A beidou-based internet of things terminal access authentication method and an internet of things terminal and an edge gateway

Abstract

The application provides a Beidou timing-based Internet of Things terminal access authentication method and an Internet of Things terminal and an edge gateway, and the method applied to the Internet of Things terminal side comprises the following steps: receiving first timing information sent by a Beidou satellite system based on current access demand; generating a first input sequence based on the first timing information, Internet of Things terminal identification information and an access demand count value; the access demand count value is dynamically generated according to the current access demand triggered by the Internet of Things terminal; generating a first authentication code based on a first preset lightweight hash algorithm, a first preset hash value and the first input sequence; receiving a verification result sent by the edge gateway, wherein the verification result is generated after the edge gateway verifies the first authentication code sent by the Internet of Things terminal; and accessing the Internet of Things network through the edge gateway in response to the verification result indicating that the verification is passed. The application improves the Internet of Things device network access security and reduces the calculation amount of the authentication code generation through the one-time one-code access authentication mode.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) communication technology, and in particular to an IoT terminal access authentication method based on BeiDou time synchronization, as well as IoT terminals and edge gateways. Background Technology

[0002] With the popularization of IoT technology, a large number of resource-constrained IoT terminals (such as sensors driven by 8 / 32-bit MCUs, NB-IoT terminals, outdoor monitoring equipment, etc.) are widely used in industrial control, agricultural monitoring, outdoor environmental sensing and other scenarios. The core pain points of these devices are low computing power, small memory, and strict power consumption requirements. They cannot handle complex encryption and authentication calculations, but they place high demands on the security and real-time performance of identity authentication—effectively preventing attacks such as device forgery, authentication code replay, and time tampering to ensure the legitimacy of device access.

[0003] Currently, the commonly used one-time password (OTP) generation technologies in the Internet of Things (IoT) field are mainly divided into two categories. Both suffer from limitations in the application of BeiDou-related authentication schemes, and their parameter design, except for BeiDou time, is redundant, further increasing the computational burden, as detailed below:

[0004] Traditional OTP generation schemes (TOTP / HOTP): TOTP relies on the device's local clock to generate time-dependent OTPs, while HOTP relies on a pre-shared key and a counter to generate OTPs. Both have significant drawbacks: First, relying on a local clock or pre-shared key makes the local clock susceptible to tampering, and key distribution is complex and prone to leakage; second, the core operations rely on complex hash algorithms, resulting in high computational overhead, and the redundant bit width of parameters such as device ID and counter further increases the computational burden, making it unsuitable for resource-constrained devices such as 8-bit MCUs; third, the lack of a trusted time anchor makes them vulnerable to replay attacks, resulting in insufficient security.

[0005] In existing technologies, the BeiDou system is mostly used for short messages and device location binding, failing to utilize the high-precision, tamper-proof timestamps provided by BeiDou time synchronization as the sole reliable time source for OTP generation. Furthermore, it lacks lightweight modifications for resource-constrained devices, and the design of parameters other than BeiDou time is cumbersome, resulting in high computational overhead, complex deployment, and incompatibility with low-power terminals. The problems or shortcomings of existing methods are as follows:

[0006] 1. Poor compatibility with resource-constrained devices: Traditional OTP generation algorithms are computationally complex and have high computing power overhead. Furthermore, parameters such as device ID and counters have redundant bit widths, making it difficult for 8-bit MCUs to operate efficiently. They also consume too much memory, which does not meet the usage requirements of low-power, low-resource devices.

[0007] 2. Insufficient security of OTP: Traditional solutions rely on local untrusted clocks or pre-shared keys, which are easily tampered with and replayed. They lack a trusted time anchor and cannot ensure the uniqueness and unpredictability of OTP.

[0008] 3. BeiDou timing resources are not fully utilized: Existing BeiDou-related certification schemes do not integrate the high precision and tamper-proof characteristics of BeiDou timing into the core process of OTP generation, but only use it as an auxiliary positioning or timing tool, thus wasting the spatiotemporal reliability value of the BeiDou system.

[0009] 4. High deployment cost and poor scalability: Traditional OTP solutions require the distribution and maintenance of pre-shared keys, which is a cumbersome process and not suitable for large-scale deployment of a large number of IoT devices; moreover, if the key is leaked, it needs to be redistributed, resulting in high maintenance costs.

[0010] 5. Redundancy of non-BeiDou time parameters: The existing solution has an excessively large bit width for parameters such as device ID, counter, and random salt, which is unnecessary and increases the burden of data storage and computation, and does not meet the requirements of lightweight design. Summary of the Invention

[0011] The technical problem to be solved by the present invention is to provide an IoT terminal access authentication method based on BeiDou time synchronization, as well as an IoT terminal and an edge gateway, so as to improve the network access security of IoT devices and reduce the computational load of generating the authentication code required for network access, thereby meeting the requirements of lightweight design.

[0012] To address the aforementioned technical problems, embodiments of the present invention provide an IoT terminal access authentication method based on BeiDou timing, applied to IoT terminals, comprising:

[0013] Receive the first timing information sent by the BeiDou satellite system based on the current access requirements;

[0014] Based on the first timing information, IoT terminal identification information, and access demand count value, a first input sequence is generated; the access demand count value is dynamically generated based on the current access demand triggered by the IoT terminal.

[0015] A first authentication code is generated based on a first preset lightweight hash algorithm, a first preset hash value, and the first input sequence;

[0016] The system receives a verification result sent by an edge gateway, which is generated by the edge gateway after verifying the first authentication code sent by the IoT terminal.

[0017] The verification result indicates that the verification passed, and the device is connected to the IoT network through the edge gateway.

[0018] In one embodiment, a first input sequence is generated based on the first timing information, the IoT terminal identification information, and the access demand count value, including:

[0019] Based on a first preset order, the first timing information, the IoT terminal identification information, and the access demand count value are concatenated to obtain a first continuous byte sequence.

