Dynamic trust and identity authentication method for manet

Abstract

The application discloses a kind of dynamic trust and identity authentication methods for MANET, it includes: deploying blockchain network on MANET and registering decentralized identity;Between neighbor nodes, two-way identity authentication is realized based on elliptic curve cryptosystem and zero-knowledge proof and mutual transmission of verifiable credential;Non-neighbor nodes build multi-hop authentication chain through intermediate nodes, and realize selective information disclosure by using verifiable expression to complete cross-node authentication;A variety of group differential evolution improved arithmetic optimization algorithm is used to automatically tune the super parameters of lightweight machine learning model, to build a dynamic trust evaluation model, to identify internal malicious nodes in real time;Based on the principle of large prime product, decentralized verifiable credential revocation and permission management are realized.The application eliminates the dependence on centralized authentication agency, adapts to the characteristics of MANET multi-hop communication, has the ability to dynamically defend against internal malicious node attacks, and has good security and scalability.

Description

Technical Field

[0001] This invention relates to the field of mobile self-organizing network security technology, specifically to a dynamic trust and identity authentication method and system for MANET. Background Technology

[0002] Mobile Ad-Hoc Networks (MANETs) are decentralized, self-organizing wireless networks that have attracted widespread attention from academia and industry due to their unique network architecture and application advantages. MANETs possess significant characteristics such as multi-hop communication, dynamic topology, and resource constraints. While these characteristics grant MANETs greater network flexibility, they also expose them to more complex network security threats.

[0003] While traditional security authentication technologies can defend against external security threats, they have significant limitations in dealing with malicious nodes within a MANET. Existing MANET identity authentication schemes suffer from the following main problems: First, they have low decentralization, relying on trusted third parties such as cluster head nodes or lightweight authentication centers, which poses a single point of failure risk. Second, they are insufficiently adapted to the multi-hop nature of MANET networks, leading to message loss and increased latency during multi-hop transmission of authentication messages. Third, they lack effective defense against internal malicious nodes, which may obtain legitimate authentication information and bypass the authentication process to launch attacks.

[0004] While blockchain-based authentication technologies have been researched in other fields, their application in the MANET environment still faces challenges such as performance bottlenecks, privacy risks, and limitations in smart contract applications. Therefore, there is an urgent need to propose a fully decentralized identity authentication scheme that is adapted to the characteristics of the MANET network and possesses dynamic trust assessment capabilities. Summary of the Invention

[0005] This invention aims to address the problems of low decentralization, insufficient adaptation to network characteristics, and lack of defense against malicious internal nodes in existing MANET identity authentication schemes. It provides a dynamic trust and identity authentication method and system for MANET. This invention introduces blockchain technology and combines it with machine learning algorithms to achieve fully decentralized identity authentication and dynamic trust assessment in the MANET environment, effectively resisting attacks from both internal and external malicious nodes.

[0006] To achieve the above objectives, the present invention provides a dynamic trust and authentication method for MANETs, ​​comprising five steps: network initialization and identity registration, neighbor node authentication, non-neighbor node authentication, dynamic trust assessment, and access control and credential revocation. Specifically:

[0007] Step S1, Network Initialization and Identity Registration: Deploy a blockchain network on the mobile ad hoc network MANET, and deploy smart contracts related to identity registration and authentication functions in the blockchain network; each network node generates public-private key pairs based on elliptic curve cryptography algorithm, creates a decentralized identity (DID) and a corresponding decentralized identity document (DID document). The DID document contains a decentralized identity identifier, public key information and authentication method, and stores the DID document in the blockchain system.

[0008] Step S2, Neighbor Node Identity Authentication: Neighboring nodes exchange decentralized identities (DIDs) and obtain each other's public keys from the blockchain network. They then perform decentralized two-way identity authentication based on elliptic curve cryptography. After successful authentication, both parties issue verifiable credentials to each other.

[0009] Step S3, Non-neighbor node authentication: When the source node needs to establish an authentication relationship with the target node that cannot communicate directly, it uses the underlying routing protocol to discover the path from the source node to the target node, forwards the authentication request sequentially through each intermediate node in the path and adds its own verifiable credentials, constructs a multi-hop authentication chain, and uses verifiable representations to achieve selective information disclosure, thus completing the two-way authentication between non-neighbor nodes.

[0010] Step S4, Dynamic Trust Assessment: During network operation, behavioral data of each node is continuously collected, trust features are extracted, and a lightweight machine learning model optimized by the MPDE-AOA algorithm is used to dynamically assess the trust of the nodes. When the trust value of a node is lower than a preset threshold, the node is determined to be untrustworthy and corresponding security response measures are triggered.

[0011] AOA stands for Arithmetic Optimization Algorithm.

[0012] MPDE-AOA, or Multi-Population Differential Evolution Improved Arithmetic Optimization Algorithm, is a algorithm that improves arithmetic optimization through multi-population differential evolution.

[0013] Step S5, Access Control and Credential Revocation: A decentralized credential revocation mechanism based on the product of large prime numbers is adopted. When issuing verifiable credentials, the issuer selects large prime numbers from the public prime number file, writes their index into the credential attributes, and publishes the product of large prime numbers corresponding to all its unrevoked credentials. The verifier verifies whether the credential has been revoked by integer division, without relying on a centralized certification authority.

[0014] Furthermore, in step S1, the DID document does not contain the user's personal privacy information, but only publicly verifiable information such as the public key and the cryptographic algorithm used. The user's private key is stored locally, and only the DID document is stored on the blockchain; the user's privacy information is not stored on the blockchain.

