An iot device identity access authentication management method

Abstract

The present application relates to the technical field of Internet of Things access, and particularly relates to an Internet of Things device identity access authentication management method. An Internet of Things device receives a random challenge code issued by an access gateway, extracts a current physical environment parameter as an auxiliary factor, splices the random challenge code and the auxiliary factor into a combined incentive vector, inputs the combined incentive vector into a physically unclonable circuit to output a response sequence, and generates an access authentication token by one-way operation on the response sequence using a hash function and sends the access authentication token. The access gateway extracts an expected response hash value in a local shadow mapping library according to the physical environment parameter and the random challenge code, and allows connection establishment if the expected response hash value is consistent. The present application cancels static key storage, eliminates the risk of physical extraction of device end credentials, and blocks the path of attackers using leaked keys to forge legitimate identities.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) access technology, and more specifically to a method for managing the identity access authentication of IoT devices. Background Technology

[0002] Existing IoT device access authentication typically employs a pre-shared key mechanism. During the manufacturing process, a fixed encryption key is burned into the device's internal memory. When a device initiates a connection request to the access gateway, the gateway generates a random number and sends it to the device. The device reads the static key from its memory, encrypts the random number, and sends the ciphertext back to the gateway. The gateway searches its local database for the corresponding static key for the device, decrypts the ciphertext using the same encryption algorithm, and compares the decrypted random number with the previously sent random number. If they match, the gateway determines the device's identity is legitimate and allows the device to establish a network connection.

[0003] The aforementioned conventional authentication scheme suffers from a core technical problem during implementation. Because the static key upon which encryption operations rely is permanently stored in the storage medium of the IoT device, when the IoT device is deployed in an unattended physical environment, attackers can extract this static key by disassembling the chip to read the memory data or by analyzing side-channel power consumption. Once the static key is leaked, attackers can use the extracted key to simulate a legitimate device and generate correct authentication ciphertext during subsequent network access, rendering the entire authentication mechanism ineffective and preventing the gateway from distinguishing between legitimate and counterfeit devices. Summary of the Invention

[0004] The purpose of this invention is to provide a method for managing the identity access authentication of Internet of Things (IoT) devices, which can effectively solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows: An IoT device identity access authentication management method includes: IoT devices receive random challenge codes from the access gateway; The IoT device extracts the currently collected physical environment parameters as auxiliary factors; The IoT device concatenates the random challenge code with the auxiliary factor bitwise to generate a combined incentive vector. The IoT device inputs the combined excitation vector into the physically unclonable circuit, which then excites the physically unclonable circuit to output a first response sequence. The IoT device uses a preset hash function to perform a one-way hash operation on the first response sequence to generate an access authentication token, and sends the access authentication token to the access gateway; The access gateway extracts the corresponding expected response hash value from the locally stored shadow mapping library, using the physical environment parameters and the random challenge code as a joint retrieval key. The access gateway compares the expected response hash value with the access authentication token. If the comparison matches, the IoT device is allowed to establish a Transmission Control Protocol (TCP) connection. If the comparison does not match, the access gateway disconnects the network port of the IoT device.

[0006] Preferably, the IoT device extracts currently collected physical environment parameters as auxiliary factors, including: The IoT device calls upon its internally integrated temperature sensor, humidity sensor, and photosensor to obtain the current temperature reading, humidity reading, and light intensity reading. The IoT device performs truncation processing on the temperature reading, humidity reading, and light intensity reading respectively, retaining binary data with a preset number of significant bits; The IoT device arranges the truncated binary data in a staggered manner according to the high segment corresponding to the temperature reading, the middle segment corresponding to the humidity reading, and the low segment corresponding to the light intensity reading, to generate a fixed-length environmental feature binary string, and uses the environmental feature binary string as the auxiliary factor.

[0007] Preferably, the IoT device inputs the combined excitation vector into a physically unclonable circuit, stimulating the physically unclonable circuit to output a first response sequence, including: The physically unclonable circuit comprises a multi-stage cascaded arbiter structure, and the combined excitation vector is divided into multiple sets of sub-vectors. The multiple sets of sub-vectors are respectively input to the gating control terminal in the multi-level cascaded arbitrator structure to control the switching state of the XOR gate array in each level of the arbitrator. The XOR gate array selects the path of the rising edge and falling edge of the input clock signal according to the switching state, generating multiple delayed signals with phase differences. The multiple delayed signals with phase differences are input to the final stage flip-flop, and the final stage flip-flop outputs the first response sequence consisting of high and low levels based on the arrival order of the delayed signals.

[0008] Preferably, the IoT device performs a one-way hash operation on the first response sequence using a preset hash function to generate an access authentication token, including: The IoT device divides the first response sequence into multiple data blocks of equal length and fills the multiple data blocks sequentially into the initial message buffer of a preset hash function; In each round of compression operation of the preset hash function, the IoT device introduces the auxiliary factor as a round constant to participate in the nonlinear permutation operation; After completing the iterative compression of all data blocks, the IoT device extracts the final output hash value digest. The IoT device extracts the first half of the hash value digest and appends the hardware identifier hash value of the IoT device to the end of the first half, and determines the appended bit stream as the access authentication token.

[0009] Preferably, the access gateway extracts the corresponding expected response hash value from a locally stored shadow mapping library, using the physical environment parameters and the random challenge code as a joint retrieval key, including: The shadow mapping library is stored in a multidimensional trie structure. The root node of the multidimensional trie structure corresponds to the hardware identifier of the IoT device, the first-level child nodes correspond to the discretized range of physical environment parameters, the second-level child nodes correspond to the random challenge codes that have been issued in the past, and the leaf nodes store the expected response hash values ​​that are bound to the random challenge codes and the physical environment parameters. The access gateway performs discretization and quantization processing on the currently received physical environment parameters to determine the discretization interval to which they belong. The access gateway, based on the hardware identifier, the discretization interval, and the currently issued random challenge code, traverses the corresponding branch paths of the multidimensional trie structure and extracts the expected response hash value stored in the leaf nodes.