[0020] Based on a second preset order, the first continuous byte sequence is split to obtain the first input sequence, which includes multiple ordered bytes.

[0021] In one embodiment, generating a first authentication code based on a first preset lightweight hash algorithm, a first preset hash value, and the first input sequence includes:

[0022] Based on the first preset lightweight hash algorithm and the first preset hash value, a byte-by-byte iterative hashing process is performed on multiple ordered bytes in the first input sequence to generate the first authentication code; the number of iterations in the iterative hashing process is equal to the number of ordered bytes in the first input sequence.

[0023] In one embodiment, based on the first preset lightweight hash algorithm and the first preset hash value, a byte-by-byte iterative hashing process is performed on multiple ordered bytes in the first input sequence to generate the first authentication code, including:

[0024] Assign the first preset hash value to the initial hash value of the current iteration;

[0025] Based on the first preset lightweight hash algorithm, the initial hash value of the current iteration and the current ordered byte in the first input sequence are hashed to obtain the target hash value corresponding to the current ordered byte;

[0026] The target hash value of the current ordered byte is determined as the initial hash value for the next ordered byte to be hashed, and the above process is repeated until all ordered bytes in the first input sequence have been traversed;

[0027] The first authentication code is generated based on the target hash value corresponding to the last ordered byte in the first input sequence.

[0028] In one embodiment, based on the first preset lightweight hash algorithm, the initial hash value of the current iteration and the currently ordered byte in the first input sequence are hashed to obtain the target hash value corresponding to the currently ordered byte, including:

[0029] Perform a bitwise XOR operation on the initial hash value of the current iteration and the current ordered byte to obtain the first updated hash value of the current ordered byte;

[0030] Based on preset constraints, the first update hash value is preprocessed to obtain the second update hash value of the current ordered bytes;

[0031] Perform a second bitwise XOR operation on the first updated hash value and the second updated hash value to obtain the target hash value of the current ordered bytes.

[0032] In one embodiment, generating the first authentication code based on the target hash value corresponding to the last ordered byte in the first input sequence includes:

[0033] Perform a transformation on the target hash value corresponding to the last ordered byte in the first input sequence to obtain the first transformed number string;

[0034] Perform a modulo operation on the first converted number string to obtain the number string after the modulo operation;

[0035] The number string after the modulo operation is subjected to a second transformation to obtain a second transformed number string, and the second transformed number string is used as the first authentication code.

[0036] Embodiments of the present invention also provide an Internet of Things (IoT) terminal, comprising:

[0037] The first BeiDou timing module is used to receive the first timing information sent by the BeiDou satellite system based on the current access requirements;

[0038] The first processing module is used to generate a first input sequence based on the first timing information, IoT terminal identification information, and access demand count value; the access demand count value is dynamically generated based on the current access demand triggered by the IoT terminal; and to generate a first authentication code based on a first preset lightweight hash algorithm, a first preset hash value, and the first input sequence.

[0039] The first transceiver module is used to receive the verification result sent by the edge gateway. The verification result is generated by the edge gateway after verifying the first authentication code sent by the IoT terminal.

[0040] The second processing module is used to respond to the verification result indicating that the verification has passed, and to access the Internet of Things network based on the edge gateway.

[0041] Embodiments of the present invention also provide an IoT terminal access authentication method based on BeiDou time synchronization, applied to an edge gateway, comprising:

[0042] The device receives the current access request, first timing information, first authentication code, and access request count value sent by the IoT terminal; the access request count value is dynamically generated based on the current access request triggered by the IoT terminal.

[0043] Based on the current access requirements, receive the second timing information sent by the BeiDou satellite system;

[0044] Based on the first timing information and the second timing information, the first authentication code is verified once;

[0045] In response to a successful verification, a second authentication code is generated based on the access demand count value, the second timing information, the IoT terminal identification information pre-stored in the edge gateway, the second preset lightweight hash algorithm, and the second preset hash value.

[0046] The first authentication code is verified a second time based on the second authentication code, and the verification result obtained from the second verification is sent to the IoT terminal so that the verification is successful in response to the verification result, and the IoT terminal accesses the IoT network through the edge gateway.

[0047] In one embodiment, a second authentication code is generated based on the access demand count, the second timing information, the IoT terminal identification information pre-stored in the edge gateway, the second preset lightweight hash algorithm, and the second preset hash value, including:

[0048] Based on the access demand count, the second timing information, and the IoT terminal identification information pre-stored in the edge gateway, a second input sequence is generated;

[0049] A second authentication code is generated based on a second preset lightweight hash algorithm, a second preset hash value, and the second input sequence.

[0050] Embodiments of the present invention also provide an edge gateway, comprising:

[0051] The second transceiver module is used to receive the current access request, the first timing information, the first authentication code, and the access request count value sent by the IoT terminal; the access request count value is dynamically generated based on the current access request triggered by the IoT terminal.

[0052] The second BeiDou timing module receives the second timing information sent by the BeiDou satellite system based on the current access requirements.

[0053] The processing module is configured to perform a first verification on the first authentication code based on the first timing information and the second timing information; in response to the first verification passing, generate a second authentication code based on the access demand count value, the second timing information, the IoT terminal identification information pre-stored in the edge gateway, the second preset lightweight hash algorithm, and the second preset hash value; perform a second verification on the first authentication code based on the second authentication code, and send the verification result obtained from the second verification to the IoT terminal through the second transceiver module, so that in response to the verification result indicating that the verification has passed, the IoT terminal accesses the IoT network through the edge gateway.

