A security authentication method of a communication device and related apparatus

Abstract

Embodiments of the present application provide a security authentication method of a communication device and related apparatus, and relate to the technical field of information security. The robustness of security authentication is improved. The method comprises the following steps: for each candidate national cryptographic asymmetric algorithm in a candidate national cryptographic asymmetric algorithm set, the following operations are performed respectively: based on a target strategy parameter set, real-time state information of a target communication device, and a cost calculation strategy corresponding to one candidate national cryptographic asymmetric algorithm, the respective sub-costs of multiple cost dimensions generated by the target communication device using the one candidate national cryptographic asymmetric algorithm for security authentication are determined, and based on the sub-costs and the target strategy parameter set, the total cost generated by the target communication device using the one candidate national cryptographic asymmetric algorithm for security authentication is determined; from the candidate national cryptographic asymmetric algorithm set, a target national cryptographic asymmetric algorithm corresponding to the minimum total cost is selected, and the target national cryptographic asymmetric algorithm is used to perform security authentication on the target communication device.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a security authentication method and related apparatus for communication devices. Background Technology

[0002] With the deepening development of the Internet of Everything era, the number of devices connected to communication networks has surged and the operating environment has become increasingly complex. Secure authentication of device identities has become a key link in ensuring basic network security and preventing unauthorized access and attacks, and has a vital impact on the overall security and stable operation of the network.

[0003] Currently, communication device authentication mechanisms based on national cryptographic asymmetric algorithms (such as SM2 and SM9 algorithms) are widely used as a reliable technology supported by national cryptographic standards for security authentication of communication devices.

[0004] Existing security authentication methods typically employ static authentication strategies, selecting a fixed national cryptographic asymmetric algorithm (such as SM2 or SM9) for communication devices and configuring the corresponding authentication process. However, this approach suffers from a single algorithm, potentially leading to poor scenario adaptability and underutilization of communication device performance. Summary of the Invention

[0005] This application provides a security authentication method and related apparatus for communication devices, which solves the problem that traditional communication device security authentication encryption algorithms are fixed and cannot be flexibly adjusted according to specific environments, thereby improving the robustness of security authentication.

[0006] In a first aspect, embodiments of this application provide a security authentication method for a communication device, the method comprising: The target policy parameter set for the target communication device is sent by the server. The target policy parameter set is determined based on the characteristic information of the target communication device. For each candidate national cryptographic asymmetric algorithm in the candidate national cryptographic asymmetric algorithm set, the following operations are performed: Based on the target policy parameter set, the real-time status information of the target communication device, and the cost calculation strategy corresponding to a candidate national cryptographic asymmetric algorithm, determine the sub-costs of each of the multiple cost dimensions generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication, and based on each sub-cost and the target policy parameter set, determine the total cost generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication. The multiple cost dimensions include: time dimension, energy dimension, and risk dimension. From the set of candidate national cryptographic asymmetric algorithms, the target national cryptographic asymmetric algorithm with the minimum total cost is selected, and the target national cryptographic asymmetric algorithm is used to perform security authentication on the target communication device.

[0007] Secondly, embodiments of this application also provide a security authentication device for a communication device, the device comprising: The receiving module is used to receive the target policy parameter set of the target communication device sent by the server. The target policy parameter set is determined based on the characteristic information of the target communication device. The cost calculation module is used to perform the following operations for each candidate national cryptographic asymmetric algorithm in the candidate national cryptographic asymmetric algorithm set: based on the target policy parameter set, the real-time status information of the target communication device, and the cost calculation strategy corresponding to a candidate national cryptographic asymmetric algorithm, determine the sub-costs of each of the multiple cost dimensions generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication, and based on each sub-cost and the target policy parameter set, determine the total cost generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication, wherein the multiple cost dimensions include: time dimension, energy dimension, and risk dimension; The security authentication module is used to select the target national cryptographic asymmetric algorithm with the minimum total cost from the candidate national cryptographic asymmetric algorithm set, and to use the target national cryptographic asymmetric algorithm to perform security authentication on the target communication device.

