An underwater internet of things authentication method and system based on spatiotemporal anomaly detection

Abstract

The application provides an underwater Internet of Things authentication method and system based on space-time anomaly detection, and relates to the technical field of identity authentication. The method comprises the following steps: obtaining authentication credential information of an underwater node; generating initial authentication data based on node identity information and key information; verifying the authentication signature in the initial authentication data and performing space-time anomaly detection based on adjacent underwater nodes; determining whether the underwater node passes the initial authentication according to the signature verification result and the space-time anomaly detection result; if yes, ending the authentication process; otherwise, constructing and sending challenge interaction data based on the initial shared authentication information and the adjacent underwater nodes; verifying the challenge interaction data based on the abnormal underwater node, generating updated shared authentication information, and constructing response interaction data; receiving the response interaction data based on the adjacent underwater nodes, synchronously using the updated shared authentication information, and completing the interaction verification.

Description

Technical Field

[0001] This invention relates to the field of identity authentication technology, and in particular to an underwater Internet of Things authentication method and system based on spatiotemporal anomaly detection. Background Technology

[0002] Underwater IoT has been widely applied in scenarios such as marine environmental monitoring, underwater communication, and marine resource exploration. Massive edge nodes complete environmental data collection and information collaboration, providing crucial data support and technical assurance for underwater engineering applications. Underwater IoT relies on an open underwater environment and wireless communication links for operation. Secure node identity authentication is a vital foundation for ensuring reliable data transmission and stable system operation, playing a key supporting role in improving the reliability of underwater network operations.

[0003] Existing underwater IoT node authentication technologies focus on physical layer channel characteristics, cryptographic mechanisms, and lightweight authentication frameworks. Based on channel statistical characteristics, node legitimacy can be distinguished; complex cryptography can enhance authentication security; and lightweight frameworks can reduce the operational overhead of underwater nodes. These technologies provide diverse implementation paths for underwater identity authentication, driving the continuous improvement of underwater IoT security mechanisms. These technologies have positive significance in adapting to the characteristics of underwater networks and improving identity verification capabilities, providing important technical references for secure underwater communication.

[0004] However, existing authentication methods struggle to balance lightweight requirements with spatiotemporal security detection capabilities. Some solutions have limited adaptability to dynamic underwater channels, while others have high computational overhead, and they generally lack anomaly detection mechanisms that are deeply integrated with underwater spatiotemporal characteristics. Summary of the Invention

[0005] To address the technical challenges of existing authentication methods that struggle to balance lightweight requirements with spatiotemporal security detection capabilities, some solutions have limited adaptability to dynamic underwater channels, others have high computational overhead, and there is a general lack of anomaly detection mechanisms that deeply integrate with underwater spatiotemporal characteristics.

[0006] The technical solution provided by this invention is as follows: A first aspect of this invention proposes an underwater Internet of Things (IoT) authentication method based on spatiotemporal anomaly detection, comprising: S1: Obtain the authentication credentials of the underwater nodes. The authentication credentials include the node's identity information, key information, and initial shared authentication information between nodes. S2: Generate initial authentication data based on node identity information and key information; S3: Based on nearby underwater nodes, verify the authentication signature in the initial authentication data and perform spatiotemporal anomaly detection; S4: Based on the signature verification result and the spatiotemporal anomaly detection result, determine whether the underwater node has passed the initial authentication; if yes, end the authentication process; otherwise, construct and send challenge interaction data based on the initial shared authentication information of the neighboring underwater nodes, and proceed to step S5; S5: Based on the abnormal underwater node, verify the challenge interaction data, generate and update the shared authentication information, and construct the response interaction data; S6: Based on nearby underwater nodes, receive response interaction data, synchronously update shared authentication information, and complete interactive verification.

[0007] A second aspect of this invention proposes an underwater Internet of Things (IoT) authentication system based on spatiotemporal anomaly detection, comprising: a processor and a memory; The memory stores programs or instructions that can run on the processor, which, when executed by the processor, implement the steps of the underwater IoT authentication method based on spatiotemporal anomaly detection as described in the first aspect.