[0015] Further, the specific process of neighbor node identity authentication in step S2 is as follows: The first node sends an authentication request to the second node, which includes a timestamp, a random number, and its own identifier; after verifying the validity of the timestamp, the second node obtains the first node's public key from the blockchain network, generates a random number and a hash value, signs the hash value using its own private key, and returns it; the first node obtains the second node's public key from the blockchain and verifies the signature, confirming the legitimacy of the second node's identity; subsequently, the first node generates a new random number, concatenates the random numbers from both parties with the timestamp, signs it with its private key, and sends it to the second node; the second node verifies the signature and completes the two-way authentication.

[0016] Furthermore, in step S3, the Verifiable Presentation (VP) for non-neighbor node authentication supports selective information disclosure. Users only need to disclose the original text of some fields in the verifiable credential, replacing the remaining fields with hash values. The verifier calculates the hash values ​​of the disclosed fields and reconstructs the credential structure, then verifies the signature using the publisher's public key, thereby confirming the legitimacy of the VP. In this way, the complete verifiable credential does not need to be exposed during multi-hop authentication, and the identity authentication relationship between non-neighbor nodes is securely established by leveraging the transitivity of trust.

[0017] Furthermore, in step S4, the improvements of the MPDE-AOA algorithm to the basic arithmetic optimization algorithm AOA include: dividing the population into multiple subpopulations, with each subpopulation using its own best individual to update its position, replacing the single guidance method of the globally best individual in the original algorithm, thereby improving population diversity; and after each iteration, performing crossover, mutation, and selection operations of the differential evolution algorithm on the best individuals generated by each subpopulation, thereby realizing information exchange and co-evolution among multiple populations.

[0018] Furthermore, in step S4, the trust assessment uses a decision tree algorithm or a random forest algorithm as the base model, and the MPDE-AOA algorithm is used to automatically tune the hyperparameters of the base model. (From a macroscopic perspective...) As the objective function, the model's hyperparameters are iteratively optimized by transforming the maximization problem into a minimization problem. The trust assessment model is periodically retrained based on newly labeled malicious node information and trust feature information generated during network operation to adapt to changes in the network environment.

[0019] Furthermore, the decentralized credential revocation mechanism in step S5 is based on the following mathematical principle: for any integer greater than 1, if the integer is not a prime number, it can be uniquely represented as a product of a series of prime numbers; and currently there is no efficient algorithm to perform integer factorization on the semiprime number obtained by multiplying two sufficiently large prime numbers. Therefore, even if a malicious node obtains a publicly available large number on the blockchain, it cannot make its revoked verifiable credential pass verification by forging a large prime number.

[0020] Secondly, this invention provides a dynamic trust and identity authentication system for MANETs, ​​comprising: an identity management module for generating and managing decentralized identities (DIDs) of nodes, handling the issuance, revocation, and generation of verifiable credentials; an authentication module for executing decentralized bidirectional identity authentication protocols between neighboring and non-neighboring nodes, supporting multi-hop authentication coordination; a trust assessment module for collecting node behavior data and using a lightweight machine learning model optimized by MPDE-AOA to perform dynamic trust assessment of nodes; a data storage module for securely storing and querying DID documents, authentication records, and trust assessment logs based on blockchain; and a visualization interface module for displaying network topology and node trust status information.

[0021] The dynamic trust and identity authentication method of this invention for MANET has the following beneficial effects:

[0022] (1) Fully decentralized: Using blockchain as a distributed public key infrastructure, combined with decentralized identity (DID) technology, it eliminates the dependence on centralized certification authorities, avoids the risk of single point of failure, and improves the robustness and anti-attack capability of the system.

[0023] (2) Adapting to MANET multi-hop characteristics: It implements a mechanism for non-neighbor nodes to build a multi-hop authentication chain through intermediate nodes. During the authentication process, verifiable expressions are used to selectively disclose information, which protects user privacy while realizing cross-node trust transfer and fully adapts to the multi-hop communication characteristics of MANET.

[0024] (3) Dynamic trust assessment: A lightweight machine learning model optimized by a multi-group differential evolution improved arithmetic optimization algorithm can perform real-time and dynamic trust assessment of node behavior, effectively defend against attacks from internal malicious nodes, and make up for the shortcomings of traditional authentication schemes in defending against internal attacks.

[0025] (4) Decentralized voucher management: Based on the voucher revocation mechanism of large prime number product and integer division operation, it realizes the autonomous management of verifiable vouchers without the need for a centralized institution, and uses mathematical principles to ensure the security and non-forgeability of the revocation operation.

[0026] (5) Good scalability: The method of establishing authentication relationships on demand avoids the network load caused by broadcasting across the entire network. As the network scale increases, the authentication performance only increases linearly with the path length, which has good scalability. Attached Figure Description

[0027] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0028] Figure 1 This is a flowchart of the decentralized identity authentication process of this invention.

[0029] Figure 2 This is a timing diagram for neighbor node identity authentication in this invention.

[0030] Figure 3 This is a timing diagram for non-neighbor node identity authentication in this invention.

[0031] Figure 4 This is a schematic diagram showing the before and after the revocation of the verifiable certificate according to the present invention.

[0032] Figure 5 This is a flowchart of the decentralized identity authentication system for mobile self-organizing networks of the present invention.

[0033] Figure 6 This is a graph showing the node authentication performance under different numbers of nodes. Detailed Implementation

[0034] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this invention.

