A data encryption communication method and system based on the Internet of Things

Abstract

The present application relates to the technical field of Internet of Things communication, and in particular to a data encryption communication method and system based on Internet of Things. The present application inputs random numbers, quantized channel digest, policy version and session round into a key derivation function, selects a protection policy according to data sensitivity, channel quality and device running state parameters, and uses the derived transceiving chain key to complete authentication encryption; the receiver returns an authenticated confirmation after verification, drives the message ratchet to submit, and promotes the round ratchet when the trigger condition is met; the current edge node synchronizes the state increment containing the state version number to the adjacent edge node, realizing fast re-authentication during mobile switching. The present application combines physical unclonable function restoration with domain separation two-way authentication, keeps the original physical response within the terminal trusted boundary, and reduces the long-term secret exposure surface in the running period wireless message.

Description

Technical Field

[0001] This invention belongs to the field of Internet of Things (IoT) communication technology, specifically relating to a data encryption communication method and system based on IoT. Background Technology

[0002] IoT terminals typically have limited processing power, small storage space, and rely on battery power. When communicating with edge nodes such as gateways and roadside units, terminals must verify the identity of the peer, protect transmitted data, and maintain consistency of session keys, message sequence numbers, and device status. Communication methods centered on long-term static keys or online certificate services require continuous maintenance of certificates and keys; when terminals are subjected to physical contact, energy analysis, or electromagnetic analysis, the extraction of long-term secrets may affect multiple sessions.

[0003] The sensitivity of data transmitted by the same IoT terminal, the quality of the wireless channel, and the operating status of the device can change at any time. Fixed encryption strength and fixed key refresh cycles make it difficult to maintain consistent protection levels with the actual session, and can easily lead to discrepancies between the communicating parties in policy versions, counters, or ratchet cycles. When a mobile terminal switches from the current edge node to an adjacent edge node, if the registration process is re-executed, control messages and access processing will be duplicated; if the session material of the old node is directly reused, issues related to target node binding, freshness verification, and revocation state propagation need to be addressed.

[0004] To address the above problems, this invention proposes a data encryption communication method and system based on the Internet of Things. Summary of the Invention

[0005] To address the aforementioned problems in the existing technology, the present invention aims to provide a data encryption communication method and system based on the Internet of Things.

[0006] To achieve the above-mentioned objectives, the technical solution adopted by this invention is as follows: A data encryption communication method based on the Internet of Things includes: The IoT terminal reconstructs the device root secret based on the physically unclonable function response; the IoT terminal generates a session request, and the current edge node verifies the freshness of the session request to form the first authentication transcription. The current edge node decapsulates to obtain the device root secret and generates an edge authentication tag. The IoT terminal verifies the edge authentication tag and generates a device authentication tag. The current edge node verifies the device authentication tag to form an authenticated transcription. The IoT terminal and the current edge node form a channel digest based on the authenticated transcribed random numbers and quantized channel observations. They select a protection strategy based on data sensitivity, channel quality, and device operating status parameters. The device root secret, the random numbers from both parties, the channel digest, the strategy version, and the session round number are input into the key derivation function to obtain the session identifier and the transmit / receive chain key. The transmit / receive chain key includes the sending chain key and the receiving chain key. The IoT terminal and the current edge node constitute the two communicating parties. The sending end of both communicating parties forms an authenticated encrypted frame according to the protection policy and the sending chain key. After the receiving end of both communicating parties verifies the frame, it returns an authentication confirmation. Both communicating parties advance the message ratchet based on the authentication confirmation, and advance the next round of the ratchet when the triggering condition is met. The current edge node synchronizes the state increment to the adjacent edge nodes. The state increment includes the state version number. During the mobile handover, the adjacent edge nodes perform fast re-authentication based on the state increment and roaming key. If the verification fails, it switches to full authentication.

[0007] Preferably, the device root secret is formed by a key derivation function based on the device seed, device identifier, and physical unclonable function challenge version; the device seed is recovered by a fuzzy extraction recovery function based on the current physical unclonable function sample and auxiliary data, and resampling is performed when recovery fails, and the device enters the recovery state after reaching the retry limit.

[0008] Preferably, the edge authentication label and the device authentication label use different domain separation information, and both cover the device identifier, edge node identifier, random numbers of both parties, device counter, policy version, and channel description of both parties; the current edge node submits the device counter after the device authentication label is verified.

[0009] Preferably, the protection strategy includes a first protection strategy, a second protection strategy, and a third protection strategy. The first protection strategy only performs authentication encryption on the marked sensitive data. The second protection strategy encrypts sensitive fields and includes the remaining fields as associated data in the integrity authentication. The third protection strategy encrypts all business payloads. The first, second, and third protection strategies all advance the message ratchet after each message receives authentication confirmation, and correspond to the preset first, second, and third thresholds, respectively. The security level of the third threshold is higher than that of the second threshold, and the security level of the second threshold is higher than that of the first threshold.