[0008] The beneficial effects of the technical solution provided by this invention include: In this embodiment of the invention, to address the problems of existing authentication methods, such as difficulty in balancing lightweight design with spatiotemporal security detection, insufficient channel adaptability, high computational overhead, and lack of spatiotemporal fusion anomaly detection, the invention obtains authentication credential information and generates initial authentication data to ensure the credibility of node identity and key foundation. By verifying signatures and performing spatiotemporal anomaly detection, the invention achieves simultaneous verification of identity legitimacy and spatiotemporal behavior, improving dynamic channel adaptability. Challenge response and shared information updates are completed through initial shared authentication information, achieving lightweight and efficient re-authentication while reducing computational and communication overhead. Decisions are made based on signature verification and spatiotemporal detection results, effectively compensating for the blind spots in physical spatiotemporal dimension defense, and balancing the lightweight requirements and secure authentication capabilities of underwater IoT. Attached Figure Description

[0009] Figure 1 This is a flowchart illustrating an underwater IoT authentication method based on spatiotemporal anomaly detection, provided by an embodiment of the present invention. Figure 2 This is a schematic diagram of the structure of an underwater Internet of Things (IoT) authentication system based on spatiotemporal anomaly detection, provided as an embodiment of the present invention. Detailed Implementation

[0010] Reference manual attached Figure 1 The diagram illustrates a flowchart of an underwater IoT authentication method based on spatiotemporal anomaly detection provided by an embodiment of the present invention.

[0011] This invention provides an underwater IoT authentication method based on spatiotemporal anomaly detection, which may include the following steps: S1: Obtain the authentication credentials of the underwater node. The authentication credentials include the node's identity information, key information, and initial shared authentication information between nodes.

[0012] Among them, the authentication credential information is the trusted authentication basic data burned before the node is launched into the water, the node identity information is the unique identification information used to distinguish different underwater nodes, the key information is the cryptographic data used to realize node signing and verification, and the initial shared authentication information is the pre-configured point-to-point shared verification data between nodes in the same area.

[0013] Specifically, node identity information is generated based on the node's physical address, random salt value, and timestamp.

[0014] Furthermore, the node identity information is obtained using the following formula: in, ID i Indicates underwater nodes i A unique identifier across the entire network. Hash This represents a one-way hash function. MAC i Indicates underwater nodes i The factory-installed physical address of the hardware. R s Indicates the random salt value of the system. T Represents a timestamp. mod This represents the modulo operation. i Indicates the index number of the underwater node. This indicates a string concatenation operation.

[0015] For example, the node's physical address is 00:1A:2B:3C:4D:5E, the random salt value is a 16-bit random number, the timestamp is the current time, and a 2-byte unique identifier is obtained through hash and modulo operations.

[0016] It should be noted that the key information is generated based on the node identity, master node identity, random salt value, and timestamp.

[0017] Furthermore, the key information is expressed using the following formula: in, P i Indicates underwater nodes i private key, ID sv Indicates underwater nodes i The identity identifier of the main node in the region, 2 l This indicates that the hash result will be compressed to... l Bit, l Indicates the length of the private key.

[0018] Furthermore, the initial shared authentication information between nodes adopts the formula: in, F ij Indicates underwater nodes i With nodes j Point-to-point parameter sharing between them K master Indicates the area master key. ID j Indicates adjacent underwater nodes j A unique identifier across the entire network. HKDF This represents the key derivation function.

[0019] Furthermore, the authentication credential information is presented in the form of an authentication credential codebook, with the following structure: in, CB i Indicates underwater nodes i Authentication credential codebook ID 1 represents the identity identifier of the first node in the region. Q 1 represents the public key set of the first node. F i1 Indicates underwater nodes i Shared parameters with the first node, ID G Indicates the first in the region G The identity identifier of each node, Q G Indicates the first G The public key set of each node, F G Indicates underwater nodes i With the G Shared parameters between nodes G This represents the total number of underwater nodes within the region, excluding the master node.