[0010] Preferably, the access gateway compares the expected response hash value with the access authentication token. If the comparison matches, the IoT device is allowed to establish a Transmission Control Protocol (TCP) connection. If the comparison does not match, the access gateway disconnects the network port of the IoT device, including: The access gateway performs a bitwise XOR operation between the expected response hash value and the access authentication token, and determines whether the XOR operation result is a string of all zero bits. If the result of the XOR operation is a string of all zero bits, the access gateway switches the port status identifier corresponding to the IoT device from the listening state to the authorized forwarding state, and sends a Transmission Control Protocol connection confirmation message carrying a synchronization sequence number to the IoT device. If the result of the XOR operation is not a string of all zero bits, the access gateway switches the port status identifier corresponding to the IoT device from the listening state to the blocking state, sends an access control list modification instruction to the switching chip, and discards subsequent data frames related to the media access control address of the IoT device.

[0011] Preferably, before the IoT device performs truncation processing on the temperature reading, the humidity reading, and the light intensity reading, it further includes: The IoT device continuously collects temperature, humidity and light intensity readings at multiple time points according to a preset sampling frequency, and constructs multiple sets of environmental time series data. The IoT device calculates the variance of each set of environmental time series data, removes environmental time series data whose variance exceeds a preset fluctuation range, and determines the remaining environmental time series data as valid environmental time series data. The IoT device performs median filtering on the valid environmental time series data, and uses the filtered result output by the median filtering operation as the temperature reading, the humidity reading, and the light intensity reading for subsequent truncation processing.

[0012] Preferably, the multiple sets of sub-vectors are respectively input to the gating control terminal in the multi-stage cascaded arbitrator structure, including: Each arbitrator in the arbitrator structure is configured with a multiplexer group, which includes a first selector and a second selector. Each set of subvectors is split into a high-order control field and a low-order control field. The high-order control field is input to the first selector, and the low-order control field is input to the second selector. The first selector and the second selector dynamically select a target delay line from a pre-wired array of multiple metal delay lines according to the control fields they receive, and connect the target delay line to the input of the XOR gate array, so that different bits of the combined excitation vector are mapped to different combinations of physical delay paths within the physically unclonable circuit.

[0013] Preferably, in each round of compression operation of the preset hash function, the IoT device introduces the auxiliary factor as a round constant to participate in the nonlinear permutation operation, including: Each round of compression operation of the preset hash function includes multiple step functions. In each step function, the input data of the current step function is cyclically shifted left by the corresponding bit segment in the auxiliary factor. The result of the left shift operation is input to one input of the modular arithmetic unit, and the round constant of the current step function is input to the other input of the modular arithmetic unit. The modular arithmetic unit performs modular arithmetic on the values ​​at the two input terminals and inputs the output of the modular arithmetic to the nonlinear logic function arithmetic unit. The nonlinear logic function arithmetic unit performs combinational logic operations of bitwise AND, bitwise OR and bitwise XOR on the output of the modular arithmetic to generate an intermediate hash status word.

[0014] Preferably, the access gateway performs discretization and quantization processing on the currently received physical environment parameters to determine the corresponding discretization interval, including: The access gateway maintains a sliding window queue locally, and the sliding window queue stores historical physical environment parameters sent by the IoT device within a historical authentication period. The access gateway calculates the moving average and moving standard deviation of historical physical environment parameters in the sliding window queue; The access gateway divides the continuous physical environment parameter space into multiple non-overlapping discretized intervals, centered on the moving average and bounded by integer multiples of the moving standard deviation. The access gateway compares the currently received physical environment parameters with the boundary values ​​of the multiple non-overlapping discretization intervals, and determines the discretization interval to which the currently received physical environment parameters fall.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. This invention eliminates the need for storing static encryption keys in traditional schemes by concatenating a random challenge code with physical environment parameters as a combined incentive vector input to a physically unclonable circuit. The physically unclonable circuit outputs a response sequence based on differences in its internal hardware delay paths. Internally, the device only performs one-way hash operations to generate an access authentication token; the actual response sequence is not transmitted over the network. The gateway verifies the response by comparing the expected hash value stored in a multi-dimensional trie structure. This authentication architecture, coupled with hardware physical characteristics and real-time environmental variables, eliminates the possibility of physically extractable static credentials in the storage medium, blocking attackers from forging legitimate identities by obtaining fixed keys.