[0008] Thirdly, embodiments of this application also provide an electronic device, including: Processor; and Stored program memory, The program includes instructions that, when executed by a processor, cause the processor to perform the security authentication method for the communication device as described in the first aspect.

[0009] Fourthly, embodiments of this application also provide a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to execute the security authentication method of the communication device as described in the first aspect.

[0010] Fifthly, this application provides a computer program product that, when invoked by a computer, causes the computer to execute the security authentication method steps of the communication device as described in the first aspect.

[0011] The beneficial effects of this application are as follows: In the security authentication method for communication devices provided in this application embodiment, each time the target communication device needs to perform security authentication, the target policy parameter set of the target communication device is received from the server; then, for each candidate national cryptographic asymmetric algorithm in the candidate national cryptographic asymmetric algorithm set, the following operations are performed respectively: based on the target policy parameter set, the real-time status information of the target communication device, and the cost calculation strategy corresponding to a candidate national cryptographic asymmetric algorithm, the sub-costs of each of the multiple cost dimensions generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication are determined, and based on each sub-cost and the target policy parameter set, the total cost generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication is determined; finally, from the candidate national cryptographic asymmetric algorithm set, the target national cryptographic asymmetric algorithm with the smallest corresponding total cost is selected, and the target national cryptographic asymmetric algorithm is used to perform security authentication on the target communication device. In this way, the target communication device no longer passively accepts a fixed national cryptographic asymmetric algorithm, but actively calculates a comprehensive total cost for each candidate national cryptographic asymmetric algorithm based on real-time state information and a target policy parameter set related to the target communication device's characteristic information for each security authentication. The candidate national cryptographic asymmetric algorithm with the minimum total cost is selected as the target national cryptographic asymmetric algorithm for security authentication of the target communication device. This improves the flexibility of security authentication while achieving the goal of minimizing cost, meeting the security authentication needs of communication devices in multiple scenarios. Furthermore, by calculating the total cost through multiple cost dimensions, the final algorithm selection is no longer a competition of a single indicator, but can make an optimal trade-off between the three often conflicting goals of time, energy, and risk based on the real-time scenario. This significantly improves the robustness of security authentication and its broad adaptability to complex and ever-changing application scenarios.

[0012] Furthermore, other features and advantages of this application will be set forth in the following description and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description and drawings. Attached Figure Description

[0013] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described herein are used to provide a further understanding of this application, constitute a part of this application, and do not constitute an improper limitation of this application. In the accompanying drawings: Figure 1 This is a schematic diagram of an optional system architecture applicable to the embodiments of this application.

[0014] Figure 2 This is a schematic diagram illustrating the implementation process of a security authentication method for a communication device provided in an embodiment of this application.

[0015] Figure 3 This is a logical schematic diagram of a security authentication method for a communication device provided in an embodiment of this application.

[0016] Figure 4 This is a schematic diagram of the structure of a security authentication device for a communication device provided in an embodiment of this application.

[0017] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0018] Embodiments of this application will now be described in more detail with reference to the accompanying drawings. While some embodiments of this application are shown in the drawings, it should be understood that this application can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this application. It should be understood that the drawings and embodiments of this application are for illustrative purposes only and are not intended to limit the scope of protection of this application.

[0019] It should be understood that the steps described in the method embodiments of this application may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this application is not limited in this respect.

[0020] The term "comprising" and its variations as used herein are open-ended, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the following description. It should be noted that the concepts of "first", "second", etc., mentioned in this application are used only to distinguish different devices, modules, or units, and are not intended to limit the order of functions performed by these devices, modules, or units or their interdependencies.

[0021] It should be noted that the terms "a" and "a plurality of" used in this application are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0022] The names of the messages or information exchanged between multiple devices in the embodiments of this application are for illustrative purposes only and are not intended to limit the scope of these messages or information.

[0023] The design concept of the embodiments of this application is briefly introduced below: With the deepening development of the Internet of Everything era, the number of devices connected to communication networks has surged and the operating environment has become increasingly complex. Secure authentication of device identities has become a key link in ensuring basic network security and preventing unauthorized access and attacks, and has a vital impact on the overall security and stable operation of the network.

