A large-scale sensor network node identity authentication method based on a graph neural network

Abstract

The application discloses a kind of based on graph neural network's large-scale sensing network node identity authentication method, comprising the following steps: establishing unique ring entrance and identity closed diffusion ring;Replace bidirectional random walk, constrain identity state along ring transmission;Compare identity state after closed write-back, obtain closed write-back difference;According to closed write-back difference, write in trusted state or risk state;Temporary zero positioning conflict authentication association edge;Mutually exclusive diffusion forms candidate node channel state;Output node identity authentication result.The application relates to the technical field of sensing network security authentication, realizes that node identity authentication path is controllable, improves clone identification accuracy and conflict source traceability.

Description

Technical Field

[0001] This invention relates to the field of sensor network security authentication technology, and in particular to a method for large-scale sensor network node identity authentication based on graph neural networks. Background Technology

[0002] Sensor networks consist of numerous sensor nodes, access gateways, and authentication servers. Node authentication is used to verify the origin of access nodes, the validity of credentials, and communication permissions. Current node authentication methods often use node identifiers, certificate digests, key negotiation records, and historical authentication records for matching and verification. Some solutions utilize graph neural networks (GNNs) for sensor network relationship modeling, analyzing the propagation of node identity states through adjacency, communication, and historical authentication relationships. DCRNNs can handle state propagation in graph structures using diffusing convolutions, making them suitable for sensor network authentication scenarios with time-updated features.

[0003] Existing graph-based authentication methods often rely on node adjacency relationships or random walk paths to propagate identity states. These states can easily spread along unrelated neighborhood edges, making it difficult to confine them to a closed authentication path corresponding to the same node identity. For cloned nodes, credential reuse nodes, or nodes with repeated access, existing methods lack a verification mechanism for closed-loop write-back with a unique entry point, making it impossible to directly compare the differences in identity states before and after propagation. When identity conflicts occur, existing methods often provide risk assessment results but lack the ability to locate and process each authentication-related edge that caused the conflict, and also lack mutual exclusion propagation control between candidate nodes under the same node identity. This can easily allow risky nodes to continue participating in trusted state propagation, affecting the accuracy and traceability of node identity authentication in large-scale sensor networks.

[0004] Therefore, how to provide a method for large-scale sensor network node authentication based on graph neural networks is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose a large-scale sensor network node authentication method based on graph neural networks. This invention transforms the DCRNN diffusing convolution into identity closure diffusing, and sets up closure write-back difference gating, conflict edge temporary zeroing positioning, and candidate node mutual exclusion diffusing mechanism, which has the advantages of controllable authentication path, accurate clone node identification, and traceable conflict source.

[0006] A method for node authentication in a large-scale sensor network based on a graph neural network according to an embodiment of the present invention includes the following steps: S1. Using the identity of the same node corresponding to the sensor node to be authenticated as the unique loop entry, select the authentication association edge corresponding to the same node identity in the DCRNN authentication graph, and connect the first and last authentication association edges to form an identity closed diffusion loop. S2. Replace the bidirectional random walk in the DCRNN diffusion convolution with identity closure diffusion, constrain the diffusion transition matrix to pass identity state along the identity closure diffusion loop, and reset the authentication association edge weights outside the identity closure diffusion loop to zero. S3. Before each round of DCRNN loop update, the identity state is written back from the unique ring entrance along the identity closed diffusion ring. The identity state at the unique ring entrance is compared with the identity state written back to obtain the closed write-back difference. S4. Use the closed write-back difference as a gating input to the update gate and reset gate of the DCRNN recurrent unit. Write the trusted state when the closed write-back difference meets the consistency condition, write the risk state when the closed write-back difference meets the conflict condition, and close the trusted state writing channel. S5. When the risk state reaches the continuous triggering condition, the corresponding transmission channel of the authentication association edge is temporarily zeroed one by one in the DCRNN diffusion convolution. The conflict authentication association edge is determined based on the difference in the closed write-back before and after the temporary zeroing. S6. Perform mutual exclusion diffusion on candidate nodes with the same node identity that share a unique ring entry, and form the candidate node channel status based on the difference in closed writeback and risk status. S7. Output the node identity authentication result based on the trusted state, risk state, conflict authentication associated edge, and candidate node channel state.

[0007] Optionally, the establishment process of the identity closed diffusion loop in S1 specifically includes: S11. Starting from the unique ring entrance, read the authentication association edges corresponding to the same node identity in the DCRNN authentication graph, perform entrance reachability verification and write-back reachability verification on the authentication association edges, and retain the authentication association edges that meet the two conditions of being reachable from the unique ring entrance and being write-back to the unique ring entrance. S12. Sort the remaining authentication association edges according to the diffusion step order of DCRNN diffusion convolution, so that the end point of the previous authentication association edge coincides with the start point of the next authentication association edge. S13. Fix the sequence of authentication association edges where the starting point of the first authentication association edge and the ending point of the last authentication association edge are both unique loop entrances to form an identity closed diffusion loop.

[0008] Optionally, in S12, the retained authentication-related edges are sorted from beginning to end according to the diffusion step order of the DCRNN diffusion convolution, specifically including: S121. Using the unique ring entrance as the starting point of the first diffusion step, write the authentication association edge whose starting point is equal to the unique ring entrance into the first diffusion step; S122. Using the endpoint of the authentication association edge written in the previous diffusion step as the starting point of the current diffusion step, retrieve the authentication association edges with the same starting point among the retained authentication association edges. S123. Perform write-back reachability verification on the retrieved authentication-related edges, and select the authentication-related edges that can return a unique ring entry in subsequent diffusion steps to write to the current diffusion step. S124. Retain the diffusion transition matrix elements of the row corresponding to the starting point and the column corresponding to the ending point of the authentication associated edge written in the current diffusion step, and set the diffusion transition matrix elements in the row corresponding to the starting point of the current diffusion step that have not been written in the current diffusion step to zero. S125. When the endpoint of the authentication associated edge written in the current diffusion step is a unique ring entry, the diffusion step sequence writing ends.

[0009] Optionally, in S2, the bidirectional random walk in the DCRNN diffusing convolution is replaced with identity closure diffusing, specifically including: S21. Stop calling the forward random walk matrix and the reverse random walk matrix within the DCRNN diffusion convolution, and set the elements of the diffusion transition matrix that have not been written into any diffusion step to zero. S22. Read the authentication association edges in the identity closed diffusion loop in sequence according to the diffusion step order, and take the starting point of the authentication association edge corresponding to the current diffusion step as the identity state input position and the ending point of the authentication association edge corresponding to the current diffusion step as the identity state output position. S23. In the diffusion transfer matrix, only the transfer channel from the identity state input position to the identity state output position is open, and the transfer channel from the same identity state input position to the outside of the identity closed diffusion loop is closed. S24. Send the identity status output from the previous diffusion step to the identity status input position of the next diffusion step until the identity status returns to the unique loop entry to complete the closed write-back.

[0010] Optionally, obtaining the closed write-back difference in S3 specifically includes: S31. Before the identity state enters the identity closed diffusion loop, the unique loop entry identity state is locked in the gate comparison branch of the DCRNN loop unit. S32. After the identity status completes the closed write-back along the identity closed diffusion loop, send the closed write-back identity status to the entry comparison branch. S33. For the gate comparison branch, perform state alignment on the same scale between the unique ring entrance identity state and the closed write-back identity state, extract the deviation between the unique ring entrance identity state and the closed write-back identity state at the same state scale, and compress the deviation into the closed write-back difference.

