Iot identity governance method based on access authentication and credential isolation

Abstract

The application discloses an Internet of Things identity management method based on access authentication and credential isolation, relates to the technical field of Internet of Things security, and comprises the following steps: step one, collecting identity access data and resource constraint data to generate device access records; step two, establishing a device digital identity and generating an identity management index; step three, performing access consistency verification and risk grading to generate access authentication results and credential isolation levels; step four, constructing an improved Blakley credential isolation algorithm to generate a hyperplane parameter and a threshold reconstruction condition; step five, performing dynamic hyperplane fragmentation on real access credentials; step six, generating a credential alias and establishing an isolation index; step seven, gateway reconstructing temporary real access credentials; and step eight, replacing forwarding and outputting identity management audit results. The application improves the credential isolation strength and access traceability of the Internet of Things.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) security technology, and in particular to an IoT identity governance method based on access authentication and credential isolation. Background Technology

[0002] With the increasing deployment of IoT terminals and the growing demand for edge access services, identity governance technologies, including device digital identity, access credential isolation, and trusted forwarding of access gateways, have received widespread attention. Existing IoT access management solutions primarily rely on device IDs, fixed keys, static certificates, or single tokens for authentication, but these solutions commonly suffer from the following problems in practical applications: IoT devices are widely distributed and access sessions change frequently. The lack of continuous correlation between device identity data and resource permission data makes it difficult for access authentication results to accurately reflect the device's identity status and resource access boundaries. Real access credentials are usually directly configured in the device firmware, operating environment, or edge nodes. Once logs are leaked, configurations are exposed, or the terminal is compromised, attackers can reuse real credentials to access target resources for a long time. Existing credential isolation methods mostly use simple mapping tables or fixed proxy forwarding, which cannot dynamically adjust the credential fragmentation structure and reconstruction threshold according to access risks, making it difficult to shrink the exploitation window after credential leakage in a timely manner. The credential replacement, reconstruction status, and forwarding results in the access forwarding process lack a unified audit link, making it difficult to accurately trace abnormal access and update credential status.

[0003] Therefore, how to provide an IoT identity governance method based on access authentication and credential isolation is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] One objective of this invention is to propose an IoT identity governance method based on access authentication and credential isolation. This invention employs an improved Blakley credential isolation algorithm, which combines the IoT device access authentication result with dynamic hyperplane fragmentation of the real access credentials. Through credential alias issuance, gateway threshold reconstruction, temporary credential replacement, and credential isolation residual update, it achieves secure access control without exposing the real access credentials on the device side. It has the advantages of low credential leakage risk, refined access authentication, traceable access process, and high credential isolation strength.

[0005] The IoT identity governance method based on access authentication and credential isolation according to embodiments of the present invention includes the following steps: Step 1: Collect the identity access data and resource constraint data of IoT devices to generate device access records; Step 2: Establish device digital identities based on device access records and generate an identity governance index by associating it with resource constraint data; Step 3: Perform access consistency verification and risk classification on the identity governance index to generate access authentication results and credential isolation levels; Step 4: Based on the access authentication results and credential isolation level, construct an improved Blakley credential isolation algorithm to generate hyperplane parameters and threshold reconstruction conditions; Step 5: Perform dynamic hyperplane fragmentation on the actual access credentials using hyperplane parameters to form a set of credential fragmentation hyperplanes; Step 6: Generate credential aliases based on credential isolation levels, establish isolation indexes between credential aliases and credential sharding hyperplane sets, and issue credential aliases to IoT devices; Step 7: The IoT access gateway receives the access request carrying the credential alias, calls the credential fragmentation hyperplane set according to the isolation index, and solves the hyperplane intersection to generate a temporary real access credential when the threshold reconstruction condition is met. Step 8: The IoT access gateway replaces the credential alias with a temporary real access credential and forwards the access request. Based on the forwarding result, it generates a credential isolation residual, updates the credential fragmentation hyperplane set based on the credential isolation residual, records the credential reconstruction process and the access forwarding process, and outputs the identity governance audit results.

[0006] Optionally, step one specifically includes: Collect the device identity field and access session field generated by IoT devices during the registration and access process, and associate and organize the device identity field and access session field according to the access order of IoT devices to generate identity access data; Collect the access object field and permission boundary field generated by IoT devices during resource access, and associate and organize the access object field and permission boundary field according to the access object ownership relationship to generate resource constraint data; Using the device identity field as the association benchmark, the identity access data and resource constraint data are organized accordingly, and the organized results are arranged in order according to the access session field to generate device access records.

[0007] Optionally, step two specifically involves: Extract identity access data from device access records, merge access session fields belonging to the same IoT device according to device identity fields, and generate device identity baseline records based on the merging results; A device digital identity identifier is generated based on the device identity baseline record. The device digital identity identifier is bound to the device identity field. The identity validity status is marked according to the access session field to establish the device digital identity. Extract resource constraint data from device access records, organize permission boundary fields according to access object fields, and establish access ownership relationship between the organized results and device identity fields to generate resource constraint association records; The device digital identity and resource constraint association records are linked and arranged according to access ownership relationships, generating an identity governance index that records the binding relationships between device digital identity, resource constraint data, and permission boundary fields.

[0008] Optionally, step three specifically includes: Extract the device digital identity and associated resource constraint data from the identity governance index, and generate access verification records based on the binding relationship between the device digital identity and resource constraint data; The identity validity status, access ownership relationship, and permission boundary fields in the access verification record are matched with the binding relationships in the identity governance index to generate access consistency verification results. Based on the access consistency verification results, risk assessment is performed on the resource constraint data and permission boundary fields associated with the device's digital identity, and a risk classification record is generated; The access consistency verification results and risk classification records are correlated and arranged to generate access authentication results, and the credential isolation level is determined based on the risk classification records.