[0035] The present invention provides a dynamic trust and identity authentication method for MANET, which is achieved through the following two aspects:

[0036] (a) MANET Decentralized Identity Authentication Based on Blockchain

[0037] This invention proposes a decentralized identity authentication protocol for Mobile Ad Hoc Networks (MANETs). To address the single point of failure issues caused by the high degree of centralization in traditional solutions, decentralized identity and zero-knowledge proof technologies are introduced to construct a distributed identity infrastructure. Considering the multi-hop communication characteristics of MANETs, ​​decentralized multi-hop bidirectional identity authentication between nodes is implemented, and a mechanism for managing and revoking authentication permissions is designed to support node self-management. Furthermore, trust assessment logic is integrated into the authentication process to address the threat of malicious internal nodes. Analysis and experimental results show that this protocol not only effectively addresses security threats such as single points of failure but also significantly outperforms traditional centralized identity authentication technologies in terms of performance and computational overhead.

[0038] The MANET decentralized identity authentication model, based on blockchain, comprises three entities: nodes, users, and the blockchain network. Nodes are the basic building blocks of MANET, possessing wireless communication capabilities and certain computing and storage resources. Relationships between nodes are categorized as neighboring nodes and non-neighboring nodes based on their ability to directly establish communication. Users are individuals or entities that communicate, obtain services, or share resources through nodes. The blockchain network is deployed by the nodes themselves, using a consensus mechanism to ensure the immutability of on-chain information, serving as a distributed public key infrastructure to replace the functions of traditional authentication centers.

[0039] During network initialization, nodes establish connections via physical channels, deploying the blockchain on MANET or connecting to existing blockchain networks. Smart contracts related to identity registration and authentication functions are deployed within the blockchain network (referencing the decentralized identity identifier technical standard developed by the W3C working group, aiming to achieve decentralized identity authentication between nodes). Users first generate public-private key pairs based on elliptic curve cryptography, then package the public key and related information together to form a DID document. The DID document contains fields such as the DID identifier, public key information, and authentication method, but does not contain specific personal privacy information of the user. The DID document is stored on the blockchain system and corresponds to a unique DID identifier. Users can use their private keys to control the DID, such as updating or revoking it. The Decentralized Identity (DID) concept emphasizes users' autonomous control over their own digital identities. The identity verification and information storage processes involved all adopt a decentralized model, while also requiring compliance with security, privacy, and trust requirements. During identity authentication, users do not need to rely on trusted third-party institutions, but instead utilize a decentralized blockchain to directly complete identity authentication with other users through zero-knowledge proofs. The blockchain network stores users' public keys and other verification information, but it does not store users' private information. The immutability of the blockchain can prevent important parameters such as public keys from being attacked and tampered with. At the same time, keeping private information off the blockchain also protects users' information from being stolen.

[0040] Furthermore, node resources in mobile ad hoc networks are typically extremely limited. Network nodes generally lack sufficient computing resources, and the overall network load capacity is low. Therefore, an on-demand request strategy is adopted for node authentication and authentication information updates. Specifically, nodes only perform authentication operations with nodes that have actual data interaction needs, rather than building a unified identity authentication system across the entire network. This approach not only enables rapid deployment of the authentication mechanism, effectively reducing the time cost of initial configuration, but also significantly reduces network load, avoiding network congestion caused by large-scale authentication operations, and fully adapts to the limited node resources of mobile ad hoc networks.

[0041] The multi-hop nature of mobile ad hoc networks is also an important characteristic that cannot be ignored. In actual operation, network nodes may not be able to establish direct connections due to limitations in wireless signal strength. In this case, it is necessary to rely on other intermediate nodes to form a multi-hop path to achieve communication. Based on these characteristics, this protocol focuses on building a multi-hop authentication chain during the authentication process. When the two communicating nodes cannot connect directly, a reliable authentication path can be built through intermediate nodes, thereby successfully establishing an authentication relationship and ensuring the security and stability of network communication in complex topologies.

[0042] Finally, to address the threat of malicious nodes within mobile ad hoc networks, a trust assessment mechanism is needed to identify and eliminate them. Since centralized trust assessment models are ill-suited for decentralized mobile ad hoc networks, a distributed trust assessment scheme is adopted. A lightweight trust assessment module is deployed within each node, scoring the node's trust value based on historical data of inter-node interactions and user annotation information. For nodes with trust values ​​below a threshold, authentication protocols are used to deny them permissions or revoke existing permissions, thereby protecting the network from intrusion by malicious nodes.

[0043] The decentralized identity authentication process design proposed in this invention is as follows: Figure 1 As shown:

[0044] (1) First, the node initializes and establishes the network. Users register their DID identity, and the corresponding DID document is stored in the blockchain network. Users log in to the node using their registered DID identity.

[0045] (2) After that, neighboring nodes use DID identity to complete identity authentication and issue verifiable credentials (VC) to each other. VC is used for subsequent communication between nodes.

[0046] (3) Establish authentication chains between non-neighboring nodes as needed to achieve multi-hop identity authentication in local network areas.

[0047] (4) Before establishing an authentication relationship with other nodes and after maintaining the authentication relationship for a period of time, a trust assessment needs to be performed on the relevant nodes in order to identify malicious nodes in a timely manner.

[0048] (5) Users can update or revoke their own verifiable credentials based on the trust assessment results and other actual needs, so as to realize the autonomous dynamic management of identity authentication and permissions.

[0049] In this invention, the field descriptions of the DID document are shown in Table 1:

[0050]

[0051] The DID document is stored on the blockchain system and corresponds to a unique DID. Users can control this DID using their private keys, such as updating or revoking it. The DID document does not contain specific personal privacy information of the user, but only publicly verifiable information such as the public key and the cryptographic algorithm used. After registration, only the DID document is uploaded to the blockchain; the user's important privacy information will not be uploaded, thus greatly improving security.

[0052] Because node resources are limited in mobile ad hoc networks, using broadcast authentication for the entire network would result in a huge network load. Therefore, in the initial stages of network establishment, authentication is prioritized with neighboring nodes with whom direct connections can be established. For non-neighboring nodes, authentication requests are only sent to the corresponding user when the user needs to request resources and services from other users.