[0054] The above-described solution of the present invention has at least the following beneficial effects:

[0055] 1. Extremely lightweight and with better adaptability: The bit width and logic of all parameters except BeiDou time are optimized. The entire authentication code generation process only involves basic logic operations such as XOR and left shift by 8 bits, without multiplication, division, and floating-point operations, reducing redundant steps. The 8-bit MCU can complete the hash iteration in a single cycle. The generation latency of the first and second authentication codes is less than 300μs, the memory usage is less than 256B, and the power consumption is less than 0.8mW, thereby reducing the computing power and power consumption of IoT terminals and edge gateways.

[0056] 2. High security and protection against multiple attacks: On the IoT terminal side, the first timing information sent by the BeiDou satellite system is used as the only trusted time source. Based on the 8-bit lightweight IoT terminal identification information and the 8-bit access requirement count value, a unique first authentication code is generated, which prevents common IoT attacks such as replay attacks, time tampering, and terminal device forgery from the root. At the same time, the generation process of this first authentication code can realize the zero-key and zero-certificate design within the terminal device, eliminate redundant random salt modules, avoid the risks of key distribution and leakage, improve authentication security, and simplify terminal device design.

[0057] 3. Simpler deployment and stronger scalability: On the edge gateway side: the second timing information sent by the Beidou satellite system is used as the only reliable time source, and the corresponding second authentication code is generated based on the 8-bit lightweight IoT terminal identification information and the 8-bit access requirement count value. Only the 8-bit lightweight IoT terminal identification information is stored in the edge gateway, which simplifies the storage and management of the edge gateway, is suitable for the large-scale deployment of massive IoT devices, and further reduces deployment and maintenance costs.

[0058] 4. Full utilization of BeiDou resources: The high precision and tamper-proof characteristics of BeiDou time synchronization are integrated into the authentication code generation process. This differs from the auxiliary positioning of existing BeiDou-related solutions, achieving deep integration of BeiDou time synchronization and OTP authentication code generation. On the one hand, it improves the security of OTP authentication code generation and subsequent authentication, ensuring the security and accuracy of IoT terminal access. On the other hand, it fully leverages the spatiotemporal reliability value of the BeiDou satellite system, avoiding redundancy in bit width design caused by non-BeiDou time-related parameters (device ID, counter, random salt, etc.), thereby reducing data storage and computational burdens and meeting lightweight requirements.

[0059] It should be understood that the implementation of any embodiment of the present invention does not mean that it will simultaneously possess or achieve multiple or all of the above-mentioned beneficial effects. Attached Figure Description

[0060] To more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings in the following description are merely exemplary, and those skilled in the art can derive other embodiments based on the provided drawings without creative effort.

[0061] The structures, proportions, sizes, etc. illustrated in this specification are only for the purpose of assisting those skilled in the art in understanding and reading the content disclosed herein, and are not intended to limit the conditions under which the present invention can be implemented. Therefore, they have no substantial technical significance. Any modifications to the structure, changes in the proportions, or adjustments to the size, without affecting the effects and objectives that the present invention can produce, should still fall within the scope of the technical content disclosed in the present invention.

[0062] Figure 1 This is a schematic diagram of the access authentication method on the IoT terminal side provided in an embodiment of the present invention;

[0063] Figure 2 This is a schematic diagram illustrating information interaction between an IoT terminal and an edge gateway according to an optional embodiment of the present invention;

[0064] Figure 3 This is a schematic diagram of the access authentication method on the edge gateway side provided in an embodiment of the present invention;

[0065] Figure 4 This is a schematic block diagram of an IoT terminal provided in an embodiment of the present invention; and

[0066] Figure 5 This is a schematic block diagram of a communication device provided in an embodiment of the present invention. Detailed Implementation

[0067] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0068] It should be understood that the terms "comprising / including," "consisting of," or any other variations are intended to cover non-exclusive inclusion, such that a product, apparatus, process, or method that comprises a list of elements includes not only those elements but may also include, where necessary, other elements not expressly listed, or elements inherent to such a product, apparatus, process, or method. Without further limitation, an element defined by the phrases "comprising / including," "consisting of," does not exclude the presence of additional identical elements in the product, apparatus, process, or method that includes said element.

[0069] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0070] like Figure 1 As shown, an embodiment of the present invention proposes an IoT terminal access authentication method based on BeiDou timing, applied to the IoT terminal side, including:

[0071] Step 11: Receive the first timing information sent by the BeiDou satellite system based on the current access requirements;

[0072] Step 12: Generate a first input sequence based on the first timing information, IoT terminal identification information, and access demand count value; the access demand count value is dynamically generated based on the current access demand triggered by the IoT terminal.

[0073] Step 13: Generate a first authentication code based on a first preset lightweight hash algorithm, a first preset hash value, and a first input sequence;

[0074] Step 14: Receive the verification result sent by the edge gateway. The verification result is generated by the edge gateway after verifying the first authentication code sent by the IoT terminal.

[0075] Step 15: In response to the verification result indicating that the verification has passed, access the IoT network through the edge gateway.

[0076] See Figure 2When an IoT terminal needs to access the IoT network (such as periodically reporting data, requesting command interaction, etc.), it triggers the current access requirement and receives the first timing information sent by the Beidou satellite system based on the first Beidou timing module set in it. At the same time, it extracts the current 48-bit UTC millisecond-level first timestamp T of the first timing information and uses the first timestamp T as the time reference for the subsequent generation of the first authentication code (the parameters remain unchanged to ensure time reliability).

[0077] The IoT terminal identification information can be lightweight identification information; preferably, the identification information is 8 bits in length. The identification information can be randomly generated and solidified at the factory based on an 8-bit OTP one-time programmable chip. It has immutability and uniqueness and is used to identify the unique identity of the IoT terminal. This can meet the identification information needs of massive IoT devices and reduce storage (from the original 32 bits to 8 bits).