[0009] Optionally, step four specifically involves: Extract the access consistency verification result and risk classification record from the access authentication result, and associate and organize the access consistency verification result, risk classification record and credential isolation level to generate algorithm input record; Based on the algorithm input record, determine the hyperplane dimension, number of fragments, and reconstruction threshold of the improved Blakley credential isolation algorithm, and write the hyperplane dimension, number of fragments, and reconstruction threshold into the algorithm structure record; Based on the mapping relationship between risk classification records and credential isolation levels, fragment security weights are generated, and hyperplane normal vector generation rules and intercept perturbation rules are configured according to the fragment security weights. An improved Blakley credential isolation algorithm is constructed based on the algorithm structure record, hyperplane normal vector generation rules, and intercept perturbation rules, so that the real access credentials form the intersection points to be reconstructed in the geometric space corresponding to the hyperplane dimension; Hyperplane parameters are generated based on the improved Blakley credential isolation algorithm. The hyperplane parameters include hyperplane dimension, hyperplane normal vector, intercept perturbation, fragmentation security weight, and fragmentation valid state. Based on the reconstruction threshold, access consistency verification results, and fragment validity status, threshold reconstruction conditions are generated. These threshold reconstruction conditions limit the number and status conditions for the credential fragment hyperplane set to participate in the reconstruction of temporary real access credentials.

[0010] Optionally, step five specifically includes: Extract the hyperplane dimension, hyperplane normal vector, intercept perturbation, piecewise security weight, and piecewise valid state from the hyperplane parameters. Establish the credential piecewise geometric space according to the hyperplane dimension and write the hyperplane normal vector into the orientation constraint position of the credential piecewise geometric space. Perform character normalization and numerical conversion on the real access credentials to generate a numerical credential vector. Then, perform length registration on the numerical credential vector according to the hyperplane dimension to form the intersection to be reconstructed. The inner product of the intersection of the hyperplane normal vector and the point to be reconstructed is calculated to generate the intercept reference value. The intercept reference value is then perturbed and corrected according to the intercept perturbation amount to generate the intercept parameter. Write the hyperplane normal vector, intercept parameter, fragmentation safety weight and fragmentation validity status into the voucher fragmentation record, and construct the voucher fragmentation hyperplane that passes through the intersection point to be reconstructed according to the voucher fragmentation record; The voucher fragmentation hyperplane is weighted according to the fragmentation security weight, and the voucher fragmentation hyperplane is marked according to the fragmentation validity status to form a voucher fragmentation hyperplane set.

[0011] Optionally, step six specifically includes: Extract the device digital identity and credential isolation level from the access authentication results, associate and organize the device digital identity and credential isolation level, and generate credential alias generation records. Configure the alias length, alias valid range and alias issuance status according to the alias isolation level, write the alias generation record into the alias generation rule, and generate the alias; Extract the voucher fragmentation hyperplane and fragmentation validity status from the voucher fragmentation hyperplane set, bind the voucher alias to the voucher fragmentation hyperplane set, and generate an isolation binding record; An isolation index is created based on the credential alias, isolation binding record, and fragment validity status, and the isolation index is written to the IoT access gateway. Based on the isolation index, locate the IoT device corresponding to the credential alias, issue the credential alias to the IoT device, and record the credential alias issuance status.

[0012] Optionally, step seven specifically includes: The IoT access gateway receives an access request, extracts the credential alias from the access request, performs format validation and valid range validation on the credential alias, and writes the validation results into the alias validation record. Match the credential alias in the alias verification record with the index key in the isolation index to locate the isolation binding record associated with the credential alias, and call the credential sharding hyperplane set based on the isolation binding record; Extract the voucher fragment hyperplanes and fragment validity states from the voucher fragment hyperplane set, filter the voucher fragment hyperplanes that can participate in reconstruction according to the fragment validity states, and generate a set of reconstruction candidate hyperplanes; The number of credential fragment hyperplanes in the candidate hyperplane reconstruction set is compared with the quantity condition in the threshold reconstruction condition, and the valid fragment states are matched with the state conditions in the threshold reconstruction condition to generate the threshold judgment result. When the threshold judgment result meets the threshold reconstruction condition, the linear equation system is constructed and solved for the reconstruction candidate hyperplane set to obtain the hyperplane intersection point, and the hyperplane intersection point is converted into a temporary real access credential.

[0013] Optionally, step eight specifically includes: The IoT access gateway writes the temporary real access credential into the credential field of the access request, replaces the credential alias in the credential field, and generates a credential replacement request. The IoT access gateway performs access forwarding according to the credential replacement request, collects the forwarding status, response status and credential usage status during the access forwarding process, and generates forwarding results; Based on the forwarding results, the status of the credential fragment hyperplane set associated with the temporary real access credential is compared, fragment status offset is generated, and the fragment status offset is written into the credential isolation residual. Based on the voucher isolation residual, the intercept parameter and the effective state of the voucher fragmentation hyperplane set are adjusted to form an updated voucher fragmentation hyperplane set; Write the threshold reconstruction conditions, hyperplane intersections, temporary real access credentials, credential replacement requests, forwarding results, and credential isolation residuals into the audit log to form the credential reconstruction process and access forwarding process, and output the identity governance audit results.