[0016] 2. This invention employs variance elimination and median filtering in the environmental parameter processing stage to filter out abnormal fluctuation data, reducing transient noise interference during environmental parameter acquisition. On the gateway side, a sliding window queue is used to calculate the moving average and moving standard deviation of historical environmental parameters to dynamically divide discretized intervals, ensuring that the retrieval interval of the shadow mapping library matches the long-term physical changes in the device deployment environment. Physically unclonable circuits dynamically select multiple metal delay lines through high- and low-bit control fields, and in combination with hash operations, environmental parameters are used as round constants in cyclic left shifts and modulo-addition nonlinear permutations, altering the bit distribution of the response sequence under different input conditions. In the comparison stage, the gateway determines the result through XOR operations and directly modifies the port status identifier and issues access control lists, enabling the discarding of data frames from abnormal access packets. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating the overall execution process of IoT device identity access authentication according to the present invention. Figure 2 This is a flowchart of the physical environment parameter acquisition and auxiliary factor generation process of the present invention; Figure 3 This is a flowchart of the generation of the first response sequence for a physically unclonable circuit according to the present invention; Figure 4 A flowchart for generating the one-way hash operation of the access authentication token according to the present invention; Figure 5 This is a flowchart of the expected response hash value retrieval process for the shadow mapping library of the present invention; Figure 6 This is a flowchart of the authentication token comparison and network port control process of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Please refer to Figure 1 This embodiment provides a method for managing the identity access authentication of IoT devices. The IoT device is a wireless sensing terminal deployed in an industrial plant environment, and the access gateway is an edge access gateway of the plant's local area network. The IoT device and the access gateway interact with each other via a wireless local area network communication link. After powering on, the IoT device sends an access request message to the access gateway. The access request message carries the hardware identifier of the IoT device, which is a unique device serial number fixed at the factory. After receiving the access request message, the access gateway parses and obtains the hardware identifier, and generates a fixed-length true random number as a random challenge code using its internal true random number generator. The true random number generator generates a random sequence based on physical noise sources to ensure that each issued random challenge code is unpredictable. The access gateway encapsulates the generated random challenge code into a challenge response message and sends it to the corresponding IoT device via the wireless communication link. The radio frequency receiving unit of the IoT device receives the challenge response message, parses and extracts the random challenge code, and stores it in its internal static random access memory for subsequent calculations.

[0020] IoT devices extract currently collected physical environment parameters as auxiliary factors. The IoT device collects the current physical environment parameters through its internally integrated environmental sensing unit. The physical environment parameters include analog readings of three types of environmental variables: temperature, humidity, and light intensity. The analog-to-digital converter inside the IoT device converts the analog readings into fixed-length binary digital signals, and extracts these binary digital signals as the basic data for the auxiliary factors.

[0021] The IoT device concatenates the random challenge code and the auxiliary factor bit by bit to generate a combined incentive vector. The random challenge code is a fixed-length binary sequence, and the auxiliary factor is a binary sequence of the corresponding length. The random challenge code is used as the high-order segment, and the auxiliary factor as the low-order segment; these are concatenated bit by bit to generate the combined incentive vector of the corresponding length. The generation logic of the combined incentive vector is quantified by the following formula:

[0022] in, For the combined activation vector, This is a random challenge code. As an auxiliary factor, This indicates a bit concatenation operation.

[0023] The IoT device inputs the combined excitation vector into a physically unclonable circuit, stimulating the circuit to output a first response sequence. The physically unclonable circuit is integrated within the IoT device's chip and generates an unclonable response sequence based on inherent physical delay differences caused by process variations such as metal linewidth and oxide layer thickness during chip manufacturing. The combined excitation vector is input to the excitation input of the physically unclonable circuit, which selects the corresponding delay path based on each bit value of the combined excitation vector. Through signal competition across multiple delay paths, it generates a first response sequence uniquely corresponding to the combined excitation vector. The generation logic of the first response sequence is quantitatively described by the following formula:

[0024] in, This is the first response sequence. This represents the excitation-response mapping function of a physically unclonable circuit. This function is uniquely determined by the inherent physical characteristics of the chip. The same excitation input corresponds to a unique response output, different excitation inputs correspond to different response outputs, and the excitation input cannot be deduced from the response output.

[0025] The IoT device performs a one-way hash operation on the first response sequence using a preset hash function to generate an access authentication token, and sends the access authentication token to the access gateway. The preset hash function is a cryptographic hash algorithm compliant with national cryptographic management standards. The IoT device uses the first response sequence as the input message to the preset hash function, performs a one-way hash operation to generate a fixed-length hash value digest, extracts a fixed-length bit segment from the hash value digest as the body of the access authentication token, and appends the hash value of the device hardware identifier to the end of the body to generate the final access authentication token. The generation logic of the access authentication token is quantitatively described by the following formula:

[0026] in, For access authentication token, This represents a one-way hash operation of a preset hash function. The first part of the hash value digest Bit, The preset token body length, For hardware identifiers of IoT devices, The hash value of the hardware identifier. This represents a bit concatenation operation. IoT devices encapsulate the access authentication token, collected physical environment parameters, and device hardware identifier into an authentication request message, which is then sent to the access gateway via a wireless communication link.

[0027] The access gateway uses the physical environment parameters and the random challenge code as a joint search key in its locally stored shadow mapping library to extract the corresponding expected response hash value. The access gateway's local non-volatile memory stores the shadow mapping library, which pre-stores expected response hash values ​​generated by IoT devices during device registration and bound to different random challenge codes and physical environment parameters. Upon receiving an authentication request message, the access gateway parses it to obtain the physical environment parameters, device hardware identifier, and access authentication token. Using the parsed physical environment parameters and the randomly issued challenge code as a joint search key, it searches the shadow mapping library for the entry corresponding to that joint search key and extracts the expected response hash value stored in that entry.

[0028] The access gateway compares the expected response hash value with the access authentication token. If they match, the gateway allows the IoT device to establish a Transmission Control Protocol (TCP) connection. If they do not match, the access gateway disconnects the IoT device's network port. The access gateway then compares the extracted expected response hash value with the received access authentication token bit by bit. If all bits match, the IoT device is deemed legitimate, and the access gateway sends a TCP connection confirmation message to the IoT device, allowing it to establish a TCP connection with the backend server of the factory's local area network and forward the sensor data uploaded by the IoT device. If any bit does not match, the IoT device is deemed illegitimate, the access gateway disconnects the network port corresponding to the IoT device, discards all subsequent data packets sent by the IoT device, and generates an illegal access alarm log, storing it in the local alarm database.

[0029] In this embodiment, the bit allocation rules of the combined excitation vector are clearly defined in Table 1, ensuring that those skilled in the art can clearly understand the generation logic of the combined excitation vector and the physical meaning of each segment.