[0011] Optionally, S4 specifically includes: S41. A first difference modulation input is set in front of the update gate input terminal by the gate comparison branch, and a second difference modulation input is set in front of the reset gate input terminal. The closed write-back difference is sent to the first difference modulation input and the second difference modulation input respectively. S42. The update gate performs channel selection between the trusted state write channel and the risky state write channel based on the closed write-back difference in the first difference modulation entry. S43. The reset gate performs mode selection between the retention state recursion mode and the cut-off state recursion mode based on the closed write-back difference in the second difference modulation inlet. S44. When the closed write-back difference meets the consistency condition, the update gate opens the trusted state write channel, and the reset gate executes the retained state recursion mode, so that the identity state obtained by the previous round of DCRNN loop update can participate in the current round of hidden state update. S45. When the closed write-back difference meets the conflict condition, the update gate closes the trusted state write channel and opens the risky state write channel. The reset gate executes the cut-off state recursion mode, blocking the identity state obtained from the previous round of DCRNN loop update from participating in the current round of hidden state update.

[0012] Optionally, determining the conflict authentication association edge in S5 specifically includes: S511. When the risk state reaches the continuous triggering condition, keep the current round diffusion transfer matrix unchanged, perform identity closure diffusion according to the state of the corresponding transmission channel of any authentication associated edge that is not set to zero, and record the obtained closure write-back difference as the benchmark closure write-back difference. S512. Select the authentication association edges in the identity closed diffusion loop in sequence according to the diffusion step order. Temporarily set the transmission channels corresponding to the selected authentication association edges to zero in the current round diffusion transition matrix, and keep the transmission channels corresponding to the remaining authentication association edges open. S513. Re-execute identity closure diffusion within the current round diffusion transfer matrix after temporary zeroing to obtain the closure write-back difference after temporary zeroing. S514. Compare the closed write-back difference after temporary zeroing with the baseline closed write-back difference. When the closed write-back difference after temporary zeroing is lower than the baseline closed write-back difference, mark the selected authentication association edge as a candidate conflict authentication association edge. S515. After canceling the temporary zeroing of the transmission channel corresponding to the selected authentication association edge, continue to select the next authentication association edge until all authentication association edges in the identity closure diffusion loop have been temporarily zeroed. S516. Select the authentication association edge that causes the largest decrease in the closed write-back difference from the candidate conflict authentication association edges, and determine it as the conflict authentication association edge.

[0013] Optionally, the continuous triggering condition for the risk state in S5 specifically includes: S521. Set a continuous trigger counter bit for the risk state within the DCRNN recurrent unit; S522. After each round of DCRNN loop update, check the open / closed status of the risk state write channel and the trusted state write channel. S523. When the risk status write channel is open, the counter bit will be continuously incremented by one. S524. When the trusted state write channel is open, the counter bit will be continuously triggered to clear to zero. S525. When the continuous trigger count reaches the preset number of triggers, the risk state is determined to meet the continuous trigger condition, and the diffusion transfer matrix of the current round is not updated.

[0014] Optionally, the formation of candidate node channel states in S6 specifically includes: S61. In the DCRNN diffusion convolution, map the candidate nodes corresponding to the same node identity to the row corresponding to the unique ring entrance, and write the authentication association edge corresponding to the transmission channel in the identity closed diffusion ring of the candidate node into the current round diffusion transition matrix. S62. Perform identity closure diffusion for each candidate node, and read the closure write-back difference and risk status corresponding to the candidate node; S63. The mutual exclusion selection gate sets the corresponding transmission channel of the authentication association edge in the identity closed diffusion ring corresponding to the candidate node that has been written into the risk state to zero, and retains the corresponding transmission channel of the authentication association edge in the identity closed diffusion ring corresponding to the candidate node with the smallest difference in closed write-back among the candidate nodes that have not been written into the risk state. S64. The mutual exclusion selection gate closes the authentication association edge corresponding to the identity closure diffusion ring of the remaining candidate nodes and writes the trusted state corresponding to the remaining candidate nodes into the channel, fixing the channel opening and closing result as the candidate node channel state.

[0015] Optionally, the node authentication result output in S7 specifically includes: S71. Set an authentication folding gate at the output of the DCRNN recurrent unit. The authentication folding gate reads the trusted state, risk state, conflict authentication associated edge, and candidate node channel state. S72. When the risk state has been written, the authentication folding door will suppress the trusted state from entering the identity authentication output channel. When the candidate node channel state is closed, the corresponding candidate node will be suppressed from entering the identity authentication output channel. S73. When a conflict authentication associated edge exists, the corresponding transmission channel of the conflict authentication associated edge is written into the conflict output channel. S74. When the authentication folding door has been written to the trusted state, not written to the risk state, and the candidate node channel status is open, the identity authentication output channel is retained. S75. The authentication folding door outputs the node authentication result according to the retention status of the authentication output channel, the suppression status of the authentication output channel, and the channel status of the conflict output channel.

[0016] The beneficial effects of this invention are: (1) This invention replaces the bidirectional random walk in the DCRNN diffusion convolution with identity closure diffusion, so that the identity state can only be transmitted and written back along the identity closure diffusion loop corresponding to the identity of the same node, forming an authentication closed loop of "unique loop entry - closure write-back - difference comparison"; the closed identity verification method can limit the authentication propagation path to the closed path corresponding to the identity of the same node, reducing the interference of irrelevant node relationships on the identity authentication result.

[0017] (2) The present invention sends the closed write-back difference into the update gate and reset gate of the DCRNN loop unit, and completes the writing of trusted state, writing of risky state and cutting off of historical state inside the gate; the gated state diversion method can block the recursion of abnormal identity state before identity conflict enters the final output, and reduce the pollution of trusted state by cloned nodes or credential reuse nodes.

[0018] (3) After the risk state is triggered continuously, the present invention temporarily sets the corresponding transmission channels of the authentication association edge in the identity closed diffusion loop to zero one by one, determines the conflict authentication association edge based on the decrease of the closed write-back difference, and then retains the candidate node channel with the smallest closed write-back difference through mutual exclusion diffusion; the conflict location and mutual exclusion authentication method can simultaneously realize the location of the conflict source and the exclusive authentication of candidate nodes under the same node identity, thereby improving the traceability and anti-cloning ability of the authentication results. Attached Figure Description

[0019] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of a large-scale sensor network node authentication method based on graph neural networks proposed in this invention. Figure 2 This is a schematic diagram of the identity closure diffusion and closure write-back differential gating proposed in this invention; Figure 3 This is a schematic diagram of the conflict authentication associated edge location and candidate node mutual exclusion authentication proposed in this invention. Detailed Implementation

