Iot gateway authentication method and system based on multi-terminal access

Abstract

The application provides a kind of based on multi-terminal access Internet of Things gateway authentication method and system, it is related to Internet of Things security and terminal authentication technical field, after gateway receives terminal network access authentication request, terminal equipment identifier is carried out equipment identity mirror association processing and generates the request source mark data carrying source mark;According to the source mark, extract the preset identity token from the terminal identity token binding relationship table, and generate a one-time challenge vector by mixing and transforming with the current gateway clock signal and send to the terminal equipment;After receiving terminal response data, extract terminal response feature string and terminal operating environment snapshot data, use preset identity token to verify the consistency of response source, and carry out access risk multidimensional fusion evaluation based on environment snapshot data;According to the evaluation result and terminal identifier, generate network access permission certificate and issue to terminal equipment.The application realizes the adaptive time limit authentication of identity and environment dual perception in multi-terminal access scene.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) security and terminal authentication technology, and more specifically, to an IoT gateway authentication method and system based on multi-terminal access. Background Technology

[0002] The rapid development of IoT technology has driven the demand for massive numbers of terminal devices to access networks. As the core hub connecting terminal devices and cloud services, the IoT gateway undertakes the critical functions of terminal device authentication and network access control. In practical applications, IoT gateways often need to simultaneously accept network access requests from multiple terminal devices of different types and protocols. These terminal devices may be in different operating environments with varying security states. If the gateway adopts a uniform authentication policy for all network access requests, it is highly vulnerable to threats such as malicious terminal spoofing, replay attacks, and security vulnerabilities exploited due to a lack of environmental awareness, seriously threatening the overall security of the IoT system.

[0003] Currently, IoT gateway terminal authentication methods mainly rely on pre-shared keys or digital certificate mechanisms. Pre-shared key schemes typically pre-configure a fixed key at the terminal's factory, and the gateway verifies identity by comparing the key reported by the terminal. However, in such schemes, the key is a static value; if leaked, all terminals using the same key are at risk of being impersonated, and it's impossible to distinguish the behavioral differences of the same terminal accessing the network at different times and in different environments. While digital certificate schemes offer stronger identity binding capabilities, in scenarios with multiple terminals accessing concurrently, the gateway needs to perform a complete certificate chain verification process for each terminal, resulting in huge computational overhead and making it difficult to meet the stringent timeliness requirements of low-power IoT terminals. Furthermore, existing technologies typically only focus on the legitimacy of the terminal's identity during the authentication process, neglecting the perception and assessment of the terminal's current operating environment. This fails to identify potential risks when a terminal, despite holding a legitimate identity, is operating in an abnormal environment, leading to a significant discrepancy between the authentication result and the actual access risk.

[0004] Furthermore, most gateway authentication processes in existing technologies adopt a fixed-time access permission mechanism, that is, after authentication, the terminal is granted network access permission within a fixed time window. This fails to adaptively adjust the time constraint of the access permission according to the risk level dynamically assessed in each authentication process. As a result, high-risk terminals may obtain excessively long access time windows, while the access efficiency of low-risk terminals is not fully optimized, making it difficult to achieve a dynamic balance between security and efficiency. Summary of the Invention

[0005] In view of the aforementioned problems, and in conjunction with the first aspect of the present invention, embodiments of the present invention provide an IoT gateway authentication method based on multi-terminal access, the method comprising: After the target IoT gateway receives a network access authentication request from a terminal device, it performs device identity mirror association processing on the terminal device identifier carried in the network access authentication request to obtain terminal identity mirror data corresponding to the terminal device identifier, and performs request source marking processing on the terminal identity mirror data to generate request source mark data carrying the source mark. Based on the source tag contained in the request source tag data, a preset identity token bound to the source tag is extracted from the terminal identity token binding relationship table stored locally by the gateway. The preset identity token is then mixed and transformed with the current gateway clock signal output from the clock circuit of the target IoT gateway to generate a primary query vector. The primary query vector is then sent to the terminal device to trigger the terminal-side response generation operation. After receiving the terminal response data returned by the terminal device, the terminal response feature string and the terminal operating environment snapshot data are extracted from the terminal response data. The preset identity token is used to perform response source consistency verification processing on the terminal response feature string to obtain the response source consistency verification result. When the response source consistency verification result indicates that the response source is consistent, based on the source tag contained in the terminal operating environment snapshot data and the request source tag data, the access behavior of the terminal device is subjected to multi-dimensional fusion assessment of access risk, and an access risk assessment result is generated. Based on the access risk assessment results and the terminal device identifier, a network access license credential containing access license validity constraints is generated, and the network access license credential is issued to the terminal device to complete multi-terminal access authentication.

[0006] Furthermore, embodiments of the present invention also provide an IoT gateway authentication system based on multi-terminal access, comprising: A processor; a machine-readable storage medium for storing machine-executable instructions of the processor; wherein the processor is configured to execute the above-described IoT gateway authentication method based on multi-terminal access by executing the machine-executable instructions.

[0007] Based on the above, after the target IoT gateway receives the network access authentication request from the terminal device, it performs device identity mirroring association processing on the terminal device identifier to generate terminal identity mirror data, and performs request source marking processing on it to generate request source mark data carrying the source mark. This establishes an explicit binding relationship between the terminal identity and its request source at the beginning of the authentication process. Then, based on the request source mark, it extracts a pre-set identity token bound to the source mark from the terminal identity token binding relationship table stored locally on the gateway. This pre-set identity token is then mixed and transformed with the current gateway clock signal output by the gateway clock circuit to generate a primary query vector, which is sent to the terminal device. This ensures that each authentication challenge factor incorporates identity token information bound to a specific source and an unpredictable clock signal, effectively resisting replay attacks and spoofing access threats after token theft. After receiving the terminal response data returned by the terminal device, it extracts the terminal response feature string and the terminal operating environment sequence. Based on the data, and using a pre-set identity token to verify the consistency of the response source of the terminal response feature string, the system also performs a multi-dimensional fusion assessment of access risk based on the terminal's operating environment snapshot data and source markers. This ensures that the authentication process not only verifies the cryptographic consistency between the terminal response and the challenge factor, but also incorporates the terminal's current operating environment status into the risk assessment dimension, achieving a leap from single identity verification to a dual-awareness authentication paradigm of identity and environment. Finally, based on the access risk assessment results and the terminal device identifier, a network access license credential containing access license validity constraints is generated and issued to the terminal device. This allows the validity period of the access license to dynamically adapt to the risk level assessed in the current authentication process. High-risk terminals receive access licenses with limited validity periods, while low-risk terminals receive relatively lenient access licenses. This achieves an adaptive dynamic balance between security and access efficiency, significantly improving the authentication security, environmental awareness, and access management refinement of the IoT gateway in multi-terminal concurrent access scenarios. Attached Figure Description

[0008] Figure 1 This is a schematic diagram of the execution flow of the IoT gateway authentication method based on multi-terminal access provided in an embodiment of the present invention.

[0009] Figure 2 This is a logical schematic diagram of the IoT gateway authentication method based on multi-terminal access provided in an embodiment of the present invention.

[0010] Figure 3 This is a schematic diagram of exemplary hardware and software components of an IoT gateway authentication system based on multi-terminal access provided in an embodiment of the present invention. Detailed Implementation

[0011] Figure 1This is a flowchart illustrating an IoT gateway authentication method based on multi-terminal access provided in an embodiment of the present invention. The following is a summary of the process. Figure 2 A detailed introduction is provided. This embodiment applies the entire technical solution to a scenario where an IoT gateway deployed in an industrial plant performs network access authentication for multiple sensor terminals. The target IoT gateway, designated G1, manages the network access of dozens of terminal devices within the plant, including temperature sensors, vibration sensors, and pressure sensors. The network access authentication process for all terminal devices follows this method, and the authentication data is processed by the gateway's built-in security processing unit, without involving the collection or transmission of personal privacy information.

[0012] Step S110: After the target IoT gateway receives the network access authentication request from the terminal device, it performs device identity mirror association processing on the terminal device identifier carried in the network access authentication request to obtain the terminal identity mirror data corresponding to the terminal device identifier, and performs request source marking processing on the terminal identity mirror data to generate request source mark data carrying the source mark.

[0013] After receiving a network access authentication request from a temperature sensor terminal numbered T01 via its terminal communication interface, the target IoT gateway G1 extracts the terminal device identifier from the request line and header of the request. The terminal device identifier is a string consisting of a terminal type code and a unique terminal serial number. Using this identifier, the target IoT gateway G1 retrieves the corresponding terminal identity image data from its locally stored terminal identity image database. Upon finding the terminal identity image data, the target IoT gateway G1 reads the current gateway clock signal from its own clock circuit and, combining this with the terminal access history summary field and the terminal communication capability description field from the terminal identity image data, generates a request source tag. This request source tag is then appended to the terminal identity image data, encapsulating it into request source tag data carrying the source tag.

[0014] Step S111: Extract the gateway device factory-fixed serial number and the gateway private identification key from the non-volatile storage area of ​​the target IoT gateway, wherein the gateway device factory-fixed serial number and the gateway private identification key are associated and bound together and stored in the non-volatile storage area during the factory deployment phase of the target IoT gateway.

[0015] The non-volatile storage area of ​​the target IoT gateway G1 is a dedicated secure storage chip that stores the gateway device's factory-installed serial number SN1 and the gateway's private identification key K1. The gateway device's factory-installed serial number SN1 is an unchangeable hardware identifier consisting of a string of numbers and letters. The gateway's private identification key K1 is a 256-bit binary sequence generated by a secure random number generator. SN1 and K1 are associated and bound during the target IoT gateway G1's factory deployment phase using a key injection tool, and the association and binding information is simultaneously stored in a protected partition of the secure storage chip.

[0016] Step S112: Parse the request header data of the network access authentication request, extract the terminal type encoding field and the terminal unique serial number field corresponding to the terminal device identifier, and combine the terminal type encoding field and the terminal unique serial number field into a terminal identifier tuple.

[0017] The network access authentication request uses a message format based on the Constraint Application Protocol. The target IoT gateway G1 parses the request header data of this network access authentication request and locates the option field containing the terminal device identifier field. From this option field, it extracts the terminal type code field, whose value represents the type code of the temperature sensor; it also extracts the terminal unique serial number field, whose value is the unique serial number burned into the temperature sensor at the factory. The terminal type code field and the terminal unique serial number field are concatenated in sequence, separated by a colon, to form a terminal identifier tuple.

[0018] Step S113: Using the terminal identifier tuple as the index key, query the terminal identity image data that matches the index key from the terminal identity image library stored locally by the target IoT gateway. The terminal identity image library stores the identity image data of registered terminals, and each piece of identity image data includes a terminal communication capability description field and a terminal access history summary field.

[0019] The terminal identity image database is a key-value pair storage structure, with the hash value of the terminal identifier tuple as the key and the terminal identity image data as the value. The terminal identity image data contains two main fields: a terminal communication capability description field, which stores parameters such as the supported communication protocol version, maximum transmit power, supported frequency band list, and maximum data packet length; and a terminal access history summary field, which stores the timestamp sequence of the terminal's historical accesses, the signal strength value of each access, and the statistical distribution of access failure reason codes. The target IoT gateway G1 calculates the hash value of the terminal identifier tuple, searches for a record matching this hash value in the terminal identity image database, and extracts the corresponding terminal identity image data.

[0020] Step S114: Perform load feature comparison processing on the terminal communication capability description field in the terminal identity image data and the access request load data carried in the network access authentication request to obtain the load feature comparison result. The load feature comparison result includes a communication capability matching degree marker and a load anomaly marker.

[0021] The terminal communication capability description field records the maximum data packet length and communication protocol version declared during the terminal device's registration. The target IoT gateway G1 extracts the actual data packet length and actual communication protocol version identifier from the access request payload data of the network access authentication request. The communication capability matching score is calculated as follows: if the actual data packet length is less than or equal to the maximum data packet length and the actual communication protocol version identifier matches the registered protocol version, the communication capability matching score is set to 1; otherwise, it is set to 0. The load anomaly score is generated as follows: if the access request payload data of the network access authentication request carries extended options not declared in the terminal communication capability description field, the load anomaly score is set to 1; otherwise, it is set to 0. The communication capability matching score and the load anomaly score are combined to form the load feature comparison result.