[0053] The neighbor node authentication process is as follows: Figure 2 As shown, taking nodes A and B as an example, nodes A and B are neighbors. The specific authentication process is as follows: Node A sends an authentication request to node B containing a timestamp, a random number, and its own DID; after verifying the timestamp, node B obtains node A's public key from the blockchain, generates a random number, calculates its hash value, signs it with its own private key, and returns it; node A obtains node B's public key from the blockchain, verifies the signature, and confirms node B's legitimate identity; subsequently, node A generates a new random number, concatenates both random numbers and the timestamp, signs it with its private key, and sends it to node B; node B verifies the signature and completes the two-way authentication. After authentication, both parties exchange verifiable credentials.

[0054] Further, based on the sequence diagram, the neighbor node authentication process is as follows:

[0055] (1) Node A and Node B have registered their DID identities and logged in. Their public keys, private keys, and DIDs are respectively .

[0056] (2) Node A sends an authentication request RA to Node B, which includes timestamp information. random numbers and one's own .

[0057] (3) After receiving the request RA, node B first checks The validity of, and then according to Obtain the public key of node A in the blockchain network. Generate random numbers And using RA and Generate a hash value after concatenation Use your own private key right Signature obtained ,return .

[0058] (4) Node A uses Obtain from the blockchain network Then use For signature Decryption and recalculate ,Will and If the comparison is successful, user B's identity is confirmed as legitimate, and authentication is passed.

[0059] (5) Following (2) to (4), node A generates random numbers. ,Will , and timestamp Concatenate using your own private key Signature generation Send RA2 to node B. RA2 contains... , and .

[0060] (6) Node B check The validity of the signature Decryption yields information ,and If the comparison is successful and the nodes are equal, then node A's identity is confirmed as legitimate, and the two-way authentication between nodes is successful.

[0061] After authentication, Node A and Node B will generate verifiable credentials (VCs) for each other. These VCs can then be used to request services and resources from the other node. Different services and resources require different permissions. Users only provide the information corresponding to the requested resource / service from the VCs, without providing information unnecessary during authentication; this is called selective representation. Nodes need to generate corresponding verifiable representations based on specific requirements and their own VCs. The content of the VCs is shown in Table 2.

[0062]

[0063] The authentication process for non-neighbor nodes is as follows: Figure 3 As shown. Due to the multi-hop nature of mobile ad hoc networks, nodes cannot directly connect to each other but need to form links through other nodes. Therefore, an authentication chain is also required during identity authentication. Taking nodes A, C, G, and H as an example, node G and node H are non-neighboring nodes, but node A and node G are neighbors, node A and node H are neighbors, and node C is the authentication process node. First, the source node G (i.e., node G) performs direct identity authentication with its neighbor node A, obtaining verifiable credentials from each other. When the source node G needs to establish an authentication relationship with the target node H (i.e., node H), it discovers at least one path using the underlying routing protocol and sends an authentication request to the next node in the path. After each intermediate node verifies the validity of the previous node's credentials, it writes its own next-hop credentials, signs them with its private key, and forwards them. After the target node H receives the request and verifies it, it generates a response and returns it in reverse along the path. During the authentication process, verifiable representations are used to achieve selective information disclosure, protecting user privacy by disclosing only the original text of necessary fields and providing hash values ​​for the remaining fields.

[0064] Further, based on the sequence diagram, the non-neighbor node authentication process is as follows:

[0065] (1) The source node G and the neighbor node A perform direct identity authentication and obtain verifiable credentials from each other.

[0066] (2) When the source node G needs to establish an authentication relationship with a target node H, it first uses the underlying routing protocol (such as AODV, DSR, etc.) to discover at least one path from the source node to the target node.

[0067] (3) After obtaining the path, the source node G sends an authentication request to the next node C in the path. The request content includes: the DID of the source node, the DID of the target node, and the verifiable credentials held by the source node. The complete path from source node G to target node H. This represents a verifiable credential issued by node C to source node G, which source node G can use to obtain resources from node C.

[0068] (4) Assume that the intermediate node in the path is numbered k, and k receives the previous node When sending or forwarding an authentication request, verify The validity of the authentication request is verified, and if the verification passes, the following information is written to the authentication request: It then signs the new authentication request with its own private key and sends the new authentication request and signature to the next node. .

[0069] (5) When the target node H receives the authentication request, it verifies the signature of the last intermediate node k and all verifiable credentials. If the verification passes, authentication is successful. A random number is then generated. and hash value Using your own private key right Signature obtained Send an authentication request reply to the last intermediate node k, which includes... , The source node's DID, the target node's DID, and the verifiable credentials held by the target node. The complete path from source node G to target node H.

[0070] (6) Assume that the intermediate node in the path is numbered k, and k receives the node When responding to the authentication request, verify The validity of the verification is checked, and if the verification passes, the following is added to the authentication request: It then signs the new authentication request with its own private key and sends the new authentication request and signature to the node. .

[0071] (7) After receiving the reply from the target node H, the source node G uses the public key of the target node H to decrypt the signature to obtain the result. Recalculate automatically If the results are equal after comparison, the identity of the target node H is confirmed to be legitimate, and multi-hop authentication is completed.