[0010] Preferably, the authentication encryption frame uses session identifier, device alias, session round, transmission direction, message sequence number, policy version, and payload type as associated data; the authentication encryption random number is formed based on the session identifier, transmission direction, session round, and message sequence number, and remains unique within the same session and transmission direction; wherein, the authentication encryption random number is a unique 96-bit random number within the same session and transmission direction.

[0011] Preferably, the authenticated confirmation includes a session identifier, session round, transmission direction, confirmation sequence number, received bitmap, and confirmation authentication tag calculated based on the session key; after the message ratchet verifies the authenticated confirmation at the sending end, it submits the message with the confirmation sequence number and received bitmap as idempotent identifiers; the round ratchet causes the session round to monotonically increase and resets the count of confirmed messages within the round to zero.

[0012] Preferably, the state increment also includes device status, maximum received counter, session round, policy version, validity period, state summary, and control plane authentication label; adjacent edge nodes perform fast re-authentication based on the state version number, validity period, target node identifier, device counter, revocation status, and device-side authentication label.

[0013] The present invention also provides a data encryption communication system based on the Internet of Things, comprising: The IoT terminal is used to reconstruct the device root secret based on the physically unclonable function response, generate a session request, verify the edge authentication tag and generate a device authentication tag, form an authentication encryption frame, and advance the message ratchet and round ratchet. The current edge node is used to verify the freshness of session requests to form the first authentication transcription, decapsulate the device root secret to obtain the edge authentication tag, verify the device authentication tag to form an authenticated transcription, form a channel digest and select a protection strategy based on the random numbers of both parties and the quantized channel observations corresponding to the authenticated transcription, derive the session identifier and transmit / receive chain keys, and synchronize the state increment to adjacent edge nodes; the transmit / receive chain keys include the send chain key and the receive chain key; the IoT terminal and the current edge node constitute the two communicating parties; Adjacent edge nodes are used to perform fast re-authentication based on state increments and roaming keys, and switch to full authentication if the verification fails. Among them, the IoT terminal and the current edge node are also used to form a channel digest based on the double random numbers and quantized channel observations corresponding to the certified transcription, select a protection strategy based on data sensitivity, channel quality and device operating status parameters, and input the device root secret, double random numbers, channel digest, strategy version and session round into the key derivation function to obtain the session identifier and transmit / receive chain key; The sending end of both communicating parties forms an authenticated encrypted frame according to the protection policy and the sending chain key. After the receiving end of both communicating parties verifies the frame, it returns an authentication confirmation. Both communicating parties advance the message ratchet based on the authentication confirmation, and advance the next round of the ratchet when the triggering condition is met. Edge authentication labels and device authentication labels use different domain-separated information, but both cover device identifier, edge node identifier, random numbers from both parties, device counter, policy version, and channel descriptions from both parties; the current edge node submits the device counter after the device authentication label is verified. The protection strategy includes a first protection strategy, a second protection strategy, and a third protection strategy. The first protection strategy only performs authentication encryption on the marked sensitive data. The second protection strategy encrypts sensitive fields and includes the remaining fields as associated data in the integrity authentication. The third protection strategy encrypts all business payloads. The first, second, and third protection strategies all advance the message ratchet after each message receives authentication confirmation, and they correspond to the preset first threshold, second threshold, and third threshold, respectively. The security level of the third threshold is higher than that of the second threshold, and the security level of the second threshold is higher than that of the first threshold. The state increment includes the state version number, as well as the device status, maximum received counter, session round, policy version, validity period, state summary, and control plane authentication label. Adjacent edge nodes perform fast re-authentication based on the state version number, validity period, target node identifier, device counter, revocation status, and device-side authentication label, and perform fast re-authentication based on the state increment and roaming key during mobile handover. If the verification fails, it switches to full authentication.

[0014] Preferably, the IoT terminal includes a physically unclonable function unit, a root secret reconstruction unit, a terminal authentication unit, a channel measurement unit, a policy and authentication encryption unit, and a ratchet unit. The output of the physically unclonable function unit is connected to the input of the root secret reconstruction unit, the output of the root secret reconstruction unit is connected to the input of the terminal authentication unit, the output of the channel measurement unit is connected to the input of the terminal authentication unit and the input of the policy and authentication encryption unit, the policy and authentication encryption unit reads the authenticated transcription and the current chain key and outputs the authentication encryption frame, and the ratchet unit updates the current chain key according to the authenticated confirmation.