[0020] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0021] refer to Figures 1-3 A method for large-scale sensor network node authentication based on graph neural networks includes the following steps: S1. Using the identity of the same node corresponding to the sensor node to be authenticated as the unique loop entry, select the authentication association edge corresponding to the same node identity in the DCRNN authentication graph, and connect the first and last authentication association edges to form an identity closed diffusion loop. In this invention, the same node identity refers to the identity object corresponding to the sensor node to be authenticated during the node identity authentication process, and the unique ring entry refers to the fixed starting point of the identity state entering the identity closed diffusion ring and the fixed ending point of completing the closed write-back; the same node identity corresponding to the sensor node to be authenticated is read in the DCRNN authentication graph, and the position corresponding to the same node identity is recorded as the unique ring entry. The unique ring entry remains unchanged before the end of the current round of DCRNN loop update. In this invention, the DCRNN authentication graph refers to a graph structure constructed for node identity authentication; the DCRNN authentication graph is obtained by reading the authentication records saved during the node identity authentication process, and the authentication records contain the sensor node to be authenticated, the identity of the same node, and the connection corresponding to the identity of the same node; the authentication association edge refers to the connection within the DCRNN authentication graph that corresponds to the identity of the same node. S2. Replace the bidirectional random walk in the DCRNN diffusion convolution with identity closure diffusion, constrain the diffusion transition matrix to pass identity state along the identity closure diffusion loop, and reset the authentication association edge weights outside the identity closure diffusion loop to zero. In this invention, DCRNN diffusion convolution refers to the computational part of the DCRNN model that performs convolutional propagation on identity states based on the diffusion transition matrix. DCRNN diffusion convolution determines the direction of identity state propagation through non-zero matrix elements in the diffusion transition matrix. The row where the non-zero matrix element is located corresponds to the starting point of the authentication association edge, and the column where the non-zero matrix element is located corresponds to the ending point of the authentication association edge. The identity state at the starting point of the authentication association edge is propagated to the ending point of the authentication association edge along the non-zero matrix elements. In this invention, bidirectional random walk refers to the diffusion method of identity state propagation along the connection direction and reverse connection direction in the DCRNN authentication graph in the DCRNN model; bidirectional random walk is formed by the connection direction in the DCRNN authentication graph forming the forward propagation direction, and then the connection direction is reversed to form the reverse propagation direction, and the forward propagation direction and the reverse propagation direction together constitute bidirectional random walk; In this invention, the diffusion transition matrix refers to the matrix in the DCRNN diffusion convolution that records the identity state transfer direction and transfer weights. The diffusion transition matrix is ​​obtained by writing the authentication association edges in the DCRNN authentication graph. The starting point of the authentication association edge corresponds to the matrix row, the ending point of the authentication association edge corresponds to the matrix column, and the corresponding weight is written at the intersection of the matrix row and column. The authentication association edge outside the identity closed diffusion loop corresponds to the matrix position with a zero value. The corresponding weight refers to the matrix value assigned when the authentication association edge is written into the diffusion transition matrix. When the starting point of the same authentication association edge connects to only one ending point of the same authentication association edge, the corresponding weight is 1. When the starting point of the same authentication association edge connects to two or more ending points of the same authentication association edge, the corresponding weight is evenly distributed according to the number of connections, so that the sum of the weights in the corresponding row of the same starting point is 1. In this invention, the identity state refers to the hidden state in the DCRNN recurrent unit that represents the identity propagation result of the sensor node to be authenticated; the identity state is obtained by the authentication association edge, diffusion transition matrix and the previous round of DCRNN recurrent update result of the sensor node to be authenticated in the DCRNN authentication graph. S3. Before each round of DCRNN loop update, the identity state is written back from the unique ring entrance along the identity closed diffusion ring. The identity state at the unique ring entrance is compared with the identity state written back to obtain the closed write-back difference. In this invention, closed write-back refers to the operation of returning the identity state to the unique ring entrance after completing one round of transmission along the identity closed diffusion ring; closed write-back is obtained when the identity state enters the identity closed diffusion ring from the unique ring entrance, and is transmitted sequentially according to the order of the first and last connection of the authentication association edges, until the identity state reaches the end point of the last authentication association edge, and the end point of the last authentication association edge is the unique ring entrance; the identity state after returning to the unique ring entrance is recorded as the closed write-back identity state; S4. Use the closed write-back difference as a gating input to the update gate and reset gate of the DCRNN recurrent unit. Write the trusted state when the closed write-back difference meets the consistency condition, write the risk state when the closed write-back difference meets the conflict condition, and close the trusted state writing channel. In this invention, the update gate refers to the gate structure in the DCRNN loop unit that controls the writing result of the current round identity state. The update gate is set by the DCRNN loop unit. The DCRNN loop unit refers to the loop calculation unit in the DCRNN model that performs round-by-round updates of the identity state. After the closed write-back difference is input into the update gate, the update gate determines whether the current round identity state is written to a trusted state or a risky state based on whether the closed write-back difference meets the consistency condition or the conflict condition. In this invention, the reset gate refers to the gate control structure in the DCRNN loop unit that controls the recursive method of the current round identity state. The reset gate is set by the DCRNN loop unit. After the write-back difference is closed and input to the reset gate, the reset gate determines whether the previous round identity state participates in the current round DCRNN loop update based on whether the write-back difference meets the consistency condition or the conflict condition. In this invention, the consistency condition refers to the determination condition that the closed write-back difference meets the identity status closure consistency requirement; the consistency condition is obtained by a preset consistency range, which is a numerical range in which the closed write-back difference is less than or equal to 0.20; when the closed write-back difference falls within the preset consistency range, the consistency condition is determined to be met. In this invention, the trusted state refers to the identity state written by the DCRNN recurrent unit when the closed write-back difference meets the consistency condition; the trusted state is obtained by writing the identity state of the current round. After the closed write-back difference meets the consistency condition, the DCRNN recurrent unit writes the identity state of the current round into the trusted state. In this invention, the conflict condition refers to the determination condition that the closed write-back difference meets the identity status closure conflict requirement; the conflict condition is obtained by a preset conflict range, which is a numerical range in which the closed write-back difference is greater than 0.20; when the closed write-back difference falls into the preset conflict range, the conflict condition is determined to be met. In this invention, the risk state refers to the identity state written by the DCRNN recurrent unit when the closed write-back difference meets the conflict condition; the risk state is obtained by writing the identity state of the current round. After the closed write-back difference meets the conflict condition, the DCRNN recurrent unit writes the identity state of the current round into the risk state. In this invention, the trusted state writing channel refers to the gated channel in the DCRNN recurrent unit that writes the current round identity state into the trusted state; the opening and closing state of the trusted state writing channel is controlled by the update gate of the DCRNN recurrent unit. The trusted state writing channel is open when the closed write-back difference meets the consistency condition, and closed when the closed write-back difference meets the conflict condition. S5. When the risk state reaches the continuous triggering condition, the corresponding transmission channel of the authentication association edge is temporarily zeroed one by one in the DCRNN diffusion convolution. The conflict authentication association edge is determined based on the difference in the closed write-back before and after the temporary zeroing. In this invention, temporary zeroing refers to the operation of closing the transmission channel corresponding to a certain authentication associated edge during a comparison in the current round diffusion transfer matrix; temporary zeroing is obtained by writing zero value into the current round diffusion transfer matrix of the transmission channel corresponding to the selected authentication associated edge; after completing a closed write-back difference comparison, the transmission channel corresponding to the selected authentication associated edge is restored to the transmission state before temporary zeroing. S6. Perform mutual exclusion diffusion on candidate nodes with the same node identity that share a unique ring entry, and form the candidate node channel status based on the difference in closed writeback and risk status. In this invention, a candidate node refers to a sensor node object that participates in authentication competition under the same node identity; candidate nodes are obtained by reading the nodes corresponding to the same node identity in the DCRNN authentication graph; when the same node identity corresponds to more than two nodes, the read nodes are recorded as candidate nodes. In this invention, mutual exclusion diffusion refers to the operation of identity closure diffusion where candidate nodes with the same node identity share a unique ring entry. Mutual exclusion diffusion is performed based on the closure write-back difference and risk status of the candidate nodes. The transmission channel corresponding to the candidate node with the smallest closure write-back difference and no risk status is written is kept open. The transmission channel corresponding to the candidate node that has been written with a risk status is written with a zero value. The transmission channels corresponding to the remaining candidate nodes and the trusted status writing channels corresponding to the remaining candidate nodes are closed. S7. Output the node identity authentication result based on the trusted state, risk state, conflict authentication associated edge, and candidate node channel state.