[0024] Currently, communication device authentication mechanisms based on national cryptographic asymmetric algorithms (such as SM2 and SM9) are widely used for security authentication of communication devices as a reliable technology supported by national cryptographic standards. Among them, the SM2 algorithm has significant advantages in standardization, compatibility, and computational efficiency, and can adapt well to the hardware conditions and operating environments of various communication devices. The SM9 algorithm is based on the IBC (Identifier-Based Cryptography) system and does not rely on the PKI / CA system, saving resources such as certificate application, storage, and transmission; however, its security is relatively weaker than SM2.

[0025] Existing security authentication methods typically employ static authentication strategies, selecting a fixed national cryptographic asymmetric algorithm (such as SM2 or SM9) for communication devices and configuring the corresponding authentication process. However, this approach can lead to poor overall performance in terms of authentication efficiency, device energy consumption, and security reliability in complex scenarios with high mobility, energy sensitivity, or variable network conditions. It is difficult to achieve a globally optimal balance between security, efficiency, and resources in dynamic environments. For example, using a fixed SM2 algorithm can result in significant communication latency and additional energy consumption due to its certificate-based verification process (such as OCSP queries and certificate transmission) under poor network conditions (high latency, high packet loss). When device battery is low, its relatively high computational and communication overhead can accelerate battery depletion. Furthermore, there is a risk of authentication failure and service interruption when certificates are nearing expiration or verification services are unavailable. For example, while using a fixed SM9 algorithm eliminates certificate management overhead and has advantages in weak network or energy-saving scenarios, its security is theoretically lower than that of the SM2 algorithm. In scenarios with extremely high security requirements, using the SM9 algorithm in a fixed manner will introduce unnecessary and continuous security risks.

[0026] In view of this, this application provides a method and related apparatus for secure authentication of communication devices. Each time a target communication device needs to undergo secure authentication, it receives a target policy parameter set from a server. The target policy parameter set is determined based on the characteristic information of the target communication device. Then, for each candidate national cryptographic asymmetric algorithm in the candidate national cryptographic asymmetric algorithm set, the following operations are performed: based on the target policy parameter set, the real-time status information of the target communication device, and the cost calculation strategy corresponding to a candidate national cryptographic asymmetric algorithm, the sub-costs of each of the multiple cost dimensions generated by the target communication device using a candidate national cryptographic asymmetric algorithm for secure authentication are determined. Based on each sub-cost and the target policy parameter set, the total cost generated by the target communication device using a candidate national cryptographic asymmetric algorithm for secure authentication is determined. The multiple cost dimensions include: time dimension, energy dimension, and risk dimension. Finally, from the candidate national cryptographic asymmetric algorithm set, the target national cryptographic asymmetric algorithm with the minimum corresponding total cost is selected, and the target national cryptographic asymmetric algorithm is used to perform secure authentication of the target communication device. In this way, the target communication device no longer passively accepts a fixed national cryptographic asymmetric algorithm, but actively calculates a comprehensive total cost for each candidate national cryptographic asymmetric algorithm based on real-time state information and a target policy parameter set related to the target communication device's characteristic information for each security authentication. The candidate national cryptographic asymmetric algorithm with the minimum total cost is selected as the target national cryptographic asymmetric algorithm for security authentication of the target communication device. This improves the flexibility of security authentication while achieving the goal of minimizing cost, meeting the security authentication needs of communication devices in multiple scenarios. Furthermore, by calculating the total cost through multiple cost dimensions, the final algorithm selection is no longer a competition of a single indicator, but can make an optimal trade-off between the three often conflicting goals of time, energy, and risk based on the real-time scenario. This significantly improves the robustness of security authentication and its broad adaptability to complex and ever-changing application scenarios.

[0027] In particular, the preferred embodiments of this application will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit this application. Furthermore, the embodiments of this application and the features in the embodiments can be combined with each other without conflict.

[0028] See Figure 1 As shown, it is a schematic diagram of an optional system architecture applicable to the embodiments of this application. The system architecture may include: communication devices (101a, 101b, 101c) and server 102.