[0030] Table 1 Bit Allocation Table for Combined Excitation Vector

[0031] In this embodiment, a combined incentive vector is generated by concatenating a random challenge code with real-time collected physical environment parameters. This vector is then input into a physically non-clonable circuit to generate a first response sequence. An access authentication token is generated based on the first response sequence. The access gateway performs authentication by comparing the expected response hash value in the shadow mapping library. This eliminates the storage of static keys in traditional authentication schemes, removes the security risk of physical extraction of static keys, and achieves secure access authentication for IoT device identities.

[0032] In a preferred embodiment, the IoT device is a low-power sensor node deployed in an outdoor agricultural monitoring scenario, and the access gateway is an edge aggregation gateway for agricultural IoT. The IoT device and the access gateway interact with each other via a narrowband IoT communication link. After powering on, the IoT device sends an access request message to the access gateway, carrying the hardware identifier of the IoT device. Upon receiving the access request message, the access gateway parses and obtains the hardware identifier, generates a random challenge code, and sends it to the IoT device. The IoT device receives and parses the random challenge code, stores it in its internal memory, and obtains the random challenge code.

[0033] refer to Figure 2 The IoT device utilizes its integrated temperature, humidity, and light sensors to acquire current temperature, humidity, and light intensity readings. The IoT device continuously collects these readings at multiple time points according to a preset sampling frequency, constructing multiple sets of environmental time-series data. Each set of environmental time-series data corresponds to a type of environmental parameter, containing values ​​from multiple continuously collected sampling points. The IoT device calculates the variance of each set of environmental time-series data, discarding those with variances exceeding a preset fluctuation range, and determining the remaining environmental time-series data as valid environmental time-series data. The variance calculation logic for the environmental time-series data is quantified using the following formula:

[0034] in, This represents the variance of the environmental time series data. This represents the number of sampling points for the time series data. For the first Environmental parameter readings at each sampling point This represents the arithmetic mean of the environmental time series data. The calculation logic of the arithmetic mean is quantified using the following formula:

[0035] The preset fluctuation range is a pre-set variance threshold. Different types of environmental parameters correspond to different variance thresholds. If the variance value of a certain set of environmental time series data exceeds the corresponding variance threshold, the set of time series data is determined to have abnormal fluctuations and is removed. If the variance value is within the preset fluctuation range, it is determined to be valid environmental time series data.

[0036] The IoT device performs median filtering on the valid environmental time-series data, and uses the filtered result as the temperature reading, humidity reading, and light intensity reading for subsequent truncation processing. The median filtering operation sorts the sampled data points in the valid environmental time-series data in ascending order, selects the middle value of the sorted sequence as the median filtering output, and if the number of valid sampled points is even, selects the arithmetic mean of the two middle values ​​as the median filtering output. The logic of the median filtering operation is quantified by the following formula:

[0037] in, This is the output of the median filtering operation. This represents the median operation. The number of sampling points for effective environmental time series data. to These are the sampled point values ​​of the effective environmental time series data.

[0038] The IoT device performs truncation processing on the temperature reading, humidity reading, and light intensity reading, retaining binary data with a preset number of significant bits. The IoT device converts the temperature, humidity, and light intensity readings output by median filtering into fixed-length binary two's complement data, performs truncation processing on the binary two's complement data, retaining the high-order bits with a preset number of significant bits and removing low-order noise data, generating binary data of corresponding lengths for temperature, humidity, and light intensity, respectively.

[0039] The IoT device interleaves the truncated binary data according to the high-order segment corresponding to the temperature reading, the middle segment corresponding to the humidity reading, and the low-order segment corresponding to the light intensity reading, generating a fixed-length binary string of environmental features. This binary string is used as the auxiliary factor. The IoT device further divides the truncated temperature, humidity, and light intensity binary data into multiple equal-length segments, and interleaves these segments in the order of temperature, humidity, and light intensity to generate a fixed-length binary string of environmental features, which serves as the auxiliary factor. The generation logic of the auxiliary factor is quantified using the following formula:

[0040] in, The binary string representing the environmental features corresponding to the auxiliary factor. to Splitting the binary temperature data A sub-segment of equal length, to Splitting the humidity binary data A sub-segment of equal length, to The binary data of light intensity is split A sub-segment of equal length, This indicates a bit concatenation operation.

[0041] In this embodiment, the relevant parameter configurations for environmental parameter processing are specified in Table 2, ensuring that those skilled in the art can reproduce the complete generation process of auxiliary factors.

[0042] Table 2 Environmental Parameter Processing Parameter Configuration Table

[0043] refer to Figure 3 The IoT device concatenates the random challenge code and auxiliary factors bit by bit to generate a combined incentive vector. The generation logic of the combined incentive vector is consistent with that in the previous embodiment. The IoT device inputs the combined incentive vector into a physically unclonable circuit, stimulating the physically unclonable circuit to output a first response sequence. The physically unclonable circuit includes a multi-stage cascaded arbiter structure. The combined incentive vector is divided into multiple sub-vectors, the number of which is consistent with the number of stages in the arbiter structure. The length of each sub-vector corresponds to the control bit width of each stage of the arbiter.