[0020] Optionally, the node identity information specifically includes the node's physical address and a unique identifier across the entire network.

[0021] The key information specifically includes the node's private key and the node's public key set.

[0022] In this embodiment of the invention, node identity, key and shared authentication information are generated by pre-configuration, short-length unique identifier is constructed by hash and modular operation, point-to-point shared parameters are established by key derivation function, and trusted storage is completed by authentication credential codebook. This can provide a highly secure initial authentication foundation for underwater nodes, while ensuring the lightweight and uniqueness of the identifier and key, and adapting to the resource-constrained characteristics of underwater nodes.

[0023] S2: Generate initial authentication data based on node identity information and key information.

[0024] The initial authentication data is the node network access request data containing signature and spatiotemporal information.

[0025] In one possible implementation, S2 specifically includes sub-steps S201 to S204: S201: Based on node identity information and key information, the key information is split into multiple subkeys through the exchange mapping of Chebyshev polynomials.

[0026] Among them, the Chebyshev polynomial exchange mapping is a bit-level processing method used to simplify the operation, and the subkey is a low-dimensional cryptographic unit obtained by splitting the master key.

[0027] Specifically, Chebyshev polynomials perform operational transformations over finite fields, using only shift and XOR operations to complete the calculations.

[0028] S202: Based on each subkey and the data to be signed, generate multiple expected subsignatures through an exchange mapping method.

[0029] Among them, the data to be signed is the core authentication data that needs to be identified, and the expected sub-signature is the segmented signature data generated based on the subkey.

[0030] Furthermore, the expected sub-signature adopts the formula: in, Indicates the first k One expected sub-signature, Indicates based on private key P i Chebyshev commutative mapping operation, F Hash(D) Indicates based on the hash value of the data to be signed Hash ( D Chebyshev commutative mapping operation, x Indicates the public benchmark element, k Indicates the sequence number of the expected sub-signature. m Indicates the total number of sub-signatures. D This indicates the data to be signed. P i Indicates underwater nodes i The private key.

[0031] S203: Compress each expected sub-signature into an authentication signature through a nonlinear mixing function.

[0032] Among them, the nonlinear mixing function is a hash mixing method used to compress sub-signatures, and the authentication signature is a compact signature data used to prove the legitimacy of a node's identity.

[0033] Furthermore, the authentication signature uses the following formula: in, Indicates underwater nodes i Expected authentication signature, H mix Represents a nonlinear mixture function. This represents the first expected sub-signature. This represents the second expected sub-signature. Indicates the first m One expected sub-signature, i Indicates the index number of the underwater node. m This indicates the total number of sub-signatures.

[0034] S204: Combine the authentication signature, current timestamp, and current 3D coordinate information into initial authentication data.

[0035] Among them, the current timestamp is the time information that records the moment the data was generated, and the current three-dimensional coordinate information is the spatial information that records the location of the node.

[0036] For example, three-dimensional coordinate information can be represented as X=120, Y=250, Z=45, in meters.

[0037] Optionally, after S2 and before S3, the following are also included: The initial authentication data is verified for integrity using error correction check codes.

[0038] Among them, error correction check codes are used to check whether data is complete or has been tampered with, while data integrity checks are operations to verify that data has not been tampered with or damaged.

[0039] Specifically, the error correction check code is implemented using a combination of extended Hamming code and CRC16, which can distinguish between transmission errors and malicious tampering.

[0040] It should be noted that if the ECC integrity verification fails, the corresponding data packet will be discarded directly, and subsequent signature verification and anomaly detection processes will not be carried out.