[0029] This application does not limit the number of network devices involved in the above system architecture. For example, the above system architecture may include more communication devices, or it may include fewer communication devices, or it may include other network devices. Figure 1As shown, only communication devices (101a, 101b, 101c) and server 102 are described as examples. The following is a brief introduction to each of the above network devices and their respective functions.

[0030] For example, any one of the communication devices (101a, 101b, 101c) is the target communication device in this application embodiment. The communication device is the device to be authenticated. Specifically, the communication device is a high-performance sensor around an important infrastructure.

[0031] Server 102 is an authentication server; specifically, server 102 is an industrial IoT platform server.

[0032] The following describes the security authentication method for communication devices provided by exemplary embodiments of this application in conjunction with the above-described system architecture and with reference to the accompanying drawings. It should be noted that the above-described system architecture is only shown to facilitate understanding of the spirit and principles of this application, and the embodiments of this application are not limited in any way in this respect.

[0033] See Figure 2 The diagram shown illustrates the implementation flow of a security authentication method for a communication device provided in this application. Taking the target communication device as an example, the specific implementation flow of this method is as follows: S20: Receive the target policy parameter set of the target communication device sent by the server.

[0034] The target policy parameter set is determined based on the characteristic information of the target communication device. It serves as the decision criterion for adaptively selecting the target national cryptographic asymmetric algorithm, guiding the target communication device to make the most suitable adaptive selection for the current scenario and overall strategy during security authentication. The characteristic information includes: device characteristic information (e.g., processing power score, memory size, etc.) and environmental characteristic information (e.g., round-trip time, signal-to-noise ratio, packet loss rate, etc.). The target policy parameter set includes, but is not limited to: weight parameters for each of the multiple cost dimensions, identifiers related to cost calculation, and constants. The identifiers and constants related to cost calculation include: first identifier, second identifier, third identifier, first constant, second constant, third constant, and fourth constant.

[0035] In this embodiment of the application, in order to flexibly adjust the target policy parameter set of the target communication device, the target communication device provides its own characteristic information to the server during security authentication. Based on the characteristic information of the target communication device, the server determines the target policy parameter set of the target communication device and sends the target policy parameter set to the target device so that the target device receives the target policy parameter set sent by the server. Specifically, when the server sends the target policy parameter set to the target device, the content of the target policy parameter set is independent of the extended fields outside the national cryptographic asymmetric algorithm.

[0036] Optionally, in this embodiment of the application, after the server determines the target policy parameter set of the target communication device based on the characteristic information of the target communication device, if it is determined that the target policy parameter set has changed, the server will send the new target policy parameter set to the target device so that the target device can receive the new target policy parameter set sent by the server. If it is determined that the target policy parameter set has not changed, the server will not send the new target policy parameter set so that the target device can continue to use the old target policy parameter set.

[0037] Optionally, in this embodiment, the target policy parameter set is determined by the server clustering each device according to each feature dimension based on the feature information of each device, obtaining various clusters corresponding to each feature dimension, and then selecting the target policy parameter set from each candidate policy parameter set based on the target cluster to which the target communication device belongs in each feature dimension. Specifically, the target device reports its feature information to the server, the server clusters each device according to each feature dimension based on the feature information of each device, obtains various clusters corresponding to each feature dimension, then determines the target cluster to which the target communication device belongs in each feature dimension, and uses the candidate policy parameter set corresponding to each target cluster as the target policy parameter set of the target communication device.

[0038] Among them, the target communication device belongs to each device, and each feature dimension includes: device performance, packet loss type and certificate coverage.