[0044] The multiple sets of sub-vectors are respectively input to the gating control terminals in the multi-stage cascaded arbiter structure, controlling the switching state of the XOR gate array in each stage of the arbiter. Each stage of the arbiter structure is equipped with a multiplexer group, which includes a first selector and a second selector. Each set of sub-vectors is split into a high-order control field and a low-order control field. The high-order control field is input to the control terminal of the first selector, and the low-order control field is input to the control terminal of the second selector. The first selector and the second selector dynamically select a target delay line from a plurality of pre-wired metal delay lines according to their respective received control fields, and connect the target delay line to the input terminal of the XOR gate array, so that different bits of the combined excitation vector are mapped to different combinations of physical delay paths within the physically unclonable circuit. The first selector and the second selector of each stage of the arbiter are respectively connected to a plurality of pre-wired metal delay lines. Each metal delay line has a different physical length and a different corresponding signal transmission delay. The delay difference of the metal delay lines is inherently caused by process deviations in the chip manufacturing process. The first selector selects one of the multiple metal delay lines as the first target delay line based on the value of the high-order control field; the second selector selects one of the multiple metal delay lines as the second target delay line based on the value of the low-order control field. The outputs of the first and second target delay lines are respectively connected to the two inputs of the XOR gate array of the arbiter at this stage.

[0045] The XOR gate array selects the rising and falling edges of the input clock signal according to the switching state, generating multiple delayed signals with phase differences. The input of the physically unclonable circuit receives a global clock signal, which is a fixed-frequency square wave. The rising edge of the global clock signal is simultaneously input to the first and second selectors of each arbiter stage. After passing through the selected first and second target delay lines, a first delayed clock signal and a second delayed clock signal are generated, respectively. A phase difference exists between the first and second delayed clock signals due to the difference in delay line lengths. The XOR gate array performs an XOR operation on the first and second delayed clock signals to generate the output signal of that arbiter stage. This output signal is input to the input of the multiplexer group of the next arbiter stage, serving as the input clock signal for that stage.

[0046] The multiple delayed signals with phase differences are input to the final stage flip-flop. Based on the arrival order of the delayed signals, the final stage flip-flop outputs a first response sequence consisting of high and low levels. After processing by a multi-stage cascaded arbitrator structure, the two delayed signals output by the final stage arbitrator are input to the input and clock terminals of the final stage D flip-flop. The D flip-flop outputs corresponding level values ​​according to the arrival order of the two delayed signals. The time difference between the rising edges of the two delayed signals is quantified using the following formula:

[0047] in, The difference between the rising edges of the two delayed signals is the time difference between their arrival times. The arrival time of the rising edge of the first delayed signal. The rising edge arrival time of the second delayed signal is given. The output logic of the D flip-flop is quantized and described by the following formula:

[0048] in, This represents a single bit value in the first response sequence. A fixed-length first response sequence is generated by continuously sampling the global clock signal over multiple cycles.

[0049] The IoT device performs a one-way hash operation on the first response sequence using a preset hash function to generate an access authentication token. This access authentication token, along with collected physical environment parameters and the device hardware identifier, is encapsulated in an authentication request message and sent to the access gateway. The access gateway retrieves the corresponding expected response hash value from its locally stored shadow mapping library, using the physical environment parameters and a random challenge code as the joint search key. It then compares the expected response hash value with the access authentication token and executes the corresponding port control operation based on the comparison result. The relevant operation logic is consistent with that in the aforementioned embodiments.

[0050] In this embodiment, abnormal fluctuations and transient noise during the environmental parameter acquisition process are filtered out by variance elimination and median filtering, thereby improving the stability of the auxiliary factor. The bit diffusion characteristics of the auxiliary factor are enhanced by generating an environmental feature binary string through staggered interleaving. The non-cloning mapping from the combined excitation vector to the first response sequence is realized through a multi-level cascaded arbitrator structure and dynamic selection of the metal delay line by multiplexer, which further improves the anti-counterfeiting capability of the authentication process and prevents attackers from gaining unauthorized access by copying static credentials.

[0051] In a preferred embodiment, the IoT device is a power distribution terminal device deployed in a smart grid scenario, and the access gateway is the core access gateway of the power IoT. The IoT device and the access gateway interact with each other via a power line communication link. After power-on, the IoT device sends an access request message to the access gateway, which carries the hardware identifier of the IoT device. After receiving the access request message, the access gateway parses and obtains the hardware identifier, generates a random challenge code, and sends it to the IoT device. The IoT device receives and parses the random challenge code, collects physical environment parameters to generate auxiliary factors, concatenates the random challenge code and auxiliary factors to generate a combined excitation vector, and inputs it into a physically non-cloning circuit to generate a first response sequence. The relevant operation logic is consistent with the logic in the aforementioned embodiment.

[0052] refer to Figure 4 The IoT device uses a preset hash function to perform a one-way hash operation on the first response sequence to generate an access authentication token. The IoT device divides the first response sequence into multiple data blocks of equal length and sequentially fills these data blocks into the initial message buffer of the preset hash function. The preset hash function is the SM3 cryptographic hash algorithm, which conforms to national cryptographic management standards. It divides the first response sequence into multiple 128-bit data blocks of equal length and fills them sequentially into the initial message buffer of the SM3 algorithm according to the order in which the data blocks are generated. The initial message buffer has a length of 512 bits. Any bits less than 512 bits are padded according to the padding rules of the SM3 algorithm: first, a 1 bit is added to the end of the message, followed by several 0 bits, until the message length modulo 512 equals 448. Finally, the original message length value of 64 bits is added.

[0053] In each round of compression operations using the preset hash function, the IoT device introduces the auxiliary factor as a round constant to participate in the nonlinear permutation operation. Each round of compression operations using the preset hash function includes multiple step functions. In each step function, the input data of the current step function is cyclically shifted left by the corresponding bit segment in the auxiliary factor. The auxiliary factor is a fixed-length binary sequence, divided into multiple equal-length bit segments. Each group of consecutive step functions shares one auxiliary factor bit segment. In each step function, the input status word of the current step function is concatenated with the corresponding bit segment of the auxiliary factor to generate intermediate data. A cyclic left shift operation is then performed on the intermediate data, with the number of bits shifted left being the decimal value of the corresponding bit segment of the auxiliary factor. The logic of the cyclic left shift operation is quantified and described by the following formula:

[0054] in, For the first The output of the left shift operation of the step function. For the first The input status word of the step function. For the corresponding first auxiliary factor Bit segments of the step function This represents a bit concatenation operation. Indicates a circular left shift Bitwise operations for The corresponding decimal value.