[0015] Preferably, the current edge node includes a registration record storage unit, an edge authentication and key derivation unit, a channel verification and policy calculation unit, a session state unit, and a revocation and state synchronization unit; the adjacent edge node includes a state version verification unit, a roaming key decapsulation unit, and a fast re-authentication unit; the system also includes a policy and state management service, which includes a policy version storage unit and a revocation version coordination unit.

[0016] Beneficial effects: 1. This invention combines physical non-clonable function recovery, domain separation bidirectional authentication, and session key derivation to keep the original physical response within the trusted boundary of the terminal, and enables edge nodes to reconstruct the terminal itself and the terminal to mutually confirm the legitimate registration record holder; after authentication transcription, mutual random numbers, and channel digests enter the derivation context, the session key can be updated with this connection, thereby reducing the long-term secret exposure surface in runtime wireless messages and ordinary storage records, and mitigating the risk of multi-session association caused by the reuse of static secrets.

[0017] 2. This invention employs risk scoring, mandatory upgrade conditions, policy version binding, authentication encryption, and dual ratchet collaboration to apply appropriate protection levels when data sensitivity is high, channel quality is low, or device status is abnormal. Furthermore, message keys evolve sequentially after authentication, and round keys are re-injected with the root secret and field digest when triggered by time, count, or security events. This maintains consistency in policy and key status between the sender and receiver, limits the data range corresponding to a single message key or the current chain key, and reduces ratchet misalignment caused by mismatch between fixed protection policies and dynamic communication states, as well as lost confirmations.

[0018] 3. This invention, through the coordination of state version number, maximum received counter, revocation status, validity period, and target node binding roaming key, enables adjacent edge nodes to accept mobile terminals after verifying state freshness, and to switch to full authentication when the verification conditions are not met; disassembly events, authentication tag failures, or state conflicts can drive the propagation of suspicious, restored, or revoked states, thereby shortening the state break interval during edge handover, suppressing the continued acceptance of old counters, expired roaming contexts, or low-version revocation states, and solving the problem of the difficulty in maintaining continuity between authentication and security states when multiple edge accesses are in use. Attached Figure Description

[0019] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a system module diagram of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to specific embodiments. It should be understood that the specific embodiments described herein are merely for explaining the invention and are not intended to limit the scope of protection of the invention.

[0021] Example 1: Please refer to Figure 1 As shown, this embodiment provides a data encryption communication method and system based on the Internet of Things (IoT). The method includes the following steps: S1. Register and establish PUF root anchors; The terminal receives the device identifier, PUF challenge version, error correction parameters, and initial policy version. Within the terminal's trusted boundary, it collects the PUF response, invokes the fuzzy extraction process to generate the device seed and auxiliary data, and then derives the device root secret based on the device seed, device identifier, and PUF challenge version. Once the device seed forms the root secret, it is cleared from the temporary storage area. The original PUF response is only transmitted between the PUF unit and the root secret reconstruction unit. The current edge node obtains the root secret or equivalent verification material encapsulated in the edge management key through the protected registration channel, generating a registration record containing the registration version, policy version, device status, maximum received counter, and revocation version.

[0022] Further, the terminal performs a fuzzy extraction recovery function to recover the device seed based on the current PUF sampling and auxiliary data. After successful recovery, the device root secret is obtained through a key derivation function based on the device seed, device identifier, and PUF challenge version. If the recovery result exceeds the error correction capability, a failure state is returned. Preferably, resampling can be performed at 20-millisecond intervals, up to three times. If all three attempts fail, the terminal enters the recovery state, keeping normal service transmission closed. S1 outputs terminal-side auxiliary data, an anti-rollback counter, and edge-side registration records. The registration records serve as inputs for the state and freshness verification in S2, while the auxiliary data and root secret encapsulation serve as inputs for recovery and authentication in S3.

[0023] S2. Initiate a session and verify its freshness; The terminal reads the anti-rollback counter stored in S1 and monotonically increments it, generating a terminal random number. This random number is then combined with the device alias, the incremented counter, the algorithm capability set, the terminal policy version, and the initial channel description to form a session request M1. The current edge node locates the registration record formed by S1 based on M1, comparing the device status, counter, and random number. When the device status allows authentication, the request counter is greater than the maximum received counter, and the random number does not appear in the deduplication window, a first authentication transcription that passes the initial freshness screening is formed. This step only temporarily stores candidate counters and submits them after successful two-way authentication in S3, ensuring that the submitted maximum counter is only updated by requests that have undergone two-way authentication. S2 outputs the first authentication transcription and the candidate algorithm set, both of which are further supplemented by edge challenges and device proofs in S3.