[0022] In this embodiment, the specific process of establishing the identity closed diffusion loop in S1 includes: S11. Starting from the unique ring entrance, read the authentication association edges corresponding to the same node identity in the DCRNN authentication graph, perform entrance reachability verification and write-back reachability verification on the authentication association edges, and retain the authentication association edges that meet the two conditions of being reachable from the unique ring entrance and being write-back to the unique ring entrance. In this invention, entry reachability verification refers to the verification operation that determines whether the authentication associated edge can be reached from the unique ring entry. Entry reachability verification is obtained through the connection result between the unique ring entry and the starting point of the authentication associated edge. If the starting point of the authentication associated edge can be reached from the unique ring entry along the connection in the DCRNN authentication graph, then the authentication associated edge satisfies the entry reachability verification. If the starting point of the authentication associated edge cannot be reached from the unique ring entry, then the authentication associated edge does not satisfy the entry reachability verification. In this invention, writeback reachability verification refers to the verification operation of determining whether the authentication associated edge can be written back to the unique ring entry. Writeback reachability verification is obtained through the connection result between the endpoint of the authentication associated edge and the unique ring entry. If the endpoint of the authentication associated edge can be written back to the unique ring entry along the connection in the DCRNN authentication graph, then the authentication associated edge satisfies the writeback reachability verification. If the endpoint of the authentication associated edge cannot be written back to the unique ring entry, then the authentication associated edge does not satisfy the writeback reachability verification. S12. Sort the remaining authentication association edges according to the diffusion step order of DCRNN diffusion convolution, so that the end point of the previous authentication association edge coincides with the start point of the next authentication association edge. In this invention, the diffusion step sequence refers to the order in which the identity state is gradually transmitted along the authentication associated edge in the DCRNN diffusion convolution. The diffusion step sequence is obtained by taking the unique loop entry as the starting point and arranging the authentication associated edges according to the connection order. The end point of the previous authentication associated edge is used as the starting point of the next authentication associated edge, until the end point of the authentication associated edge is written back to the unique loop entry. In this invention, the first and last sorting refers to the operation of arranging the authentication association edges according to the rule that the end point of the previous authentication association edge coincides with the start point of the next authentication association edge; the first and last sorting takes the unique loop entry as the starting point and matches the start point and end point of each of the retained authentication association edges one by one. The start point of the first authentication association edge corresponds to the unique loop entry, and the end point of the last authentication association edge corresponds to the unique loop entry. S13. Fix the sequence of authentication association edges where the starting point of the first authentication association edge and the ending point of the last authentication association edge are both unique loop entrances to form an identity closed diffusion loop.

[0023] In this invention, the authentication associated edge sequence refers to the ordered set of authentication associated edges formed after sorting the beginning and end; the authentication associated edge sequence is obtained by arranging the retained authentication associated edges according to the diffusion step order, the end point of the previous authentication associated edge in the sequence coincides with the start point of the next authentication associated edge, the start point of the first authentication associated edge corresponds to a unique loop entry, and the end point of the last authentication associated edge corresponds to a unique loop entry.

[0024] In this invention, fixing the identity closed diffusion ring is the operation of locking the authentication associated edge sequence that has completed the first and last closure as the identity closed diffusion ring used for the current round of DCRNN cycle update; the fixing operation is triggered by the first and last closure results of the authentication associated edge sequence. When the starting point of the first authentication associated edge corresponds to a unique ring entry and the ending point of the last authentication associated edge corresponds to a unique ring entry, the authentication associated edge sequence is written into the current round of identity closed diffusion ring, and the order and connection relationship of the authentication associated edge sequence are not changed before the end of the current round of DCRNN cycle update.

[0025] In this embodiment, S12 sorts the retained authentication-related edges according to the diffusion step order of the DCRNN diffusion convolution, specifically including: S121. Using the unique ring entrance as the starting point of the first diffusion step, write the authentication association edge whose starting point is equal to the unique ring entrance into the first diffusion step; In this invention, the first diffusion step refers to the first transmission step from the unique ring entrance into the diffusion step sequence; the first diffusion step is determined by the unique ring entrance as the starting point, and when the DCRNN diffusion convolution reads the diffusion step sequence, the transmission position corresponding to the unique ring entrance is recorded as the first diffusion step; In this invention, an authentication association edge whose starting point is equal to the unique ring entrance refers to an authentication association edge whose starting position is the same as the unique ring entrance; the authentication association edge whose starting point is equal to the unique ring entrance is obtained by comparing the starting point of the authentication association edge and the unique ring entrance. When the two are consistent, the corresponding authentication association edge is written into the first diffusion step. S122. Using the endpoint of the authentication association edge written in the previous diffusion step as the starting point of the current diffusion step, retrieve the authentication association edges with the same starting point among the retained authentication association edges. In this invention, the previous diffusion step refers to the transmission step in the diffusion step sequence that has completed the writing of the authentication association edge and is located before the current diffusion step; the previous diffusion step is obtained by the authentication association edge that is adjacent to the previous one in the diffusion step sequence, and the endpoint of the authentication association edge written in the previous diffusion step is used as the identity state continuation position of the next transmission step. In this invention, the current diffusion step refers to the transmission step in the diffusion step sequence where the authentication association edge is being written; the current diffusion step is determined by the endpoint of the authentication association edge written in the previous diffusion step, and the endpoint of the authentication association edge written in the previous diffusion step is recorded as the starting point of the current diffusion step. In this invention, authentication association edges with the same starting point refer to authentication association edges among the retained authentication association edges whose starting point is consistent with the starting point of the current diffusion step; authentication association edges with the same starting point are obtained by comparing the starting point of the current diffusion step with the starting point of the retained authentication association edges. When the two are consistent, the corresponding authentication association edge is used as the authentication association edge to be written in the current diffusion step. S123. Perform write-back reachability verification on the retrieved authentication-related edges, and select the authentication-related edges that can return a unique ring entry in subsequent diffusion steps to write to the current diffusion step. S124. Retain the diffusion transition matrix elements of the row corresponding to the starting point and the column corresponding to the ending point of the authentication associated edge written in the current diffusion step, and set the diffusion transition matrix elements in the row corresponding to the starting point of the current diffusion step that have not been written in the current diffusion step to zero. In this invention, the diffusion transition matrix element refers to the unit value in the diffusion transition matrix that records the identity state transfer relationship; the diffusion transition matrix element is obtained from the starting point, ending point and corresponding weight of the authentication association edge. The starting point of the authentication association edge determines the corresponding row in the diffusion transition matrix, the ending point of the authentication association edge determines the corresponding column in the diffusion transition matrix, and the intersection of the corresponding row and the corresponding column forms the diffusion transition matrix element; when the authentication association edge is written into the current diffusion step, the corresponding diffusion transition matrix element is retained, and the diffusion transition matrix element not written into the current diffusion step is written with a zero value; S125. When the endpoint of the authentication associated edge written in the current diffusion step is a unique ring entry, the diffusion step sequence writing ends.

[0026] In this embodiment, S2 replaces the bidirectional random walk in the DCRNN diffuse convolution with identity closure diffusion, specifically including: S21. Stop calling the forward random walk matrix and the reverse random walk matrix within the DCRNN diffusion convolution, and set the elements of the diffusion transition matrix that have not been written into any diffusion step to zero. In this invention, the forward random walk matrix refers to the matrix in the DCRNN diffusion convolution that records the forward transmission relationship of identity status according to the connection direction of the DCRNN authentication graph. The forward random walk matrix is ​​obtained from the starting point, ending point and corresponding weight of the authentication association edge in the DCRNN authentication graph. The weights of the same starting point pointing to the corresponding ending point are adjusted until the sum of the weights is 1 and then written into the forward random walk matrix. In this invention, the reverse random walk matrix refers to the matrix in the DCRNN diffusion convolution that records the reverse propagation relationship of identity state according to the reverse connection direction of the DCRNN authentication graph. The reverse random walk matrix is ​​obtained from the endpoint, starting point and corresponding weight of the authentication association edge in the DCRNN authentication graph. The weights of the same endpoint pointing in the opposite direction to the corresponding starting point are adjusted until the sum of the weights is 1 and then written into the reverse random walk matrix. S22. Read the authentication association edges in the identity closed diffusion loop in sequence according to the diffusion step order, and take the starting point of the authentication association edge corresponding to the current diffusion step as the identity state input position and the ending point of the authentication association edge corresponding to the current diffusion step as the identity state output position. In this invention, the identity state input position refers to the starting position of the identity state entering the diffusion transition matrix in the current diffusion step; the identity state input position is obtained from the starting point of the authentication association edge corresponding to the current diffusion step, and the row descriptor of the diffusion transition matrix corresponding to the starting point of the authentication association edge is the identity state input position; In this invention, the identity state output position refers to the position reached after the identity state is transmitted in the current diffusion step; the identity state output position is obtained from the endpoint of the authentication association edge corresponding to the current diffusion step, and the column of the diffusion transition matrix corresponding to the endpoint of the authentication association edge is denoted as the identity state output position; S23. In the diffusion transfer matrix, only the transfer channel from the identity state input position to the identity state output position is open, and the transfer channel from the same identity state input position to the outside of the identity closed diffusion loop is closed. In this invention, the transmission channel refers to the channel in the diffusion transition matrix through which the identity state is transmitted from the identity state input position to the identity state output position. The transmission channel is obtained from the diffusion transition matrix elements corresponding to the authentication association edge. The starting point of the authentication association edge corresponds to the identity state input position, and the ending point of the authentication association edge corresponds to the identity state output position. The non-zero matrix elements between the identity state input position and the identity state output position are denoted as the transmission channel. S24. Send the identity status output from the previous diffusion step to the identity status input position of the next diffusion step until the identity status returns to the unique loop entry to complete the closed write-back.