[0078] The access request count value is the current access request count value corresponding to the current access request. Preferably, the access request count value can be dynamically generated based on a lightweight rolling counter set in the IoT terminal. Preferably, the length of the access request count value is 8 bits (to meet low-frequency authentication requirements and reduce computation and storage burden). After the IoT terminal is powered on, the data in the lightweight rolling counter is cleared to zero. Each time the IoT terminal triggers an access request, the lightweight rolling counter counts once, and the next time an access request is triggered, the next count is accumulated based on the previous count (automatically returning to zero after reaching the count limit to prevent random number errors), so that the access request count value corresponding to each access request is different to distinguish different access requests.

[0079] Furthermore, based on the first timing information, IoT terminal identification information, and access demand count value, a first input sequence is generated. Since the first timing information, IoT terminal identification information, and access demand count value are all unique, the generated first input sequence is also unique, thereby ensuring the uniqueness and immutability of the subsequently generated first authentication code, and preventing common IoT attacks such as replay attacks, time tampering, and device forgery from the root.

[0080] Here, the first preset lightweight hash algorithm is a hash algorithm that includes basic logical operations. When generating the first authentication code based on this first preset lightweight hash algorithm, only basic logical operations are involved, without complex operations such as multiplication, division, and floating-point operations. This reduces redundant steps, lowers computational complexity and power consumption, and thus reduces the computing power and power consumption of the IoT terminal. The first preset hash value is the initial seed processed by the first preset lightweight hash algorithm, and its length can be 32 bits. Both the first preset hash value and the first preset lightweight hash algorithm are stored in the first processing module (which can be an MCU) of the IoT terminal so that the first authentication code can be generated in a timely manner.

[0081] Furthermore, the specific process of generating the first authentication code described above can realize a zero-key, zero-certificate design within the terminal device, eliminate redundant random salt modules, avoid the risks of key distribution and leakage, and simplify the design of the terminal device while improving authentication security.

[0082] In an optional embodiment of the present invention, step 12 above may include:

[0083] Step 121: Based on the first preset order, the first timing information, the IoT terminal identification information, and the access demand count value are concatenated to obtain the first continuous byte sequence.

[0084] Step 122: Based on the second preset order, the first continuous byte sequence is split to obtain the first input sequence, which includes multiple ordered bytes.

[0085] In this embodiment, the 8-bit IoT terminal identification information, the 48-bit first timestamp T in the first timing information, and the 8-bit count value are first concatenated in a fixed order of “IoT terminal identification information || first timestamp T in the first timing information || access demand count value” to form a 64-bit first continuous byte sequence S.

[0086] Furthermore, the first continuous byte sequence S can be split in order from high byte to low byte to obtain a first input sequence with multiple ordered bytes, so as to facilitate the subsequent processing by the first preset lightweight hash algorithm.

[0087] In a specific implementation example, when the IoT terminal identification information is represented as 0x12, the first timestamp T in the first timing information is represented as 2026-05-07 00:10:00, and the access demand count value is represented as 0x0A, the first timestamp T: 1778110200 is first encoded into a 32-bit hexadecimal form, which can be specifically represented as 0x69FBCEF8; the IoT terminal identification information, the encoded first timestamp T, and the access demand count value are then sequentially concatenated to obtain a 40-bit first continuous byte sequence 0x69FBCEF80A; furthermore, the first continuous byte sequence is split according to the order from high bit to low bit to obtain 5 ordered bytes, each of which can be specifically represented as B[1]=0x69, B[2]=0xFB, B[3]=0xCE, B[4]=0xF8, B[5]=0x0A.

[0088] Preferably, the splicing process only uses byte copying operations without any computation, ensuring extreme lightweight design and thus reducing the computing power of IoT terminals.

[0089] In an optional embodiment of the present invention, step 13 above may include:

[0090] Step 131: Based on the first preset lightweight hash algorithm and the first preset hash value, perform byte-by-byte iterative hashing on multiple ordered bytes in the first input sequence to generate the first authentication code; here, the number of iterations in the iterative hashing process is equal to the number of ordered bytes in the first input sequence, and the iteration order corresponds one-to-one with the order of ordered bytes in the first input sequence.

[0091] In this embodiment, a simplified, multiplication-free, lightweight first preset hash algorithm is used to iteratively hash the five ordered bytes in the first input sequence S. Each iteration process involves only XOR operations, reducing the number of iteration steps and eliminating multiplication, thus significantly reducing computational overhead.

[0092] Specifically, step 131 above may include:

[0093] Step 1311: Assign the first preset hash value to the initial hash value of the current iteration;

[0094] Step 1312: Based on the first preset lightweight hash algorithm, perform hash processing on the initial hash value of the current iteration and the current ordered byte in the first input sequence to obtain the target hash value corresponding to the current ordered byte;

[0095] Step 1313: Determine the target hash value of the current ordered byte as the initial hash value for the next ordered byte, and repeat the above process until all ordered bytes in the first input sequence have been traversed;

[0096] Step 1314: Generate the first authentication code based on the target hash value corresponding to the last ordered byte in the first input sequence.

[0097] In this embodiment, a first preset hash value is assigned to the initial hash value of the current iteration (as the starting hash value of the current ordered byte processed in the current iteration). Each iteration is a process of updating the initial hash value of the current ordered byte to obtain the target hash value of the current ordered byte. The target hash value of the current ordered byte is then used as the initial hash value of the next ordered byte in the next iteration, and the initial hash value of the next ordered byte is updated based on the first preset lightweight hash algorithm. This process continues until all ordered bytes in the first input sequence have been traversed in order, at which point the iteration stops.

[0098] Specifically, the first preset hash value can be used as the initial hash value of the first ordered byte in the first input sequence, and the initial hash value and the first ordered byte can be processed in the first iteration based on the first preset lightweight hash algorithm to obtain the target hash value of the first ordered byte.