[0022] Step S115: Perform correlation analysis on the communication capability matching degree marker in the load feature comparison result and the terminal access history summary field in the terminal identity image data to generate an access behavior consistency marker, wherein the access behavior consistency marker is used to indicate the degree of deviation between the current network access authentication request and the terminal's historical access behavior.

[0023] The terminal access history summary field stores a sequence of access signal strength values ​​from several successful past accesses of the terminal device. The target IoT gateway G1 extracts the current access signal strength value from the access request payload data of the network access authentication request. The access behavior consistency flag is calculated as follows: the absolute value of the difference between the current access signal strength value and the mean of the signal strength value sequence in the terminal access history summary field is calculated, and then divided by the standard deviation of the signal strength value sequence to obtain the deviation multiple. If the deviation multiple exceeds a preset deviation threshold, the access behavior consistency flag is set to 0, indicating a large deviation; otherwise, it is set to 1, indicating a small deviation.

[0024] Step S116: Extract the clock count value from the current gateway clock signal output by the clock circuit of the target IoT gateway, and perform clock granularity division processing on the clock count value to generate a clock granularity sequence with a preset granularity unit.

[0025] The target IoT gateway G1's clock circuit is a high-precision temperature-compensated crystal oscillator, outputting a 64-bit clock count value with microsecond-level accuracy. The target IoT gateway G1 reads the clock count value of the current gateway clock signal and divides it according to a preset granularity unit. The preset granularity unit is milliseconds, and the division method is to divide the clock count value by 1000 and round down to obtain a clock granularity value in milliseconds. Multiple consecutively read clock granularity values ​​are arranged in the order they were read, generating a clock granularity sequence of a preset length.

[0026] Step S117: Combine and encapsulate the access behavior consistency flag, the load anomaly flag in the load feature comparison result, the clock granularity sequence, and the gateway private identifier key to generate a request source flag, and attach the request source flag to the terminal identity image data to generate request source flag data carrying the source flag.

[0027] The access behavior consistency flag, load anomaly flag, clock granularity sequence, and gateway private identifier key K1 are concatenated into a single byte string in sequence. A hash value is calculated for this byte string using the SHA-256 hash algorithm, and the hash output serves as the request source flag. This request source flag is then appended as a new field to the end of the terminal identity mirror data to generate request source flag data carrying the source flag.

[0028] Step S120: Based on the source tag contained in the request source tag data, extract the preset identity token bound to the source tag from the terminal identity token binding relationship table stored locally by the gateway, and perform a mixing transformation process on the preset identity token and the current gateway clock signal output from the clock circuit of the target IoT gateway to generate a primary query vector, and send the primary query vector to the terminal device to trigger the terminal-side response generation operation.

[0029] The target IoT gateway G1 uses the source tag in the request source tag data to find the pre-set identity token and generate a query vector.

[0030] Step S121: Parse the source tag contained in the request source tag data, and extract the storage index value of the terminal identity mirror data associated with the source tag and the request receiving context information, wherein the request receiving context information includes the request arrival timestamp and the request signal strength indication value.

[0031] The first few bits of the source tag store the storage index value of the terminal identity mirror data. The target IoT gateway G1 extracts this storage index value bit by bit from the source tag. The request reception context information is stored in the following few bits of the source tag, including the request arrival timestamp, i.e., the time when the target IoT gateway G1 received the network access authentication request, and the request signal strength indication value, i.e., the received signal strength measured by the radio frequency receiving module of the target IoT gateway G1.

[0032] Step S122: Using the storage index value as the query key, perform token lookup processing on the terminal identity token binding relationship table stored locally by the gateway, and extract the preset identity token corresponding to the storage index value, wherein the preset identity token includes a token body data segment and a token validity period flag field.

[0033] The terminal identity token binding relationship table is a key-value pair storage structure, with the storage index as the key and the preset identity token as the value. The token body data segment of the preset identity token is a 128-bit random binary sequence, generated by the target IoT gateway G1 during terminal registration and securely distributed to the terminal device. The token validity period field contains the valid start time and valid end time, stored in Unix timestamp format.

[0034] Step S123: Perform timeliness determination processing on the token validity period marker field, extract the valid start time and valid end time from the token validity period marker field, and compare the current gateway clock signal with the valid start time and valid end time in terms of time range to generate a token validity determination result.

[0035] Extract the valid start time Tstart and valid end time Tend from the token validity period flag field. Read the current time Tnow of the current gateway clock signal from the clock circuit of the target IoT gateway G1. If Tnow is greater than or equal to Tstart and Tnow is less than or equal to Tend, the token validity period is determined to be valid; otherwise, it is invalid.

[0036] Step S124: When the token validity determination result indicates that the preset identity token is within the validity period, extract the clock count value from the current gateway clock signal output by the clock circuit of the target IoT gateway, and perform clock granularity division processing on the clock count value to generate a clock granularity sequence with a preset granularity unit.

[0037] When the token validity determination result is valid, a new clock granularity sequence is generated using the same method as in step S116. The length of this clock granularity sequence is the same as the length of the clock granularity sequence generated in step S116.

[0038] Step S125: Input the token body data segment and the clock granularity sequence into a single-invertible mixing function for mixing transformation to generate a first-order query vector, wherein the output sequence of the single-invertible mixing function maintains a verifiable one-way mapping relationship with the token body data segment and the clock granularity sequence.

[0039] The one-time reversible hybrid function employs a key hash message authentication code (HMAC) algorithm, using the token body data segment as the message input and the clock granularity sequence as the key input. The output of the HMAC algorithm is a fixed-length message authentication code. This message authentication code is used as a first-order query vector. This first-order query vector maintains a verifiable one-way mapping relationship with the token body data segment and the clock granularity sequence. That is, a terminal device with the same token body data segment and the same clock granularity sequence can verify the correctness of the first-order query vector, but cannot deduce the token body data segment from the first-order query vector.

[0040] Step S126: Perform vector length verification and vector randomness evaluation on the first-order query vector to obtain a vector quality evaluation result. When the vector quality evaluation result meets the preset conditions, encapsulate the first-order query vector, the token validity period flag field, and the request receiving context information into a query request message data packet, and send the query request message data packet to the terminal device through the terminal communication interface of the target IoT gateway to trigger the terminal-side response generation operation.

[0041] The vector length check verifies whether the bit length of the primary query vector is equal to the preset length. Vector randomness evaluation employs frequency and run-length tests to calculate the frequency of 0s and 1s in the primary query vector and the run-length distribution of consecutive identical bits. If the statistics of both the frequency and run-length tests are within the preset acceptable range, the vector quality evaluation result meets the preset conditions. The primary query vector, token validity period flag field, and request reception context information are encapsulated in TLV format into a query request message data packet and sent to the temperature sensor terminal T01 through the RF transmission module of the terminal communication interface of the target IoT gateway G1.

[0042] Step S130: After receiving the terminal response data returned by the terminal device, extract the terminal response feature string and the terminal operating environment snapshot data from the terminal response data, and use the preset identity token to perform response source consistency verification processing on the terminal response feature string to obtain the response source consistency verification result.

[0043] After receiving the challenge request message data packet, the temperature sensor terminal T01 performs a terminal-side response generation operation, generates terminal response data, and sends it back to the target IoT gateway G1. Upon receiving the terminal response data, the target IoT gateway G1 performs the following processing.

[0044] Step S131: Parse the message body structure of the terminal response data, locate the response feature string storage field and the runtime environment snapshot storage field from the message body structure, extract the terminal response feature string from the response feature string storage field, and extract the terminal runtime environment snapshot data from the runtime environment snapshot storage field.

[0045] The terminal response data uses the same constraint application protocol message format as the network access authentication request. The message body structure contains multiple option fields. The target IoT gateway G1 locates the response feature string storage field and the runtime environment snapshot storage field according to the preset option number. The response feature string storage field stores the terminal response feature string, and the runtime environment snapshot storage field stores the terminal runtime environment snapshot data.

[0046] Step S132: Perform snapshot data deconstruction processing on the snapshot data of the terminal running environment to obtain the terminal memory segment feature sequence, the terminal running process list, and the terminal communication protocol stack version identifier.

[0047] The terminal operating environment snapshot data is structured data obtained by the temperature sensor terminal T01 taking a snapshot of its own operating environment at the moment it receives the challenge request message data packet. The snapshot data decomposition process, according to a preset data structure definition, parses the terminal operating environment snapshot data into three independent data blocks. The terminal memory segment feature sequence is a binary sequence recording the feature values ​​of several preset address ranges in the terminal device's memory. The terminal running process list is a list of process identifiers, recording the processes currently running on the terminal device. The terminal communication protocol stack version identifier is a string recording the version number of the communication protocol stack currently used by the terminal device.

[0048] Step S133: Perform memory segmentation processing on the terminal memory segment feature sequence, divide the terminal memory segment feature sequence into multiple memory block units according to a preset memory address range, and perform feature summary extraction processing on each memory block unit to generate a memory block feature summary corresponding to each memory block unit.

[0049] The preset memory address range is a series of consecutive memory address ranges within the terminal device's memory space. The memory segmentation process divides the terminal memory segment feature sequence into multiple memory block units based on the start and end addresses corresponding to each memory address range. For each memory block unit, a CRC32 algorithm is used to calculate a cyclic redundancy check code, which serves as the memory block feature digest for that memory block unit.

[0050] Step S134: Filter out the target process identifiers related to communication connection management from the terminal running process list, and extract the process execution path and process memory usage characteristic value corresponding to the target process identifier.

[0051] In the terminal's running process list, target process identifiers are filtered based on a preset list of process name keywords. This list includes name keywords for communication protocol stack processes, security authentication processes, and network management processes. For each filtered target process identifier, the process execution path (i.e., the storage path of the process's executable file in the terminal's file system) and the process memory usage characteristic value (i.e., the number of bytes of memory occupied by the process) are extracted from the extended fields of the terminal's runtime environment snapshot data.

[0052] Step S135: Perform version matching processing on the terminal communication protocol stack version identifier and the set of compatible protocol stack versions stored locally by the target IoT gateway to generate a protocol stack version matching result.

[0053] The target IoT gateway G1 stores a list of compatible protocol stack versions locally, containing the protocol stack version numbers supported by the target IoT gateway G1. The terminal communication protocol stack version identifier is compared with each version number in the compatible protocol stack version set. If an exact match exists between the terminal communication protocol stack version identifier and the compatible protocol stack version set, the protocol stack version matching result is a match; otherwise, it is a mismatch.

[0054] Step S136: Extract the stored preset identity token from the current session context of the target IoT gateway, and use the token body data segment in the preset identity token to perform a one-way reversible mapping inverse transformation on the terminal response feature string to obtain response restoration feature data.

[0055] The target IoT gateway G1 stores the preset identity token extracted in step S122 in its current session context. The token body data segment is extracted from the preset identity token. The unidirectional reversible mapping inverse transformation process uses the same HMAC algorithm as in step S125, taking the terminal response feature string as the message authentication code input and the token body data segment as the key to calculate the response restoration feature data. The response restoration feature data includes the restored value of the original challenge vector and the terminal-side processing timestamp.

[0056] Step S137: Parse the feature format of the response restoration feature data, extract the challenge vector restoration value and the terminal-side processing timestamp contained in the response restoration feature data, perform bit-by-bit comparison and verification processing between the challenge vector restoration value and the original challenge vector corresponding to the terminal response feature string, and generate a response source consistency verification result indicating whether the response source is consistent based on the result of the bit-by-bit comparison and verification processing.

[0057] The first few bits of the response restoration feature data store the restored challenge vector value, and the subsequent bits store the terminal-side processing timestamp. The target IoT gateway G1 extracts the restored challenge vector value bit by bit from the response restoration feature data and compares it bit by bit with the original primary challenge vector generated and stored in step S125. If the bit sequences of the two are completely identical, the response source consistency verification result is consistent; otherwise, it is inconsistent.