[0024] S3. Restore the device root secret and complete two-way authentication; The current edge node reads the first authentication transcription of S2 and the root secret encapsulation of S1. Within a controlled execution environment, it decapsulates the device root secret, generates edge random numbers, and calculates the edge authentication label based on the device identifier, edge node identifier, random numbers from both sides, device counter, algorithm set, policy version, and channel descriptions from both sides. The terminal reads auxiliary data and resamples the PUF response to recover the device seed. Based on the device seed, it derives the device root secret, first verifies the edge authentication label, and then calculates the device authentication label for the same authentication transcription using information separated by different domains. After verifying the device authentication label, the current edge node atomically submits the candidate counter.

[0025] When S3 fails to recover the PUF for the first time, the terminal remains in the authentication state and resamples after 20 milliseconds. After a successful second recovery, it continues to verify the bidirectional tag, submitting the candidate counter only after successful verification. If the recovery result exceeds the error correction capability, it returns to a failure state; after reaching the retry limit, the device enters the recovery state. S3 outputs the authenticated transcription, the acknowledged counter, and the temporary root secret handle for S4 to form the channel digest and derive session material; no usable session key is output when any tag fails.

[0026] S4. Based on the characteristics of the authenticated transcription fusion channel, derive the session key, and select a protection strategy; The terminal and the current edge node obtain the signal-to-noise ratio, received signal strength and packet loss rate within the same measurement window. Preferably, the measurement window is 100 milliseconds. The measurement times are aligned, the observations are encoded according to the common quantization boundary, and a common channel summary is formed when the difference is within the tolerance range.

[0027] In the initial stage, the device anomaly degree and behavior anomaly degree in the device operating status parameters can be set to default values, such as 0.5 or 0; after operation, they will be dynamically updated based on the sliding window statistics. Define a truncation function. Channel quality is calculated as follows: Signal-to-noise ratio mass component ; Received signal strength quality components ; Reverse packet loss quality component ; Furthermore, the overall channel quality value can be taken as... The values ​​0.4, 0.3, and 0.3 are preset weights, and those skilled in the art can adjust these weight coefficients according to the actual scenario. The unit is dB, with -10dB to 30dB corresponding to the two ends of the normalization interval; The unit is dBm, with -110dBm to -50dBm corresponding to the two ends of the normalized interval; The packet loss rate is between 0 and 1, which represents the proportion of unacknowledged packets to the total number of sent packets within the measurement window. Observations exceeding the aforementioned calibration interval are limited to between 0 and 1 by the truncation function. It is a dimensionless value ranging from 0 to 1.

[0028] Preferably, the risk value can be calculated by weighting data sensitivity, reverse channel quality, equipment anomaly, and behavior anomaly, wherein data sensitivity, equipment anomaly, and behavior anomaly are all taken as 0 to 1; each weight is a preset value, and those skilled in the art can adjust the above weight coefficients according to the actual scenario.

[0029] Risk Value The calculation formula is:

[0030] in, The data sensitivity is defined as a value ranging from [0,1]. It is determined by: a preset sensitivity level mapping table, which divides business data types into several sensitivity levels, each corresponding to a sensitivity value within the range [0,1]. The IoT terminal or edge node queries the mapping table based on the data type of the currently transmitted business data to obtain the corresponding sensitivity value. The more a value or data type involves private information or control instructions, the higher its sensitivity level. The larger the value.

[0031] The aforementioned comprehensive channel quality value ranges from [0,1]. Therefore, (1- ) represents the reverse channel quality. The smaller the value, the worse the reverse channel quality, and the greater the risk contribution.

[0032] The device anomaly level, with a value range of [0,1], is determined as follows: A preset normal operating baseline is established, which includes the normal operating range or standard values ​​of the device's operating parameters, including but not limited to CPU utilization, memory utilization, operating temperature, operating voltage, and signal transmission power. The IoT terminal collects the current operating parameters in real time, calculates the weighted Euclidean distance or weighted deviation percentage between the current operating parameters and the normal operating baseline, and normalizes this distance or deviation percentage to the [0,1] interval. The normalized value is the [0,1] value. The greater the deviation, the better. The larger the value.

[0033] The abnormality score is defined as follows: A behavioral pattern baseline is preset, obtained statistically based on the behavioral characteristics of IoT terminals during historical normal communication periods. These behavioral characteristics include, but are not limited to, data packet transmission frequency, data packet length distribution, connection time period distribution, and target address set within a unit of time. The IoT terminal or edge node then statistically analyzes the actual behavioral characteristics within the current communication sliding window, calculates the Mahalanobis distance or cosine distance between the actual behavioral characteristics and the behavioral pattern baseline, and normalizes this distance to the [0,1] interval. The normalized value is the baseline score. The further the actual behavior deviates from the baseline, the more... The larger the value.