[0027] In this embodiment, the closed write-back difference obtained in S3 specifically includes: S31. Before the identity state enters the identity closed diffusion loop, the unique loop entry identity state is locked in the gate comparison branch of the DCRNN loop unit. In this invention, latching refers to the operation of keeping the unique ring entry identity state unchanged during the current round of identity closure diffusion execution; latching is obtained by reading the unique ring entry identity state before the identity state enters the identity closure diffusion ring, and keeping the unique ring entry identity state unchanged before the closure write-back is completed; In this invention, the pre-gate comparison branch refers to the state comparison path set before the update gate and reset gate of the DCRNN loop unit; the pre-gate comparison branch is set by the DCRNN loop unit before the input of the update gate and reset gate, and the pre-gate comparison branch reads the unique loop entry identity state and the closed write-back identity state of the latched unique loop entry branch to form the closed write-back difference. S32. After the identity status completes the closed write-back along the identity closed diffusion loop, send the closed write-back identity status to the entry comparison branch. S33. For the gate comparison branch, perform state alignment on the same scale between the unique ring entrance identity state and the closed write-back identity state, extract the deviation between the unique ring entrance identity state and the closed write-back identity state at the same state scale, and compress the deviation into the closed write-back difference.

[0028] In this invention, the same state scale refers to the same value range that can be directly compared between the unique ring entry identity state and the closed write-back identity state, and the value range of the same state scale is 0 to 1; same scale state alignment refers to adjusting the state values ​​of corresponding positions in the unique ring entry identity state and the closed write-back identity state to the value range of 0 to 1; deviation refers to the absolute value of the difference between the state values ​​of corresponding positions in the two identity states; compression refers to taking the average value of the deviations of each corresponding position, and the average value is recorded as the closed write-back difference.

[0029] In this embodiment, S4 specifically includes: S41. A first difference modulation input is set in front of the update gate input terminal by the gate comparison branch, and a second difference modulation input is set in front of the reset gate input terminal. The closed write-back difference is sent to the first difference modulation input and the second difference modulation input respectively. In this invention, the update gate input refers to the position in the DCRNN loop unit where the update gate receives the closed write-back difference; the first difference modulation input refers to the closed write-back difference input position set before the update gate input; the reset gate input refers to the position in the DCRNN loop unit where the reset gate receives the closed write-back difference; the second difference modulation input refers to the closed write-back difference input position set before the reset gate input; the first difference modulation input is obtained by setting the closed write-back difference input position before the update gate input, and the second difference modulation input is obtained by setting the closed write-back difference input position before the reset gate input; the closed write-back difference is written to the update gate input via the first difference modulation input and to the reset gate input via the second difference modulation input. S42. The update gate performs channel selection between the trusted state write channel and the risky state write channel based on the closed write-back difference in the first difference modulation entry. In this invention, the risk state writing channel refers to the gated channel in the DCRNN recurrent unit that writes the current round identity state into the risk state; the opening and closing state of the risk state writing channel is formed by the update gate based on the closed write-back difference. The risk state writing channel is open when the closed write-back difference meets the conflict condition, and closed when the closed write-back difference meets the consistency condition. In this invention, channel selection refers to the operation of the update gate to determine the open channel between the trusted state write channel and the risky state write channel. The channel selection is formed by comparing the closed write-back difference with the consistency condition and the conflict condition. When the closed write-back difference meets the consistency condition, the trusted state write channel is opened and the risky state write channel is closed. When the closed write-back difference meets the conflict condition, the risky state write channel is opened and the trusted state write channel is closed. S43. The reset gate performs mode selection between the retention state recursion mode and the cut-off state recursion mode based on the closed write-back difference in the second difference modulation inlet. In this invention, the retained state recursive mode refers to the recursive method in which the reset gate allows the identity state obtained from the previous round of DCRNN cycle update to be written into the current round of hidden state; the retained state recursive mode is formed by the closed write-back difference satisfying the consistency condition, and the reset gate opens the channel for writing the identity state obtained from the previous round of DCRNN cycle update into the current round of hidden state in the retained state recursive mode. In this invention, the cut-off state recursive mode refers to the recursive method in which the reset gate blocks the writing of the identity state obtained from the previous round of DCRNN cycle update into the current round of hidden state; the cut-off state recursive mode is formed by the closed write-back difference satisfying the conflict condition, and the reset gate closes the channel for writing the identity state obtained from the previous round of DCRNN cycle update into the current round of hidden state in the cut-off state recursive mode. S44. When the closed write-back difference meets the consistency condition, the update gate opens the trusted state write channel, and the reset gate executes the retained state recursion mode, so that the identity state obtained by the previous round of DCRNN loop update can participate in the current round of hidden state update. S45. When the closed write-back difference meets the conflict condition, the update gate closes the trusted state write channel and opens the risky state write channel. The reset gate executes the cut-off state recursion mode, blocking the identity state obtained from the previous round of DCRNN loop update from participating in the current round of hidden state update.

[0030] In this invention, the current round hidden state update refers to the operation of the DCRNN recurrent unit to generate the current round hidden state; when the closed write-back difference meets the consistency condition, the identity state obtained from the previous round DCRNN recurrent update and the current round identity state together form the current round hidden state, and the current round hidden state is written into the trusted state; when the closed write-back difference meets the conflict condition, the identity state obtained from the previous round DCRNN recurrent update is blocked by the reset gate, and the current round identity state is written into the risk state.

[0031] In this embodiment, determining the conflict authentication association edge in S5 specifically includes: S511. When the risk state reaches the continuous triggering condition, keep the current round diffusion transfer matrix unchanged, perform identity closure diffusion according to the state of the corresponding transmission channel of any authentication associated edge that is not set to zero, and record the obtained closure write-back difference as the benchmark closure write-back difference. S512. Select the authentication association edges in the identity closed diffusion loop in sequence according to the diffusion step order. Temporarily set the transmission channels corresponding to the selected authentication association edges to zero in the current round diffusion transition matrix, and keep the transmission channels corresponding to the remaining authentication association edges open. In this invention, sequential selection refers to the operation of reading the authentication-related edges one by one according to the diffusion step sequence in the identity closed diffusion loop; sequential selection is obtained by the arrangement order of the authentication-related edges in the identity closed diffusion loop, starting from the authentication-related edge corresponding to the first diffusion step, reading the authentication-related edges one by one according to the order of the next diffusion step, until the last authentication-related edge is read. S513. Re-execute identity closure diffusion within the current round diffusion transfer matrix after temporary zeroing to obtain the closure write-back difference after temporary zeroing. S514. Compare the closed write-back difference after temporary zeroing with the baseline closed write-back difference. When the closed write-back difference after temporary zeroing is lower than the baseline closed write-back difference, mark the selected authentication association edge as a candidate conflict authentication association edge. S515. After canceling the temporary zeroing of the transmission channel corresponding to the selected authentication association edge, continue to select the next authentication association edge until all authentication association edges in the identity closure diffusion loop have been temporarily zeroed. S516. Select the authentication association edge that causes the largest decrease in the closed write-back difference from the candidate conflict authentication association edges, and determine it as the conflict authentication association edge.