[0058] Step S140: When the response source consistency verification result indicates that the response source is consistent, based on the source tag contained in the terminal operating environment snapshot data and the request source tag data, perform multi-dimensional fusion assessment of access risk on the access behavior of the terminal device to generate an access risk assessment result.

[0059] When the response source consistency verification result obtained in step S137 is consistent, the target IoT gateway G1 initiates the multi-dimensional fusion assessment process for access risks.

[0060] Step S141: Extract the terminal access history digest field corresponding to the terminal identity mirror data from the source marker contained in the request source marker data, and parse the terminal access history digest field to obtain historical access frequency distribution data, historical access failure reason distribution data, and historical access duration distribution data.

[0061] The request source tagging data contains the complete content of the terminal identity mirroring data, including the terminal access history summary field. The target IoT gateway G1 parses the terminal access history summary field, which is a structured data block. The historical access frequency distribution data is a histogram array of access counts counted by day. The historical access failure reason distribution data is a count array categorized by failure reason code. The historical access duration distribution data is a count array categorized by access duration interval.

[0062] Step S142: Perform frequency distribution feature extraction processing on the historical access frequency distribution data to generate access frequency distribution features that include access frequency peak time period markers and median access interval values.

[0063] The histogram array in the historical access frequency distribution data is scanned to find the time interval corresponding to the maximum number of accesses, and this time interval is marked as the peak period of access frequency. The median value of the access interval is calculated by sorting the timestamp interval values ​​of each access in the historical access frequency distribution data and taking the median.

[0064] Step S143: Extract the terminal memory segment feature sequence, the process execution path corresponding to the target process identifier, and the process memory usage feature value from the terminal runtime environment snapshot data, and perform memory segment feature fingerprint generation processing on the terminal memory segment feature sequence to obtain the terminal memory feature fingerprint.

[0065] The memory segment feature fingerprint generation process uses the SHA-256 hash algorithm. The entire terminal memory segment feature sequence is taken as input, the SHA-256 hash value is calculated, and the first few bits of the hash value are taken as the terminal memory feature fingerprint.

[0066] Step S144: Perform fingerprint similarity comparison processing on the terminal memory feature fingerprint and the legal memory feature fingerprint database stored locally by the target IoT gateway to generate a memory feature fingerprint comparison result. The memory feature fingerprint comparison result includes fingerprint matching degree and fingerprint difference bit record.

[0067] The legitimate memory feature fingerprint database stores multiple terminal memory feature fingerprints recorded during successful authentications of the terminal device. The fingerprint similarity comparison process compares the terminal memory feature fingerprint with each fingerprint in the legitimate memory feature fingerprint database bit by bit, calculates the proportion of identical bits to the total number of bits, and takes the maximum value as the fingerprint matching score. The positions of the different bits in the fingerprint corresponding to the maximum matching score are recorded as fingerprint difference bit records.

[0068] Step S145: Perform path compliance analysis on the process execution path, match the process execution path with a preset set of legal paths, and generate path compliance analysis results. The path compliance analysis results include path matching markers and descriptions of path deviation.

[0069] The default set of valid paths is a list of path prefixes. Path matching uses prefix matching: if the process execution path begins with any path prefix in the set of valid paths, the path matching is marked as 1; otherwise, it is marked as 0. The path deviation is described as the edit distance between the process execution path and the nearest valid path prefix.

[0070] Step S146: Perform memory usage anomaly analysis on the process memory usage feature value, compare the process memory usage feature value with the preset memory usage baseline range, and generate memory usage anomaly analysis results.

[0071] The preset baseline range for memory usage is a closed interval consisting of a minimum and a maximum value. If the process memory usage characteristic value is within the closed interval, the memory usage anomaly analysis result is normal; if it is less than the minimum value, it is considered low; if it is greater than the maximum value, it is considered high.

[0072] Step S147: Input the access frequency distribution characteristics, the historical access failure reason distribution data, the memory feature fingerprint comparison results, the path compliance analysis results, and the memory usage anomaly analysis results into a multi-dimensional fusion evaluation function for comprehensive evaluation and processing, and generate access risk assessment results.

[0073] The multi-dimensional fusion evaluation function adopts a weighted scoring method. The total score S of the access risk assessment result is calculated as follows: S = w1×F1 + w2×F2 + w3×F3 + w4×F4 + w5×F5. Where F1 is the score for the degree to which the access frequency distribution characteristics deviate from the normal pattern, calculated by weighting the deviation between the peak access frequency period and the historical normal period, and the deviation between the median access interval and the historical median. After normalization, F1's value ranges from 0 to 1. F2 is the proportion of high-risk reason codes in the historical access failure reason distribution data, with a value range from 0 to 1. F3 is 1 minus fingerprint matching degree, with both fingerprint matching degree and F3's values ​​ranging from 0 to 1. F4 is 1 minus path matching mark, with the path matching mark value being either 0 or 1, and both F4's values ​​being either 0 or 1. F5 is the score for the degree of memory usage anomaly, where the deviation of the memory usage characteristic value from the baseline range is normalized and mapped to the 0-1 interval. w1 to w5 are preset weighting coefficients, summing to 1. The value of S ranges from 0 to 1, with a larger S indicating a higher access risk. Based on the value range of S, the access risk assessment results are divided into three levels: low risk, medium risk, and high risk.

[0074] Step S150: Generate a network access license credential containing access license validity constraints based on the access risk assessment result and the terminal device identifier, and issue the network access license credential to the terminal device to complete multi-terminal access authentication.

[0075] The target IoT gateway G1 determines the access license validity period constraint based on the access risk assessment result. Low risk corresponds to a longer validity period, medium risk to a medium validity period, and high risk to a shorter validity period. The access license validity period constraint is converted into a validity expiration time. A network access license credential is generated, which is a data structure containing the terminal device identifier, validity expiration time, allocated communication frequency band, and gateway signature. The gateway signature is generated by signing the hash value of the aforementioned fields using the gateway's private identification key K1. The network access license credential is encapsulated in an authentication response message and sent to the temperature sensor terminal T01 through the terminal communication interface, completing this multi-terminal access authentication process.

[0076] Step S210: After the target IoT gateway issues the network access license credential to the terminal device, it receives the periodic keep-alive request message sent by the terminal device, and extracts the current operating environment snapshot data and the current communication signal strength value of the terminal from the periodic keep-alive request message.

[0077] After the target IoT gateway G1 issues a network access license credential to the temperature sensor terminal T01, terminal T01 periodically sends keep-alive request messages. Each keep-alive request message carries a snapshot of the terminal's current operating environment and a current communication signal strength value. The snapshot of the terminal's current operating environment is a snapshot of its own operating environment taken by terminal T01 at the time the keep-alive request message is sent. The current communication signal strength value is the received signal strength indication value measured by terminal T01's radio frequency module when sending the keep-alive request message. After receiving each keep-alive request message, the target IoT gateway G1 parses and extracts these two types of data from the message body.

[0078] Step S220: Perform snapshot data destructuring processing on the snapshot data of the current running environment of the terminal to obtain the feature sequence of the current memory segment of the terminal and the list of the current running processes of the terminal.

[0079] Using the same snapshot data deconstruction processing method as in step S132, the snapshot data of the terminal's current running environment is parsed into a feature sequence of the terminal's current memory segment and a list of the terminal's currently running processes. The feature sequence of the terminal's current memory segment is a binary sequence that records the current feature values ​​of a preset address range in the memory of terminal T01. The list of the terminal's currently running processes is a list of process identifiers that records all processes currently running on terminal T01.

[0080] Step S230: Perform process addition / deletion detection processing on the current running process list of the terminal, compare the current running process list of the terminal with the terminal running process list stored in the access authentication stage item by item, and obtain the process addition / deletion detection result. The process addition / deletion detection result includes a list of newly added process identifiers and a list of terminated process identifiers.

[0081] The target IoT gateway G1 stores a copy of the terminal running process list obtained in step S134 in its session context. The process addition / deletion detection process compares the terminal's currently running process list with the stored copy of the terminal running process list by process identifier. Process identifiers that appear in the terminal's currently running process list but not in the stored copy are added to the list of newly added process identifiers. Process identifiers that appear in the stored copy but not in the terminal's currently running process list are added to the list of terminated process identifiers.

[0082] Step S240: Perform memory segmentation processing on the current memory segment feature sequence of the terminal, divide the current memory segment feature sequence of the terminal into multiple current memory block units according to a preset memory address range, and perform feature summary extraction processing on each current memory block unit to generate a current memory block feature summary corresponding to each current memory block unit.

[0083] The same memory segmentation and feature digest extraction methods as in step S133 are adopted. The current memory segment feature sequence of the terminal is divided into multiple current memory block units according to the same preset memory address range. For each current memory block unit, the CRC32 algorithm is used to calculate the cyclic redundancy check code, which serves as the current memory block feature digest corresponding to that current memory block unit.

[0084] Step S250: Perform block-by-block comparison between the current memory block feature summary corresponding to each current memory block unit and the memory block feature summary of the corresponding memory block unit stored in the access authentication phase to generate the memory feature drift amount of each memory block unit.

[0085] The target IoT gateway G1 stores copies of the memory block feature summaries generated in step S133 within its session context. The block-by-block comparison process performs a bitwise XOR operation between each current memory block feature summary and its corresponding stored memory block feature summary, counting the number of bits with a value of 1 in the XOR result. This number of bits represents the memory feature drift amount for that memory block unit. The memory feature drift amount ranges from 0 to the summary bit length.

[0086] Step S260: When the list of newly added process identifiers in the process addition / deletion detection result contains at least one newly added process identifier, perform path compliance analysis processing on the execution path of the newly added process corresponding to each newly added process identifier, and generate a path compliance analysis result for the newly added process.

[0087] When the list of newly added process identifiers is not empty, the target IoT gateway G1 extracts the execution path of each newly added process identifier from the extended field of the snapshot data of the terminal's current operating environment. Using the same path compliance analysis processing method as in step S145, each newly added process execution path is prefix-matched with a preset set of legal paths. If the execution paths of all newly added processes begin with a path prefix from the set of legal paths, the result of the newly added process path compliance analysis is compliant; otherwise, it is non-compliant.

[0088] Step S270: Generate a terminal operating environment continuity assessment result based on the memory feature drift amount of each memory block unit and the compliance analysis result of the newly added process path. When the terminal operating environment continuity assessment result indicates an abnormal change, perform credential revocation processing on the current network access license credential between the target IoT gateway and the terminal device, and terminate the network access of the terminal device.

[0089] The calculation method for the terminal operating environment continuity assessment result is as follows: if the sum of the memory feature drift amounts of all memory block units exceeds the preset drift total threshold, or the compliance analysis result of the newly added process path is non-compliant, then the terminal operating environment continuity assessment result is considered to have an abnormal change; otherwise, it is considered normal. When the terminal operating environment continuity assessment result is considered to have an abnormal change, the target IoT gateway G1 marks the network access license credential status of terminal T01 as revoked in the local access license table, sends a credential revocation notification message to terminal T01 through the terminal communication interface, and then disconnects the network connection with terminal T01.

[0090] Step S310: When the target IoT gateway receives network access authentication requests sent simultaneously by multiple terminal devices, it parses the source markers in the request source marker data of the multiple terminal devices and extracts the terminal type encoding field and terminal communication capability description field corresponding to each terminal device.

[0091] In an industrial plant environment, the target IoT gateway G1 may simultaneously receive network access authentication requests from multiple terminal devices within a short period of time. For example, it may simultaneously receive network access authentication requests from a temperature sensor (numbered T01), a vibration sensor (numbered V01), and a pressure sensor (numbered P01). The target IoT gateway G1 parses the source tag in the request source tag data for each terminal device. The source tag contains the storage index value of the terminal identity mirror data queried in step S113. This storage index value allows the extraction of the corresponding terminal type encoding field and terminal communication capability description field from the terminal identity mirror database.

[0092] Step S320: Perform terminal category grouping processing on the plurality of terminal devices according to the terminal type encoding field to obtain at least one terminal category group, and each terminal category group contains a set of terminal devices with the same terminal type encoding field.