[0034] , , , The preset weight coefficients are all positive numbers and satisfy the following conditions: + + + =1, the specific value is pre-configured by the system, and the above weight coefficient is adjusted according to the actual scenario.

[0035] Furthermore, a first protection strategy, a second protection strategy, or a third protection strategy is selected based on the risk value and the mandatory upgrade conditions. Preferably, the first protection strategy is selected when the risk value is less than the first threshold and there are no mandatory upgrade conditions; the second protection strategy is selected when the risk value is greater than or equal to the first threshold and less than the second threshold; and the third protection strategy is selected when the risk value is greater than or equal to the second threshold, the data sensitivity is greater than or equal to the third threshold, the overall channel quality value is less than the fourth threshold, or the equipment is in a suspicious state.

[0036] The first protection strategy only performs authentication encryption on data marked as sensitive, using a 128-bit authentication tag; low-risk business fields not marked as sensitive retain their original business encoding and are not used as security inputs for device state migration, key advancement, or access control. The second protection strategy encrypts sensitive fields and includes other business fields as associated data in integrity authentication, using a 128-bit authentication tag. The third protection strategy encrypts all business payloads and uses a 128-bit authentication tag. All three strategies advance the message ratchet only after each message has received authentication confirmation.

[0037] Furthermore, the ratchet threshold for the first protection strategy can be the first of 30 minutes or 50 confirmed messages; the ratchet threshold for the second protection strategy can be the first of 20 minutes or 30 confirmed messages; and the ratchet threshold for the third protection strategy can be the first of 10 minutes or 20 confirmed messages.

[0038] When a device is in a suspicious state, only security recovery control frames are allowed; normal service frames and fast re-authentication are not permitted. Fast re-authentication is only enabled when the device is active, the target credentials and revocation snapshot are valid, and there are no outstanding security events. Policy upgrades take effect immediately; policy downgrades take effect after the lower-level conditions are met for three consecutive measurement windows and there are no outstanding security events.

[0039] Once the strategy is determined, both parties input the device root secret, random numbers from both sides, channel digest, strategy version, and round number into the key derivation function, which outputs the session identifier, session key, and initial chain keys for both directions. The session identifier, chain key, round number, strategy level, and corresponding protection action output by S4 are used by S5 to construct the authentication encryption frame, and by S6 as the initial state and threshold input for key evolution.

[0040] S5. Perform authenticated encrypted transmission based on the formed chain key and policy; The sending end derives a one-time message key from the current direction chain key, and constructs associated data using session identifier, device alias, round, direction, message sequence number, policy version, and payload type. It generates a unique 96-bit random number within the same session direction based on the session identifier, direction, round, and sequence number. A preset lightweight authentication encryption algorithm (preferably ASCON-128 or a negotiated equivalent lightweight authentication encryption algorithm) is used to output ciphertext and an authentication tag. The receiving end first checks the device status, round, message sequence number, and the uniqueness of the random number, and then verifies the authentication tag. After all verifications pass, the plaintext is delivered to the service processing unit. The receiving end uses the receive chain key formed by S4 as the intra-session confirmation authentication material, performs confirmation field separation calculations on the session identifier, round, transmission direction, confirmation sequence number, and receive bitmap to form a 16-byte confirmation authentication tag, which, along with the aforementioned fields, constitutes an authenticated confirmation. The sending end verifies the session identifier, round, direction, and confirmation window in the authenticated confirmation, and only after verifying the confirmation authentication tag is the authenticated confirmation considered valid.

[0041] When the S5 receiver detects an inconsistency in the authentication tag, it keeps plaintext output off and does not return an authentication confirmation. The sender, lacking an authentication confirmation, remains in the most recently submitted transmission chain state. Preferably, if three authentication or tag failures occur within a five-minute window, the revocation and state synchronization unit updates the state to suspicious and increments the state version number. S5 outputs a ciphertext frame, the reception result, and the confirmed authentication confirmation. S6 determines whether to submit the message ratchet in the corresponding direction for the authentication confirmation; verification failure codes are accumulated by S7 to form state transition events.

[0042] S6. Advance the message ratchet based on the authenticated confirmation from S5, and advance the round ratchet based on time, count, or security event; After the authentication encryption frame tag passes, the receiving end calculates the candidate next receive chain key and retains the current submitted state as a limited recovery point before constructing the authenticated acknowledgment. The sending end only atomically submits the candidate next send chain key after the authenticated acknowledgment tag passes, using the acknowledgment sequence number and the received bitmap as idempotent identifiers. Duplicate authenticated acknowledgments are not repeated. If an authenticated acknowledgment is lost, the sending end retransmits the original ciphertext corresponding to the same sequence number and plaintext, or aligns with the most recent acknowledgment state by querying the authenticated state, without encrypting different plaintexts with the same random number. For each acknowledged message, both communicating parties erase the used message key; unacknowledged messages are kept within a limited temporary storage window.