[0039] For example, suppose the clustering results of each device in the device performance dimension are cluster A (representing high performance), cluster B (representing medium performance), and cluster C (representing low performance); the clustering results of each device in the packet loss type dimension are cluster D (representing mainly congestion packet loss) and cluster E (representing mainly bit error packet loss); and the clustering results of each device in the certificate coverage dimension are cluster F (representing healthy certificates), cluster G (representing certificates nearing expiration), and cluster H (representing certificate status and service unavailable). The target device belongs to cluster A, cluster D, and cluster G in each feature dimension. A corresponding set of candidate strategy parameters is pre-configured for the combination of clusters in each dimension (e.g., for the combination of {high-performance cluster, congestion packet loss cluster, and certificate health cluster}, the weight corresponding to the time sub-cost can be configured to be higher, the weight corresponding to the energy sub-cost to be lower, and the weight corresponding to the risk sub-cost to be lower; for {low-performance cluster, bit error packet loss cluster, and certificate nearing expiration cluster}...). The combination of configurable time sub-costs has a lower weight, energy sub-costs have a higher weight, and risk sub-costs have a higher weight. Among them, the candidate policy parameter set corresponding to the combination of clusters A, D, and G is the candidate policy parameter set A. Then, the candidate policy parameter set A is used as the target policy parameter set of the target communication device.

[0040] In this way, by clustering devices in multiple dimensions using feature information, appropriate policy parameter sets can be assigned to device groups with different characteristics. This ensures that devices with different characteristics can obtain the most suitable target policy parameter set, greatly improving the accuracy and scientific nature of adaptive decision-making. Furthermore, placing clustering analysis and policy allocation tasks on the server side leverages the server's global perspective and powerful computing capabilities, avoiding complex calculations on resource-constrained communication devices and ensuring the consistency and manageability of the entire system's policies.

[0041] Optionally, in this embodiment, the target strategy parameter set is obtained by the server clustering each sample device according to each feature dimension based on the feature information of each sample device, obtaining each comprehensive cluster, and then selecting from each candidate strategy parameter set based on the distance between the feature vector of the target device and the centroid of each comprehensive cluster. Specifically, the server clusters each sample device according to each feature dimension based on the feature information of each sample device, obtains each comprehensive cluster, then extracts the feature vector of the target device based on the feature information of the target device, calculates the distance between the feature vector of the target device and the centroid of each comprehensive cluster, and selects the comprehensive cluster with the smallest distance between the centroid and the feature vector of the target device as the target comprehensive cluster of the target device, and the candidate strategy parameter set associated with the target comprehensive cluster as the target strategy parameter set of the target communication device.

[0042] For example, suppose the clustering results of each sample device are comprehensive cluster I, comprehensive cluster J, comprehensive cluster K, comprehensive cluster L, comprehensive cluster M, and comprehensive cluster N. A corresponding candidate strategy parameter set is pre-configured for each comprehensive cluster. The distance between the feature vector of the target device and the centroid of comprehensive cluster I is the smallest. The candidate strategy parameter set corresponding to comprehensive cluster I is candidate strategy parameter set A. Then, candidate strategy parameter set A is used as the target strategy parameter set of the target communication device.

[0043] Optionally, in this embodiment, before performing security authentication, each communication device (including the target communication device) and server are initialized for each candidate national cryptographic asymmetric algorithm. Specifically, during the device factory initialization or system deployment phase, the common basic parameters of the SM2 and SM9 algorithms are uniformly configured to the secure storage area of ​​the target communication device and server, and the target communication device and server combine the public key P of the SM2 algorithm... SM2 The device's unique identifier and certificate application information are sent to the CA to apply for a certificate. Both the target communication device and the server receive the certificate requested by the other. The certificate contains the identifier information, public key information, and authorization information of the target communication device or server. The common basic parameters of the SM2 algorithm include: prime field modulus, elliptic curve coefficients a and b, base point G, and base point order; the common basic parameters of the SM9 algorithm include: elliptic curve field parameters, bilinear pairing identifier, and public key P. SM9In addition, some communication devices in each communication device may only deploy one national cryptographic asymmetric algorithm (either the SM2 algorithm or the SM9 algorithm). Such communication devices do not participate in the adaptive algorithm selection step (i.e., S20~S22) and directly use the deployed national cryptographic asymmetric algorithm for security authentication. This application embodiment does not impose any restrictions on this.