[0093] The target IoT gateway G1 groups terminal devices with the same terminal type encoding field into the same terminal category group. For example, temperature sensor terminals, vibration sensor terminals, and pressure sensor terminals belong to different terminal category groups.

[0094] Step S330: For terminal devices within each terminal category group, perform resource allocation sorting processing based on the terminal supported frequency band set and terminal maximum transmit power parameter in the terminal communication capability description field to generate a terminal resource allocation sequence within each terminal category group.

[0095] The set of frequency bands supported by each terminal is a list of frequency band numbers, and the maximum transmit power parameter of each terminal is a value in milliwatts (dB). The resource allocation sorting process for terminals of the same category is based on the descending degree of matching between the terminal's supported frequency band set and the available frequency bands of the target IoT gateway G1. The matching degree is the size of the intersection of the terminal's supported frequency band set and the gateway's available frequency band set. In cases where the matching degree is the same, the terminals are sorted in ascending order of their maximum transmit power parameter, with terminals having lower power receiving priority in resource allocation. The resulting sorting order constitutes the terminal resource allocation sequence.

[0096] Step S340: Extract the currently available frequency band resource information from the communication frequency band resource table of the target IoT gateway. The currently available frequency band resource information includes a list of available frequency band identifiers and the frequency band bandwidth parameters and frequency band interference level markers corresponding to each available frequency band.

[0097] The communication frequency band resource table of the target IoT gateway G1 stores all communication frequency bands supported by the gateway's radio frequency module and their current status. The available frequency band identifier list is a list of frequency band numbers that are currently unoccupied and whose interference level is below a preset threshold. Each available frequency band corresponds to a frequency band bandwidth parameter, representing the upper limit of the data transmission rate of that frequency band. The frequency band interference level is marked as the level of external interference currently experienced by that frequency band, obtained through periodic spectrum scanning measurements.

[0098] Step S350: Based on the terminal resource allocation sequence and the currently available frequency band resource information, perform time-division multiplexing scheduling on the communication frequency band resources and authentication processing resources of the target IoT gateway, and sequentially allocate authentication processing time windows and communication frequency band resources to the multiple terminal devices.

[0099] The time-sharing multiplexing scheduling process employs a time-slice round-robin scheduling algorithm. The authentication processing timeline of the target IoT gateway G1 is divided into equal-length authentication processing time windows. Following the order of terminal devices in the terminal resource allocation sequence, an authentication processing time window is allocated to each terminal device sequentially. When allocating communication frequency band resources, the frequency band with the largest intersection with the terminal's supported frequency band set and the fewest currently allocated terminals is selected from the available frequency band identifier list and allocated to that terminal device.

[0100] Step S360: Perform a statistical processing of the number of terminals in the same frequency band for terminal devices allocated to the same communication frequency band resources. When the number of terminals in the same frequency band exceeds the preset frequency band load threshold, perform frequency band load balancing adjustment processing on the allocation scheme of the communication frequency band resources to generate an adjusted communication frequency band resource allocation scheme.

[0101] For each communication frequency band, the total number of terminal devices allocated to that band is counted. If the total number exceeds a preset frequency band load threshold, the terminal devices exceeding the threshold in that band are reallocated to other frequency bands with available capacity. During reallocation, the alternative frequency band with the largest intersection with the set of frequency bands supported by the terminals is selected first. After the adjustment is completed, an adjusted communication frequency band resource allocation scheme is generated.

[0102] Step S370: Encapsulate the authentication processing time window information and the adjusted communication frequency band resource configuration information of each terminal device into the corresponding network access license credential, and issue the corresponding network access license credential to each of the multiple terminal devices respectively.

[0103] For each terminal device, the start and end times of its assigned authentication processing time window, along with the frequency band number and bandwidth parameters from the adjusted communication frequency band resource configuration information, are encapsulated into the extended fields of the network access license credential corresponding to that terminal device. Each network access license credential is then distributed to the corresponding terminal device.

[0104] Step S410: After the target IoT gateway generates the access risk assessment result, the access risk assessment result, the terminal device identifier, and the source tag contained in the request source tag data are associated and stored in the terminal access behavior log record stored locally by the gateway.

[0105] After completing the multi-dimensional fusion assessment of access risks in step S140, the target IoT gateway G1 associates the current access risk assessment result with the terminal device identifier and the source tag in the request source tag data. The associated data is appended to the terminal access behavior log file stored locally on the gateway in the form of structured log records. Each log record contains a timestamp, terminal device identifier, access risk assessment result level, and hash value of the source tag.

[0106] Step S420: Perform access risk trend analysis on the historical access risk assessment results stored in the terminal access behavior log records, and extract the access risk change trend features corresponding to the terminal device identifier. The access risk change trend features include risk upward trend markers and risk fluctuation amplitude descriptions.

[0107] For all log records belonging to the same terminal device identifier in the terminal access behavior log, extract the access risk assessment score sequence in ascending order of timestamp. Perform linear regression analysis on the score sequence and calculate the slope of the regression line. If the slope is greater than 0, the risk is marked as rising; if the slope is less than 0, it is marked as falling; if the slope is equal to 0, it is marked as stable. The standard deviation of the score sequence is used to describe the risk fluctuation range.

[0108] Step S430: Based on the risk increase trend marker and risk fluctuation amplitude description in the access risk change trend characteristics, dynamically adjust the token validity period marker field of the preset identity token corresponding to the terminal device identifier to generate the adjusted token validity period marker field.

[0109] The original validity period of the token validity period flag field is T0. The adjusted validity period Tnew is calculated as follows: Tnew = T0 × (1 - α × S - β × σ). Where S is the value corresponding to the risk upward trend flag, taking the value 1 when rising, 0 when stable, and -1 when falling. σ is the standard deviation corresponding to the risk volatility description. α and β are preset adjustment coefficients, ranging from 0 to 1. Tnew is truncated to a lower bound, ensuring it is not less than the preset minimum validity period.

[0110] Step S440: Update the adjusted token validity period flag field to the preset identity token corresponding to the terminal device identifier in the terminal identity token binding relationship table stored locally by the gateway.

[0111] The target IoT gateway G1 finds the pre-set identity token record corresponding to the terminal device identifier in the terminal identity token binding relationship table, and updates the valid expiration time of the token validity period flag field to the current time plus the adjusted valid duration Tnew.

[0112] Step S450: Based on the updated preset identity token and the current gateway clock signal generated when the next network access authentication request sent by the terminal device is received, the token body data segment in the updated preset identity token and the clock granularity sequence generated by the current gateway clock signal are mixed and transformed to generate a new query vector used in the next authentication process.

[0113] When the target IoT gateway G1 receives the network access authentication request from the terminal device again, it extracts the token body data segment from the updated preset identity token, uses the same HMAC hybrid transformation processing method as in step S125, and performs hybrid transformation with the clock granularity sequence generated at that time to generate a new query vector in the new authentication process.

[0114] Step S510: After the target IoT gateway establishes a network connection with multiple terminal devices, it receives the terminal operation status report data periodically reported by each connected terminal device. The terminal operation status report data includes the terminal's current memory segment feature sequence and the terminal's current communication signal strength value.

[0115] After the target IoT gateway G1 establishes network connections with multiple terminal devices, each connected terminal device reports its terminal operating status data to the gateway at a preset 1-minute interval. The format of the terminal operating status report data is the same as the keep-alive request message in step S210, including the terminal's current memory segment characteristic sequence and the terminal's current communication signal strength value. The target IoT gateway G1 continuously receives these periodically reported data through its terminal communication interface.

[0116] Step S520: Perform memory segmentation processing on the terminal current memory segment feature sequence reported by each connected terminal device. Divide the terminal current memory segment feature sequence into multiple current memory block units according to a preset memory address range, and perform feature summary extraction processing on each current memory block unit to generate a current memory block feature summary corresponding to each current memory block unit.

[0117] The processing method is exactly the same as that in steps S133 and S240. For the current memory segment feature sequence of each connected terminal device, the current memory block unit is divided according to the preset memory address range, and the current memory block feature digest is calculated for each current memory block unit using the CRC32 algorithm.

[0118] Step S530: Perform block-by-block comparison between the current memory block feature summary corresponding to each current memory block unit of each connected terminal device and the memory block feature summary of the corresponding memory block unit stored by the corresponding terminal during the access authentication phase, and generate the memory feature drift amount of each memory block unit of each connected terminal device.

[0119] The same block-by-block comparison process as step S250 is adopted. The feature digest of each current memory block is XORed with the corresponding memory block feature digest stored in the access authentication stage by bits, and the number of 1s is counted as the memory feature drift amount.

[0120] Step S540: Calculate the overall drift value of memory features for each connected terminal device based on the memory feature drift of each memory block unit of each connected terminal device.

[0121] The overall memory feature drift value is calculated by taking the arithmetic mean of the memory feature drift of all memory block units of the connected terminal device.

[0122] Step S550: Compare the overall memory feature drift value of each connected terminal device with the preset drift threshold, and classify the connected terminal devices whose overall memory feature drift value exceeds the preset drift threshold into the suspected abnormal terminal set, and classify the remaining connected terminal devices into the stable operating terminal set.

[0123] A preset drift threshold is set to Tdrift. For each connected terminal device, if its overall memory characteristic drift value is greater than Tdrift, it is classified into the suspected abnormal terminal set. If it is less than or equal to Tdrift, it is classified into the stable operating terminal set.

[0124] Step S560: For each terminal device in the suspected abnormal terminal set, extract the current communication signal strength value of the terminal corresponding to the terminal device, analyze and process the changing trend of the current communication signal strength value of the terminal, and generate a signal strength changing trend marker.

[0125] For each terminal device in the suspected abnormal terminal set, extract the most recent records from its periodically reported current communication signal strength values ​​to form a signal strength time series. Calculate the slope of a linear regression on this time series. If the slope is less than 0 and its absolute value exceeds a preset attenuation threshold, the signal strength trend is marked as continuously attenuating; otherwise, it is considered stable.

[0126] Step S570: Perform secondary confirmation processing of abnormal terminals based on the signal strength change trend marker and the overall drift value of the memory characteristics of each terminal device in the suspected abnormal terminal set, generate an abnormal terminal confirmation result, and when the abnormal terminal confirmation result indicates that there is a confirmed abnormal terminal, perform credential revocation processing on the network access license credential of the confirmed abnormal terminal, and send a network access authentication re-initiation instruction to the confirmed abnormal terminal to trigger a new round of authentication process.

[0127] The determination rule for the abnormal terminal secondary confirmation process is as follows: if the signal strength change trend of a terminal device is marked as continuous attenuation and its overall memory characteristic drift value is greater than a preset drift threshold multiplied by a preset multiple, then the terminal device is determined to be an abnormal terminal. For the confirmed abnormal terminal, the target IoT gateway G1 uses the same credential revocation processing method as in step S270 to revoke its network access license credential and sends it a network access authentication re-initiation instruction, which includes an indication code for re-initiating authentication and the address information of the target IoT gateway G1.

[0128] For example, the method may further include: step S610: before the gateway access decision module of the target IoT gateway generates the access risk assessment result, extract the gateway device factory-fixed serial number from the non-volatile storage area of ​​the target IoT gateway, and perform device relationship binding processing on the gateway device factory-fixed serial number and the terminal device identifier to generate a gateway terminal association binding certificate.

[0129] At any time before generating the access risk assessment result in step S140, the target IoT gateway G1 extracts the gateway device's factory-fixed serial number SN1 from the non-volatile storage area. The device relationship binding process combines SN1 with the terminal device identifier TID in TLV format, where the combination format is: tag field + length field + SN1 value field + length field + TID value field. A SHA-256 hash value is calculated for this combined data, serving as the gateway terminal association binding credential.

[0130] Step S620: Embed the gateway terminal association binding credential into the source tag contained in the request source tag data, so that the source tag simultaneously carries the association information between the terminal device identifier and the factory-fixed serial number of the gateway device.

[0131] When generating the request source mark in step S117, the gateway terminal association binding credential is appended to the extended field of the source mark, so that the source mark carries the association information between the terminal device identifier TID and the gateway device factory-fixed serial number SN1.