[0043] As a preferred option, the out-of-order window can be set to eight message sequence numbers. The intermediate message key within the window is temporarily stored as a bitmap. Duplicate sequence numbers are treated as replays, and skipped sequence numbers outside the window trigger round synchronization or full re-authentication.

[0044] When the elapsed time reaches the policy threshold, the number of confirmed messages reaches the policy threshold, a policy upgrade occurs, or a security event occurs, both parties exchange new random numbers and channel digests. The device root secret, current round's basic information, the new random number, channel digest, and policy version are jointly input into the round key derivation process, incrementing the round number and resetting the current round's message count. When both time and counting conditions are met simultaneously, the new round number is used as the idempotency identifier, and the process is committed only once. S6 outputs the updated transmit / receive chain key, round number, confirmed message count, and security event. The updated chain key is fed back to S5 to process the next message, and the remaining states are synchronized by S7.

[0045] S7. Based on the round, counter, and security event output by S6, perform synchronization, rapid re-authentication, revocation, or recovery. The current edge node generates a state increment, which includes at least the device alias, device status, maximum received counter, session round, policy version, state version number, validity period, state summary, and control plane authentication tag, and sends it to the adjacent edge node or policy and state management service through the protected edge control link.

[0046] Regarding state transitions, device status is maintained according to seven states: unregistered, registered, authenticating, active, suspicious, recovering, and revoked. After successful registration (S1), the device transitions from unregistered to registered; after passing freshness verification (S2), it enters the authentication phase; after passing bidirectional tag verification (S3) and key confirmation (S4), it enters the active phase. In the active state, the device remains active and advances the message ratchet when receiving and acknowledging data frames; it remains active and increments the ratchet count when a time or count threshold is reached.

[0047] When the number of authentication or tag failures reaches the threshold or a state version number conflict occurs, the device enters a suspicious state; the terminal and the current edge node erase the activity message key, and then enter the recovery state through complete PUF recovery, two-way authentication and policy review, and then return to the active state after confirmation by a higher state version number.

[0048] When a terminal or the current edge node obtains a confirmed detachment event with a monotonic event sequence number, the terminal erases the volatile session key and stops sending normal services. The current edge node adds the device to the local revocation list, increases the state version number, and synchronizes the revocation state. A confirmed detachment event or a higher state version number causes any communicable state to enter revocation. An authorized deregistration record with a higher version returns the revocation state to unregistered, and S1 is re-executed.

[0049] Regarding mobile handover, when a terminal switches from the current edge node to an adjacent edge node, the current edge node sends the target node to be bound, the maximum counter, the round number, the status version number, and the validity period as a status increment to the adjacent edge node, along with a roaming key encapsulated for the adjacent edge node. Preferably, the validity period can be 5 seconds.

[0050] During fast re-authentication, the terminal increments the counter and generates a target-bound authentication tag. The state version verification unit, roaming key decapsulation unit, and fast re-authentication unit sequentially verify the state version number, validity period, target identifier, revocation status, counter, and tag; if all pass, new session material is generated that belongs only to the terminal and the adjacent edge node. If the credentials time out, the target node does not match, the counter does not increment, the state version number is outdated, or the tag fails, the adjacent edge node clears the temporary roaming material and returns to S2 to S4 to perform full authentication.

[0051] When the edge control link is interrupted, the current edge node can process existing and normal sessions within the validity period of the policy snapshot and the snapshot revocation.

[0052] As a preferred option, the maximum stale period for the revocation status is set to 60 seconds. After this period expires, the current edge node keeps the entry points for new sessions and fast re-authentication closed, and allows active sessions to complete restricted control messages.

[0053] After the control link is restored, the revocation version coordination unit sends incremental updates according to the monotonic version. When the same state version number corresponds to different state summaries, the relevant edge nodes set the device as suspicious and obtain a higher adjudication version, restoring a consistent state based on the version comparison result. S7 outputs the new activity, suspicious, restored, or revoked state, as well as the target edge session. Subsequent normal communication re-enters S2 with this output state.

[0054] Example 2: Please refer to Figure 2 As shown, this embodiment provides a data encryption communication system based on the Internet of Things, including the following modules: The IoT terminal includes a PUF unit, a root secret reconstruction unit, a terminal authentication unit, a channel measurement unit, a policy and authentication encryption unit, a ratchet unit, and a terminal state storage unit. The output of the PUF unit is connected to the input of the root secret reconstruction unit, and the output of the root secret reconstruction unit is connected to the input of the terminal authentication unit. The channel measurement unit sends quantized observations to the terminal authentication unit and the policy and authentication encryption unit. The policy and authentication encryption unit reads the authenticated transcription generated by the terminal authentication unit and the current chain key generated by the ratchet unit, and outputs an authenticated encryption frame. The ratchet unit reads the authenticated confirmation, and the updated round number and count are stored in the terminal state storage unit.