[0072] After the authentication chain is formed, authentication relationships and multi-hop paths are also established between non-neighbor nodes, enabling subsequent data transmission. When establishing an authentication relationship with a non-neighbor node, verifiable credentials are transmitted in the network. However, these credentials may contain important user information, some of which is not needed when establishing authentication with non-neighbor nodes. For security reasons in mobile ad hoc networks, users do not want to disclose this information to other nodes; therefore, selective disclosure is required. The specific method is as follows:

[0073] The intermediate user selects the set of fields to be disclosed (which can be one or more fields). The fields to be disclosed are provided in their original text, and the other fields are provided with their hash values. A verifiable credential containing this Claim structure is sent to the source node. This verifiable credential is also called a Verifiable Presentation (VP). The following is the verification process of the source node: (1) The user extracts the fields disclosed by the other party from the VP; (2) The user calculates the hash value of each disclosed field and then obtains a Claim structure containing the hash values ​​of all fields; (3) The hash values ​​of each field in this Claim structure are concatenated to form a string. Then, together with the other existing fields of Credential, a new VP structure is formed for calculating the hash value; (4) For this structure containing The hash value is calculated from the VP structure to obtain... (5) Decode the Signature in the VP and the publisher's public key to obtain a calculated signature value; (6) Compare the calculated value of the Credential Hash with the calculated signature value. If they are equal, the legitimacy of the VP can be confirmed. In this way, when performing multi-hop authentication, the complete verifiable credentials can be avoided by using verifiable representations as a tool for trust transfer. Without revealing too much information, the transitivity of trust can be used to establish identity authentication between non-neighboring nodes more securely.

[0074] The revocation of verifiable credentials employs a decentralized mechanism based on the product of large prime numbers. A file containing large prime numbers is publicly available on the blockchain system, with each prime number corresponding to an index. When issuing a verifiable credential, a prime number is randomly selected from the prime number file, and its index is written into the credential's attributes. Each user multiplies the large prime numbers corresponding to all their unrevoked credentials to obtain a large number (denoted as Ac) and publishes it. The verifier divides the large prime number Ac published by the issuer by the large prime number corresponding to the credential; if the division is even, the credential is valid. When revoking a credential, the issuer simply divides its own maintained large prime number Ac by the large prime number corresponding to the credential and updates the published value.

[0075] In traditional PKI authentication, a certification center is needed to maintain and manage certificates. When a certificate expires or an organization becomes untrustworthy, the certification center needs to update or revoke the certificate. To achieve flexible management of authentication information and permissions in a decentralized mobile ad hoc network, this invention designs a method based on blockchain and the difficult mathematical principle of large integer factorization to achieve decentralized management of verifiable credentials. When the authenticator needs to verify the validity of a received verifiable credential, it only needs to use the corresponding index in the verifiable credential to find the corresponding large prime number in a large prime number file. This large prime number is then divided by all publicly available large numbers Ac recorded by the publisher in the verifiable credential. If the division is even, it indicates that the verifiable credential has not been revoked. If the publisher needs to revoke its own published verifiable credential, it needs to divide the large prime number corresponding to the verifiable credential by the large number Ac maintained by the publisher and update the value of Ac. Figure 4 As shown. Through the above operations, the publisher can revoke the specified verifiable credentials. This function involves the following two aspects.

[0076] (1) For any integer greater than 1, if the integer is not a prime number, the integer can be represented as a product of a series of prime numbers, and this representation is unique regardless of the order.

[0077] (2) There is currently no efficient algorithm to perform integer decomposition on the semiprime obtained by multiplying two sufficiently large prime numbers.

[0078] Based on the above two points, it can be seen that if the publisher revokes the verifiable credential issued to a malicious node due to security issues, even if the malicious node can obtain a large number Ac on the blockchain, it will not be able to use its own verifiable credential to impersonate a valid verifiable credential by forging a large prime number in the verifiable credential. This achieves a decentralized yet secure and reliable verifiable credential management mechanism.

[0079] Regarding overall network load, since this protocol adopts an on-demand authentication approach, it eliminates the need to establish authentication relationships between all nodes across the network, thus effectively reducing network load. Furthermore, this protocol eliminates the need for a central authentication authority to manage authentication relationships. Through the decentralized permission management method proposed in this invention, users can independently manage and revoke verifiable credentials, effectively controlling their own authentication information. This avoids system bottlenecks caused by excessive load on the authentication authority and prevents network congestion caused by periodic network certificate broadcast updates, further reducing network load and improving overall network efficiency and performance.

[0080] Regarding communication overhead, authentication between neighboring nodes and between non-neighboring nodes needs to be performed separately. For directly connectable neighboring nodes, Table 3 compares the efficiency of the decentralized identity authentication protocol proposed in this invention with a centralized PKI authentication scheme. It can be seen that, since this protocol does not require interaction with third-party authentication nodes, the number of information exchanges using this protocol is reduced. At the same time, due to the use of the more efficient elliptic curve algorithm, the performance of the protocol is further improved.

[0081] Table 3 Comparison of Protocol Efficiency Analysis

[0082]

[0083] Table 4 shows the efficiency analysis of different authentication protocols during cross-domain authentication. The results indicate that the efficiency of the protocol of this invention is still improved compared to the PKI scheme. For non-neighbor nodes, the protocol of this invention does not adopt the method of directly issuing verifiable credentials, but establishes authentication relationships by constructing an authentication chain. This mechanism effectively reduces the number of hash operations.

[0084] Table 4. Comparison of Protocol Efficiency (Cross-Domain)

[0085]

[0086] Furthermore, as the number of authentication domains in the network increases, if all authentication center nodes need to exchange information to establish a trust alliance, the number of authentication information exchanges may increase exponentially with the increase in the number of authentication domains. However, the user computational load of the protocol of this invention only increases linearly with the authentication path length, demonstrating better scalability. Therefore, when facing changes such as network expansion, the protocol of this invention can maintain stable performance and alleviate the problem of a sharp decline in efficiency caused by the increase in scale.