[0132] Step S630: After the terminal device receives the network access license credential, it extracts the gateway terminal association binding credential from the network access license credential, and performs association relationship verification processing on the gateway terminal association binding credential to obtain the association relationship verification result.

[0133] After receiving the network access license credential, terminal device T01 extracts the gateway terminal association binding credential from its extended fields. The association verification process is as follows: Terminal device T01 uses its stored terminal device identifier and the gateway device's factory-fixed serial number recorded during access to calculate a verification hash value using the same combination method and hash algorithm as in step S610. The verification hash value is compared with the gateway terminal association binding credential; if they match, the association verification result is successful; otherwise, it fails.

[0134] Step S640: When the association verification result indicates that an association binding relationship has been established between the terminal device and the target IoT gateway, the terminal device shall use the terminal communication frequency band configuration carried in the network access license certificate to conduct data communication with the target IoT gateway within the access license validity period of the network access license certificate.

[0135] When the association verification result is successful, the terminal device T01, before the expiration time of the network access license certificate, uses the communication frequency band number and frequency band bandwidth parameters allocated in the network access license certificate to conduct data communication with the target IoT gateway G1. Data communication includes periodically reporting sensor-collected data and receiving configuration instructions issued by the gateway.

[0136] Step S650: Each time the terminal device sends an uplink data packet to the target IoT gateway, it appends the gateway terminal association binding credential to the extended field of the header of the uplink data packet, so that the target IoT gateway can continuously verify the identity of the terminal device through the gateway terminal association binding credential when it receives the uplink data packet.

[0137] When terminal device T01 sends an uplink data packet, it writes the gateway terminal association binding credential into the extended field of the packet header. When the target IoT gateway G1 receives the uplink data packet, it extracts the gateway terminal association binding credential from the extended field of the packet header and compares it with the gateway terminal association binding credential corresponding to the terminal device stored locally. If they match, the identity association is confirmed and the packet is processed normally; if they do not match, the packet is discarded and an abnormal event is recorded.

[0138] Step S710: Before the target IoT gateway sends the first query vector to the terminal device, extract the request source tag data of multiple terminal devices that the target IoT gateway has processed within the current time window, and construct a multi-terminal access behavior association graph. The multi-terminal access behavior association graph includes terminal device nodes and connection edges with behavioral similarity between nodes.

[0139] Before generating a query vector, the target IoT gateway G1 extracts request source tagging data from all terminal devices processed within the current time window. The current time window is a sliding time interval that extends backwards for a preset duration, ending at the current time. A multi-terminal access behavior association graph is created, treating each terminal device as a node. Initially, behavioral similarity connections are established between all terminal device nodes, with initial edge weights of 0. The multi-terminal access behavior association graph is stored as an adjacency matrix, with the matrix dimension equal to the number of terminal devices within the current time window.

[0140] Step S720: Perform behavior fingerprint extraction processing on the request source marker data of each terminal device node in the multi-terminal access behavior association graph to obtain the access behavior feature vector corresponding to each terminal device node. The access behavior feature vector includes the access time distribution feature dimension, the request signal strength distribution feature dimension, and the terminal communication capability feature dimension.

[0141] For each terminal device node's request source tagging data, the terminal access history summary field and terminal communication capability description field are extracted. The access time distribution feature dimension is extracted from the terminal access history summary field and is a 24-dimensional vector divided by hour, with each dimension storing the historical access count within that hour. The request signal strength distribution feature dimension is extracted from the terminal access history summary field and is a vector divided by signal strength intervals, with each dimension storing the access count for the corresponding interval. The terminal communication capability feature dimension is extracted from the terminal communication capability description field and includes values ​​for maximum transmit power and the number of supported frequency bands. The feature vectors of these three dimensions are concatenated along the dimension axes to generate an access behavior feature vector.

[0142] Step S730: Based on the access behavior feature vector, perform edge weight calculation on the behavior similarity connection edges between different terminal device nodes in the multi-terminal access behavior association graph to generate a multi-terminal access behavior association graph carrying edge weights.

[0143] For any two terminal device nodes i and j, the edge weight is calculated as follows: W(i,j) = exp(-D(i,j) / σ), where D(i,j) is the Euclidean distance between the access behavior feature vectors of nodes i and j, and σ is a preset scale parameter. The value of W(i,j) ranges from 0 to 1; a larger value indicates that the access behaviors of the two terminal device nodes are more similar. The calculated edge weights are then assigned to the corresponding positions in the adjacency matrix.

[0144] Step S740: Perform group behavior clustering analysis on the multi-terminal access behavior association graph carrying edge weights, and classify terminal device nodes whose edge weights between behavior feature vectors exceed a preset clustering threshold into the same access behavior group to obtain multiple access behavior groups.

[0145] The spectral clustering algorithm is used for group behavior clustering analysis. First, the Laplacian matrix is ​​calculated based on the adjacency matrix. Then, eigenvalue decomposition is performed on the Laplacian matrix, and the eigenvectors corresponding to the K smallest non-zero eigenvalues ​​are used to form a feature matrix, where K is the preset number of clusters. Each row of the feature matrix is ​​used as a low-dimensional embedding vector for the corresponding terminal device node. The K-means clustering algorithm is then used to cluster these low-dimensional embedding vectors, grouping terminal device nodes belonging to the same cluster into the same access behavior group.

[0146] Step S750: Perform group behavior feature aggregation processing on the request source tagging data of terminal device nodes within each access behavior group to generate a group behavior feature summary corresponding to each access behavior group.

[0147] For each access behavior group, the arithmetic mean of the access behavior feature vectors of all terminal device nodes within the group is calculated along the corresponding dimension to obtain a mean vector with the same dimension as the access behavior feature vectors. This mean vector is used as a summary of the group behavior features of that access behavior group.

[0148] Step S760: Perform group behavior feature summary and preset normal access behavior baseline analysis on the group behavior deviation of each access behavior group to generate group behavior deviation assessment results for each access behavior group.

[0149] The preset baseline for normal access behavior is a baseline vector with the same dimension as the group behavior feature summary, composed of the average behavior features of a group of terminal devices that have historically achieved successful authentication. The group behavior deviation assessment result is calculated as follows: the cosine distance between the group behavior feature summary and the baseline vector is taken, where the cosine distance equals 1 minus the cosine similarity. The value of the cosine distance ranges from 0 to 2, with a larger value indicating a greater degree of deviation.

[0150] Step S770: When there is an abnormal access behavior group whose group behavior deviation assessment result exceeds the preset group deviation threshold, the first-order property query vector corresponding to all terminal devices in the abnormal access behavior group is subjected to query vector enhancement processing. A group abnormality marker field is added to the first-order property query vector to generate an enhanced query vector.

[0151] A preset group deviation threshold, Tgroup, is set. If the group behavior deviation assessment result of a certain access behavior group is greater than Tgroup, the access behavior group is marked as an abnormal access behavior group. For each terminal device within the abnormal access behavior group, after its primary challenge vector is generated in step S125, a group abnormality marker field is appended. This group abnormality marker field contains the group identifier of the abnormal access behavior group and the group behavior deviation assessment result value. The appended challenge vector is the reinforced challenge vector.

[0152] Step S780: Send the enhanced challenge vector to the corresponding terminal device within the abnormal access behavior group to trigger the enhanced terminal-side response generation operation.

[0153] The enhanced challenge vector replaces the original primary challenge vector, is encapsulated in a challenge request message data packet, and sent to the corresponding terminal device. Upon receiving the enhanced challenge vector, the terminal device, in generating its terminal response data, in addition to completing the original response generation operation, also needs to extract the group identifier from the group anomaly flag field and append an encrypted verification field corresponding to the group identifier to the terminal response feature string to prove that the terminal device knows the access behavior group it belongs to.

[0154] Step S810: After the target IoT gateway generates the network access license credential, the network data traffic generated by the terminal device after access is processed by traffic behavior pattern capture, and the traffic packet long distribution sequence, traffic packet arrival interval sequence and traffic protocol type distribution sequence of the network data traffic are extracted.

[0155] After obtaining a network access license, terminal device T01 communicates with the target IoT gateway G1, generating network data traffic. The target IoT gateway G1 mirrors and captures the data traffic of terminal device T01 at the network layer. The traffic packet length distribution sequence is an array, where the array index is the number of the packet length interval, and the array value is the count of packets within that interval. The traffic packet arrival interval sequence is an array, where the array index is the number of the arrival interval, and the array value is the count of packets within that interval. The traffic protocol type distribution sequence is an array, where the array index is the protocol type number, and the array value is the count of packets of that protocol type. The sampling time window length for these three sequences is equal to the validity period of the network access license.

[0156] Step S820: Perform packet length distribution feature extraction processing on the traffic packet length distribution sequence to obtain packet length distribution feature vector, and perform interval distribution feature extraction processing on the traffic packet arrival interval sequence to obtain interval distribution feature vector.

[0157] Packet length distribution feature extraction processing divides the count value of each packet length interval in the packet length distribution sequence by the total number of packets to obtain a normalized packet length probability distribution vector, which serves as the packet length distribution feature vector. Interval distribution feature extraction processing divides the count value of each interval interval in the packet arrival interval sequence by the total number of intervals to obtain a normalized interval probability distribution vector, which serves as the interval distribution feature vector.

[0158] Step S830: Extract protocol type distribution features from the traffic protocol type distribution sequence to obtain a protocol distribution feature vector, and combine the packet length distribution feature vector, the interval distribution feature vector, and the protocol distribution feature vector into a terminal traffic behavior feature vector.

[0159] The protocol type distribution feature extraction process divides the count value of each protocol type in the traffic protocol type distribution sequence by the total number of packets to obtain a normalized protocol probability distribution vector, which serves as the protocol distribution feature vector. The packet length distribution feature vector, interval distribution feature vector, and protocol distribution feature vector are then concatenated along the dimension axis to form the terminal traffic behavior feature vector.

[0160] Step S840: Extract the historical legal traffic behavior feature vector corresponding to the terminal device identifier from the legal traffic behavior feature library stored locally by the target IoT gateway. The legal traffic behavior feature library stores the historical legal traffic behavior feature vectors of each registered terminal at different time periods.

[0161] The legitimate traffic behavior feature library is a key-value pair storage structure, where the key is the terminal device identifier and the values ​​are a list of historical legitimate traffic behavior feature vectors. The structure of each historical legitimate traffic behavior feature vector is the same as the terminal traffic behavior feature vector generated in step S830. The target IoT gateway G1 extracts the historical legitimate traffic behavior feature vectors recorded by the terminal device in the most recent successful communications from the legitimate traffic behavior feature library, using the terminal device identifier TID as the key.

[0162] Step S850: Perform traffic behavior offset calculation on the terminal traffic behavior feature vector and the historical legal traffic behavior feature vector to generate a traffic behavior offset evaluation result.

[0163] The traffic behavior offset assessment result is calculated as follows: the Euclidean distance between the terminal traffic behavior feature vector and each historical legitimate traffic behavior feature vector is calculated, and the minimum value of all Euclidean distances is taken as the traffic behavior offset assessment result. The smaller the Euclidean distance, the closer the current traffic behavior is to the historical legitimate behavior.

[0164] Step S860: When the traffic behavior offset evaluation result indicates that the offset between the terminal traffic behavior feature vector and the historical legal traffic behavior feature vector exceeds a preset traffic offset threshold, a re-verification process for the operating environment of the terminal device is triggered.

[0165] Set the preset traffic offset threshold to Tflow. If the traffic behavior offset assessment result is greater than Tflow, it is determined that the offset exceeds the threshold, triggering the runtime environment re-verification process.

[0166] Step S870: In the runtime environment re-verification process, a runtime environment re-verification challenge instruction is sent to the terminal device. The runtime environment re-verification challenge instruction carries a newly generated primary challenge vector and a terminal runtime environment snapshot acquisition instruction.

[0167] The target IoT gateway G1 re-executes steps S124 and S125 to generate a new primary challenge vector. This new primary challenge vector and the terminal runtime environment snapshot acquisition instruction are encapsulated into a runtime environment re-verification challenge instruction. The terminal runtime environment snapshot acquisition instruction carries a list of memory address ranges that the terminal is required to collect. This instruction is sent to the terminal device T01 via the terminal communication interface.