[0099] Furthermore, the target hash value of the first ordered byte is used as the initial hash value of the second ordered byte in the first input sequence. Based on the first preset lightweight hash algorithm, the initial hash value of the second ordered byte and the second ordered byte are processed in a second iteration to obtain the target hash value of the second ordered byte. The above process is performed on the other ordered bytes in the first input sequence until all 5 ordered bytes in the first input sequence have been traversed, and then the iteration stops. At this point, the final first authentication code can be generated based on the target hash value of the eighth ordered byte in the first input sequence.

[0100] In an optional embodiment of the present invention, step 1312 above may include:

[0101] Step 13121: Perform a bitwise XOR operation on the initial hash value of the current iteration and the current ordered byte to obtain the first updated hash value of the current ordered byte;

[0102] Step 13122: Based on preset constraints, preprocess the first update hash value to obtain the second update hash value of the current ordered bytes;

[0103] Step 13123: Perform a second bitwise XOR operation on the first updated hash value and the second updated hash value to obtain the target hash value of the current ordered bytes.

[0104] In this embodiment, the initial hash value of the current iteration can be represented as: The currently ordered byte can be represented as B[i]; a bitwise XOR operation is performed on the initial hash value of the current iteration and the currently ordered byte, which can be specifically represented as: ;in, This represents the first updated hash value, and i represents the iteration order of the current iteration (which also represents the i-th ordered byte in the first input sequence). =f( In this formula, the equal sign "=" indicates assignment. This represents the target hash value corresponding to the (i-1)th ordered byte in the first input sequence after the last iteration. i = 1, 2, 3, ..., m are positive integers. When i equals 1, it represents the first iteration, and the initial hash H1 value of the first ordered byte B[1] is the first preset hash value.

[0105] Furthermore, the first update hash value The overall logic is shifted left by 8 bits (specifically, it can be represented as...) ); where the first update hash value The lowest 8 bits are padded with 0s to obtain the second updated hash value. ;

[0106] Furthermore, for the first updated hash value and the second updated hash value Performing a second bitwise XOR operation can be specifically represented as: ;in, This represents the target hash value of the currently ordered bytes.

[0107] Here, the two bitwise XOR operations only apply to the lower 8 bits of the hash value, while the higher 24 bits remain unchanged. By processing the hash value using bitwise XOR operations, multiplication operations are avoided, thereby reducing computational complexity and thus reducing the computing power and power consumption of IoT terminal devices.

[0108] In an optional embodiment of the present invention, step 1314 above may include:

[0109] Step 13141: Perform a transformation on the target hash value corresponding to the last ordered byte in the first input sequence to obtain the first transformed number string;

[0110] Step 13142: Perform a modulo operation on the first converted number string to obtain the number string after the modulo operation;

[0111] Step 13143: Perform a second transformation on the number string after the modulo operation to obtain a second transformed number string, and use the second transformed number string as the first authentication code.

[0112] Here, both the first and second conversion processes are decimal conversions. A conversion is performed on the 32-bit target hash value corresponding to the last ordered byte in the first input sequence to obtain the corresponding decimal integer, which is the first converted number string. Further, a modulo operation is performed on the first converted number string, fixed at 10. 6 (i.e., 1000000) modulo 1000000 to get an integer between 0 and 999999, which is the number string after the modulo operation. Furthermore, the number string after the modulo operation is converted into a decimal number string. If it is less than 6 bits, the high bits are padded with 0 to get the final first authentication code, so that the edge gateway can verify it.

[0113] To further illustrate the feasibility of this invention, the following will describe in detail the specific generation process of the first authentication code, taking into account the application scenario of an 8-bit MCU-driven NB-IoT temperature and humidity sensor (IoT terminal) accessing an IoT network. The specific process is as follows:

[0114] Step 21, Instance Parameters:

[0115] Identification information ID (8-bit) of the NB-IoT temperature and humidity sensor driven by an 8-bit MCU: 0x12;

[0116] First timestamp T (32-bit): 2026-05-07 00:10:00, encoded as 32-bit hexadecimal: 0x69FBCEF8 (parameters remain unchanged);

[0117] Access demand count value C (8 bits): 0x0A;

[0118] First preset hash value: 0x0000811C

[0119] Step 22, concatenate and generate the first input sequence S:

[0120] Step 221: Concatenate the bytes in the order of "ID∥T∥C" to obtain the first 48-bit consecutive byte sequence;

[0121] Step 222: After splitting the first consecutive byte sequence in order from most significant byte to least significant byte, we obtain 5 ordered bytes, as follows:

[0122] The first ordered byte B[1] = 0x69, the second ordered byte B[2] = 0xFB, the third ordered byte B[3] = 0xCE, the fourth ordered byte B[4] = 0XF8, and the fifth ordered byte B[5] = 0x0A;

[0123] Step 23: Based on the first preset lightweight hash algorithm, perform byte-by-byte iterative hashing on multiple ordered bytes in the first input sequence (specifically, 5 iterations, each of which is a 32-bit operation):

[0124] The first preset hash value is assigned to the initial hash value required for the first iteration, which is H1=0x0000811C. The ordered bytes in the first input sequence are subjected to a byte-by-byte "XOR → left shift 8 bits → XOR" iterative process, as follows:

[0125] Step 231, perform hash processing on the first ordered byte B[1]=0x69:

[0126]

[0127]

[0128]

[0129] Step 232, perform hash processing on the second ordered byte B[2]=0xFB:

[0130]

[0131]

[0132]

[0133] Step 233, perform hash processing on the third ordered byte B[3]=0xCE:

[0134]

[0135]

[0136]

[0137] Step 234, perform hash processing on the fourth ordered byte B[4]=0xF8:

[0138]

[0139] F3AB800

[0140] 0xF40F3AB8⊕0x0F3AB800=0xFB3582B8

[0141] Step 235, perform hash processing on the fifth ordered byte B[5]=0x0A:

[0142]

[0143]

[0144] CEB730B2

[0145] Step 24, update the hash value based on ordered bytes. Generate a 6-digit first authentication code:

[0146] Step 241, convert the 32-bit data... ( The first converted number string (3467733170) is converted from CEB730B2 to a decimal integer.