[0087] (ii) MANET Dynamic Trusted Identity Authentication

[0088] In order to organically combine the decentralized identity authentication protocol and lightweight trust assessment method of mobile ad hoc networks, this invention designs a decentralized identity authentication system for mobile ad hoc networks (i.e., MANET dynamic trusted identity authentication system) to ensure the security of mobile ad hoc network nodes.

[0089] The MANET dynamic trusted identity authentication system of this invention can achieve the following functions:

[0090] (1) User identity management function: After logging into the system with their own decentralized identity, users can manage their own identity information independently and issue or revoke verifiable credentials for other users.

[0091] (2) Node authentication function: Strictly implement the authentication protocol to reliably verify the identity of nodes and ensure that only legitimate nodes can access the network. Support multi-hop authentication to adapt to the authentication requirements under the dynamic topology of mobile ad hoc networks.

[0092] (3) Dynamic Trust Assessment Function: Continuously collect node behavior data and use a lightweight trust assessment model to calculate and update the trust value of nodes in real time. When an abnormal decrease in the trust value of a node is detected or suspicious behavior is detected, an early warning is issued in a timely manner to prompt the user to take corresponding measures, or with the user's authorization, the system can automatically revoke the authentication relationship with the abnormal node to prevent potential security risks.

[0093] (4) Data storage and query function: Store the identity information, authentication records, behavioral data and trust assessment results of the storage nodes, and provide a convenient data query interface to facilitate users and management modules to obtain relevant information.

[0094] (5) Data visualization function: After logging into the system, users can perform visualization operations on local nodes and other nodes, and intuitively display the network status of the mobile ad hoc network on the page. Users can observe and monitor the network status.

[0095] This embodiment proposes an improved version of the basic arithmetic optimization algorithm (AOA). The AOA algorithm is inspired by the four arithmetic rules in mathematical operations, using a mathematical optimizer (MOA) to dynamically select between global exploration and local exploitation strategies. However, AOA suffers from insufficient population diversity and a tendency to get trapped in local optima in the later stages of operation. Arithmetic optimization (AOA) is a novel heuristic optimization algorithm. This invention introduces a multi-population learning strategy and a differential evolution mechanism, proposing a Multi-Population Differential Evolution Improved Arithmetic Optimization Algorithm (MPDE-AOA), which enhances the optimization ability and stability of the original algorithm and is applied to automated tuning of machine learning models. Finally, comparative experiments with other algorithms show that MPDE-AOA has stronger optimization capabilities, and using this method for automated tuning of machine learning models can effectively improve the model's trust evaluation performance.

[0096] The main improvements of the MPDE-AOA algorithm include: dividing all individuals into multiple populations and setting different learning rates for different populations; during the exploration and development phases, each population uses its own best individual for position updates, replacing the single guidance method of the globally optimal individual in the original algorithm, thus improving population diversity. After each iteration, the best individuals generated by each subpopulation undergo crossover, mutation, and selection processes using differential evolution, enabling information exchange between superior individuals across multiple populations and achieving co-evolution. Experimental results show that the MPDE-AOA algorithm outperforms the basic AOA algorithm on 16 out of 23 CEC benchmark functions, and the solutions of the two algorithms differ statistically significantly on most functions.

[0097] Based on the MPDE-AOA algorithm, a general automated hyperparameter tuning method for machine learning models, MPDE-AOA-APTGM, is proposed. This method uses the MPDE-AOA algorithm to fine-tune key hyperparameters of lightweight machine learning models (such as decision trees and random forests). (Macroscopic...) As the objective function, the maximization problem is transformed into a minimization problem for easier algorithm processing. Experiments were conducted on the WSN-DS dataset, and the results show that the MPDE-AOA-APTGM method effectively improves the model's classification performance, particularly in accuracy and macroscopic aspects. It outperforms both the basic AOA algorithm-tuned and untuned models in four metrics: Cohen-Kappa coefficient, Matthews correlation coefficient, and all other metrics.

[0098] The MANET dynamic trusted identity authentication system of this invention adopts a layered architecture design, including a physical layer, a data layer, a functional module layer, and a visualization layer. The physical layer consists of the actual node devices and communication links in MANET. The data layer includes a data acquisition component and a blockchain system. The functional module layer includes an identity management module, an authentication module, a trust assessment module, and a data storage module. The visualization layer provides users and administrators with an intuitive operating interface.

[0099] Physical layer: Composed of the actual node devices (such as mobile terminals, routers, etc.) and communication links in the mobile ad hoc network. It is responsible for the physical transmission of data and is the foundation for the operation of the entire system.

[0100] The data layer comprises two parts: a data acquisition component and a blockchain system. The data acquisition component, deployed on various nodes, is responsible for collecting real-time behavioral data from these nodes, such as data packet transmission and reception records and resource usage statistics. After initial processing, the collected data is uploaded to the functional module layer. The blockchain system consists of a distributed ledger maintained by multiple nodes, constructing a distributed public key infrastructure. It stores node DID documents and other identity authentication association information, and records inter-node authentication actions as logs, storing them in the blockchain for traceability. This lays the foundation for identity authentication and other functions, and ensures data consistency, immutability, and traceability through a consensus mechanism.

[0101] Functional Module Layer: This layer includes the identity management module, authentication module, trust assessment module, and data storage module. Each module communicates and collaborates through interfaces (such as APIs) based on data provided by the data layer to achieve its corresponding functions. The specific functions of each module will be described in detail in the system module design section of the next section.

[0102] Visualization Layer: This layer receives data from the functional module layers and performs visualization processing and display. It provides users and administrators with an intuitive interface for convenient system configuration, status monitoring, and decision-making. All layers communicate through standardized interfaces to ensure system scalability.