[0055] The current edge node includes a registration record storage unit, an edge authentication and key derivation unit, a channel verification and policy calculation unit, a session state unit, and a revocation and state synchronization unit. The edge authentication and key derivation unit reads the root secret encapsulation from the registration record storage unit and the first authentication transcription sent by the terminal to form an edge authentication tag and verify the device authentication tag. The channel verification and policy calculation unit reads the authentication result and the quantized channel observations from both parties, outputting the channel digest, policy level, and derivation context. The session state unit stores the chain key handle, round number, message count, and state version number, and sends the submitted maximum counter, round number, and security events to the revocation and state synchronization unit.

[0056] The adjacent edge nodes include a status version verification unit, a roaming key decapsulation unit, and a fast re-authentication unit. The status version verification unit receives the status increment output by the revocation and status synchronization unit, first comparing the status version number and the validity period; after the verification passes, the roaming key decapsulation unit only decapsulates the roaming key facing the adjacent edge node, and the fast re-authentication unit then combines the terminal's new counter and the target-bound authentication tag to form a new session.

[0057] The policy and state management service includes a policy version storage unit and a revocation version coordination unit. The former provides certified policy snapshots to the current edge node, while the latter compares the state version number with the state summary and outputs a monotonically increasing decision version. Business encrypted data is transmitted directly between the terminal and the current edge node or adjacent edge nodes. The policy and state management service handles policy and state control data.

[0058] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A data encryption communication method based on the Internet of Things, characterized in that, include: The IoT terminal reconstructs the device root secret based on the physically unclonable function response; the IoT terminal generates a session request, and the current edge node verifies the freshness of the session request to form the first authentication transcription. The current edge node decapsulates to obtain the device root secret and generates an edge authentication tag. The IoT terminal verifies the edge authentication tag and generates a device authentication tag. The current edge node verifies the device authentication tag to form an authenticated transcription. The IoT terminal and the current edge node form a channel digest based on the authenticated transcribed random numbers and quantized channel observations. They select a protection strategy based on data sensitivity, channel quality, and device operating status parameters. The device root secret, the random numbers from both parties, the channel digest, the strategy version, and the session round number are input into the key derivation function to obtain the session identifier and the transmit / receive chain key. The transmit / receive chain key includes the sending chain key and the receiving chain key. The IoT terminal and the current edge node constitute the two communicating parties. The sending end of both communicating parties forms an authenticated encrypted frame according to the protection policy and the sending chain key. After the receiving end of both communicating parties verifies the frame, it returns an authentication confirmation. Both communicating parties advance the message ratchet based on the authentication confirmation, and advance the next round of the ratchet when the triggering condition is met. The current edge node synchronizes the state increment to the adjacent edge nodes. The state increment includes the state version number. During the mobile handover, the adjacent edge nodes perform fast re-authentication based on the state increment and roaming key. If the verification fails, they switch to full authentication. The edge authentication label and the device authentication label use different domain-separated information, but both cover the device identifier, edge node identifier, random numbers from both parties, device counter, policy version, and channel descriptions from both parties; the current edge node submits the device counter after the device authentication label is verified. The protection strategy includes a first protection strategy, a second protection strategy, and a third protection strategy. The first protection strategy only performs authentication encryption on the marked sensitive data. The second protection strategy encrypts sensitive fields and includes the remaining fields as associated data in the integrity authentication. The third protection strategy encrypts all business payloads. The first, second, and third protection strategies all advance the message ratchet after each message receives authentication confirmation, and they correspond to the preset first threshold, second threshold, and third threshold, respectively. The security level of the third threshold is higher than that of the second threshold, and the security level of the second threshold is higher than that of the first threshold. The state increment also includes device status, maximum received counter, session round, policy version, validity period, state summary, and control plane authentication label; adjacent edge nodes perform fast re-authentication based on the state version number, validity period, target node identifier, device counter, revocation status, and device-side authentication label.

2. The data encryption communication method based on the Internet of Things according to claim 1, characterized in that, The device root secret is formed by a key derivation function based on the device seed, device identifier, and physical unclonable function challenge version. The device seed is recovered by a fuzzy extraction recovery function based on the current physical unclonable function sample and auxiliary data. If the recovery fails, it is resampled. After reaching the retry limit, it enters the recovery state.