[0032] In this embodiment, the continuous triggering condition for the risk state in S5 specifically includes: S521. Set a continuous trigger counter bit for the risk state within the DCRNN recurrent unit; In this invention, the continuous trigger count bit refers to the counting position in the DCRNN recurrent unit that records the number of consecutive triggers of the risk state; the initial value of the continuous trigger count bit is 0; the continuous trigger count bit increases by 1 every time the risk state write channel is opened; the continuous trigger count bit returns to 0 every time the trusted state write channel is opened. S522. After each round of DCRNN loop update, check the open / closed status of the risk state write channel and the trusted state write channel. S523. When the risk status write channel is open, the counter bit will be continuously incremented by one. S524. When the trusted state write channel is open, the counter bit will be continuously triggered to clear to zero. S525. When the continuous trigger count reaches the preset number of triggers, the risk state is determined to meet the continuous trigger condition, and the diffusion transfer matrix of the current round is not updated.

[0033] In this invention, the preset trigger count refers to the threshold number of times the risk state is determined to meet the continuous trigger condition; in this embodiment, the preset trigger count is set to 3. When the continuous trigger count reaches 3, the risk state is determined to meet the continuous trigger condition.

[0034] In this embodiment, the formation of candidate node channel states in S6 specifically includes: S61. In the DCRNN diffusion convolution, map the candidate nodes corresponding to the same node identity to the row corresponding to the unique ring entrance, and write the authentication association edge corresponding to the transmission channel in the identity closed diffusion ring of the candidate node into the current round diffusion transition matrix. In this invention, mapping refers to the operation of writing candidate nodes corresponding to the same node identity into the row corresponding to the unique ring entry; mapping is obtained by reading the authentication association edge corresponding to the transmission channel in the identity closed diffusion ring corresponding to the candidate node, and writing the read transmission channel into the row corresponding to the unique ring entry in the current round diffusion transition matrix; S62. Perform identity closure diffusion for each candidate node, and read the closure write-back difference and risk status corresponding to the candidate node; S63. The mutual exclusion selection gate sets the corresponding transmission channel of the authentication association edge in the identity closed diffusion ring corresponding to the candidate node that has been written into the risk state to zero, and retains the corresponding transmission channel of the authentication association edge in the identity closed diffusion ring corresponding to the candidate node with the smallest difference in closed write-back among the candidate nodes that have not been written into the risk state. In this invention, the mutual exclusion selection gate refers to the gate structure in the DCRNN diffusion convolution that controls the opening and closing of the corresponding transmission channel of the candidate node; the opening and closing result of the mutual exclusion selection gate is obtained from the closing write-back difference and risk state of the candidate node. The corresponding transmission channel of the candidate node that has been written to the risk state is set to zero, and the corresponding transmission channel of the candidate node that has not been written to the risk state and has the smallest closing write-back difference is retained. S64. The mutual exclusion selection gate closes the authentication association edge corresponding to the identity closure diffusion ring of the remaining candidate nodes and writes the trusted state corresponding to the remaining candidate nodes into the channel, fixing the channel opening and closing result as the candidate node channel state.

[0035] In this embodiment, the node authentication result output in S7 specifically includes: S71. Set an authentication folding gate at the output of the DCRNN recurrent unit. The authentication folding gate reads the trusted state, risk state, conflict authentication associated edge, and candidate node channel state. In this invention, the output end of the DCRNN loop unit refers to the position where the DCRNN loop unit outputs the trusted state and the risk state after completing the current round of identity state update; the authentication folding gate is set at the output end of the DCRNN loop unit to read the trusted state, the risk state, the conflict authentication association edge obtained by temporary zeroing, and the candidate node channel state obtained by mutual exclusion diffusion. In this invention, the authentication folding gate refers to a gated structure set at the output of the DCRNN loop unit; the authentication folding gate is obtained by reading the trusted state, risk state, conflict authentication association edge, and candidate node channel state from the output of the DCRNN loop unit; the authentication folding gate determines the retention state, suppression state, and channel state of the identity authentication output channel based on the existence of the written trusted state, the written risk state, the conflict authentication association edge, and the channel open or closed result of the candidate node channel state. S72. When the risk state has been written, the authentication folding door will suppress the trusted state from entering the identity authentication output channel. When the candidate node channel state is closed, the corresponding candidate node will be suppressed from entering the identity authentication output channel. In this invention, the identity authentication output channel refers to the channel in the authentication folding door that outputs the identity authentication pass result or suppression result of the node; the identity authentication output channel is obtained by the authentication folding door after reading the trusted state, risk state and candidate node channel state. When the trusted state has been written, the risk state has not been written, and the candidate node channel state is open, the identity authentication output channel is retained; when the risk state has been written or the candidate node channel state is closed, the identity authentication output channel is suppressed. S73. When a conflict authentication associated edge exists, the corresponding transmission channel of the conflict authentication associated edge is written into the conflict output channel. In this invention, the conflict output channel refers to the channel in the authentication folding door that outputs the conflict authentication association edge; the conflict output channel is obtained by the authentication folding door after reading the conflict authentication association edge. When the conflict authentication association edge exists, the conflict output channel is open; when the conflict authentication association edge does not exist, the conflict output channel is closed. S74. When the authentication folding door has been written to the trusted state, not written to the risk state, and the candidate node channel status is open, the identity authentication output channel is retained. S75. The authentication folding door outputs the node authentication result according to the retention status of the authentication output channel, the suppression status of the authentication output channel, and the channel status of the conflict output channel.

[0036] In this invention, the node identity authentication result is obtained from the reserved state of the identity authentication output channel, the suppressed state of the identity authentication output channel, and the channel state of the conflict output channel. When the identity authentication output channel is in the reserved state, the node identity authentication result is recorded as authentication passed. When the identity authentication output channel is in the suppressed state, the node identity authentication result is recorded as authentication failed. When the conflict output channel is in the open state, the conflict authentication association edge is written into the node identity authentication result.

[0037] Example 1: To verify the feasibility of this invention in practice, it was applied to a large-scale sensor network node access authentication scenario. When a sensor node to be authenticated accesses the network, it needs to complete node identity authentication. The test data includes normal access nodes, cloned nodes, credential reuse nodes, and duplicate access nodes. Normal access nodes have complete authentication records; cloned nodes copy the identity of a legitimate node, but cannot form a stable identity closure diffusion loop in the DCRNN authentication graph; credential reuse nodes use expired or reused credentials to access the network, and can match some authentication records, but the identity status deviates significantly after the closure write-back; duplicate access nodes come from two or more candidate nodes under the same node identity, which easily leads to the same node identity being occupied by different sensor nodes simultaneously.

[0038] In this scenario, the node access authentication process reads the authentication records saved during the node identity authentication process. These records contain the sensor node to be authenticated, the identity of the same node, and the connections corresponding to that identity. Based on this, a DCRNN authentication graph is constructed. Connections in the DCRNN authentication graph that correspond to the same node identity and can start from and return to the unique ring entry point are read as authentication-related edges. Using the identity of the same node corresponding to the sensor node to be authenticated as the unique ring entry point, the authentication-related edges are filtered through entry point reachability verification and write-back reachability verification. Authentication-related edges that satisfy the conditions of being reachable from and write-back to the unique ring entry point are retained. The retained authentication-related edges are sorted according to the diffusion step order, with the endpoint of the previous authentication-related edge coinciding with the starting point of the next authentication-related edge. The starting point of the first authentication-related edge and the endpoint of the last authentication-related edge both correspond to the unique ring entry point. The sorted sequence of authentication-related edges is fixed as an identity-closed diffusion ring.