[0041] In this embodiment of the invention, subkeys and subsignatures are generated based on Chebyshev polynomial exchange mapping, and compact authentication signatures are obtained by compression through nonlinear hybrid functions. The signatures and spatiotemporal information are combined into initial authentication data, which can significantly reduce computation and storage overhead, reduce the length of authentication data, and improve transmission efficiency in low-bandwidth underwater environments.

[0042] S3: Based on nearby underwater nodes, verify the authentication signature in the initial authentication data and perform spatiotemporal anomaly detection.

[0043] Among them, the neighboring underwater node is the adjacent node within the communication range responsible for verification, and the spatiotemporal anomaly detection is a detection operation that combines time and space information to determine whether the node behavior is abnormal.

[0044] Optionally, the authentication signature is specifically a compact signature with configurable length.

[0045] In one possible implementation, S3 specifically includes sub-steps S301 to S305: S301: Based on the nearest underwater node, receive initial authentication data, which includes authentication signature, timestamp, and three-dimensional coordinate information.

[0046] Among them, the timestamp is the information that identifies the time when the data was generated, and the three-dimensional coordinate information is the information that identifies the spatial location of the node.

[0047] Specifically, the initial authentication data adopts a packet structure: in, M 1 indicates a new node request packet. type Indicates the package type. ID i Indicates underwater nodes i A unique identifier across the entire network. LOC i Indicates underwater nodes i Three-dimensional coordinate information, T Represents a timestamp. ecc This represents the error correction check code. sig i Indicates underwater nodes i Compact signature of data within the packet.

[0048] S302: Verify the authentication signature and obtain the signature verification result.

[0049] The signature verification result indicates whether the authenticated signature is valid.

[0050] S303: Perform a timeliness check based on the timestamp and the reference timestamp of the nearby underwater node to obtain the timeliness check result.

[0051] Among them, the reference timestamp is the time information recorded locally by the neighboring node, the timeliness check is the verification operation to check whether the message is within the valid time, and the timeliness check result is the judgment result indicating whether the message has timed out.

[0052] Furthermore, the message dwell time is determined using the following formula: in, Indicates message dwell time. T r This indicates the timestamp of the data packet received locally by a nearby underwater node. T s This indicates the sending timestamp carried in the authentication data packet.

[0053] S304: Based on the three-dimensional coordinate information, the reference three-dimensional coordinate information of the nearby underwater nodes, and the underwater acoustic propagation speed, perform spatial propagation verification to obtain the spatial propagation verification result.

[0054] Among them, the reference three-dimensional coordinate information is the spatial location information recorded locally by the neighboring nodes, the underwater acoustic propagation speed is the fixed physical speed of underwater signal transmission, the spatial propagation verification is a verification operation to check whether the data packet transmission path is normal, and the spatial propagation verification result is the judgment result indicating whether the path is abnormal.

[0055] Specifically, the physical straight-line distance between nodes is expressed by the formula: in, d This represents the actual physical straight-line distance between two underwater nodes. X r Indicates the local proximity of underwater nodes X Axis coordinates X s Indicates the underwater node of the initiator X Axis coordinates Y r Indicates the local proximity of underwater nodes Y Axis coordinates Y s Indicates the underwater node of the initiator Y Axis coordinates Z r Indicates the local proximity of underwater nodes Z Axis coordinates Z s Indicates the underwater node of the initiator Z Axis coordinates.

[0056] Furthermore, the theoretical propagation delay is calculated using the following formula: in, Indicates the theoretical propagation delay. v This represents the speed of sound propagation in water, usually taken as 1500 m / s.

[0057] It should be noted that the spacetime verification uses inequalities: in, Indicates the actual duration of transmission. ε Indicates the tolerance factor. This indicates the absolute value operation.

[0058] S305: Perform spatiotemporal anomaly detection based on the timeliness verification results and spatial propagation verification results.

[0059] Furthermore, by combining the results of message timeliness verification, packet frequency verification, and spatial propagation anomaly detection, the anomaly type and anomaly level are recorded simultaneously and uniformly encapsulated and reported to the regional master node SV.