[0014] The beneficial effects of this invention are: This invention unifies the organization of IoT device access data and resource constraint data, establishing device digital identities and identity governance indexes. This creates a continuous correspondence between device identity, access session, access object, and permission boundaries. Consistency verification of identity validity status, access ownership, and permission boundary fields can be completed during the access phase. Based on the verification results, access authentication results and credential isolation levels are generated. This overcomes the problems of the separation between device identity and resource permissions in traditional IoT access management, and the difficulty in reflecting the true access boundaries in authentication results. It transforms the access authentication process from a single identity verification to a comprehensive governance process oriented towards device identity, resource constraints, and access risks, improving the accuracy and fine-grained management capabilities of IoT device access control.

[0015] This invention further introduces an improved Blakley credential isolation algorithm into the real access credential protection process. Based on the access authentication result and credential isolation level, it generates hyperplane parameters and threshold reconstruction conditions, transforming the real access credential into a credential fragmentation hyperplane set. Device-side credential isolation is achieved through credential aliases, isolation indexes, and the IoT access gateway, ensuring that IoT devices only hold credential aliases and do not directly access the real access credential. After an access request reaches the gateway, a temporary real access credential is generated through threshold reconstruction and replaced and forwarded. Then, based on the forwarding result, a credential isolation residual is generated and the credential fragmentation hyperplane set is updated. This reduces the risk of long-term reuse of real credentials due to firmware leaks, configuration exposures, and log leaks. Simultaneously, it enables auditing and traceability of the credential reconstruction process, access forwarding process, and credential state changes, improving credential isolation strength, dynamic update capabilities, and abnormal access tracking capabilities. Attached Figure Description

[0016] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of the IoT identity governance method based on access authentication and credential isolation proposed in this invention; Figure 2 This is a schematic diagram of the improved Blakley credential isolation algorithm for the IoT identity governance method based on access authentication and credential isolation proposed in this invention. Figure 3 This is a schematic diagram of the credential isolation residual update in the IoT identity governance method based on access authentication and credential isolation proposed in this invention. Detailed Implementation

[0017] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0018] refer to Figures 1-3 The IoT identity governance method based on access authentication and credential isolation includes the following steps: Step 1: Collect the identity access data and resource constraint data of IoT devices to generate device access records; Step 2: Establish device digital identities based on device access records and generate an identity governance index by associating it with resource constraint data; Step 3: Perform access consistency verification and risk classification on the identity governance index to generate access authentication results and credential isolation levels; Step 4: Based on the access authentication results and credential isolation level, construct an improved Blakley credential isolation algorithm to generate hyperplane parameters and threshold reconstruction conditions; Step 5: Perform dynamic hyperplane fragmentation on the actual access credentials using hyperplane parameters to form a set of credential fragmentation hyperplanes; Step 6: Generate credential aliases based on credential isolation levels, establish isolation indexes between credential aliases and credential sharding hyperplane sets, and issue credential aliases to IoT devices; Step 7: The IoT access gateway receives the access request carrying the credential alias, calls the credential fragmentation hyperplane set according to the isolation index, and solves the hyperplane intersection to generate a temporary real access credential when the threshold reconstruction condition is met. Step 8: The IoT access gateway replaces the credential alias with a temporary real access credential and forwards the access request. Based on the forwarding result, it generates a credential isolation residual, updates the credential fragmentation hyperplane set based on the credential isolation residual, records the credential reconstruction process and the access forwarding process, and outputs the identity governance audit results.

[0019] In this embodiment, step one specifically includes: Collect the device identity field and access session field generated by IoT devices during the registration and access process, standardize the format of the device identifier content in the device identity field and the session identifier content in the access session field, establish the field correspondence between the device identity field and the access session field according to the access order of IoT devices, and generate identity access data. Collect the access object field and permission boundary field generated by IoT devices during resource access, format the resource object content in the access object field and the access restriction content in the permission boundary field, establish the field correspondence between the access object field and the permission boundary field according to the access object ownership relationship, and generate resource constraint data. Using the device identity field as the association benchmark, the field correspondence in the identity access data is matched with the field correspondence in the resource constraint data. The matching results are then arranged in order according to the access session field to generate device access records that record the access order of IoT devices, resource access relationships, and permission boundary relationships.

[0020] In this embodiment, step two specifically involves: Locate the identity access data from the device access record, perform field format unification and duplicate item merging on the device identity field in the identity access data, use the device identity field with the unified field format as the grouping key, group the access session fields belonging to the same IoT device into the same identity group, and then organize the identity groups according to the order of the access session fields in the device access record to generate the device identity baseline record. A device digital identity identifier is generated based on the device identity baseline record. The device digital identity identifier is written into the identity record position corresponding to the device identity field. The device digital identity identifier is then bound to the device identity field. Finally, the identity validity status is marked according to the registration access status corresponding to the access session field to establish the device digital identity. Locate resource constraint data from device access records, perform object attribution sorting on the access object field within the resource constraint data, group the permission boundary fields associated with the same access object field into the same resource constraint group, and then establish access attribution relationship between the resource constraint group and the device identity field to generate resource constraint association records; The device digital identity and resource constraint association records are arranged according to the access ownership relationship, so that the device digital identity, resource constraint data and permission boundary fields are written into the same binding record. Then, the binding record is indexed according to the device digital identity identifier and access object field to generate an identity governance index.