[0039] When performing authentication computation, DCRNN's diffusion convolution no longer diffuses identity states along bidirectional random walks. Instead, it constrains the diffusion transition matrix within a closed identity diffusion loop. The matrix positions corresponding to authentication-related edges within the closed identity diffusion loop retain their corresponding weights, while the matrix positions corresponding to authentication-related edges outside the closed identity diffusion loop are written with zero values. The identity state starts from the unique loop entry point and is progressively propagated along the authentication-related edges within the closed identity diffusion loop, returning to the unique loop entry point to form a closed write-back identity state. The pre-gate comparison branch reads the identity state at the unique loop entry point and the closed write-back identity state, adjusts the two identity states to the same state scale (0 to 1), calculates the absolute value of the difference between the state values ​​at corresponding positions, and averages the deviations to obtain the closed write-back difference. When the closed write-back difference is less than or equal to 0.20, the DCRNN recurrent unit writes a trusted state; when the closed write-back difference is greater than 0.20, the DCRNN recurrent unit writes a risky state and closes the trusted state writing channel.

[0040] When the number of consecutive triggers of a risk state reaches a preset trigger count of 3, the DCRNN diffusion convolution keeps the current round's diffusion transition matrix unchanged and selects authentication-related edges in the identity closure diffusion loop one by one according to the diffusion step order. The transmission channel corresponding to the selected authentication-related edge is temporarily written to zero in the current round's diffusion transition matrix. After completing one identity closure diffusion, the closure write-back difference after temporary zeroing is obtained again. When the closure write-back difference after temporary zeroing is lower than the baseline closure write-back difference, the selected authentication-related edge is marked as a candidate conflict authentication-related edge. After all authentication-related edges in the identity closure diffusion loop have been temporarily zeroed, the authentication-related edge with the largest decrease in closure write-back difference is selected from the candidate conflict authentication-related edges and determined as the conflict authentication-related edge.

[0041] When two or more candidate nodes exist under the same node identity, the candidate nodes share a unique ring entry point and perform mutual exclusion diffusion. Each candidate node performs identity closure diffusion and reads the corresponding closure write-back difference and risk state. The mutual exclusion selection gate sets the corresponding transmission channel of the candidate node that has been written with a risk state to zero, retains the corresponding transmission channel of the candidate node with the smallest closure write-back difference among the candidate nodes that have not been written with a risk state, and closes the corresponding transmission channels of the remaining candidate nodes and the corresponding trusted state write channels of the remaining candidate nodes. The channel opening and closing result is fixed as the candidate node channel state. The authentication folding gate reads the trusted state, risk state, conflict authentication association edge, and candidate node channel state, and outputs the node identity authentication result: authentication passed, authentication failed, and node identity authentication result for the node that has written a conflict authentication association edge. The above processing can avoid ordinary adjacency diffusion from bringing the identity state into irrelevant connections, and can also prevent cloned nodes from obtaining trusted states by using locally similar authentication records.

[0042] Table 1: Comparison of Node Identity Authentication Implementation Effects

[0043] Table 1 uses 120,000 node access authentication samples for comparative verification, covering normal nodes, cloned nodes, credential reuse nodes, and duplicate access nodes. The adjacency diffusion authentication method propagates identity status according to ordinary adjacency relationships, while the method of this invention completes closed-loop write-back and gating traffic distribution according to identity closed diffusion loop. The results in the table show that the pass rate of normal nodes increased from 95.8% to 98.7%, the cloned node recognition rate increased from 87.6% to 96.4%, and the credential reuse recognition rate increased from 84.9% to 94.8%. These data indicate that identity closed diffusion does not reduce the access capability of normal nodes and can also identify abnormal nodes with similar identity identifiers but inconsistent closed propagation states.

[0044] The false positive rate of identity conflicts decreased from 6.8% to 1.7%, and the trigger rate of irrelevant neighborhood interference decreased from 9.4% to 2.3%. This change indicates that after identity states are restricted to propagation within the closed diffusion loop corresponding to the identity of the same node, the impact of irrelevant adjacency relationships on authentication decisions is significantly weakened. After the closed write-back difference enters the update gate and reset gate, trusted states and risky states are separated, and identity conflicts are no longer easily directed towards the trusted output direction.

[0045] The accuracy of conflict source location improved from 68.5% to 92.6%, an increase of 24.1 percentage points. After temporarily setting the corresponding transmission channel of the authentication association edge to zero, the conflict authentication association edge can be located by the decrease in the difference of the closed write-back, so that the source of identity conflict falls on the specific authentication association edge. Compared with the processing method that only outputs the risk judgment result, this invention can write the conflict authentication association edge into the node identity authentication result, which is convenient for subsequent review and handling.

[0046] The success rate of mutual exclusion among candidate nodes improved from 75.2% to 95.1%, an increase of 19.9 percentage points. The mutual exclusion selection gate, based on the difference in closed write-back and risk status, controls the opening and closing of channels for candidate nodes under the same node identity. It retains the transmission channel corresponding to the candidate node with the smallest difference in closed write-back and closes the transmission channels and trusted state write channels corresponding to the remaining candidate nodes. Two or more candidate nodes under the same node identity no longer simultaneously obtain trusted state through different diffusion paths, reducing the risk of false access by cloned nodes and duplicate access nodes.

[0047] The average authentication time increased from 38.5 milliseconds / node to 41.2 milliseconds / node, an increase of 2.7 milliseconds. This increase primarily stemmed from closed-loop write-back comparisons and temporary zeroing checks. However, the proportion of manual review decreased from 12.8% to 5.4%, a reduction of 7.4 percentage points. Considering the false release rate, the accuracy of conflict source location, and the success rate of candidate node mutual exclusion, the slight increase in computational time yields higher authentication accuracy, stronger conflict traceability, and lower manual review pressure, making it suitable for large-scale sensor network node access authentication scenarios.

[0048] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for node authentication in a large-scale sensor network based on graph neural networks, characterized in that, The steps include the following: S1. Using the identity of the same node corresponding to the sensor node to be authenticated as the unique loop entry, select the authentication association edge corresponding to the same node identity in the DCRNN authentication graph, and connect the first and last authentication association edges to form an identity closed diffusion loop. S2. Replace the bidirectional random walk in the DCRNN diffusion convolution with identity closure diffusion, constrain the diffusion transition matrix to pass identity state along the identity closure diffusion loop, and reset the authentication association edge weights outside the identity closure diffusion loop to zero. S3. Before each round of DCRNN loop update, the identity state is written back from the unique ring entrance along the identity closed diffusion ring. The identity state at the unique ring entrance is compared with the identity state written back to obtain the closed write-back difference. S4. Use the closed write-back difference as a gating input to the update gate and reset gate of the DCRNN recurrent unit. Write the trusted state when the closed write-back difference meets the consistency condition, write the risk state when the closed write-back difference meets the conflict condition, and close the trusted state writing channel. S5. When the risk state reaches the continuous triggering condition, the corresponding transmission channel of the authentication association edge is temporarily zeroed one by one in the DCRNN diffusion convolution. The conflict authentication association edge is determined based on the difference in the closed write-back before and after the temporary zeroing. S6. Perform mutual exclusion diffusion on candidate nodes with the same node identity that share a unique ring entry, and form the candidate node channel status based on the difference in closed writeback and risk status. S7. Output the node identity authentication result based on the trusted state, risk state, conflict authentication associated edge, and candidate node channel state.

2. The method for large-scale sensor network node authentication based on graph neural networks according to claim 1, characterized in that, The specific process for establishing the identity closed diffusion loop in S1 includes: S11. Starting from the unique ring entrance, read the authentication association edges corresponding to the same node identity in the DCRNN authentication graph, perform entrance reachability verification and write-back reachability verification on the authentication association edges, and retain the authentication association edges that meet the two conditions of being reachable from the unique ring entrance and being write-back to the unique ring entrance. S12. Sort the remaining authentication association edges according to the diffusion step order of DCRNN diffusion convolution, so that the end point of the previous authentication association edge coincides with the start point of the next authentication association edge. S13. Fix the sequence of authentication association edges where the starting point of the first authentication association edge and the ending point of the last authentication association edge are both unique loop entrances to form an identity closed diffusion loop.