[0060] In this embodiment of the invention, the initial authentication data is signed and verified, and the timeliness and spatial propagation delay are verified by combining the timestamp and three-dimensional coordinates. Based on the physical characteristics of underwater acoustics, spatiotemporal cross-verification is achieved, which can accurately identify message anomalies and path anomalies, effectively resist replay attacks and wormhole attacks, and improve the reliability of authentication detection.

[0061] S4: Based on the signature verification result and the spatiotemporal anomaly detection result, determine whether the underwater node has passed the initial authentication. If yes, end the authentication process. Otherwise, based on neighboring underwater nodes, construct and send challenge interaction data according to the initial shared authentication information, and proceed to step S5.

[0062] Initial authentication is the first identity verification process for a new node accessing the network, while challenge interaction data is the verification request data used to re-authenticate abnormal nodes.

[0063] Specifically, certification and testing results are reported using feedback packets, the structure of which is as follows: in, M 2 indicates a feedback packet. type Indicates the package type. ID i Indicates underwater nodes i A unique identifier across the entire network. ID i Indicates underwater nodes i A unique identifier across the entire network. ID j Indicates adjacent underwater nodes j A unique identifier across the entire network. LOC i Indicates underwater nodes i Three-dimensional coordinate information, R Indicates the authentication result. F Indicates the result of anomaly detection. T Represents a timestamp. ecc This represents the error correction check code.i Indicates the index number of the underwater node. j Indicates the index number of the nearest underwater node.

[0064] Specifically, if the initial node authentication and full-item detection both pass successfully, the node is allowed to access the underwater IoT network, and the regional master node (SV) will uniformly distribute network-wide configuration information. If the node authentication is deemed abnormal, the master node (SV) will initiate a re-authentication process for the abnormal node.

[0065] It should be noted that the regional master node (SV) actively initiates a delegation packet, designating the neighboring nodes within the communication range of the abnormal node as the subject of special re-authentication verification.

[0066] Specifically, subsequent authentication instructions adopt an instruction packet structure: in, M 3 indicates a subsequent authentication instruction packet. ID i Indicates underwater nodes i A unique identifier across the entire network. ID j This represents a unique identifier for neighboring underwater nodes across the entire network. T Represents a timestamp. ecc This represents the error correction check code. seq This indicates the sequence number of the task that initiates subsequent authentication.

[0067] In one possible implementation, S4, which involves constructing and sending challenge interaction data based on the initial shared authentication information, specifically includes: S401: Based on nearby underwater nodes, obtain the current timestamp and current 3D coordinate information of nearby underwater nodes.

[0068] S402: Based on the node identity information of the abnormal underwater node, the node identity information of the neighboring underwater nodes, the current three-dimensional coordinate information, the current timestamp, and the initial shared authentication information, a hash value is generated through a hash function.

[0069] Among them, abnormal underwater nodes are nodes that need to be re-verified due to authentication failures, hash functions are one-way functions used to generate fixed-length verification values, and hash values ​​are verification values ​​used to verify data consistency.

[0070] Furthermore, the hash value is calculated using the following formula: in, H j Indicates adjacent underwater nodes j The generated hash value, Hash This represents a one-way hash function. IDi Indicates underwater nodes i A unique identifier across the entire network. ID j Indicates adjacent underwater nodes j A unique identifier across the entire network. LOC j Indicates adjacent underwater nodes j Three-dimensional coordinate information, T j Indicates adjacent underwater nodes j The current timestamp of the challenge request being initiated. Indicates abnormal underwater nodes e With adjacent underwater nodes j Both parties share parameters.

[0071] S403: Assemble the hash value, current timestamp, current 3D coordinate information, and node identity information of nearby underwater nodes into challenge interaction data, and send it to the abnormal underwater node.

[0072] Specifically, the challenge interaction data adopts a packet structure: Where M4 represents the challenge request packet, type Indicates the package type. ID i Indicates underwater nodes i A unique identifier across the entire network. ecc This represents the error correction check code.