[0021] In this embodiment, step three specifically includes: Extract the device digital identity and associated resource constraint data from the identity governance index. Use the device digital identity as the retrieval benchmark to locate the binding relationship in the identity governance index. Write the device digital identity, resource constraint data and binding relationship into the same verification unit, and generate access verification records according to the order of the verification units in the identity governance index. The identity validity status in the access verification record is matched with the binding relationship of the device digital identity to obtain the identity status verification value. The access ownership relationship is matched with the binding relationship of the resource constraint data to obtain the access ownership verification value. The permission boundary field is matched with the access restriction content in the resource constraint data to obtain the permission boundary verification value. The identity status verification value, access ownership verification value and permission boundary verification value are then merged to generate the access consistency verification result. Based on the access consistency verification results, determine the verification passed items and verification deviation items, mark the risk source location for the device digital identity, resource constraint data and permission boundary fields associated with the verification deviation items, and generate risk classification records according to the number of risk source locations and the impact range of the risk source locations in the binding relationship; The access consistency verification results and risk classification records are associated and arranged according to the device digital identity, so that the verification pass items, verification deviation items and risk classification records corresponding to the same device digital identity are written into the same authentication record, generating access authentication results, and determining the credential isolation level based on the risk level in the risk classification record.

[0022] In this embodiment, step four specifically includes: Extract the access consistency verification result and risk classification record from the access authentication result. Align the verification pass items and verification deviation items in the access consistency verification result with the risk level value in the risk classification record. Then associate and organize the field alignment result with the credential isolation level to generate the algorithm input record. Based on the algorithm input record, read the risk level value, voucher isolation level and number of verification deviations, determine the hyperplane dimension of the improved Blakley voucher isolation algorithm according to the risk level value, determine the number of fragments according to the voucher isolation level, determine the reconstruction threshold according to the number of verification deviations, and write the hyperplane dimension, number of fragments and reconstruction threshold into the algorithm structure record; Based on the mapping relationship between risk classification records and voucher isolation levels, risk level values ​​and voucher isolation levels are converted into segmented security weights. Then, based on the segmented security weights, hyperplane normal vector generation rules and intercept perturbation rules are configured so that the segmented security weights participate in the determination of hyperplane direction and intercept offset. Based on the algorithm structure record, the dimensional range of the geometric space is determined. Based on the hyperplane normal vector generation rule, the normal vector corresponding to each voucher fragment is determined. Based on the intercept perturbation rule, the intercept offset corresponding to each voucher fragment is determined. The actual access voucher is mapped to the intersection point to be reconstructed in the geometric space, and an improved Blakley voucher isolation algorithm is constructed. Based on the improved Blakley credential isolation algorithm, the hyperplane dimension, hyperplane normal vector, intercept perturbation, fragmentation security weight, and fragmentation valid state are encapsulated as parameters to generate hyperplane parameters for dynamic hyperplane fragmentation. The minimum number of credential fragments to participate in the reconstruction is determined based on the reconstruction threshold, the verification qualification conditions for participating in the reconstruction are determined based on the access consistency verification results, the fragment status conditions for participating in the reconstruction are determined based on the fragment validity status, and the quantity conditions, verification qualification conditions, and fragment status conditions are associated to form threshold reconstruction conditions.

[0023] This invention unifies the input records of access consistency verification results, risk classification records, and credential isolation levels into the algorithm input record, transforming the access authentication process from a static pass / reject decision to a source of structural parameters for an improved Blakley credential isolation algorithm. By determining the hyperplane dimension through risk level values, the number of fragments through credential isolation levels, and the reconstruction threshold through the number of verification deviations, the fragment space, fragment size, and reconstruction difficulty of the actual access credentials can be dynamically adjusted according to changes in the access risk of IoT devices. Furthermore, by incorporating fragment security weights into the hyperplane normal vector generation rules and intercept perturbation rules, each credential fragment not only possesses secret sharing capabilities... It also carries security constraints corresponding to risk level and isolation level; by mapping real access credentials to intersection points to be reconstructed in geometric space, and encapsulating hyperplane dimension, hyperplane normal vector, intercept perturbation, fragment security weight, and fragment validity state, it can avoid direct exposure of real access credentials on the IoT device side; by forming threshold reconstruction conditions through quantity conditions, verification qualification conditions, and fragment status conditions, the generation of temporary real access credentials can be controlled by the number of fragments, access authentication results, and fragment status simultaneously, thereby improving credential isolation strength, reducing the risk of continuous use after credential leakage, and enhancing dynamic authentication capabilities and access security in the IoT identity governance process.

[0024] In this embodiment, step five specifically includes: Extract the hyperplane dimension, hyperplane normal vector, intercept perturbation, piecewise safety weight, and piecewise effective state from the hyperplane parameters. Use the hyperplane dimension as the coordinate length reference to establish the voucher piecewise geometric space, and configure the directional constraint positions in the voucher piecewise geometric space according to the arrangement order of the hyperplane normal vectors. The real access voucher is normalized, the normalized result is converted into a numerical sequence, and then the numerical sequence is length registered and coordinate-based according to the hyperplane dimension to generate a numerical voucher vector corresponding to the real access voucher. The numerical voucher vector is written into the voucher fragment geometric space to form the intersection to be reconstructed. The intersection of the hyperplane normal vector and the point to be reconstructed is multiplied and summed according to the coordinate position to obtain the intercept reference value. Then, the intercept perturbation is superimposed on the intercept reference value to form the perturbation correction result, and the perturbation correction result is determined as the intercept parameter. Write the hyperplane normal vector, intercept parameter, piecewise safety weight, and piecewise valid state into the same voucher piecewise record. Establish a geometric constraint relationship based on the voucher piecewise record that satisfies the sum of the hyperplane normal vector and the coordinate dot product equal to the intercept parameter, and generate a voucher piecewise hyperplane that passes through the intersection point to be reconstructed. The voucher fragment hyperplanes are sorted by security weights, and marked as reconstructible according to their valid states. The voucher fragment hyperplanes that have completed weight sorting and state marking are then set together to form a voucher fragment hyperplane set.