[0168] Step S880: Receive the re-verification response data returned by the terminal device, extract the re-verification terminal response feature string and the re-verification terminal operating environment snapshot data from the re-verification response data, and perform snapshot feature comparison processing on the re-verification terminal operating environment snapshot data to generate a re-verification result.

[0169] The target IoT gateway G1 receives the re-verification response data returned by the terminal device T01, and extracts the re-verification terminal response feature string and the re-verification terminal operating environment snapshot data in the same manner as steps S131 and S132. For the re-verification terminal operating environment snapshot data, it generates a current memory block feature summary and process list in the same manner as steps S133 to S135, and compares them with the memory block feature summary and process list stored during the access authentication phase. If the total memory feature drift does not exceed the preset drift total threshold and the compliance analysis result of the newly added process path is compliant, the re-verification result is passed; otherwise, it is failed.

[0170] Step S910: While the target IoT gateway performs multi-dimensional fusion assessment of access risk for the access behavior of the terminal device, it extracts the terminal response feature string generated by the terminal device during the access authentication phase, and performs time-frequency transformation processing on the terminal response feature string to generate time-spectrum representation data of the response features.

[0171] While performing the multi-dimensional fusion assessment of access risks in step S140, the target IoT gateway G1 extracts the terminal response feature string obtained in step S131. The response feature time-frequency transformation processing adopts the short-time Fourier transform algorithm, treating the terminal response feature string as a one-dimensional time-domain signal. By truncating signal segments through a sliding window, a fast Fourier transform is performed on each segment, and the spectrum of each segment is arranged along the time axis to generate a two-dimensional response feature time-frequency representation data, where the horizontal axis is time, the vertical axis is frequency, and the value of each pixel represents the energy density at that time-frequency position.

[0172] Step S920: Perform response feature frequency domain energy distribution extraction processing on the response feature time-spectrum representation data to obtain a response feature frequency domain energy distribution vector, wherein the response feature frequency domain energy distribution vector contains energy density values ​​of multiple frequency domain intervals.

[0173] The frequency domain energy distribution extraction process for response features involves averaging the time-frequency spectral representation data of the response features along the time axis to obtain a one-dimensional frequency energy distribution curve. This curve is then divided into preset frequency domain intervals along the frequency axis, and the energy density value of each interval is integrated to obtain the energy density value for that interval. Finally, the energy density values ​​of all frequency domain intervals are arranged into a vector to obtain the frequency domain energy distribution vector of the response features.

[0174] Step S930: Extract the terminal response feature frequency domain reference vector corresponding to the terminal device identifier from the terminal response feature frequency domain reference library stored locally by the target IoT gateway. The terminal response feature frequency domain reference library stores the response feature frequency domain energy distribution vector generated by each registered terminal during the historical access authentication process.

[0175] The terminal response feature frequency domain benchmark library is a key-value pair storage structure. The key is the terminal device identifier, and the value is the mean vector of multiple response feature frequency domain energy distribution vectors generated by the terminal device during its historical successful authentication process. The target IoT gateway G1 extracts the corresponding terminal response feature frequency domain benchmark vector using the terminal device identifier TID as the key.

[0176] Step S940: Perform frequency domain feature similarity comparison processing on the response feature frequency domain energy distribution vector and the terminal response feature frequency domain reference vector to generate frequency domain feature similarity comparison results.

[0177] Cosine similarity is used to calculate the frequency domain feature similarity. The cosine similarity between the frequency domain energy distribution vector of the response feature and the frequency domain reference vector of the terminal response feature is equal to the dot product of the two vectors divided by the product of their L2 norms. The value of cosine similarity ranges from -1 to 1, with values ​​closer to 1 indicating greater similarity between the two vectors.

[0178] Step S950: When the frequency domain feature similarity comparison result indicates that the similarity between the frequency domain energy distribution vector of the response feature and the frequency domain reference vector of the terminal response feature is lower than a preset similarity threshold, an abnormal terminal hardware feature marker is generated.

[0179] A preset similarity threshold, Tsim, is set. If the cosine similarity is less than Tsim, it is determined that the hardware characteristics of the terminal device may have undergone abnormal changes, and a terminal hardware characteristic abnormality marker is generated with a value of 1. Otherwise, the marker value is 0.

[0180] Step S960: Input the terminal hardware feature anomaly marker as a new evaluation dimension into the multi-dimensional fusion evaluation function, and perform multi-dimensional fusion evaluation of access risk together with the source marker contained in the terminal operating environment snapshot data and the request source marker data to generate an access risk evaluation result with supplementary hardware feature anomaly dimension.

[0181] The terminal hardware feature anomaly marker is added as a new evaluation factor F6 to the multi-dimensional fusion evaluation function. The adjusted total score Snew of the access risk assessment result is calculated as follows: Snew = w1×F1 + w2×F2 + w3×F3 + w4×F4 + w5×F5 + w6×F6, where F6 is the value of the terminal hardware feature anomaly marker, w6 is the preset hardware feature anomaly weight coefficient, and the sum of all weight coefficients remains 1. Based on the value range of Snew, the access risk assessment level is reclassified, generating an access risk assessment result with a supplementary hardware feature anomaly dimension.

[0182] Step S1010: After the target IoT gateway completes the access authentication of multiple terminal devices, it collects the terminal response feature string and the corresponding access risk assessment result generated by each connected terminal device during the authentication process, and constructs a terminal response feature training sample set. Each training sample in the terminal response feature training sample set contains a terminal response feature string and a corresponding risk level label.

[0183] After each successful access authentication, the target IoT gateway G1 stores the terminal response feature string obtained in step S131 and the access risk assessment result level generated in step S140 to its local training data cache. When the number of samples in the cache reaches a preset number, a terminal response feature training sample set is constructed. Each training sample uses the terminal response feature string as input features and the access risk assessment result level as risk level label.

[0184] Step S1020: Perform deep encoding of the terminal response feature string for each training sample in the terminal response feature training sample set, and use a layer-by-layer nonlinear mapping network structure to map the terminal response feature string into a high-dimensional response feature representation vector. The layer-by-layer nonlinear mapping network structure contains multiple cascaded feature mapping layers, and each feature mapping layer performs linear transformation and nonlinear activation processing on the input features.

[0185] The layer-wise nonlinear mapping network structure adopts a multilayer perceptron architecture, containing three cascaded feature mapping layers. The first feature mapping layer contains 128 neurons, the second layer contains 256 neurons, and the third layer contains 512 neurons. Each feature mapping layer performs the following operation on the input feature vector: h(l) = ReLU(W(l) × h(l-1) + b(l)), where h(l-1) is the output of the previous layer, W(l) is the weight matrix of this layer, b(l) is the bias vector of this layer, and ReLU is the linear rectified activation function. The input of the first layer is the vector obtained by byte-level one-hot encoding of the terminal response feature string. The output of the third layer is a 512-dimensional high-dimensional response feature representation vector.

[0186] Step S1030: Input the high-dimensional response feature representation vector into the response feature classification prediction network. The response feature classification prediction network includes a fully connected classification layer and a classification output layer. The fully connected classification layer performs feature space compression processing on the high-dimensional response feature representation vector. The classification output layer generates the predicted risk level label corresponding to the training sample.

[0187] The fully connected classification layer contains 64 neurons that perform a linear transformation and ReLU activation on the high-dimensional response feature representation vector, compressing the feature dimension from 512 to 64. The classification output layer contains the same number of neurons as the risk level categories, followed by a softmax function to output the predicted probability value for each category. The category corresponding to the highest probability value is taken as the predicted risk level label.

[0188] Step S1040: Perform classification loss calculation on the predicted risk level label and the risk level label corresponding to the training sample to generate a classification loss value, and update the network parameters of the layer-by-layer nonlinear mapping network structure and the response feature classification prediction network based on the classification loss value until the classification loss value converges to the preset loss convergence range, thereby obtaining the trained response feature analysis network.

[0189] The classification loss is calculated using the cross-entropy loss function. The loss value L is calculated as: L = -Σyc × log(pc), where yc is the one-hot encoding value of the risk level label in class c, and pc is the predicted probability value in class c. The Adam optimizer is used to calculate the gradients of all network parameters based on the loss value L, and the weight matrix and bias vector are updated along the gradient descent direction. Iterative training continues until the loss value no longer decreases in multiple consecutive training epochs and falls below a preset loss convergence threshold, resulting in the trained response feature analysis network.

[0190] Step S1050: After receiving the new terminal response data returned by the new terminal device, extract the new terminal response feature string from the new terminal response data, input the new terminal response feature string into the trained response feature analysis network, and generate the predicted access risk assessment result corresponding to the new terminal device.

[0191] When a new terminal device initiates network access authentication, the target IoT gateway G1 extracts the new terminal response feature string from the new terminal's response data. This new terminal response feature string is then input into the trained response feature analysis network. After layer-by-layer forward propagation, the classification output layer outputs the predicted access risk assessment level. This predicted access risk assessment result is used as an auxiliary reference input for the multi-dimensional fusion assessment in step S140.

[0192] Step S1110: After the target IoT gateway issues its respective network access license credentials to multiple connected terminal devices, a gateway authentication status shared data structure is constructed. The gateway authentication status shared data structure includes the terminal device identifier, access license validity period constraint, and terminal operating environment feature fingerprint of each connected terminal device.

[0193] After issuing network access license credentials to multiple connected terminal devices, the target IoT gateway G1 constructs an authentication status record for each connected terminal device. The terminal operating environment feature fingerprint is the terminal memory feature fingerprint generated in step S143. The terminal device identifier, access license validity constraint (expiration time), and terminal operating environment feature fingerprint are combined into a single record. All records for connected terminal devices constitute a shared gateway authentication status data structure, stored in JSON array format.

[0194] Step S1120: Distribute the gateway authentication status shared data structure to the adjacent IoT gateway through the inter-gateway communication channel between the target IoT gateway and the adjacent IoT gateway. The adjacent IoT gateway and the target IoT gateway belong to the same IoT gateway cooperation domain.

[0195] The target IoT gateway G1 establishes an inter-gateway communication channel with neighboring IoT gateways G2 and G3 via a wired backbone network. The target IoT gateway G1 sends its gateway authentication status shared data structure to all neighboring IoT gateways within the cooperative domain via the CoAP multicast protocol. Upon receiving the data, the neighboring IoT gateways store the gateway authentication status shared data structure in their local cache.

[0196] Step S1130: When a gateway switching event occurs on the terminal device, the terminal device sends a gateway switching authentication request carrying the terminal device identifier and the target IoT gateway identifier to the target switching gateway.

[0197] When the temperature sensor terminal T01 moves from the coverage area of ​​the target IoT gateway G1 to the coverage area of ​​the adjacent IoT gateway G2, terminal T01 detects that the signal strength of the target IoT gateway G1 is continuously lower than a preset handover threshold, while the signal strength of the adjacent IoT gateway G2 is higher than the access threshold, triggering a gateway handover event. Terminal T01 sends a gateway handover authentication request to the target handover gateway, i.e., the adjacent IoT gateway G2. The message header of this gateway handover authentication request carries the terminal device identifier TID and the identifier of the target IoT gateway, i.e., G1.

[0198] Step S1140: After receiving the gateway switching authentication request, the target switching gateway queries the gateway authentication status information that matches the terminal device identifier from the gateway authentication status shared data structure distributed by the target IoT gateway, which is stored locally on the target switching gateway.

[0199] Upon receiving a gateway switching authentication request, the neighboring IoT gateway G2 extracts the terminal device identifier (TID). Then, it performs a key-value lookup based on the TID in the shared gateway authentication status data structure distributed by the target IoT gateway G1, stored in its local cache, to find matching terminal authentication status information.

[0200] Step S1150: When terminal authentication status information matching the terminal device identifier is found, the access license validity constraint corresponding to the terminal device is extracted from the terminal authentication status information, and the validity period of the access license validity constraint is determined.