[0073] In this embodiment of the invention, the node legitimacy is determined by combining the signature verification result and the spatiotemporal anomaly detection result. This combines logical identity authentication with physical spatiotemporal behavior verification, improving the accuracy and security of initial authentication and providing a reliable basis for underwater node network access. The process terminates directly for legitimate nodes and triggers a re-authentication process for abnormal nodes. Challenge interaction data is constructed based on the initial shared authentication information, simplifying the processing of normal nodes while providing a lightweight re-authentication entry point for abnormal nodes, thus improving the overall flexibility and efficiency of the authentication mechanism.

[0074] S5: Based on the abnormal underwater node, verify the challenge interaction data, generate and update the shared authentication information, and construct the response interaction data.

[0075] Among them, the updated shared authentication information is shared verification data that is dynamically updated based on spatiotemporal information, and the response interaction data is the re-authentication response data fed back by abnormal nodes.

[0076] In one possible implementation, S5 specifically includes sub-steps S501 to S503: S501: Based on the abnormal underwater node, verify the legitimacy of the challenge interaction data according to the initial shared authentication information.

[0077] Specifically, the validity verification uses the following formula: in, Indicates abnormal underwater nodes e The expected hash value is calculated based on the received challenge data. Hash This represents a one-way hash function. ID e Indicates underwater nodes e A unique identifier across the entire network. ID j Indicates adjacent underwater nodes j A unique identifier across the entire network. LOC j Indicates adjacent underwater nodes j Three-dimensional coordinate information, T j Indicates adjacent underwater nodes j The current timestamp of the challenge request being initiated. Indicates abnormal underwater nodes e With adjacent underwater nodes j Both parties share parameters. This indicates a string concatenation operation.

[0078] If the challenge data hash verification and spatiotemporal anomaly detection fail, the abnormal node will not provide any response feedback, but will only retain the authentication failure result and the corresponding anomaly type locally.

[0079] S502: Input the initial shared authentication information, the timestamp and three-dimensional coordinate information in the challenge interaction data, and the current timestamp and current three-dimensional coordinate information of the abnormal underwater node into the key derivation function to generate updated shared authentication information.

[0080] Among them, the key derivation function is a cryptographic derivation method used to generate new keys.

[0081] Furthermore, the formula for updating shared authentication information is as follows: in, Indicates abnormal underwater nodes e With adjacent underwater nodes j Updated shared authentication information between them HKDF Represents the key derivation function, LOC e Indicates underwater nodes e Three-dimensional coordinate information, T eIndicates abnormal underwater nodes e The current timestamp.

[0082] S503: Construct response interaction data based on the updated shared authentication information, node identity information, current timestamp of abnormal underwater nodes, and current three-dimensional coordinate information.

[0083] Furthermore, the hash value in the response interaction data is calculated using the following formula: in, H e Indicates abnormal underwater nodes e The hash value is calculated based on the updated shared authentication information.

[0084] Specifically, the response interaction data adopts a packet structure: in, M 5 indicates the response challenge package. type Indicates the package type.

[0085] In this embodiment of the invention, the legality verification of challenge data is completed based on shared authentication information. The shared parameters are dynamically updated using key derivation functions combined with spatiotemporal information. Then, response data is constructed based on the updated parameters. This can achieve lightweight two-way verification, ensure key independence between sessions, and improve the security and efficiency of the re-authentication process.

[0086] S6: Based on nearby underwater nodes, receive response interaction data, synchronously update shared authentication information, and complete interactive verification.

[0087] Interactive verification is a re-authentication operation that involves two-way confirmation of identity between nodes.

[0088] In one possible implementation, S6 specifically includes sub-steps S601 to S605: S601: Input the initial shared authentication information, the timestamp and three-dimensional coordinate information in the challenge interaction data, and the current timestamp and current three-dimensional coordinate information of the nearby underwater nodes into the key derivation function to synchronously generate and update the shared authentication information.