[0025] This invention converts real access credentials into numerical credential vectors and writes them into the credential fragmentation geometric space. This prevents real access credentials from being directly stored and transmitted in plaintext form, instead representing them geometrically as intersections to be reconstructed. By establishing a unified coordinate length benchmark through the hyperplane dimension and configuring directional constraints according to the hyperplane normal vector, the credential fragmentation process can be guaranteed to have a definite spatial structure and a reconstructable basis. By multiplying and summing the hyperplane normal vector and the intersections to be reconstructed to obtain the intercept benchmark value, and then superimposing the intercept perturbation to form the intercept parameter, each credential fragmentation hyperplane passes through the intersections to be reconstructed. Furthermore, perturbation constraints related to access risks are introduced. By writing the hyperplane normal vector, intercept parameter, fragment security weight, and fragment validity status into the credential fragment record, the credential fragment hyperplane can simultaneously possess reconstruction constraints, risk weights, and validity status identifiers. By weighting and marking the credential fragment hyperplane with reconstructible status, credential fragments with higher security and valid status can be prioritized during the threshold reconstruction phase. This improves the isolation storage strength of real access credentials, reduces the risk of credential recovery due to leakage of a single fragment, and enhances the controllability of the IoT access gateway for the reconstruction process of temporary real access credentials.

[0026] In this embodiment, step six specifically includes: Extract the device digital identity and credential isolation level from the access authentication result, align the identity identifier content in the device digital identity with the level identifier content in the credential isolation level, write the aligned identity identifier content and level identifier content into the same generation unit, and organize the generation unit according to the order of the device digital identity in the access authentication result to generate a credential alias generation record. According to the credential isolation level, the alias length, alias valid range, and alias issuance status are read. The device digital identity in the credential alias generation record is converted into alias generation input. Then, the alias generation rules perform character encoding, length trimming, and valid range binding on the alias generation input to generate a credential alias that meets the alias length and alias valid range. Extract the voucher fragmentation hyperplane and fragmentation validity status from the voucher fragmentation hyperplane set, write the voucher alias into the binding position of the voucher fragmentation hyperplane set, write the fragmentation validity status into the status field of the binding position, and organize the binding position and status field according to the order of the voucher fragmentation hyperplane in the voucher fragmentation hyperplane set to generate an isolated binding record; An index key is created based on the credential alias. The isolated binding record is written to the fragment binding position of the index key, and the fragment valid status is written to the status verification position of the index key. Then, the index key, fragment binding position and status verification position are associated and written to the IoT access gateway to generate an isolated index for the IoT access gateway to call the credential fragment hyperplane set. Based on the index key in the isolation index, find the IoT device corresponding to the credential alias, send the credential alias to the IoT device, and write the sending time, sending result and alias validity range into the alias issuance status to complete the credential alias issuance status record.

[0027] This invention aligns the device's digital identity with the credential isolation level and generates a credential alias generation record, enabling the credential alias generation process to directly inherit the access authentication result and preventing credential aliases from being generated independently of device identity and risk level. By configuring alias length, alias validity range, and alias issuance status according to the credential isolation level, the credential alias is constrained by the isolation level during the generation stage, thereby reducing the security risks caused by low-risk devices and high-risk devices using the same alias strength. Furthermore, it associates and organizes the credential alias with the binding position, fragment validity status, and status field of the credential fragment hyperplane set. This allows credential aliases to point not directly to the actual access credential, but to a set of credential fragment hyperplanes constrained by fragmentation status. By establishing an isolated index between the index key, fragmentation binding location, and status verification location in the IoT access gateway, the gateway can accurately call the corresponding credential fragment hyperplane set after receiving the credential alias and complete status verification before the call. By sending the credential alias to the IoT device and recording the sending time, sending result, and alias validity period, the credential alias issuance process can be tracked and managed, thereby improving the isolation, security, and audit traceability of credential use on the IoT device side.

[0028] In this embodiment, step seven specifically includes: After receiving an access request, the IoT access gateway extracts the credential alias from the credential field of the access request. It then performs character length verification, encoding format verification, and alias validity range verification on the credential alias. The character length verification is used to determine whether the number of characters in the credential alias conforms to the alias generation rules. The encoding format verification is used to determine whether the character arrangement of the credential alias conforms to the alias generation rules. The validity range verification is used to determine whether the reception time of the access request is within the alias validity range. Finally, the character length verification result, encoding format verification result, and validity range verification result are written to the same verification record position to generate an alias verification record. The alias in the alias verification record is used as the matching field and compared with the index key in the isolated index item by item to obtain the index key with consistent character content and consistent alias valid range. Then, the isolated binding record is extracted from the index item corresponding to the index key, and the sharding hyperplane set is called according to the sharding binding position in the isolated binding record. Extract the voucher fragment hyperplane and fragment validity status from the voucher fragment hyperplane set. For each voucher fragment hyperplane, read the fragment validity status. Write the voucher fragment hyperplane marked as eligible for reconstruction into the candidate position. Exclude the voucher fragment hyperplane marked as not eligible for reconstruction from the candidate position. Form a reconstruction candidate hyperplane set according to the candidate positions. The number of voucher fragment hyperplanes in the candidate hyperplane set for reconstruction is counted. The number of voucher fragment hyperplanes is compared with the quantity condition in the threshold reconstruction condition. At the same time, the effective state of the fragment in the candidate hyperplane set for reconstruction is matched item by item with the state condition in the threshold reconstruction condition. The numerical comparison result and the item-by-item matching result are then associated to generate the threshold judgment result. When the threshold judgment result meets the threshold reconstruction condition, the hyperplane normal vector and intercept parameter of the candidate hyperplane set are extracted. The hyperplane normal vector is used as the coefficient term of the linear equation system, and the intercept parameter is used as the constant term of the linear equation system. A linear equation system is constructed to solve the intersection point to be reconstructed. The hyperplane intersection point is obtained by performing elimination on the linear equation system. The hyperplane intersection point is then numerically decoded and the voucher format is restored to generate a temporary real access voucher.