[0055] The result of the left shift operation is input to one input of the modular adder, and the round constant of the current step function is input to the other input. The modular adder performs a modular operation on the values ​​at both inputs and inputs the output to the nonlinear logic function operation unit. Modular addition is a modulo operation. The addition operation uses the lower 32 bits of the output of the left circular shift operation as one input to the modulo addition operation, and the standard round constant of the current step function as the other input to the modulo addition operation. Addition. The logic of modular addition is quantified by the following formula:

[0056] in, The output of the modulo addition operation. The lower 32 bits of the output result of the circular left shift operation. For the first The cycle constant of the step function, Modulus Addition operations.

[0057] The nonlinear logic function operation unit performs combinational logic operations (bitwise AND, bitwise OR, and bitwise XOR) on the output of the modular arithmetic to generate an intermediate hash status word. The nonlinear logic function is a Boolean function corresponding to the SM3 algorithm. For the first 16 steps, the Boolean function is an XOR combinational logic; for subsequent steps, it is an AND and OR combinational logic. The output of the modular addition operation is used as the input variable of the Boolean function, and the corresponding combinational logic operation is performed to generate the intermediate hash status word for that step, updating the status value of the message buffer.

[0058] After completing iterative compression of all data blocks, the IoT device extracts the final output hash digest. After all rounds of compression operations on all data blocks, a preset hash function outputs a fixed-length hash digest, which is stored in the IoT device's internal memory. The IoT device extracts the first half of the hash digest and appends the hardware identifier hash value of the IoT device to the end of the first half, determining the resulting bit stream as the access authentication token. The hash digest is 256 bits; the first 128 bits are used as the token body. The IoT device's hardware identifier is a fixed-length unique device number, generated using the same preset hash function. The last 128 bits of this hash value are then appended to the end of the token body to generate a 256-bit access authentication token. The generation logic of the access authentication token is quantified using the following formula:

[0059] in, For access authentication token, This is the first response sequence. The first 128 bits of the hash value digest, For hardware identifiers of IoT devices, The last 128 bits of the hardware identifier hash value, This indicates a bit concatenation operation.

[0060] In this embodiment, the round parameter configuration of hash operation is specified in Table 3, ensuring that those skilled in the art can reproduce the complete generation process of access authentication token.

[0061] Table 3 Hash Operation Round Parameter Configuration Table

[0062] The IoT device encapsulates the access authentication token, collected physical environment parameters, and device hardware identifier into an authentication request message, which is then sent to the access gateway via a power line communication link. The access gateway, in its locally stored shadow mapping library, uses the physical environment parameters and the random challenge code as a joint search key to extract the corresponding expected response hash value. The shadow mapping library is stored using a multi-dimensional trie structure. The root node of the multi-dimensional trie structure corresponds to the hardware identifier of the IoT device, the first-level child nodes correspond to the discretized range of the physical environment parameters, the second-level child nodes correspond to historically issued random challenge codes, and the leaf nodes store the expected response hash values ​​bound to the random challenge code and the physical environment parameters. The root node is a hardware identifier index. Each root node has multiple first-level child nodes. Each first-level child node corresponds to a discretized range of physical environment parameters. Each first-level child node has multiple second-level child nodes. Each second-level child node corresponds to a historically issued random challenge code. Each second-level child node has a leaf node. The leaf node stores the corresponding expected response hash value. The expected response hash value is the hash value generated by the same one-way hash operation on the response sequence output by the physically unclonable circuit during the device registration stage, under the corresponding physical environment parameters and random challenge code input conditions.

[0063] refer to Figure 5 The access gateway performs discretization and quantization processing on the currently received physical environment parameters to determine their respective discretization intervals. The access gateway maintains a sliding window queue locally, which stores historical physical environment parameters sent by the IoT device within the historical authentication period. The length of the sliding window queue is a preset fixed value, storing historical physical environment parameters sent by the IoT device during the most recent successful authentication processes. After each successful authentication, the received physical environment parameters are added to the tail of the sliding window queue, while the oldest historical parameter value at the head of the queue is removed, thus achieving dynamic updates to the sliding window.

[0064] The access gateway calculates the moving average and moving standard deviation of historical physical environment parameters in the sliding window queue. The calculation logic of the moving average is quantified by the following formula:

[0065] in, This is a moving average of historical physical environment parameters. The length of the sliding window queue. For the first in the sliding window queue The historical physical environment parameter values. The calculation logic of the moving standard deviation is quantitatively described by the following formula:

[0066] in, This represents the moving standard deviation of historical physical environment parameters.

[0067] The access gateway divides the continuous physical environment parameter space into multiple non-overlapping discretized intervals, centered on the moving average and with boundaries equal to integer multiples of the moving standard deviation. Using the moving average as the center and a step size of 1 moving standard deviation, the physical environment parameter space is further divided into multiple non-overlapping discretized intervals, each interval corresponding to a unique interval index. The access gateway compares the currently received physical environment parameter with the boundary values ​​of these multiple non-overlapping discretized intervals, determining the discretized interval into which the currently received physical environment parameter falls.