[0147] Step 242: Perform a modulo operation on the first converted number string: 3467733170 mod 1000000, to obtain the modulo-derived number string 733170;

[0148] Step 243: Perform decimal conversion on the modulo-derived number string and output the final first authentication code 733170;

[0149] The above embodiments of the present invention provide an access authentication method applied to the IoT terminal side. When generating the first authentication code, BeiDou time synchronization is used as the only reliable time source, combined with an 8-bit lightweight terminal ID (randomly fixed to ensure uniqueness) and an 8-bit access requirement count value, so that the generated first authentication code is unique. This prevents common IoT attacks such as replay attacks, time tampering, and device forgery from the root, thereby improving the security of subsequent access authentication. Moreover, the entire process of generating the first authentication code involves only basic logical operations such as XOR and left shift by 8 bits, without multiplication, division, or floating-point operations. This allows an IoT terminal with an 8-bit MCU to complete the hash iteration in a single cycle. Furthermore, the first authentication code generation latency is less than 300μs, memory usage is less than 256B, and power consumption is less than 0.8mW, thereby reducing the computing power and power consumption of the IoT terminal.

[0150] See Figure 3 The embodiments of the present invention also provide an IoT terminal access authentication method based on BeiDou time synchronization, applied to the edge gateway side, including:

[0151] Step 31: Receive the current access request, first timing information, first authentication code, and access request count value sent by the IoT terminal; the access request count value is dynamically generated based on the current access request triggered by the IoT terminal.

[0152] Step 32: Receive the second timing information sent by the BeiDou satellite system based on the current access requirements;

[0153] Step 33: Verify the first authentication code based on the first timing information and the second timing information;

[0154] Step 34: In response to a successful verification, a second authentication code is generated based on the access demand count, the second timing information, the IoT terminal identification information pre-stored in the edge gateway, the second preset lightweight hash algorithm, and the second preset hash value.

[0155] Step 35: Perform a second verification on the first authentication code based on the second authentication code, and send the verification result obtained from the second verification to the IoT terminal so that the IoT terminal can access the IoT network through the edge gateway in response to the verification result.

[0156] See Figure 2 When an IoT terminal needs to access the IoT network, it will synchronously send the generated access request to the edge gateway (the current access request can carry IoT terminal identification information, so as to match it with the identification information pre-stored in the edge gateway when generating the second authentication code later); after generating the first authentication code, the IoT terminal will synchronously send the first timing information, the first authentication code, and the access request count value to the edge gateway; after receiving the current access request, the edge gateway will synchronously receive the second timing information sent by the Beidou satellite system based on the second timing module set in it, and at the same time extract the current 32-bit UTC millisecond-level second timestamp of the second timing information. ; and based on the second timestamp The first authentication code is verified against the first timestamp T. Specifically:

[0157] The difference between the second timestamp and the first timestamp is calculated and compared with a threshold range. If the difference exceeds the threshold range, the verification fails, and a verification result indicating failure is generated and sent back to the IoT terminal. If the difference is within the threshold range (i.e., ...), the verification fails. ),Should If the threshold range is met, then the first verification is successful, and a second verification is performed on the first authentication code.

[0158] During the secondary verification, the edge gateway first generates a second authentication code based on the access demand count, the second timing information, the IoT terminal identification information pre-stored in the edge gateway, the second preset lightweight hash algorithm, and the second preset hash value. Then, the first authentication code is verified based on the second authentication code. If the second authentication code matches the first authentication code, the secondary verification passes, and a verification result indicating successful verification is generated and fed back to the IoT terminal. Otherwise, a verification result indicating failed verification is generated and fed back to the IoT terminal.

[0159] Here, the second preset lightweight hash algorithm is the same as the first preset lightweight hash algorithm on the IoT terminal side, and the second preset hash value is the same as the first preset hash value. Preferably, the second preset hash value can be the first preset hash value sent by the IoT terminal; furthermore, step 34 above may include:

[0160] Step 341: Generate a second input sequence based on the access demand count, the second timing information, and the IoT terminal identification information pre-stored in the edge gateway;

[0161] Step 342: Generate a second authentication code based on the second preset lightweight hash algorithm, the second preset hash value, and the second input sequence.

[0162] Here, the specific process of generating the second input sequence and generating the second authentication code based on the second input sequence is the same as the specific process on the IoT terminal side described above (the only difference is that the timestamp for generating the second input sequence is different), and will not be repeated here.

[0163] On the edge gateway side, a second authentication code is generated based on a second preset hash algorithm, which is the same as the first preset lightweight hash algorithm. On the edge gateway side, BeiDou time synchronization is used as the only trusted time source. Combined with the 8-bit lightweight device ID and 8-bit access requirement count value sent by the IoT terminal, a unique second authentication code is generated. This prevents common IoT attacks such as replay attacks, time tampering, and device forgery from the root. It avoids the risks of key distribution and leakage, and simplifies the design while improving authentication security. In addition, it also simplifies the verification process and improves verification efficiency.

[0164] The IoT terminal access authentication method provided by the above embodiments of the present invention deeply integrates the high precision and tamper-proof characteristics of BeiDou time synchronization into the core process of authentication code generation on both the terminal side and the gateway side. This differs from the "assisted positioning" of existing BeiDou-related solutions, achieving deep integration of BeiDou time synchronization and authentication code generation. This fully leverages the spatiotemporal reliability value of the BeiDou satellite system and facilitates the promotion and application of the BeiDou system. At the same time, BeiDou time synchronization supports a dynamic time window of ±1s, adapting to latency issues caused by network fluctuations, ensuring high reliability, and adapting to complex environments.