[0201] If a matching record is found, the access license validity period constraint, i.e., the expiration time, is extracted from the terminal's authentication status information. The current gateway clock time is compared with the expiration time. If the current time is earlier than the expiration time, the validity period is deemed valid; otherwise, it is deemed invalid.

[0202] Step S1160: When the access license validity period constraint is within the validity period, the target switching gateway extracts the terminal operating environment feature fingerprint corresponding to the terminal device from the terminal authentication status information, and uses the terminal operating environment feature fingerprint as the pre-set identity token of the terminal device, skipping the generation and sending steps of the first query vector, and directly generating the switching network access license credential.

[0203] When the validity determination result is valid, the adjacent IoT gateway G2 extracts the terminal operating environment feature fingerprint from the terminal authentication status information. Using the terminal operating environment feature fingerprint as a temporary pre-set identity token, it directly skips the generation and sending of the query vector in step S120 and proceeds to the network access license credential generation process in step S150.

[0204] Step S1170: The switching network access license credential is sent to the terminal device, enabling the terminal device to continue data communication within the coverage area of ​​the target switching gateway.

[0205] The neighboring IoT gateway G2 encapsulates the switched network access license credential into an authentication response message and sends it to the terminal device T01 via the terminal communication interface. The communication frequency band allocated in the switched network access license credential is the available frequency band of the neighboring IoT gateway G2. After receiving the switched network access license credential, the terminal device T01 establishes a data communication connection with the neighboring IoT gateway G2 using the new communication frequency band configuration and continues to report the data collected by the temperature sensor.

[0206] Step S1110: Construct an adversarial sample feature library inside the gateway trust root module of the target IoT gateway. The adversarial sample feature library is used to store adversarial sample feature data of abnormal authentication requests detected in history. The adversarial sample feature data includes descriptions of request feature tampering traces and descriptions of terminal identity mirror forgery features.

[0207] The target IoT gateway G1 internally contains a gateway trust root module, which is a trusted execution environment based on a hardware security module. Within the secure storage area of ​​this gateway trust root module, an adversarial example feature library is initialized and built. The adversarial example feature library is initially empty and gradually filled in. The request feature tampering trace is described as a binary sequence, recording the payload feature fingerprint sequence of the tampered network access authentication request. The terminal identity image forgery feature is described as a binary sequence, recording the feature summary of the forged terminal identity image data.

[0208] Step S1120: When the target IoT gateway receives the network access authentication request from the terminal device, before the request source marking process, the access request load data carried by the network access authentication request is processed by load data fragmentation, and the access request load data is divided into multiple load data fragmentation units according to the preset load data byte length.

[0209] Before the load feature comparison process in step S114, the target IoT gateway G1 extracts the access request load data carried in the network access authentication request. The load data fragmentation process divides the access request load data into M load data fragment units according to a preset load data byte length L, where M = ceil (total access request load data byte length / L), and ceil represents rounding up. If the last load data fragment unit is less than L in length, it is padded with zero bytes.

[0210] Step S1130: Perform sharding feature fingerprint extraction processing on each load data sharding unit to generate load sharding feature fingerprints corresponding to each load data sharding unit, and combine the load sharding feature fingerprints corresponding to all load data sharding units into a load feature fingerprint sequence.

[0211] For each load data shard unit, its hash value is calculated using the SHA-256 hash algorithm, and the first few bits of the hash value are taken as the load shard feature fingerprint corresponding to that load data shard unit. All M load shard feature fingerprints are arranged in the order of the load data shard units and combined into a load feature fingerprint sequence.

[0212] Step S1140: Perform sequence pattern matching processing on the payload feature fingerprint sequence and the request feature tampering trace description stored in the adversarial example feature library to generate a request feature tampering matching result, wherein the request feature tampering matching result includes a tampering matching marker and a tampering matching location indication.

[0213] The sequence pattern matching process employs the longest common subsequence algorithm. The payload feature fingerprint sequence is compared with the tampering trace descriptions of each requested feature in the adversarial example feature library, and the length of the longest common subsequence between the two is calculated. If the proportion of the longest common subsequence length to the total length of the payload feature fingerprint sequence exceeds a preset matching threshold, the tampering matching flag is set to 1, and the tampering matching position indicates the start and end indexes of the common subsequence in the payload feature fingerprint sequence; otherwise, the tampering matching flag is set to 0.

[0214] Step S1150: Cross-validate the tampering matching marker in the request feature tampering matching result with the load feature comparison result generated during the request source marker processing to generate a comprehensive judgment result on the authenticity of the request load.

[0215] The cross-validation process performs a logical OR operation between the tampered matching flag and the load anomaly flag in the load feature comparison result generated in step S114. If the tampered matching flag is 1 or the load anomaly flag is 1, the overall judgment result of the requested load authenticity is questionable; otherwise, it is normal.

[0216] Step S1160: When the comprehensive judgment result of the request load authenticity indicates that the load data of the network access authentication request is suspected of being tampered with, extract the terminal device identifier from the network access authentication request, and perform abnormal behavior appending processing on the terminal access history summary field in the terminal identity image data corresponding to the terminal device identifier to generate an updated terminal access history summary field.

[0217] When the overall assessment result of the request load authenticity is questionable, the target IoT gateway G1 extracts the terminal device identifier (TID) and finds the corresponding terminal identity image data in the terminal identity image library. An abnormal behavior record is appended to the end of the terminal access history summary field. The record includes the current timestamp, the abnormal type identifier (i.e., suspected load tampering), and the digest hash of the current load feature fingerprint sequence. After appending, an updated terminal access history summary field is generated.

[0218] Step S1170: Write the updated terminal access history summary field back to the terminal identity image data corresponding to the terminal device identifier in the terminal identity image library, and store the currently detected load feature fingerprint sequence as a new adversarial example feature data in the adversarial example feature library.

[0219] The updated terminal access history summary field is written to the record corresponding to the terminal device identifier in the terminal identity image library. Simultaneously, the currently detected payload feature fingerprint sequence is stored as a new request feature tampering trace description in the adversarial example feature library.

[0220] Step S1180: Perform enhanced request source tagging processing on the network access authentication request. When generating the request source tag, attach an adversarial sample association tag and attach the request source tag with the adversarial sample association tag to the terminal identity image data to generate request source tag data carrying the enhanced source tag.

[0221] In step S117, when generating the request source tag, an adversarial sample association tag field is appended. This field contains the value of the tampered matching tag and the index number of the matched adversarial sample in the adversarial sample feature library. The request source tag with the appended adversarial sample association tag is then used as an enhanced source tag and appended to the terminal identity mirror data to generate request source tag data carrying the enhanced source tag. Subsequent steps use this enhanced source tag data for the authentication process.

[0222] Based on the same inventive concept, please refer to Figure 3 This diagram illustrates a schematic block diagram of an IoT gateway authentication system based on multi-terminal access provided in an embodiment of this application. The system includes a central processing unit (CPU), a system memory comprising random access memory (RAM) and read-only memory (ROM), and a system bus connecting the system memory and the CPU. The IoT gateway authentication system based on multi-terminal access also includes a basic input / output system to facilitate information transmission between various devices within the computer, and a large-capacity storage device for storing the operating system, applications, and other program modules.

[0223] A basic input / output system includes a display for showing information and input devices such as a mouse and keyboard for user input. Both the display and the input devices are connected to the central processing unit via an input / output controller connected to the system bus. The basic input / output system may also include an input / output controller for receiving and processing input from multiple other devices such as a keyboard, mouse, or electronic stylus. Similarly, the input / output controller also provides output to a display screen, printer, or other types of output devices.

[0224] A mass storage device is connected to the central processing unit via a mass storage controller connected to the system bus. The mass storage device and its associated computer-readable medium provide non-volatile storage for the multi-terminal access-based IoT gateway authentication system. Without loss of generality, the computer-readable medium can include computer storage media and communication media. Computer storage media includes volatile and non-volatile, removable and non-removable media implemented using any method or technology for storing information such as computer-readable instructions, data structures, program modules, or other data. According to various embodiments of this application, the multi-terminal access-based IoT gateway authentication system can also operate by connecting to a remote computer on a network such as the Internet. That is, the multi-terminal access-based IoT gateway authentication system can connect to a network via a network interface unit connected to the system bus, or it can use the network interface unit to connect to other types of networks or remote computer systems.

[0225] The above are merely exemplary embodiments of this application and are not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. An IoT gateway authentication method based on multi-terminal access, characterized in that, The method includes: After the target IoT gateway receives a network access authentication request from a terminal device, it performs device identity mirror association processing on the terminal device identifier carried in the network access authentication request to obtain terminal identity mirror data corresponding to the terminal device identifier, and performs request source marking processing on the terminal identity mirror data to generate request source mark data carrying the source mark. Based on the source tag contained in the request source tag data, a preset identity token bound to the source tag is extracted from the terminal identity token binding relationship table stored locally by the gateway. The preset identity token is then mixed and transformed with the current gateway clock signal output from the clock circuit of the target IoT gateway to generate a primary query vector. The primary query vector is then sent to the terminal device to trigger the terminal-side response generation operation. After receiving the terminal response data returned by the terminal device, the terminal response feature string and the terminal operating environment snapshot data are extracted from the terminal response data. The preset identity token is used to perform response source consistency verification processing on the terminal response feature string to obtain the response source consistency verification result. When the response source consistency verification result indicates that the response source is consistent, based on the source tag contained in the terminal operating environment snapshot data and the request source tag data, the access behavior of the terminal device is subjected to multi-dimensional fusion assessment of access risk, and an access risk assessment result is generated. Based on the access risk assessment results and the terminal device identifier, a network access license credential containing access license validity constraints is generated, and the network access license credential is issued to the terminal device to complete multi-terminal access authentication.

2. The IoT gateway authentication method based on multi-terminal access according to claim 1, characterized in that, After the target IoT gateway receives a network access authentication request from a terminal device, it performs device identity mirroring association processing on the terminal device identifier carried in the network access authentication request to obtain terminal identity mirror data corresponding to the terminal device identifier, and performs request source marking processing on the terminal identity mirror data to generate request source mark data carrying the source mark, including: Extract the gateway device's factory-fixed serial number and gateway private identification key from the non-volatile storage area of ​​the target IoT gateway, wherein the gateway device's factory-fixed serial number and the gateway private identification key are associated and bound together and stored in the non-volatile storage area during the factory deployment phase of the target IoT gateway; The request header data of the network access authentication request is parsed to extract the terminal type encoding field and the terminal unique serial number field corresponding to the terminal device identifier, and the terminal type encoding field and the terminal unique serial number field are combined into a terminal identifier tuple; Using the terminal identifier tuple as the index key, query the terminal identity image data that matches the index key from the terminal identity image library stored locally by the target IoT gateway. The terminal identity image library stores the identity image data of registered terminals, and each piece of identity image data includes a terminal communication capability description field and a terminal access history summary field. The terminal communication capability description field in the terminal identity image data is compared with the access request load data carried in the network access authentication request to obtain the load feature comparison result. The load feature comparison result includes a communication capability matching degree marker and a load anomaly marker. The communication capability matching degree marker in the load feature comparison result is correlated with the terminal access history summary field in the terminal identity image data to generate an access behavior consistency marker, wherein the access behavior consistency marker is used to indicate the degree of deviation between the current network access authentication request and the terminal's historical access behavior. The clock count value is extracted from the current gateway clock signal output by the clock circuit of the target IoT gateway, and the clock count value is processed by clock granularity division to generate a clock granularity sequence with a preset granularity unit. The access behavior consistency flag, the load anomaly flag in the load feature comparison result, the clock granularity sequence, and the gateway private identifier key are combined and encapsulated to generate a request source flag. The request source flag is then attached to the terminal identity image data to generate request source flag data carrying the source flag.