[0068] The access gateway, based on the hardware identifier, the discretization interval, and the currently issued random challenge code, traverses the corresponding branch paths of the multidimensional trie structure and extracts the expected response hash value stored in the leaf nodes. First, the access gateway uses the parsed hardware identifier as an index to locate the root node of the multidimensional trie; then, using the determined discretization interval as an index, it traverses the first-level child nodes under the root node to locate the corresponding first-level child node; next, using the currently issued random challenge code as an index, it traverses the second-level child nodes under this first-level child node to locate the corresponding second-level child node; finally, it extracts the expected response hash value stored in the leaf node corresponding to this second-level child node.

[0069] refer to Figure 6 The access gateway compares the expected response hash value with the access authentication token. If they match, the gateway allows the IoT device to establish a Transmission Control Protocol (TCP) connection; otherwise, the gateway disconnects the IoT device's network port. The access gateway performs a bitwise XOR operation on the expected response hash value and the access authentication token, determining whether the result is a string of all zero bits. The logic of the XOR operation is quantified using the following formula:

[0070] in, The result of the XOR operation. The expected response hash value, For the received access authentication token, This represents a bitwise XOR operation. If If all bits are 0, the result of the XOR operation is a string of all zero bits; if any bit is 1, the result of the XOR operation is not a string of all zero bits.

[0071] If the XOR operation result is an all-zero bit string, the access gateway switches the port status identifier corresponding to the IoT device from the listening state to the authorized forwarding state, and sends a Transmission Control Protocol (TCP) connection confirmation message carrying a synchronization sequence number to the IoT device. The port status identifier of the access gateway is stored in a local port status register, with different identifier values ​​corresponding to different port states. After switching to the authorized forwarding state, the forwarding unit of the access gateway allows the port to receive and forward TCP messages from the IoT device. The IoT device can establish an end-to-end TCP connection with the power IoT master station system through the access gateway, upload power distribution monitoring data, and receive control commands issued by the master station system.

[0072] If the XOR operation result is not a string of all zero bits, the access gateway switches the port status identifier corresponding to the IoT device from listening state to blocking state, issues an access control list modification instruction to the switching chip, and discards subsequent data frames related to the media access control address of the IoT device. After switching to blocking state, the forwarding unit of the access gateway stops forwarding all packets on that port. The access gateway issues an access control list modification instruction to the internal switching chip, adding a denial rule to the access control list. The matching condition of the rule is that the source media access control address is equal to the media access control address of the IoT device, and the action of the rule is to discard all matching data frames. After the rule is added, the switching chip discards all subsequent data frames sent by the IoT device, and the access gateway generates an illegal access alarm and reports it to the power IoT security management platform.

[0073] In this embodiment, by introducing an auxiliary factor as a round constant in each round step function of the hash operation to participate in the cyclic left shift and modulo nonlinear permutation, the collision resistance and unpredictability of the hash operation are enhanced, preventing attackers from forging authentication tokens by pre-compiling hash values. The shadow mapping library is stored using a multi-dimensional trie structure, improving the retrieval efficiency of the expected response hash value and reducing the computational overhead of the access gateway. Dynamically dividing the discretized intervals using a sliding window queue allows the retrieval intervals of the shadow mapping library to match the long-term physical changes in the device deployment environment, improving the environmental adaptability of the authentication process. Token comparison is performed through bitwise XOR operations, combined with the switching of port status identifiers and the dynamic modification of the access control list, enabling rapid authorization of legitimate devices and precise blocking of illegitimate devices, thus ensuring the security of power distribution terminal equipment access in the power Internet of Things scenario.

Claims

1. A method for managing access authentication of an Internet of Things device identity, characterized by, include: IoT devices receive random challenge codes from the access gateway; The IoT device extracts the currently collected physical environment parameters as auxiliary factors; The IoT device concatenates the random challenge code with the auxiliary factor bitwise to generate a combined incentive vector. The IoT device inputs the combined excitation vector into the physically unclonable circuit, which then excites the physically unclonable circuit to output a first response sequence. The IoT device uses a preset hash function to perform a one-way hash operation on the first response sequence to generate an access authentication token, and sends the access authentication token to the access gateway; The access gateway extracts the corresponding expected response hash value from the locally stored shadow mapping library, using the physical environment parameters and the random challenge code as a joint retrieval key. The access gateway compares the expected response hash value with the access authentication token. If the comparison matches, the IoT device is allowed to establish a Transmission Control Protocol (TCP) connection. If the comparison does not match, the access gateway disconnects the network port of the IoT device.

2. The IoT device identity access authentication management method according to claim 1, characterized in that, The IoT device extracts currently collected physical environment parameters as auxiliary factors, including: The IoT device calls upon its internally integrated temperature sensor, humidity sensor, and photosensor to obtain the current temperature reading, humidity reading, and light intensity reading. The IoT device performs truncation processing on the temperature reading, humidity reading, and light intensity reading respectively, retaining binary data with a preset number of significant bits; The IoT device arranges the truncated binary data in a staggered manner according to the high segment corresponding to the temperature reading, the middle segment corresponding to the humidity reading, and the low segment corresponding to the light intensity reading, to generate a fixed-length environmental feature binary string, and uses the environmental feature binary string as the auxiliary factor.

3. The IoT device identity access authentication management method according to claim 1, characterized in that, The IoT device inputs the combined excitation vector into a physically unclonable circuit, stimulating the physically unclonable circuit to output a first response sequence, including: The physically unclonable circuit comprises a multi-stage cascaded arbiter structure, and the combined excitation vector is divided into multiple sets of sub-vectors. The multiple sets of sub-vectors are respectively input to the gating control terminal in the multi-level cascaded arbitrator structure to control the switching state of the XOR gate array in each level of the arbitrator. The XOR gate array selects the path of the rising edge and falling edge of the input clock signal according to the switching state, generating multiple delayed signals with phase differences. The multiple delayed signals with phase differences are input to the final stage flip-flop, and the final stage flip-flop outputs the first response sequence consisting of high and low levels based on the arrival order of the delayed signals.