[0044] Furthermore, it is worth noting that in this embodiment, before receiving the target policy parameter set for the target communication device from the server, the target communication device determines its current security level. When the security level of the target communication device meets the preset high security conditions, the SM2 algorithm is used to perform security authentication on the target communication device. In this way, by setting security level exception rules, the mandatory requirement that a specific high-security national cryptographic asymmetric algorithm (such as the SM2 algorithm) must be used for specific devices or scenarios is met. Flexible optimization is performed while meeting the hard security baseline, making the solution both highly principled and flexible, and easier to deploy and apply in environments with strict regulatory oversight. Specifically, when the security level of the target communication device is determined to be high security, the SM2 algorithm is directly used to perform security authentication on the target communication device, without participating in the adaptive algorithm selection steps (i.e., S20~S22). The current security level of the target communication device can be determined by a security level identifier, or it can be determined by features such as device type, business importance, and compliance requirements.

[0045] S21: For each candidate national cryptographic asymmetric algorithm in the candidate national cryptographic asymmetric algorithm set, perform the following operations respectively: Based on the target policy parameter set, the real-time status information of the target communication device, and the cost calculation strategy corresponding to a candidate national cryptographic asymmetric algorithm, determine the sub-costs of each of the multiple cost dimensions generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication, and based on each sub-cost and the target policy parameter set, determine the total cost generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication.

[0046] The multiple cost dimensions include: time dimension, energy dimension, and risk dimension. The candidate set of national cryptographic asymmetric algorithms includes: SM2 algorithm and SM9 algorithm.

[0047] In this embodiment of the application, after the target communication device completes power-on startup, network access, and local status self-check, before sending a formal security authentication request to the server, for each candidate national cryptographic asymmetric algorithm in the candidate national cryptographic asymmetric algorithm set, the following operations are performed respectively: based on each identifier and constant related to cost calculation in the target policy parameter set, the real-time status information of the target communication device, and the cost calculation strategy corresponding to a candidate national cryptographic asymmetric algorithm, the sub-costs of each of the multiple cost dimensions generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication are determined, and the sub-costs are weighted and summed based on the weight parameters of each of the multiple cost dimensions to obtain the total cost generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication.

[0048] In this embodiment of the application, the calculation formula for the total cost of a candidate national cryptographic asymmetric algorithm can be specifically expressed as follows:

[0049] Where α is the weight parameter corresponding to the time dimension, β is the weight parameter corresponding to the energy dimension, γ is the weight parameter corresponding to the risk dimension, T is the sub-cost generated in the time dimension when the target communication device uses a candidate national cryptographic asymmetric algorithm for security authentication, i.e., the time sub-cost, E is the sub-cost generated in the energy dimension when the target communication device uses a candidate national cryptographic asymmetric algorithm for security authentication, i.e., the energy sub-cost, and R is the sub-cost generated in the risk dimension when the target communication device uses a candidate national cryptographic asymmetric algorithm for security authentication, i.e., the risk sub-cost.

[0050] Optionally, in this embodiment of the application, a possible implementation method is provided for determining the sub-costs of each of the multiple cost dimensions generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication, based on the cost calculation related identifiers and constants in the target policy parameter set, the real-time status information of the target communication device, and the cost calculation strategy corresponding to a candidate national cryptographic asymmetric algorithm. Specifically, this includes the following operations: S210: Determine the network quality coefficient of the target communication device based on the current packet loss rate in the real-time status information and the target penalty coefficient for congestion and packet loss.

[0051] In this embodiment of the application, the difference between 1 and the current packet loss rate is calculated, and the ratio between the target penalty coefficient and the difference is calculated to obtain the network quality coefficient.

[0052] Specifically, in this embodiment, the calculation formula for the network quality coefficient of the target communication device can be expressed as follows: η / (1-p), where η is the target penalty coefficient for congestion and packet loss, and p is the current packet loss rate (i.e. the probability of packet retransmission).

[0053] Optionally, in this embodiment, since the network quality coefficient (i.e., packet loss rate and target penalty coefficient) participates in the calculation of subsequent time sub-cost and energy sub-cost, and amplifies the impact of the number of interactions and average power between the SM2 and SM9 algorithms on the calculation results, it is necessary to improve the prediction accuracy of packet loss rate and target penalty coefficient as much as possible. The target penalty coefficient is determined in the following way: SA1: Based on the relative changes of the recent average signal-to-noise ratio (SNR) of the target communication device to the long-term average SNR, and the relative changes of the recent average round-trip delay (RTD) of the target communication device to the long-term average RTD, determine the current congestion and packet loss percentage of the target communication device.