[0089] S602: Obtain the hash value from the response interaction data based on the nearest underwater node.

[0090] S603: Based on the updated shared authentication information, calculate the expected hash value using a hash function.

[0091] The expected hash value is the standard hash value used for comparison and verification.

[0092] Furthermore, the expected hash value is calculated using the following formula: in, Indicates adjacent underwater nodes j The expected hash value is calculated based on the response interaction data. Hash This represents a one-way hash function. ID e Indicates underwater nodes e A unique identifier across the entire network. ID j Indicates adjacent underwater nodes j A unique identifier across the entire network. LOC e Indicates underwater nodes e Three-dimensional coordinate information, T e Indicates abnormal underwater nodes e Current timestamp, Indicates adjacent underwater nodes j The updated shared authentication information is obtained through synchronous computation using the key derivation function. This indicates a string concatenation operation.

[0093] S604: Verify the hash value in the response interaction data based on the expected hash value.

[0094] S605: Complete the interactive verification based on the hash value verification result.

[0095] The hash value verification result indicates whether the hash values ​​match.

[0096] Furthermore, neighboring nodes encapsulate the full results of this re-authentication test into a feedback packet and report it to the regional master node (SV). The SV then combines this information with the overall network information to make the final judgment on the abnormal node.

[0097] Specifically, if the master node successfully resolves the abnormal state, it synchronously reports the result to the top-level base station, and the abnormal node and the verification node synchronously update the shared parameters in their local credential codebook. If the abnormal state is not resolved, the corresponding node is added to a temporary observation list and silent control is implemented for a specified duration.

[0098] Furthermore, if the cumulative number of authentication failures of a node exceeds a preset threshold, the node is determined to be a persistently abnormal node, and the abnormal determination results are summarized and reported to the base station for isolation processing.

[0099] In this embodiment of the invention, synchronously updating shared authentication information and verifying response data based on hash values, and completing interactive verification based on the verification results, can realize trusted identity confirmation between nodes, ensure consistency of shared parameters, and improve the security and execution efficiency of re-authentication.

[0100] Reference manual attachedFigure 2 The diagram shows a schematic representation of an underwater Internet of Things (IoT) authentication system based on spatiotemporal anomaly detection, provided by an embodiment of the present invention.

[0101] This invention provides an underwater IoT authentication system 20 based on spatiotemporal anomaly detection, comprising: a processor 201 and a memory 202; The memory 202 stores programs or instructions that can run on the processor 201. When the program or instructions are executed by the processor 201, they implement the steps of the underwater IoT authentication method based on spatiotemporal anomaly detection described above and achieve the same technical effect. To avoid repetition, the present invention will not elaborate further.

[0102] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. The scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. An underwater IoT authentication method based on spatiotemporal anomaly detection, characterized in that... ,include: S1: Obtain the authentication credential information of the underwater node, which includes node identity information, key information, and initial shared authentication information between nodes; S2: Generate initial authentication data based on the node identity information and the key information; S3: Based on nearby underwater nodes, verify the authentication signature in the initial authentication data and perform spatiotemporal anomaly detection; S4: Based on the signature verification result and the spatiotemporal anomaly detection result, determine whether the underwater node has passed the initial authentication; if yes, end the authentication process; otherwise, construct and send challenge interaction data based on the neighboring underwater nodes and the initial shared authentication information, and proceed to step S5; S5: Based on the abnormal underwater node, verify the challenge interaction data, generate updated shared authentication information, and construct response interaction data; S6: Based on the nearby underwater node, receive the response interaction data, synchronously use the updated shared authentication information, and complete the interaction verification.

2. The underwater IoT authentication method based on spatiotemporal anomaly detection according to claim 1, characterized in that... The node identity information specifically includes the node's physical address and a unique identifier across the entire network; The key information specifically includes the node's private key and the node's public key set.