[0103] The system operation process is as follows: Before a node joins the network, a lightweight trust assessment model is pre-trained using a public dataset to obtain an initial model; after registering a DID identity, a user joins the MANET network; two-way identity authentication is performed between nodes as needed, and a trust assessment of the other node is required before authentication; nodes with insufficient trust cannot establish an authentication relationship; during operation, each node records the trust characteristics of interacting nodes and establishes a log stored on the blockchain; the node trust characteristics are periodically fed into the trust assessment model for binary classification to determine whether the node is still trustworthy; for nodes that fail the trust assessment, the system automatically revokes the corresponding verifiable credentials and refuses authentication.

[0104] Furthermore, the operation of the decentralized identity authentication system in mobile self-organizing networks is as follows: Figure 5 As shown, the specific process is as follows:

[0105] (1) Before a node joins the network, it obtains the public dataset or user-annotated dataset in the network to train the lightweight trust evaluation model and obtain the initial trust evaluation model for trust evaluation.

[0106] (2) Users register a DID identity and join the mobile ad hoc network using the DID identity on a certain node. When users need to obtain resources from other nodes, they need to perform on-demand two-way identity authentication with other nodes. Before authentication, a trust assessment of the other node is required, and authentication relationships cannot be established between nodes with insufficient trust.

[0107] (3) During operation, each node records the information of the nodes that have established authentication relationships with itself, and extracts and saves the trust characteristics generated by these nodes in the network operation, and establishes them as log records in the blockchain system, which can be queried by all nodes.

[0108] (4) For all nodes that have established an authentication relationship with this node, the trust assessment model is used periodically to assess the trust features of the extracted corresponding nodes.

[0109] (5) If an abnormality occurs in the authentication process of the corresponding node or the trust assessment fails, the node where the user is located will refuse to authenticate and revoke the corresponding verifiable credentials. Only nodes that pass the trust assessment can proceed to the next step of two-way authentication. At the same time, the node will also save the interaction data and retrain the model based on the new interaction data after a specified time window to achieve dynamic and adaptive trust assessment.

[0110] In the test, all nodes were assigned numbers, node types, and behavioral patterns as shown in Table 5. Four nodes each were designated for black hole attacks, gray hole attacks, DDoS attacks, and resource exhaustion attacks. The system was observed to determine whether it could reasonably assess the trust value of a malicious node after it launched an attack and automatically revoke the authentication relationship with that malicious node. System test results show that in functional testing, the system can correctly identify and automatically revoke malicious nodes such as those involved in black hole attacks, gray hole attacks, DDoS attacks, and resource exhaustion attacks. In performance testing, authentication time increases slowly with the number of nodes, plateauing when there are more than 40 nodes, demonstrating good scalability. In security testing, the system successfully resisted replay attacks, man-in-the-middle attacks, and key leakage attacks. All test results met the expected design requirements.

[0111] Table 5 Node Types and Behavior Patterns

[0112]

[0113] During node authentication, the average authentication time of all nodes in the network is recorded, and the authentication times between neighboring nodes and non-neighboring nodes are statistically analyzed separately. Figure 6As shown in the figure, the test results indicate that as the number of nodes increases, the average authentication time of neighboring nodes increases slowly, while the average authentication time of non-neighboring nodes increases significantly. Notably, after the number of nodes reaches a certain scale, the growth rate of the average authentication time begins to slow down, and even decreases with the increase of the number of nodes. This is because increasing the number of nodes does not significantly increase the hop count distance between nodes; instead, it may shorten the shortest path between some nodes. Therefore, when the network scale reaches a certain level, the average authentication time can remain relatively stable. These experimental results demonstrate that the system performs well in terms of performance and scalability.

[0114] In the security test, the stability and reliability of the decentralized identity authentication system for mobile ad hoc networks were verified under various security threats, ensuring that the system can effectively resist common attacks such as replay attacks, man-in-the-middle attacks, and key leakage attacks. During the security test, after a user logs into the system, an attacking node launches an attack; the specific attack behaviors are shown in Table 6. Finally, the system is checked to see if it can identify and reject the attack request. If the attacking node fails to authenticate, the test passes; otherwise, it fails. The test results are shown in Table 7. The system proposed in this invention successfully identified and rejected malicious requests, demonstrating that the identity authentication method of this invention has good security and can resist various network attacks.

[0115] Table 6 Attack Types and Testing Procedures

[0116]

[0117] Table 7 Security Test Results

[0118]

[0119] The various embodiments in this invention are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments of apparatus, devices, and non-volatile computer storage media are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0120] The foregoing has described specific embodiments of the present invention. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired results. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0121] The above description is merely an embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations can be made to the embodiments of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the embodiments of the present invention should be included within the protection scope of the present invention.

Claims

1. A dynamic trust and identity authentication method for MANET, characterized in that, Includes the following steps: Step S1, Network Initialization and Identity Registration: Deploy a blockchain network on the mobile self-organizing network, and deploy smart contracts related to identity registration and authentication functions in the blockchain network; each network node generates public-private key pairs based on elliptic curve cryptography algorithm, creates decentralized identity and corresponding decentralized identity document, the decentralized identity document contains decentralized identity identifier, public key information and authentication method, and stores the decentralized identity document in the blockchain system; Step S2, Neighbor Node Identity Authentication: Neighboring nodes exchange decentralized identity identifiers and obtain each other's public keys from the blockchain network. They then perform decentralized two-way identity authentication based on elliptic curve cryptography. After successful authentication, both parties issue verifiable credentials to each other. Step S3, Non-neighbor node authentication: When the source node needs to establish an authentication relationship with the target node that cannot communicate directly, it uses the underlying routing protocol to discover the path from the source node to the target node, forwards the authentication request through each intermediate node in the path and adds its own verifiable credentials, builds a multi-hop authentication chain, and uses verifiable expressions to achieve selective information disclosure, thus completing the two-way authentication between non-neighbor nodes. Step S4, Dynamic Trust Assessment: During network operation, behavioral data of each node is continuously collected, trust features are extracted, and a lightweight machine learning model optimized based on multi-group differential evolution improved arithmetic optimization algorithm is used to dynamically assess the trust of nodes. When the trust value of a node is lower than a preset threshold, the node is determined to be untrustworthy. Step S5, Access Control and Credential Revocation: A decentralized credential revocation mechanism based on the product of large prime numbers is adopted. When issuing verifiable credentials, the issuer selects large prime numbers from the public prime number file, writes their index into the credential attributes, and publishes the product of large prime numbers corresponding to all its unrevoked credentials. The verifier verifies whether the credential has been revoked through integer division operations.