4. The IoT device identity access authentication management method according to claim 1, characterized in that, The IoT device uses a preset hash function to perform a one-way hash operation on the first response sequence to generate an access authentication token, including: The IoT device divides the first response sequence into multiple data blocks of equal length and fills the multiple data blocks sequentially into the initial message buffer of a preset hash function; In each round of compression operation of the preset hash function, the IoT device introduces the auxiliary factor as a round constant to participate in the nonlinear permutation operation; After completing the iterative compression of all data blocks, the IoT device extracts the final output hash value digest. The IoT device extracts the first half of the hash value digest and appends the hardware identifier hash value of the IoT device to the end of the first half, and determines the appended bit stream as the access authentication token.

5. The IoT device identity access authentication management method according to claim 1, characterized in that, The access gateway extracts the corresponding expected response hash value from the locally stored shadow mapping library, using the physical environment parameters and the random challenge code as a joint retrieval key, including: The shadow mapping library is stored in a multidimensional trie structure. The root node of the multidimensional trie structure corresponds to the hardware identifier of the IoT device, the first-level child nodes correspond to the discretized range of physical environment parameters, the second-level child nodes correspond to the random challenge codes that have been issued in the past, and the leaf nodes store the expected response hash values ​​that are bound to the random challenge codes and the physical environment parameters. The access gateway performs discretization and quantization processing on the currently received physical environment parameters to determine the discretization interval to which they belong. The access gateway, based on the hardware identifier, the discretization interval, and the currently issued random challenge code, traverses the corresponding branch paths of the multidimensional trie structure and extracts the expected response hash value stored in the leaf nodes.

6. The IoT device identity access authentication management method according to claim 1, characterized in that, The access gateway compares the expected response hash value with the access authentication token. If they match, the gateway allows the IoT device to establish a Transmission Control Protocol (TCP) connection. If they do not match, the access gateway disconnects the IoT device's network port, including: The access gateway performs a bitwise XOR operation between the expected response hash value and the access authentication token, and determines whether the XOR operation result is a string of all zero bits. If the result of the XOR operation is a string of all zero bits, the access gateway switches the port status identifier corresponding to the IoT device from the listening state to the authorized forwarding state, and sends a Transmission Control Protocol connection confirmation message carrying a synchronization sequence number to the IoT device. If the result of the XOR operation is not a string of all zero bits, the access gateway switches the port status identifier corresponding to the IoT device from the listening state to the blocking state, sends an access control list modification instruction to the switching chip, and discards subsequent data frames related to the media access control address of the IoT device.

7. The IoT device identity access authentication management method according to claim 2, characterized in that, Before the IoT device performs truncation processing on the temperature reading, humidity reading, and light intensity reading, it further includes: The IoT device continuously collects temperature, humidity and light intensity readings at multiple time points according to a preset sampling frequency, and constructs multiple sets of environmental time series data. The IoT device calculates the variance of each set of environmental time series data, removes environmental time series data whose variance exceeds a preset fluctuation range, and determines the remaining environmental time series data as valid environmental time series data. The IoT device performs median filtering on the valid environmental time series data, and uses the filtered result output by the median filtering operation as the temperature reading, the humidity reading, and the light intensity reading for subsequent truncation processing.

8. The IoT device identity access authentication management method according to claim 3, characterized in that, The multiple sets of sub-vectors respectively correspond to the gating control terminals input to the multi-level cascaded arbitrator structure, including: Each arbitrator in the arbitrator structure is configured with a multiplexer group, which includes a first selector and a second selector. Each set of subvectors is split into a high-order control field and a low-order control field. The high-order control field is input to the first selector, and the low-order control field is input to the second selector. The first selector and the second selector dynamically select a target delay line from a pre-wired array of multiple metal delay lines according to the control fields they receive, and connect the target delay line to the input of the XOR gate array, so that different bits of the combined excitation vector are mapped to different combinations of physical delay paths within the physically unclonable circuit.

9. The IoT device identity access authentication management method according to claim 4, characterized in that, The IoT device introduces the auxiliary factor as a round constant in each round of compression operation of the preset hash function to participate in the nonlinear permutation operation, including: Each round of compression operation of the preset hash function includes multiple step functions. In each step function, the input data of the current step function is cyclically shifted left by the corresponding bit segment in the auxiliary factor. The result of the left shift operation is input to one input of the modular arithmetic unit, and the round constant of the current step function is input to the other input of the modular arithmetic unit. The modular arithmetic unit performs modular arithmetic on the values ​​at the two input terminals and inputs the output of the modular arithmetic to the nonlinear logic function arithmetic unit. The nonlinear logic function arithmetic unit performs combinational logic operations of bitwise AND, bitwise OR and bitwise XOR on the output of the modular arithmetic to generate an intermediate hash status word.

10. The IoT device identity access authentication management method according to claim 5, characterized in that, The access gateway performs discretization and quantization processing on the currently received physical environment parameters to determine the corresponding discretization interval, including: The access gateway maintains a sliding window queue locally, and the sliding window queue stores historical physical environment parameters sent by the IoT device within a historical authentication period. The access gateway calculates the moving average and moving standard deviation of historical physical environment parameters in the sliding window queue; The access gateway divides the continuous physical environment parameter space into multiple non-overlapping discretized intervals, centered on the moving average and bounded by integer multiples of the moving standard deviation. The access gateway compares the currently received physical environment parameters with the boundary values ​​of the multiple non-overlapping discretization intervals, and determines the discretization interval to which the currently received physical environment parameters fall.

Images