3. The underwater IoT authentication method based on spatiotemporal anomaly detection according to claim 1, characterized in that... S2 specifically includes: S201: Based on the node identity information and the key information, the key information is split into multiple subkeys through a Chebyshev polynomial exchange mapping; S202: Based on each of the subkeys and the data to be signed, generate multiple expected subsignatures through an exchange mapping method; S203: Compress each of the expected sub-signatures into an authentication signature using a nonlinear mixing function; S204: Combine the authentication signature, current timestamp, and current three-dimensional coordinate information into the initial authentication data.

4. The underwater IoT authentication method based on spatiotemporal anomaly detection according to claim 1, characterized in that... The process includes the following steps after S2 and before S3: The initial authentication data is verified for data integrity using error correction check codes.

5. The underwater IoT authentication method based on spatiotemporal anomaly detection according to claim 1, characterized in that... The authentication signature is specifically a compact signature with configurable length.

6. The underwater IoT authentication method based on spatiotemporal anomaly detection according to claim 1, characterized in that... S3 specifically includes: S301: Based on the nearby underwater node, receive the initial authentication data, which includes the authentication signature, timestamp, and three-dimensional coordinate information; S302: Verify the authentication signature to obtain the signature verification result; S303: Perform a timeliness check based on the timestamp and the reference timestamp of the adjacent underwater node to obtain the timeliness check result; S304: Based on the three-dimensional coordinate information, the reference three-dimensional coordinate information of the adjacent underwater nodes, and the underwater acoustic propagation speed, perform spatial propagation verification to obtain the spatial propagation verification result; S305: Perform spatiotemporal anomaly detection based on the timeliness verification result and the spatial propagation verification result.

7. The underwater IoT authentication method based on spatiotemporal anomaly detection according to claim 1, characterized in that... The step S4, which involves constructing and sending challenge interaction data based on the initial shared authentication information, specifically includes: S401: Based on the nearby underwater nodes, obtain the current timestamp and current three-dimensional coordinate information of the nearby underwater nodes; S402: Based on the node identity information of the abnormal underwater node, the node identity information of the neighboring underwater nodes, the current three-dimensional coordinate information, the current timestamp, and the initial shared authentication information, a hash value is generated using a hash function; S403: Assemble the hash value, the current timestamp, the current three-dimensional coordinate information, and the node identity information of the neighboring underwater nodes into the challenge interaction data, and send it to the abnormal underwater node.

8. The underwater IoT authentication method based on spatiotemporal anomaly detection according to claim 1, characterized in that... S5 specifically includes: S501: Based on the abnormal underwater node, verify the legality of the challenge interaction data according to the initial shared authentication information; S502: Input the initial shared authentication information, the timestamp and three-dimensional coordinate information in the challenge interaction data, and the current timestamp and current three-dimensional coordinate information of the abnormal underwater node into the key derivation function to generate the updated shared authentication information; S503: Construct the response interaction data based on the updated shared authentication information, the node identity information, the current timestamp of the abnormal underwater node, and the current three-dimensional coordinate information.

9. The underwater IoT authentication method based on spatiotemporal anomaly detection according to claim 1, characterized in that... S6 specifically includes: S601: Input the initial shared authentication information, the timestamp and three-dimensional coordinate information in the challenge interaction data, and the current timestamp and current three-dimensional coordinate information of the nearby underwater nodes into the key derivation function to synchronously generate the updated shared authentication information; S602: Based on the nearby underwater node, obtain the hash value in the response interaction data; S603: Based on the updated shared authentication information, calculate the expected hash value using a hash function; S604: Verify the hash value in the response interaction data according to the expected hash value; S605: Complete the interactive verification based on the hash value verification result.

10. An underwater Internet of Things (IoT) authentication system based on spatiotemporal anomaly detection, characterized in that... This includes: processor and memory; The memory stores programs or instructions that can run on the processor, which, when executed by the processor, implement the steps of the underwater IoT authentication method based on spatiotemporal anomaly detection as described in any one of claims 1 to 9.

Images