[0029] In this embodiment, step eight specifically includes: The IoT access gateway locates the credential field in the access request, extracts the credential alias writing position from the credential field, writes the temporary real access credential to the credential alias writing position, and retains the access object field, permission boundary field and request payload field in the access request, and generates a credential replacement request. The IoT access gateway determines the forwarding object according to the access object field in the credential replacement request, verifies the forwarding permission according to the permission boundary field, sends the request payload field to the forwarding object, records the sending completion status, the forwarding object return status and the temporary real access credential verification status, and merges the sending completion status, the forwarding object return status and the temporary real access credential verification status to generate the forwarding result. Extract the sending completion status, forwarding object return status, and temporary real access credential verification status from the forwarding results. Perform a forwarding consistency comparison between the sending completion status and the fragment valid status in the credential fragment hyperplane set. Perform a response consistency comparison between the forwarding object return status and the fragment security weight. Perform a credential consistency comparison between the temporary real access credential verification status and the hyperplane intersection. Combine the forwarding consistency comparison results, response consistency comparison results, and credential consistency comparison results into a fragment status offset and write it into the credential isolation residual. Based on the voucher isolation residual, locate the voucher fragment hyperplane in the voucher fragment hyperplane set that participates in the reconstruction of temporary real access vouchers, convert the voucher isolation residual into intercept adjustment amount and state adjustment flag, use the intercept adjustment amount to correct the intercept parameter of the voucher fragment hyperplane participating in the reconstruction, and use the state adjustment flag to correct the fragment effective state of the voucher fragment hyperplane participating in the reconstruction, thus forming an updated voucher fragment hyperplane set. Write the threshold reconstruction conditions, hyperplane intersections, temporary real access credentials, credential replacement requests, forwarding results, and credential isolation residuals into the audit log according to the forwarding order of the access requests. Organize the credential reconstruction process according to the threshold reconstruction conditions and hyperplane intersections in the audit log, organize the access forwarding process according to the credential replacement requests and forwarding results in the audit log, and associate the credential reconstruction process with the access forwarding process to generate identity governance audit results.

[0030] This invention replaces credential aliases with temporary real access credentials at the IoT access gateway side, ensuring that the real access credentials are only used temporarily during the access forwarding process. This avoids the risk of leakage caused by IoT devices directly holding the real access credentials. By retaining the access object field, permission boundary field, and request payload field when generating the credential replacement request, the credential replacement process does not change the original access intent and permission boundaries, ensuring consistency between the proxy forwarding process and the original access request from the device. By collecting the sending completion status, forwarding object return status, and temporary real access credential verification status to generate forwarding results, it can uniformly record whether access forwarding is complete, whether the target resource has responded, and whether the temporary credential is valid. Furthermore, by comparing the forwarding results with... The credential fragmentation process involves a consistency comparison of the fragmentation validity status, fragmentation security weight, and hyperplane intersection to generate a fragmentation status offset, which is then written into the credential isolation residual. This allows any abnormal states during the access forwarding process to be fed back to the credential fragmentation structure. By correcting the intercept parameters and fragmentation validity status of the hyperplanes involved in the reconstruction using the credential isolation residual, the credential fragmentation hyperplane set can be dynamically updated with the access results, reducing the risk of old fragments being reused. By writing the threshold reconstruction conditions, hyperplane intersection, temporary real access credentials, credential replacement requests, forwarding results, and credential isolation residual into the audit log, the entire credential reconstruction process and access forwarding process can be preserved, thereby improving the credential isolation strength, dynamic correction capability, and audit traceability capability of IoT identity governance.

[0031] Example 1: To verify the feasibility of this invention in practice, it was applied to a device access and resource access management scenario of an industrial IoT platform. The platform's access objects include environmental monitoring terminals, energy consumption acquisition terminals, edge controllers, and video acquisition gateways. Devices need to access data receiving services, parameter configuration services, and remote control services through the IoT access gateway. In traditional solutions, some devices store real access credentials in their firmware configuration files, while others access platform resources via fixed tokens. After device replacement, repair, or relocation, credential updates rely on manual configuration, which can easily lead to problems such as untimely credential revocation, mismatch between access permissions and device identity, and difficulty in tracing abnormal access. Especially when device logs are exported, edge node caches are copied, or low-privilege devices attempt to access high-privilege resources, there is a risk that real access credentials will be reused for a long time, requiring the platform to frequently manually check device identity, access source, and resource authorization relationships.

[0032] In this embodiment, identity access data generated during the registration and access process of IoT devices is first collected, along with resource constraint data generated during resource access, to generate device access records. Then, device digital identities are established based on these access records, ensuring each device has a corresponding digital identity identifier. These digital identities are then associated with the resource constraint data to form an identity governance index. When a device initiates an access request, the platform performs access consistency verification and risk classification on the identity governance index, determining whether the device's identity validity status, access ownership relationship, and permission boundary fields are consistent, and generating access authentication results and credential isolation levels. For low-risk devices, the system configures a lower reconstruction threshold; for devices with access deviations but not meeting the rejection conditions, the system increases the credential isolation level and raises the number of credential fragments and the reconstruction threshold.