[0054] Among them, the congestion packet loss ratio is used to quantify the proportion of congestion packet loss components in the current packet loss causes.

[0055] In this embodiment, the ratio of the difference between the recent average round-trip time (RTD) and the long-term average RTD to the long-term average RTD is calculated to obtain a first relative change in the recent average RTD relative to the long-term average RTD. When the value of the first relative change is less than 0, the value of the first relative change is updated to 0. Simultaneously, the ratio of the difference between the recent average signal-to-noise ratio (SNR) and the long-term average SNR to the long-term average SNR is calculated to obtain a second relative change in the recent average SNR relative to the long-term average SNR. When the value of the second relative change is less than 0, the value of the second relative change is updated to 0. Then, the first relative change and the second relative change are added together to obtain the total relative change. Finally, the ratio between the first relative change and the total relative change is calculated to obtain the current congestion packet loss ratio of the target communication device.

[0056] In this embodiment, the network quality coefficient considers packet loss type, which can be mainly divided into congestion packet loss and bit error packet loss. These two types of packet loss reflect different channel states. During congestion packet loss, the measured round-trip time (RTT) increases, while during bit error packet loss, the measured signal-to-noise ratio (SNR) decreases. To determine the packet loss type, the target communication device recursively calculates the average RTT across all communication processes (including service communication and security authentication communication) as the baseline state of the current channel. In this embodiment, the calculation formula for the long-term average round-trip time can be specifically expressed as follows:

[0057] Where n is the number of long-term communications, and RTT is the total time to transmit data. n Let be the round-trip time of the nth communication of the target communication device. It represents the average round-trip delay of the target communication device in the first n-1 communications.

[0058] In this embodiment of the application, the calculation formula for the recent average round-trip delay can be specifically expressed as follows:

[0059] Where k is the number of recent communications, k < n, RTT i Let be the round-trip time of the i-th communication of the target communication device.

[0060] Similarly, calculate the long-term signal-to-noise ratio mean. Compared with recent average signal-to-noise ratio .

[0061] SA2: Determine the target penalty coefficient based on the initial penalty coefficient and the proportion of congestion and packet loss.

[0062] The initial penalty coefficient represents the penalty coefficient when all packet loss types are congestion packet loss.

[0063] In this embodiment of the application, for congestion and packet loss, retransmission will further increase the network burden, resulting in the impact of high packet loss rate being greater than that of error packet loss. Therefore, a target penalty coefficient for congestion and packet loss is proposed. The product of the initial penalty coefficient and the proportion of congestion and packet loss is calculated to obtain the penalty coefficient under partial congestion and packet loss (i.e., the target penalty coefficient).

[0064] In this embodiment of the application, the calculation formula for the target penalty coefficient can be specifically expressed as follows:

[0065] Where η0 is the initial penalty coefficient, representing the penalty coefficient under complete congestion and packet loss.

[0066] In this way, by comparing the recent and long-term round-trip delay and signal-to-noise ratio changes, the proportion of congestion packet loss can be determined, and the initial penalty coefficient can be dynamically adjusted accordingly. This allows for additional penalties to be imposed on congestion packet loss, which more realistically reflects the severity of how congestion packet loss exacerbates retransmissions and vicious cycles. This guides the selection of adaptive national cryptographic asymmetric algorithms to prioritize avoiding national cryptographic asymmetric algorithms with huge communication overhead in congested networks.

[0067] Optionally, in this embodiment of the application, when determining the current packet loss rate, the current signal-to-noise ratio of the target communication device is obtained, and the current packet loss rate is determined by the mapping function between the signal-to-noise ratio and the packet loss rate.

[0068] The mapping function contains mapping parameters, which are obtained by iteratively updating observation sample pairs using a recursive least squares algorithm. The observation sample pairs are the historical signal-to-noise ratio and historical packet loss rate obtained by the target communication device during historical communication.