3. The data encryption communication method based on the Internet of Things according to claim 1, characterized in that, The authentication encryption frame uses session identifier, device alias, session round, transmission direction, message sequence number, policy version, and payload type as associated data; the authentication encryption random number is formed based on the session identifier, transmission direction, session round, and message sequence number, and remains unique within the same session and transmission direction; the authentication encryption random number is a unique 96-bit random number within the same session and transmission direction.

4. The data encryption communication method based on the Internet of Things according to claim 1, characterized in that, The authenticated confirmation includes the session identifier, session round, transmission direction, confirmation sequence number, received bitmap, and confirmation authentication tag calculated based on the session key; After the message ratchet verifies the authentication confirmation at the sending end, it submits the message with the confirmation sequence number and the received bitmap as idempotent identifiers. The round ratchet causes the session rounds to increase monotonically and resets the count of confirmed messages within a round.

5. A data encryption communication system based on the Internet of Things, characterized in that, include: The IoT terminal is used to reconstruct the device root secret based on the physically unclonable function response, generate a session request, verify the edge authentication tag and generate a device authentication tag, form an authentication encryption frame, and advance the message ratchet and round ratchet. The current edge node is used to verify the freshness of session requests to form the first authentication transcription, decapsulate the device root secret to obtain the edge authentication tag, verify the device authentication tag to form an authenticated transcription, form a channel digest and select a protection strategy based on the random numbers of both parties and the quantized channel observations corresponding to the authenticated transcription, derive the session identifier and transmit / receive chain keys, and synchronize the state increment to adjacent edge nodes; the transmit / receive chain keys include the send chain key and the receive chain key; the IoT terminal and the current edge node constitute the two communicating parties; Adjacent edge nodes are used to perform fast re-authentication based on state increments and roaming keys, and switch to full authentication if the verification fails. Among them, the IoT terminal and the current edge node are also used to form a channel digest based on the double random numbers and quantized channel observations corresponding to the certified transcription, select a protection strategy based on data sensitivity, channel quality and device operating status parameters, and input the device root secret, double random numbers, channel digest, strategy version and session round into the key derivation function to obtain the session identifier and transmit / receive chain key; The sending end of both communicating parties forms an authenticated encrypted frame according to the protection policy and the sending chain key. After the receiving end of both communicating parties verifies the frame, it returns an authentication confirmation. Both communicating parties advance the message ratchet based on the authentication confirmation, and advance the next round of the ratchet when the triggering condition is met. Edge authentication labels and device authentication labels use different domain-separated information, but both cover device identifier, edge node identifier, random numbers from both parties, device counter, policy version, and channel descriptions from both parties; the current edge node submits the device counter after the device authentication label is verified. The protection strategy includes a first protection strategy, a second protection strategy, and a third protection strategy. The first protection strategy only performs authentication encryption on the marked sensitive data. The second protection strategy encrypts sensitive fields and includes the remaining fields as associated data in the integrity authentication. The third protection strategy encrypts all business payloads. The first, second, and third protection strategies all advance the message ratchet after each message receives authentication confirmation, and they correspond to the preset first threshold, second threshold, and third threshold, respectively. The security level of the third threshold is higher than that of the second threshold, and the security level of the second threshold is higher than that of the first threshold. The state increment includes the state version number, as well as the device status, maximum received counter, session round, policy version, validity period, state summary, and control plane authentication label. Adjacent edge nodes perform fast re-authentication based on the state version number, validity period, target node identifier, device counter, revocation status, and device-side authentication label, and perform fast re-authentication based on the state increment and roaming key during mobile handover. If the verification fails, it switches to full authentication.

6. A data encryption communication system based on the Internet of Things according to claim 5, characterized in that, The IoT terminal includes a physically unclonable function unit, a root secret reconstruction unit, a terminal authentication unit, a channel measurement unit, a policy and authentication encryption unit, and a ratchet unit. The output of the physically unclonable function unit is connected to the input of the root secret reconstruction unit, the output of the root secret reconstruction unit is connected to the input of the terminal authentication unit, the output of the channel measurement unit is connected to the input of the terminal authentication unit and the input of the policy and authentication encryption unit, the policy and authentication encryption unit reads the authenticated transcription and the current chain key and outputs the authentication encryption frame, and the ratchet unit updates the current chain key based on the authenticated confirmation.

7. A data encryption communication system based on the Internet of Things according to claim 5, characterized in that, The current edge node includes a registration record storage unit, an edge authentication and key derivation unit, a channel verification and policy calculation unit, a session state unit, and a revocation and state synchronization unit; the adjacent edge node includes a state version verification unit, a roaming key decapsulation unit, and a fast re-authentication unit; the system also includes a policy and state management service, which includes a policy version storage unit and a revocation version coordination unit.

Images