3. The method for large-scale sensor network node authentication based on graph neural networks according to claim 2, characterized in that, In step S12, the retained authentication-related edges are sorted from beginning to end according to the diffusion step order of the DCRNN diffusion convolution, specifically including: S121. Using the unique ring entrance as the starting point of the first diffusion step, write the authentication association edge whose starting point is equal to the unique ring entrance into the first diffusion step; S122. Using the endpoint of the authentication association edge written in the previous diffusion step as the starting point of the current diffusion step, retrieve the authentication association edges with the same starting point among the retained authentication association edges. S123. Perform write-back reachability verification on the retrieved authentication-related edges, and select the authentication-related edges that can return a unique ring entry in subsequent diffusion steps to write to the current diffusion step. S124. Retain the diffusion transition matrix elements of the row corresponding to the starting point and the column corresponding to the ending point of the authentication associated edge written in the current diffusion step, and set the diffusion transition matrix elements in the row corresponding to the starting point of the current diffusion step that have not been written in the current diffusion step to zero. S125. When the endpoint of the authentication associated edge written in the current diffusion step is a unique ring entry, the diffusion step sequence writing ends.

4. The method for large-scale sensor network node authentication based on graph neural networks according to claim 3, characterized in that, In S2, the bidirectional random walk in the DCRNN diffuse convolution is replaced with identity closure diffusion, specifically including: S21. Stop calling the forward random walk matrix and the reverse random walk matrix within the DCRNN diffusion convolution, and set the elements of the diffusion transition matrix that have not been written into any diffusion step to zero. S22. Read the authentication association edges in the identity closed diffusion loop in sequence according to the diffusion step order, and take the starting point of the authentication association edge corresponding to the current diffusion step as the identity state input position and the ending point of the authentication association edge corresponding to the current diffusion step as the identity state output position. S23. In the diffusion transfer matrix, only the transfer channel from the identity state input position to the identity state output position is open, and the transfer channel from the same identity state input position to the outside of the identity closed diffusion loop is closed. S24. Send the identity status output from the previous diffusion step to the identity status input position of the next diffusion step until the identity status returns to the unique loop entry to complete the closed write-back.

5. The method for large-scale sensor network node authentication based on graph neural networks according to claim 1, characterized in that, The closed write-back difference obtained in S3 specifically includes: S31. Before the identity state enters the identity closed diffusion loop, the unique loop entry identity state is locked in the gate comparison branch of the DCRNN loop unit. S32. After the identity status completes the closed write-back along the identity closed diffusion loop, send the closed write-back identity status to the entry comparison branch. S33. For the gate comparison branch, perform state alignment on the same scale between the unique ring entrance identity state and the closed write-back identity state, extract the deviation between the unique ring entrance identity state and the closed write-back identity state at the same state scale, and compress the deviation into the closed write-back difference.

6. The method for large-scale sensor network node authentication based on graph neural networks according to claim 5, characterized in that, S4 specifically includes: S41. A first difference modulation input is set in front of the update gate input terminal by the gate comparison branch, and a second difference modulation input is set in front of the reset gate input terminal. The closed write-back difference is sent to the first difference modulation input and the second difference modulation input respectively. S42. The update gate performs channel selection between the trusted state write channel and the risky state write channel based on the closed write-back difference in the first difference modulation entry. S43. The reset gate performs mode selection between the retention state recursion mode and the cut-off state recursion mode based on the closed write-back difference in the second difference modulation inlet. S44. When the closed write-back difference meets the consistency condition, the update gate opens the trusted state write channel, and the reset gate executes the retained state recursion mode, so that the identity state obtained by the previous round of DCRNN loop update can participate in the current round of hidden state update. S45. When the closed write-back difference meets the conflict condition, the update gate closes the trusted state write channel and opens the risky state write channel. The reset gate executes the cut-off state recursion mode, blocking the identity state obtained from the previous round of DCRNN loop update from participating in the current round of hidden state update.

7. The method for large-scale sensor network node authentication based on graph neural networks according to claim 6, characterized in that, The determination of conflict authentication association edges in S5 specifically includes: S511. When the risk state reaches the continuous triggering condition, keep the current round diffusion transfer matrix unchanged, perform identity closure diffusion according to the state of the corresponding transmission channel of any authentication associated edge that is not set to zero, and record the obtained closure write-back difference as the benchmark closure write-back difference. S512. Select the authentication association edges in the identity closed diffusion loop in sequence according to the diffusion step order. Temporarily set the transmission channels corresponding to the selected authentication association edges to zero in the current round diffusion transition matrix, and keep the transmission channels corresponding to the remaining authentication association edges open. S513. Re-execute identity closure diffusion within the current round diffusion transfer matrix after temporary zeroing to obtain the closure write-back difference after temporary zeroing. S514. Compare the closed write-back difference after temporary zeroing with the baseline closed write-back difference. When the closed write-back difference after temporary zeroing is lower than the baseline closed write-back difference, mark the selected authentication association edge as a candidate conflict authentication association edge. S515. After canceling the temporary zeroing of the transmission channel corresponding to the selected authentication association edge, continue to select the next authentication association edge until all authentication association edges in the identity closure diffusion loop have been temporarily zeroed. S516. Select the authentication association edge that causes the largest decrease in the closed write-back difference from the candidate conflict authentication association edges, and determine it as the conflict authentication association edge.

8. The method for large-scale sensor network node authentication based on graph neural networks according to claim 7, characterized in that, The risk status in S5 reaches the continuous triggering condition, specifically including: S521. Set a continuous trigger counter bit for the risk state within the DCRNN recurrent unit; S522. After each round of DCRNN loop update, check the open / closed status of the risk state write channel and the trusted state write channel. S523. When the risk status write channel is open, the counter bit will be continuously incremented by one. S524. When the trusted state write channel is open, the counter bit will be continuously triggered to clear to zero. S525. When the continuous trigger count reaches the preset number of triggers, the risk state is determined to meet the continuous trigger condition, and the diffusion transfer matrix of the current round is not updated.

9. The method for large-scale sensor network node authentication based on graph neural networks according to claim 1, characterized in that, The formation of candidate node channel states in S6 specifically includes: S61. In the DCRNN diffusion convolution, map the candidate nodes corresponding to the same node identity to the row corresponding to the unique ring entrance, and write the authentication association edge corresponding to the transmission channel in the identity closed diffusion ring of the candidate node into the current round diffusion transition matrix. S62. Perform identity closure diffusion for each candidate node, and read the closure write-back difference and risk status corresponding to the candidate node; S63. The mutual exclusion selection gate sets the corresponding transmission channel of the authentication association edge in the identity closed diffusion ring corresponding to the candidate node that has been written into the risk state to zero, and retains the corresponding transmission channel of the authentication association edge in the identity closed diffusion ring corresponding to the candidate node with the smallest difference in closed write-back among the candidate nodes that have not been written into the risk state. S64. The mutual exclusion selection gate closes the authentication association edge corresponding to the identity closure diffusion ring of the remaining candidate nodes and writes the trusted state corresponding to the remaining candidate nodes into the channel, fixing the channel opening and closing result as the candidate node channel state.

10. A method for large-scale sensor network node authentication based on graph neural networks according to claim 9, characterized in that, The output node authentication result in S7 specifically includes: S71. Set an authentication folding gate at the output of the DCRNN recurrent unit. The authentication folding gate reads the trusted state, risk state, conflict authentication associated edge, and candidate node channel state. S72. When the risk state has been written, the authentication folding door will suppress the trusted state from entering the identity authentication output channel. When the candidate node channel state is closed, the corresponding candidate node will be suppressed from entering the identity authentication output channel. S73. When a conflict authentication associated edge exists, the corresponding transmission channel of the conflict authentication associated edge is written into the conflict output channel. S74. When the authentication folding door has been written to the trusted state, not written to the risk state, and the candidate node channel status is open, the identity authentication output channel is retained. S75. The authentication folding door outputs the node authentication result according to the retention status of the authentication output channel, the suppression status of the authentication output channel, and the channel status of the conflict output channel.

Images