fails. like If the above conditions are met, the upper-layer authentication protocol will be triggered to perform auxiliary authentication, and a final judgment will be made based on the result of the upper-layer authentication protocol.

6. The lightweight large-scale node access authentication method according to claim 4, characterized in that, The kernel function is a radial basis kernel function.

7. The lightweight large-scale node access authentication method according to claim 5, characterized in that, The upper-layer authentication protocol is the RSA / ECC authentication protocol based on an asymmetric encryption algorithm.

Images