[0165] Furthermore, when generating authentication codes on both the terminal and gateway sides, the entire process involves only basic logical operations such as XOR and left shift by 8 bits, without redundant operations such as multiplication, division, and floating-point operations. This reduces the computing power and power consumption of the terminal and gateway, while improving verification efficiency. When generating authentication codes on both sides, there is no need to distribute or maintain pre-shared keys between the IoT terminal and the edge gateway, and there is no need to build a CA certificate center. The terminal can be plugged and played with an 8-bit ID fixed at the factory, and the gateway side can also store only the 8-bit ID, simplifying storage and management. This is suitable for large-scale deployment of massive IoT terminals and further reduces deployment and maintenance costs.

[0166] like Figure 4 As shown, an embodiment of the present invention also provides an Internet of Things (IoT) terminal 40, comprising:

[0167] The first BeiDou timing module 41 is used to receive the first timing information sent by the BeiDou satellite system based on the current access requirements;

[0168] The first processing module 42 is used to generate a first input sequence based on the first timing information, IoT terminal identification information, and access demand count value; the access demand count value is dynamically generated based on the current access demand triggered by the IoT terminal; and to generate a first authentication code based on the first preset lightweight hash algorithm, the first preset hash value, and the first input sequence.

[0169] The first transceiver module 43 is used to receive the verification result sent by the edge gateway. The verification result is generated by the edge gateway after verifying the first authentication code sent by the IoT terminal.

[0170] The second processing module 44 is used to respond to the verification result indicating that the verification has passed and to access the Internet of Things network through the edge gateway.

[0171] It should be noted that the IoT terminal is the terminal corresponding to the access authentication method applied to the IoT terminal side described above. All implementation methods in the above-described access authentication method applied to the IoT terminal side are applicable to the embodiments of this IoT terminal and can achieve the same technical effect.

[0172] Embodiments of the present invention also provide an edge gateway, comprising:

[0173] The second transceiver module is used to receive the current access request, the first timing information, the first authentication code, and the access request count value sent by the IoT terminal; the access request count value is dynamically generated based on the current access request triggered by the IoT terminal.

[0174] The second BeiDou timing module receives the second timing information sent by the BeiDou satellite system based on the current access requirements;

[0175] The processing module is used to perform a first verification on the first authentication code based on the first timing information and the second timing information; in response to the first verification being successful, it generates a second authentication code based on the access demand count value, the second timing information, the IoT terminal identification information pre-stored in the edge gateway, the second preset lightweight hash algorithm, and the second preset hash value; it performs a second verification on the first authentication code based on the second authentication code, and sends the verification result obtained from the second verification to the IoT terminal through the second transceiver module, so that the IoT terminal can access the IoT network through the edge gateway in response to the verification result indicating that the verification is successful.

[0176] It should be noted that the edge gateway is the gateway corresponding to the access authentication method applied to the edge gateway side described above. All implementation methods in the above-described access authentication method applied to the edge gateway side are applicable to the edge gateway embodiment and can achieve the same technical effect.

[0177] like Figure 5 As shown, an embodiment of the present invention also provides a communication device 50, including: a memory 51 for storing one or more computer programs; and one or more processors 52 for executing the one or more computer programs. When the computer programs are run by the processors, they execute the above-described IoT terminal access authentication method based on BeiDou timing applied to the IoT terminal side or the IoT terminal access authentication method based on BeiDou timing applied to the edge gateway side. All implementations in the above method embodiments are applicable to this embodiment and can achieve the same technical effect.

[0178] Embodiments of the present invention also provide a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the aforementioned IoT terminal access authentication method based on BeiDou time synchronization applied to the IoT terminal side or the IoT terminal access authentication method based on BeiDou time synchronization applied to the edge gateway side. All implementations in the above method embodiments are applicable to this embodiment and can achieve the same technical effects.

[0179] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0180] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0181] In the embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0182] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0183] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0184] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0185] Furthermore, it should be noted that in the apparatus and method of the present invention, it is obvious that the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered equivalent solutions of the present invention. Moreover, the steps performing the above series of processes can naturally be executed in the order described, but are not necessarily required to be executed in chronological order; some steps can be executed in parallel or independently of each other. Those skilled in the art will understand that all or any step or component of the method and apparatus of the present invention can be implemented in any computing device (including processors, storage media, etc.) or network of computing devices, in hardware, firmware, software, or a combination thereof. This is something that those skilled in the art can achieve by using their basic programming skills after reading the description of the present invention.

[0186] Therefore, the object of the present invention can also be achieved by running a program or a set of programs on any computing device. The computing device can be a known general-purpose device. Therefore, the object of the present invention can also be achieved simply by providing a program product containing program code for implementing the method or apparatus. That is, such a program product also constitutes the present invention, and the storage medium storing such a program product also constitutes the present invention. Obviously, the storage medium can be any known storage medium or any storage medium developed in the future. It should also be noted that in the apparatus and method of the present invention, it is obvious that the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered equivalent to the present invention. Furthermore, the steps for performing the above series of processes can naturally be performed in the order described, but are not necessarily required to be performed in chronological order. Some steps can be performed in parallel or independently of each other.

[0187] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for authenticating IoT terminal access based on BeiDou time synchronization, characterized in that, Applications in IoT terminals, including: Receive the first timing information sent by the BeiDou satellite system based on the current access requirements; Based on the first timing information, IoT terminal identification information, and access demand count value, a first input sequence is generated; the access demand count value is dynamically generated based on the current access demand triggered by the IoT terminal. A first authentication code is generated based on a first preset lightweight hash algorithm, a first preset hash value, and the first input sequence; The system receives a verification result sent by an edge gateway, which is generated by the edge gateway after verifying the first authentication code sent by the IoT terminal. The verification result indicates that the verification passed, and the device is connected to the IoT network through the edge gateway.