2. The dynamic trust and identity authentication method for MANET according to claim 1, characterized in that, In step S1, the decentralized identity document does not contain users' personal privacy information, but only publicly verifiable information such as public keys and cryptographic algorithms; the user's private key is stored locally, and only the decentralized identity document is stored on the blockchain.

3. The dynamic trust and identity authentication method for MANET according to claim 1, characterized in that, In step S2, the specific process of neighbor node identity authentication is as follows: The first node sends an authentication request to the second node, which includes a timestamp, a random number, and its own identifier; After verifying the validity of the timestamp, the second node obtains the public key of the first node from the blockchain, generates a random number and a hash value, signs the hash value with its own private key, and returns it. The first node obtains the second node's public key from the blockchain and verifies the signature. After confirming the second node's legitimate identity, it generates a new random number, concatenates the random numbers from both parties with the timestamp, signs the result with its private key, and sends it to the second node. The second node completes two-way authentication after verifying the signature.

4. The dynamic trust and identity authentication method for MANET according to claim 1, characterized in that, In step S3, the process of constructing the multi-hop authentication chain for non-neighbor node identity authentication is as follows: The source node sends an authentication request to the next node in the path. The request includes the source node, the target node, the verifiable credentials held by the source node, and the complete path information. After each intermediate node verifies the validity of the verifiable credentials of the previous node, it writes its own next-hop verifiable credentials into the authentication request, and signs the new authentication request with its private key before forwarding it. After receiving the request, the target node verifies all verifiable credentials and signatures, generates a response message, and travels back and forth along the path. After verification and credential addition by each intermediate node, it returns to the source node, completing multi-hop two-way authentication.

5. The dynamic trust and identity authentication method for MANET according to claim 1, characterized in that, In step S4, the improvements to the arithmetic optimization algorithm based on multi-group differential evolution include: The population is divided into multiple subpopulations, and each subpopulation uses the best individual within its own population to update its position, replacing the single guidance method of the globally best individual in the original algorithm. After each iteration, the optimal individuals generated by each subpopulation are subjected to crossover, mutation, and selection operations using the differential evolution algorithm to achieve information exchange and co-evolution among multiple populations.

6. The dynamic trust and identity authentication method for MANET according to claim 1, characterized in that, In step S4, the trust assessment model uses a decision tree algorithm or a random forest algorithm as the base model, and employs a multi-group differential evolution improved arithmetic optimization algorithm to automatically tune the hyperparameters of the base model for macroscopic evaluation. As the objective function, the model parameters are iteratively optimized by transforming the maximization problem into a minimization problem.

7. The dynamic trust and identity authentication method for MANET according to claim 1, characterized in that, In step S5, the specific process of the decentralized credential revocation mechanism is as follows: A file containing multiple large prime numbers is publicly available on the blockchain system, with each large prime number corresponding to an index. When issuing a verifiable certificate, a prime number is randomly selected from the prime number file, its index is written into the certificate attribute, and the large prime number corresponding to all the unrevoked certificates of the certificate is multiplied together to obtain a large number, which is then made public. After receiving the credential, the verifier divides the publisher's publicly disclosed large number Ac by the large prime number corresponding to the index in the credential. If the credential is divisible, the credential is valid; otherwise, the credential has been revoked. When a certificate is revoked, the issuer divides the large number it maintains by the large prime number corresponding to the certificate and updates the public value.

8. The dynamic trust and identity authentication method for MANET according to claim 1, characterized in that, The verifiable representation supports selective information disclosure. Users only need to disclose the original text of some fields in the verifiable credential, while the remaining fields are replaced with hash values, thus achieving trust transfer in multi-hop authentication without revealing complete credential information.

9. A dynamic trust and identity authentication system for MANET, characterized in that, include: The identity management module is used to generate and manage decentralized identity identifiers for nodes, and handles the issuance and revocation of verifiable credentials and the generation of verifiable representations. The authentication module is used to execute the decentralized two-way identity authentication protocol for neighboring nodes and non-neighboring nodes, and supports multi-hop authentication coordination and authentication result management. The trust assessment module is used to collect node behavior data, use a lightweight machine learning model optimized by MPDE-AOA to perform dynamic trust assessment of nodes, and supports online model updates. The data storage module uses blockchain to achieve secure storage and retrieval of decentralized identity documents, authentication records, and trust assessment logs. The visualization interface module is used to display network topology, node identity information, trust values, and resource usage, and provides a system operation entry point.

10. The dynamic trust and identity authentication system for MANET according to claim 9, characterized in that, The system adopts a layered architecture design, including a physical layer, a data layer, a functional module layer, and a visualization layer; the data layer contains data acquisition components and a blockchain system deployed on each node, and the functional module layer realizes communication and collaboration between modules through interfaces.

Images