[0033] During the credential processing phase, the system does not issue actual access credentials to IoT devices. Instead, it generates credential aliases based on the credential isolation level. After the actual access credential is converted into a numerical credential vector, it is written into the geometric space corresponding to the improved Blakley credential isolation algorithm, forming the intersection to be reconstructed. The system generates a set of credential fragmentation hyperplanes based on the hyperplane dimension, hyperplane normal vector, intercept perturbation, fragmentation security weight, and fragmentation validity state. After establishing an isolation index between the credential alias and the credential fragmentation hyperplane set, it writes it to the IoT access gateway. The device only stores the credential alias. When an access request reaches the IoT access gateway, the gateway calls the credential fragmentation hyperplane set based on the credential alias. When the threshold reconstruction condition is met, it solves the hyperplane intersection, generates a temporary actual access credential, and then replaces the credential alias in the access request with the temporary actual access credential before forwarding it to the target service.

[0034] In continuous operation testing, two systems with similar access scale, device type, and resource access frequency were selected for comparison. One system used a fixed token and ordinary gateway forwarding scheme, while the other system used the method of this invention. During the test, scenarios such as normal device access, credential leakage, unauthorized access, device migration access, and abnormal forwarding on the gateway side were simulated. Relevant indicators for credential exposure, anomaly identification, credential updating, and audit traceability were recorded, as shown in Table 1. Table 1 Comparison of the effects of voucher isolation management

[0035] As shown in Table 1, under the condition that the device scale and access request volume are basically the same, the method of the present invention eliminates the storage of real access credentials on the device side, and the number of times that can continue to access after credential leakage is significantly reduced. This indicates that the credential alias, isolation index, and threshold reconstruction mechanism can effectively reduce the risk of real access credentials being reused for a long time. The average time for identifying abnormal access is reduced from 38.4 seconds to 6.7 seconds. The main reason is that the access authentication result, credential isolation level, fragment validity status, and threshold reconstruction conditions are linked and verified when the access request enters the gateway. The average processing time for credential update is reduced from 31.5 minutes to 2.8 minutes, indicating that updating the credential fragment hyperplane set based on credential isolation residuals can replace a large amount of manual reconfiguration. The audit record association completeness rate is improved to 99.1%, indicating that after the threshold reconstruction conditions, hyperplane intersection, credential replacement request, forwarding result, and credential isolation residuals are uniformly written into the audit record, the credential reconstruction process and access forwarding process can be completely tracked. This proves that the present invention has feasibility and stable effect in IoT device identity governance, credential isolation protection, and abnormal access tracing.

[0036] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. An IoT identity governance method based on access authentication and credential isolation, characterized in that, The steps include the following: Step 1: Collect the identity access data and resource constraint data of IoT devices to generate device access records; Step 2: Establish device digital identities based on device access records and generate an identity governance index by associating it with resource constraint data; Step 3: Perform access consistency verification and risk classification on the identity governance index to generate access authentication results and credential isolation levels; Step 4: Based on the access authentication results and credential isolation level, construct an improved Blakley credential isolation algorithm to generate hyperplane parameters and threshold reconstruction conditions; Step 5: Perform dynamic hyperplane fragmentation on the actual access credentials using hyperplane parameters to form a set of credential fragmentation hyperplanes; Step 6: Generate credential aliases based on credential isolation levels, establish isolation indexes between credential aliases and credential sharding hyperplane sets, and issue credential aliases to IoT devices; Step 7: The IoT access gateway receives the access request carrying the credential alias, calls the credential fragmentation hyperplane set according to the isolation index, and solves the hyperplane intersection to generate a temporary real access credential when the threshold reconstruction condition is met. Step 8: The IoT access gateway replaces the credential alias with a temporary real access credential and forwards the access request. Based on the forwarding result, it generates a credential isolation residual, updates the credential fragmentation hyperplane set based on the credential isolation residual, records the credential reconstruction process and the access forwarding process, and outputs the identity governance audit results.

2. The IoT identity governance method based on access authentication and credential isolation according to claim 1, characterized in that, Step one specifically involves: Collect the device identity field and access session field generated by IoT devices during the registration and access process, and associate and organize the device identity field and access session field according to the access order of IoT devices to generate identity access data; Collect the access object field and permission boundary field generated by IoT devices during resource access, and associate and organize the access object field and permission boundary field according to the access object ownership relationship to generate resource constraint data; Using the device identity field as the association benchmark, the identity access data and resource constraint data are organized accordingly, and the organized results are arranged in order according to the access session field to generate device access records.

3. The IoT identity governance method based on access authentication and credential isolation according to claim 1, characterized in that, Step two specifically involves: Extract identity access data from device access records, merge access session fields belonging to the same IoT device according to device identity fields, and generate device identity baseline records based on the merging results; A device digital identity identifier is generated based on the device identity baseline record. The device digital identity identifier is bound to the device identity field. The identity validity status is marked according to the access session field to establish the device digital identity. Extract resource constraint data from device access records, organize permission boundary fields according to access object fields, and establish access ownership relationship between the organized results and device identity fields to generate resource constraint association records; The device digital identity and resource constraint association records are linked and arranged according to access ownership, generating an identity governance index that records the binding relationships between device digital identity, resource constraint data, and permission boundary fields.

4. The IoT identity governance method based on access authentication and credential isolation according to claim 1, characterized in that, Step three specifically involves: Extract the device digital identity and associated resource constraint data from the identity governance index, and generate access verification records based on the binding relationship between the device digital identity and resource constraint data; The identity validity status, access ownership relationship, and permission boundary fields in the access verification record are matched with the binding relationships in the identity governance index to generate access consistency verification results. Based on the access consistency verification results, risk assessment is performed on the resource constraint data and permission boundary fields associated with the device's digital identity, and a risk classification record is generated; The access consistency verification results and risk classification records are correlated and arranged to generate access authentication results, and the credential isolation level is determined based on the risk classification records.