3. The IoT gateway authentication method based on multi-terminal access according to claim 1, characterized in that, The step of retrieving a preset identity token bound to the source token from the terminal identity token binding relationship table stored locally on the gateway based on the source token contained in the request source token data, and performing a mixing transformation process on the preset identity token and the current gateway clock signal output from the clock circuit of the target IoT gateway to generate a primary query vector, and sending the primary query vector to the terminal device to trigger the terminal-side response generation operation includes: The source tag contained in the request source tag data is parsed, and the storage index value of the terminal identity mirror data associated with the source tag and the request receiving context information are extracted from it, wherein the request receiving context information includes the request arrival timestamp and the request signal strength indication value; Using the storage index value as the query key, perform token lookup processing on the terminal identity token binding relationship table stored locally by the gateway, and extract the preset identity token corresponding to the storage index value, wherein the preset identity token includes a token body data segment and a token validity period flag field; The validity period flag field of the token is processed for validity determination. The valid start time and valid end time in the token validity period flag field are extracted. The current gateway clock signal is compared with the valid start time and valid end time in terms of time range to generate a token validity determination result. When the token validity determination result indicates that the preset identity token is within the validity period, the clock count value is extracted from the current gateway clock signal output by the clock circuit of the target IoT gateway, and the clock count value is processed by clock granularity division to generate a clock granularity sequence with a preset granularity unit. The token body data segment and the clock granularity sequence are input into a single-invertible mixing function for mixing transformation to generate a first-order query vector, wherein the output sequence of the single-invertible mixing function maintains a verifiable one-way mapping relationship with the token body data segment and the clock granularity sequence; The first-order query vector is subjected to vector length verification and vector randomness evaluation to obtain a vector quality evaluation result. When the vector quality evaluation result meets the preset conditions, the first-order query vector, the token validity period flag field, and the request receiving context information are encapsulated into a query request message data packet. The query request message data packet is then sent to the terminal device through the terminal communication interface of the target IoT gateway to trigger the terminal-side response generation operation.

4. The IoT gateway authentication method based on multi-terminal access according to claim 1, characterized in that, After receiving the terminal response data returned by the terminal device, the process involves extracting the terminal response feature string and terminal runtime environment snapshot data from the terminal response data, and using the preset identity token to perform response source consistency verification processing on the terminal response feature string to obtain the response source consistency verification result, including: The message body structure of the terminal response data is parsed, the response feature string storage field and the runtime environment snapshot storage field are located from the message body structure, the terminal response feature string is extracted from the response feature string storage field, and the terminal runtime environment snapshot data is extracted from the runtime environment snapshot storage field. The snapshot data of the terminal operating environment is deconstructed to obtain the terminal memory segment feature sequence, the terminal running process list and the terminal communication protocol stack version identifier. The terminal memory segment feature sequence is divided into memory segments by dividing the terminal memory segment feature sequence into multiple memory segment units according to a preset memory address range, and feature summary extraction is performed on each memory segment unit to generate a memory segment feature summary corresponding to each memory segment unit. Filter out the target process identifiers related to communication connection management from the terminal running process list, and extract the process execution path and process memory usage characteristic value corresponding to the target process identifier; The terminal communication protocol stack version identifier is matched with the set of compatible protocol stack versions stored locally by the target IoT gateway to generate a protocol stack version matching result. Extract the stored preset identity token from the current session context of the target IoT gateway, and use the token body data segment in the preset identity token to perform a one-way reversible mapping inverse transformation on the terminal response feature string to obtain response restoration feature data; The response restoration feature data is parsed to extract the challenge vector restoration value and terminal processing timestamp contained in the response restoration feature data. The challenge vector restoration value is compared and verified bit by bit with the original challenge vector corresponding to the terminal response feature string. Based on the result of the bit-by-bit comparison and verification, a response source consistency verification result indicating whether the response source is consistent is generated.

5. The IoT gateway authentication method based on multi-terminal access according to claim 1, characterized in that, When the response source consistency verification result indicates that the response source is consistent, based on the source tag contained in the terminal operating environment snapshot data and the request source tag data, a multi-dimensional fusion assessment of access risk is performed on the access behavior of the terminal device to generate an access risk assessment result, including: Extract the terminal access history summary field corresponding to the terminal identity image data from the source tag contained in the request source tag data, and parse the terminal access history summary field to obtain historical access frequency distribution data, historical access failure reason distribution data, and historical access duration distribution data; The historical access frequency distribution data is processed by frequency distribution feature extraction to generate access frequency distribution features that include access frequency peak time period markers and median access interval values. The terminal memory segment feature sequence, the process execution path corresponding to the target process identifier, and the process memory usage feature value are extracted from the terminal runtime environment snapshot data. The terminal memory segment feature sequence is then processed to generate a memory segment feature fingerprint to obtain the terminal memory feature fingerprint. The terminal memory feature fingerprint is compared with the legal memory feature fingerprint database stored locally by the target IoT gateway to generate a memory feature fingerprint comparison result, which includes fingerprint matching degree and fingerprint difference bit record. The process execution path is subjected to path compliance analysis processing, and the process execution path is matched with a preset set of legal paths to generate path compliance analysis results. The path compliance analysis results include path matching markers and path deviation descriptions. The process memory usage feature value is subjected to memory usage anomaly analysis processing. The process memory usage feature value is compared with a preset memory usage baseline range to generate memory usage anomaly analysis results. The access frequency distribution characteristics, the historical access failure reason distribution data, the memory feature fingerprint comparison results, the path compliance analysis results, and the memory usage anomaly analysis results are input into a multi-dimensional fusion evaluation function for comprehensive evaluation and processing to generate access risk assessment results.

6. The IoT gateway authentication method based on multi-terminal access according to claim 1, characterized in that, The method further includes: After the target IoT gateway issues the network access license credential to the terminal device, it receives the periodic keep-alive request message sent by the terminal device, and extracts the current operating environment snapshot data and the current communication signal strength value of the terminal from the periodic keep-alive request message; The snapshot data of the current running environment of the terminal is deconstructed to obtain the feature sequence of the current memory segment of the terminal and the list of the current running processes of the terminal. The process addition / deletion detection process is performed on the current running process list of the terminal. The current running process list of the terminal is compared item by item with the terminal running process list stored in the access authentication stage to obtain the process addition / deletion detection result. The process addition / deletion detection result includes a list of newly added process identifiers and a list of terminated process identifiers. The current memory segment feature sequence of the terminal is divided into memory segments and blocks. The current memory segment feature sequence of the terminal is divided into multiple current memory block units according to a preset memory address range. Feature summary extraction is performed on each current memory block unit to generate a current memory block feature summary corresponding to each current memory block unit. The current memory block feature summary corresponding to each current memory block unit is compared block by block with the memory block feature summary of the corresponding memory block unit stored in the access authentication stage to generate the memory feature drift amount of each memory block unit. When the list of newly added process identifiers in the process addition / deletion detection results contains at least one newly added process identifier, a path compliance analysis is performed on the execution path of the newly added process corresponding to each newly added process identifier, and a path compliance analysis result for the newly added process is generated. Based on the memory feature drift of each memory block unit and the compliance analysis results of the newly added process path, a terminal operating environment continuity assessment result is generated. When the terminal operating environment continuity assessment result indicates an abnormal change, the current network access license credential between the target IoT gateway and the terminal device is revoked, and the network access of the terminal device is terminated.

7. The IoT gateway authentication method based on multi-terminal access according to claim 1, characterized in that, The method further includes: When the target IoT gateway receives network access authentication requests sent simultaneously by multiple terminal devices, it parses the source markers in the request source marker data of the multiple terminal devices and extracts the terminal type encoding field and terminal communication capability description field corresponding to each terminal device. The plurality of terminal devices are grouped by terminal category according to the terminal type encoding field to obtain at least one terminal category group, and each terminal category group contains a set of terminal devices with the same terminal type encoding field. For terminal devices within each terminal category group, the terminal resource allocation is sorted according to the set of supported frequency bands and the maximum transmit power parameter in the terminal communication capability description field, generating a terminal resource allocation sequence within each terminal category group; Extract the currently available frequency band resource information from the communication frequency band resource table of the target IoT gateway. The currently available frequency band resource information includes a list of available frequency band identifiers and the frequency band bandwidth parameters and frequency band interference level markers corresponding to each available frequency band. Based on the terminal resource allocation sequence and the currently available frequency band resource information, the communication frequency band resources and authentication processing resources of the target IoT gateway are time-division multiplexed and scheduled, and authentication processing time windows and communication frequency band resources are allocated to the multiple terminal devices in sequence. For terminal devices allocated to the same communication frequency band resources, a statistical processing of the number of terminals in the same frequency band is performed. When the number of terminals in the same frequency band exceeds a preset frequency band load threshold, a frequency band load balancing adjustment processing is performed on the allocation scheme of the communication frequency band resources to generate an adjusted communication frequency band resource allocation scheme. The authentication processing time window information and the adjusted communication frequency band resource configuration information of each terminal device are encapsulated into the corresponding network access license credential, and the corresponding network access license credential is issued to each of the multiple terminal devices.

8. The IoT gateway authentication method based on multi-terminal access according to claim 1, characterized in that, The method further includes: After the target IoT gateway generates the access risk assessment result, the access risk assessment result, the terminal device identifier, and the source tag contained in the request source tag data are associated and stored in the terminal access behavior log record stored locally by the gateway. The historical access risk assessment results stored in the terminal access behavior log are processed by access risk trend analysis, and the access risk change trend features corresponding to the terminal device identifier are extracted. The access risk change trend features include risk upward trend markers and risk fluctuation amplitude descriptions. Based on the risk increase trend marker and risk fluctuation amplitude description in the access risk change trend characteristics, the token validity period marker field of the preset identity token corresponding to the terminal device identifier is dynamically adjusted to generate the adjusted token validity period marker field. Update the adjusted token validity period flag field to the preset identity token corresponding to the terminal device identifier in the terminal identity token binding relationship table stored locally by the gateway; Based on the updated preset identity token and the current gateway clock signal generated when the next network access authentication request sent by the terminal device is received, the token body data segment in the updated preset identity token and the clock granularity sequence generated by the current gateway clock signal are mixed and transformed to generate a new query vector used in the next authentication process.

9. The IoT gateway authentication method based on multi-terminal access according to claim 1, characterized in that, The method further includes: After the target IoT gateway establishes a network connection with multiple terminal devices, it receives terminal operation status report data periodically reported by each connected terminal device. The terminal operation status report data includes the current memory segment feature sequence of the terminal and the current communication signal strength value of the terminal. The current memory segment feature sequence reported by each connected terminal device is processed by memory segment block processing. The current memory segment feature sequence is divided into multiple current memory block units according to a preset memory address range. Feature summary extraction processing is performed on each current memory block unit to generate a current memory block feature summary corresponding to each current memory block unit. For each current memory block feature summary corresponding to each current memory block unit of each connected terminal device, a block-by-block comparison is performed with the memory block feature summary of the corresponding memory block unit stored by the corresponding terminal during the access authentication phase to generate the memory feature drift amount of each memory block unit of each connected terminal device. Calculate the overall drift value of memory features for each connected terminal device based on the memory feature drift of each memory block unit of each connected terminal device; The overall drift value of the memory features of each connected terminal device is compared with a preset drift threshold. Connected terminal devices whose overall drift value of memory features exceeds the preset drift threshold are classified into a suspected abnormal terminal set, and the remaining connected terminal devices are classified into a stable operating terminal set. For each terminal device in the suspected abnormal terminal set, the current communication signal strength value of the terminal corresponding to the terminal device is extracted, the changing trend of the current communication signal strength value of the terminal is analyzed and processed, and a signal strength changing trend marker is generated. Based on the signal strength change trend marker and the overall drift value of the memory characteristics of each terminal device in the suspected abnormal terminal set, a secondary confirmation process for abnormal terminals is performed to generate an abnormal terminal confirmation result. When the abnormal terminal confirmation result indicates that there is a confirmed abnormal terminal, the network access license certificate of the confirmed abnormal terminal is revoked, and a network access authentication re-initiation instruction is sent to the confirmed abnormal terminal to trigger a new round of authentication process.

10. An IoT gateway authentication system based on multi-terminal access, characterized in that, include: processor; A machine-readable storage medium for storing machine-executable instructions of the processor; The processor is configured to execute the IoT gateway authentication method based on multi-terminal access as described in any one of claims 1 to 9 by executing the machine-executable instructions.

Images