2. The IoT terminal access authentication method based on BeiDou time synchronization according to claim 1, characterized in that, Based on the first timing information, the IoT terminal identification information, and the access demand count value, a first input sequence is generated, including: Based on a first preset order, the first timing information, the IoT terminal identification information, and the access demand count value are concatenated to obtain a first continuous byte sequence. Based on a second preset order, the first continuous byte sequence is split to obtain the first input sequence, which includes multiple ordered bytes.

3. The IoT terminal access authentication method based on BeiDou time synchronization according to claim 1, characterized in that, Based on a first preset lightweight hash algorithm, a first preset hash value, and the first input sequence, a first authentication code is generated, including: Based on the first preset lightweight hash algorithm and the first preset hash value, a byte-by-byte iterative hashing process is performed on multiple ordered bytes in the first input sequence to generate the first authentication code; the number of iterations in the iterative hashing process is equal to the number of ordered bytes in the first input sequence.

4. The IoT terminal access authentication method based on BeiDou time synchronization according to claim 3, characterized in that, Based on the first preset lightweight hash algorithm and the first preset hash value, a byte-by-byte iterative hashing process is performed on multiple ordered bytes in the first input sequence to generate the first authentication code, including: Assign the first preset hash value to the initial hash value of the current iteration; Based on the first preset lightweight hash algorithm, the initial hash value of the current iteration and the current ordered byte in the first input sequence are hashed to obtain the target hash value corresponding to the current ordered byte; The target hash value of the current ordered byte is determined as the initial hash value for the next ordered byte to be hashed, and the above process is repeated until all ordered bytes in the first input sequence have been traversed; The first authentication code is generated based on the target hash value corresponding to the last ordered byte in the first input sequence.

5. The IoT terminal access authentication method based on BeiDou time synchronization according to claim 4, characterized in that, Based on the first preset lightweight hash algorithm, the initial hash value of the current iteration and the current ordered byte in the first input sequence are hashed to obtain the target hash value corresponding to the current ordered byte, including: Perform a bitwise XOR operation on the initial hash value of the current iteration and the current ordered byte to obtain the first updated hash value of the current ordered byte; Based on preset constraints, the first update hash value is preprocessed to obtain the second update hash value of the current ordered bytes; Perform a second bitwise XOR operation on the first updated hash value and the second updated hash value to obtain the target hash value of the current ordered bytes.

6. The IoT terminal access authentication method based on BeiDou time synchronization according to claim 4, characterized in that, Based on the target hash value corresponding to the last ordered byte in the first input sequence, the first authentication code is generated, including: Perform a transformation on the target hash value corresponding to the last ordered byte in the first input sequence to obtain the first transformed number string; Perform a modulo operation on the first converted number string to obtain the number string after the modulo operation; The number string after the modulo operation is subjected to a second transformation to obtain a second transformed number string, and the second transformed number string is used as the first authentication code.

7. An Internet of Things (IoT) terminal, characterized in that, include: The first BeiDou timing module is used to receive the first timing information sent by the BeiDou satellite system based on the current access requirements; The first processing module is used to generate a first input sequence based on the first timing information, IoT terminal identification information, and access demand count value; the access demand count value is dynamically generated based on the current access demand triggered by the IoT terminal. A first authentication code is generated based on a first preset lightweight hash algorithm, a first preset hash value, and the first input sequence; The first transceiver module is used to receive the verification result sent by the edge gateway. The verification result is generated by the edge gateway after verifying the first authentication code sent by the IoT terminal. The second processing module is used to respond to the verification result indicating that the verification has passed, and to access the Internet of Things network based on the edge gateway.

8. A method for authenticating IoT terminal access based on BeiDou time synchronization, characterized in that, Applied to edge gateways, including: The device receives the current access request, first timing information, first authentication code, and access request count value sent by the IoT terminal; the access request count value is dynamically generated based on the current access request triggered by the IoT terminal. Based on the current access requirements, receive the second timing information sent by the BeiDou satellite system; Based on the first timing information and the second timing information, the first authentication code is verified once; In response to a successful verification, a second authentication code is generated based on the access demand count value, the second timing information, the IoT terminal identification information pre-stored in the edge gateway, the second preset lightweight hash algorithm, and the second preset hash value. The first authentication code is verified a second time based on the second authentication code, and the verification result obtained from the second verification is sent to the IoT terminal so that the verification is successful in response to the verification result, and the IoT terminal accesses the IoT network through the edge gateway.

9. The IoT terminal access authentication method based on BeiDou time synchronization according to claim 8, characterized in that, Based on the access demand count, the second timing information, the IoT terminal identification information pre-stored in the edge gateway, the second preset lightweight hash algorithm, and the second preset hash value, a second authentication code is generated, including: Based on the access demand count, the second timing information, and the IoT terminal identification information pre-stored in the edge gateway, a second input sequence is generated; A second authentication code is generated based on a second preset lightweight hash algorithm, a second preset hash value, and the second input sequence.

10. An edge gateway, characterized in that, include: The second transceiver module is used to receive the current access request, the first timing information, the first authentication code, and the access request count value sent by the IoT terminal. The access demand count is dynamically generated based on the current access demand triggered by the IoT terminal; The second BeiDou timing module receives the second timing information sent by the BeiDou satellite system based on the current access requirements. The processing module is used to perform a verification on the first authentication code based on the first timing information and the second timing information; In response to a successful verification, a second authentication code is generated based on the access demand count value, the second timing information, the IoT terminal identification information pre-stored in the edge gateway, the second preset lightweight hash algorithm, and the second preset hash value. The first authentication code is verified a second time based on the second authentication code, and the verification result obtained from the second verification is sent to the IoT terminal through the second transceiver module, so that the verification result indicates that the verification is successful, and the IoT terminal accesses the IoT network through the edge gateway.

Images