5. The IoT identity governance method based on access authentication and credential isolation according to claim 1, characterized in that, Step four specifically involves: Extract the access consistency verification result and risk classification record from the access authentication result, and associate and organize the access consistency verification result, risk classification record and credential isolation level to generate algorithm input record; Based on the algorithm input record, determine the hyperplane dimension, number of fragments, and reconstruction threshold of the improved Blakley credential isolation algorithm, and write the hyperplane dimension, number of fragments, and reconstruction threshold into the algorithm structure record; Based on the mapping relationship between risk classification records and credential isolation levels, fragment security weights are generated, and hyperplane normal vector generation rules and intercept perturbation rules are configured according to the fragment security weights. An improved Blakley credential isolation algorithm is constructed based on the algorithm structure record, hyperplane normal vector generation rules, and intercept perturbation rules, so that the real access credentials form the intersection points to be reconstructed in the geometric space corresponding to the hyperplane dimension; Hyperplane parameters are generated based on the improved Blakley credential isolation algorithm. The hyperplane parameters include hyperplane dimension, hyperplane normal vector, intercept perturbation, fragmentation security weight, and fragmentation valid state. Based on the reconstruction threshold, access consistency verification results, and fragment validity status, threshold reconstruction conditions are generated. These threshold reconstruction conditions limit the number and status conditions for the credential fragment hyperplane set to participate in the reconstruction of temporary real access credentials.

6. The IoT identity governance method based on access authentication and credential isolation according to claim 1, characterized in that, Step five specifically involves: Extract the hyperplane dimension, hyperplane normal vector, intercept perturbation, piecewise security weight, and piecewise valid state from the hyperplane parameters. Establish the credential piecewise geometric space according to the hyperplane dimension and write the hyperplane normal vector into the orientation constraint position of the credential piecewise geometric space. Perform character normalization and numerical conversion on the real access credentials to generate a numerical credential vector. Then, perform length registration on the numerical credential vector according to the hyperplane dimension to form the intersection to be reconstructed. The inner product of the intersection of the hyperplane normal vector and the point to be reconstructed is calculated to generate the intercept reference value. The intercept reference value is then perturbed and corrected according to the intercept perturbation amount to generate the intercept parameter. Write the hyperplane normal vector, intercept parameter, fragmentation safety weight and fragmentation validity status into the voucher fragmentation record, and construct the voucher fragmentation hyperplane that passes through the intersection point to be reconstructed according to the voucher fragmentation record; The voucher fragmentation hyperplane is weighted according to the fragmentation security weight, and the voucher fragmentation hyperplane is marked according to the fragmentation validity status to form a voucher fragmentation hyperplane set.

7. The IoT identity governance method based on access authentication and credential isolation according to claim 1, characterized in that, Step six specifically involves: Extract the device digital identity and credential isolation level from the access authentication results, associate and organize the device digital identity and credential isolation level, and generate credential alias generation records. Configure the alias length, alias valid range and alias issuance status according to the alias isolation level, write the alias generation record into the alias generation rule, and generate the alias; Extract the voucher fragmentation hyperplane and fragmentation validity status from the voucher fragmentation hyperplane set, bind the voucher alias to the voucher fragmentation hyperplane set, and generate an isolation binding record; An isolation index is created based on the credential alias, isolation binding record, and fragment validity status, and the isolation index is written to the IoT access gateway. Based on the isolation index, locate the IoT device corresponding to the credential alias, issue the credential alias to the IoT device, and record the credential alias issuance status.

8. The IoT identity governance method based on access authentication and credential isolation according to claim 1, characterized in that, Step seven specifically involves: The IoT access gateway receives an access request, extracts the credential alias from the access request, performs format validation and valid range validation on the credential alias, and writes the validation results into the alias validation record. Match the credential alias in the alias verification record with the index key in the isolation index to locate the isolation binding record associated with the credential alias, and call the credential sharding hyperplane set based on the isolation binding record; Extract the voucher fragment hyperplanes and fragment validity states from the voucher fragment hyperplane set, filter the voucher fragment hyperplanes that can participate in reconstruction according to the fragment validity states, and generate a set of reconstruction candidate hyperplanes; The number of credential fragment hyperplanes in the candidate hyperplane reconstruction set is compared with the quantity condition in the threshold reconstruction condition, and the valid fragment states are matched with the state conditions in the threshold reconstruction condition to generate the threshold judgment result. When the threshold judgment result meets the threshold reconstruction condition, the linear equation system is constructed and solved for the reconstruction candidate hyperplane set to obtain the hyperplane intersection point, and the hyperplane intersection point is converted into a temporary real access credential.

9. The IoT identity governance method based on access authentication and credential isolation according to claim 1, characterized in that, Step eight specifically involves: The IoT access gateway writes the temporary real access credential into the credential field of the access request, replaces the credential alias in the credential field, and generates a credential replacement request. The IoT access gateway performs access forwarding according to the credential replacement request, collects the forwarding status, response status and credential usage status during the access forwarding process, and generates forwarding results; Based on the forwarding results, the status of the credential fragment hyperplane set associated with the temporary real access credential is compared, fragment status offset is generated, and the fragment status offset is written into the credential isolation residual. Based on the voucher isolation residual, the intercept parameter and the effective state of the voucher fragmentation hyperplane set are adjusted to form an updated voucher fragmentation hyperplane set; Write the threshold reconstruction conditions, hyperplane intersections, temporary real access credentials, credential replacement requests, forwarding results, and credential isolation residuals into the audit log to form the credential reconstruction process and access forwarding process, and output the identity governance audit results.

Images