[0069] In this embodiment, since the bit error rate (BER) and signal-to-noise ratio (SNR) have an approximately exponential relationship under common digital modulation, and the packet loss rate has an approximately linear relationship when the BER is sufficiently small, a mapping function between SNR and packet loss rate is established. Specifically, in this embodiment, the mapping function between SNR and packet loss rate can be expressed as follows:

[0070] in, is the current signal-to-noise ratio of the target communication device, which is calculated by the communication module; a and b are mapping parameters. Since the mapping accuracy needs to be optimized in specific scenarios, a and b are adjustable. The mapping function is optimized using the Recursive Least Squares (RLS) algorithm. The RLS algorithm does not require storing and calling old samples for calculation, making it more friendly to resource-constrained communication devices.

[0071] The following section describes the acquisition of the latest observation sample pairs (including the latest packet loss rate p). n and the latest signal-to-noise ratio (SNR) n When updating the mapping parameters, the process is described as follows: First, the old mapping parameters (a) are calculated. n-1 b n-1 ) and the old covariance matrix (P n-1 ), and calculate the gain (K) by combining the latest observed sample pairs. n ) and prediction error (e n Then, the old mapping parameters and the old covariance matrix are updated using the gain and prediction error to obtain the new mapping parameters (a). n b n ) and the new covariance matrix (P n Finally, the new mapping parameters and the new covariance matrix will be stored by the target communication device for use in the next packet loss rate prediction.

[0072] In this embodiment, the calculation formulas for gain and prediction error can be specifically expressed as follows:

[0073]

[0074] In this embodiment, the calculation formulas for the new mapping parameters and the new covariance matrix can be specifically expressed as follows:

[0075]

[0076] Where σ is the forgetting factor, used to control the weight of historical data, and K n With en It can be obtained through the previous parameters [ a n 1, b n 1]、P n 1 and the current input SNR n Perform calculations, and then use K n With e n renew[ a n b n ] and P n After completing one recursion, the initial mapping parameters a0 and b0 can be 0.1 and 0.5 respectively. At this time, when the signal-to-noise ratio fluctuates between 25dB and 10dB, the packet loss rate will fluctuate between 1% and about 30%.

[0077] In this way, by using the signal-to-noise ratio, a directly measurable parameter at the physical layer, to predict the packet loss rate, and by using the recursive least squares algorithm to learn and optimize the mapping parameters online, the prediction model can adapt to specific wireless channel environments and modulation methods. This is more accurate and timely than using fixed empirical values ​​or simply statistically analyzing historical packet loss rates, and significantly improves the basic accuracy of network quality coefficients and even the entire cost calculation.

[0078] S211: Based on the network quality coefficient, the time index in the real-time status information, the target policy parameter set, and the cost calculation strategy corresponding to a candidate national cryptographic asymmetric algorithm, determine the time sub-cost generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication.

[0079] Among them, the time sub-cost is the sub-cost generated in the time dimension when the target communication device performs security authentication using a candidate national cryptographic asymmetric algorithm.

[0080] In this embodiment of the application, the time sub-cost generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication includes at least: the computation time required to perform the core operation of a candidate national cryptographic asymmetric algorithm (i.e., algorithm computation time) and the communication transmission time estimated based on the current network round-trip latency and number of interactions; when the SM2 algorithm is used, the time sub-cost also includes the time required to verify the certificate status online (i.e., certificate status verification time). Optionally, in this embodiment, the calculation of the time sub-cost generated by the SM2 and SM9 algorithms for security authentication of the target communication device is described in detail: Scenario 1: When a candidate national cryptographic asymmetric algorithm is the SM2 algorithm, based on the time index and the target policy parameter set, determine the first algorithm calculation time, the first communication transmission time, and the certificate status verification time generated by the current target communication device using the SM2 algorithm for security authentication. Based on the first algorithm calculation time, the first communication transmission time, the certificate status verification time, and the network quality coefficient, determine the time sub-cost generated by the target communication device using the SM2 algorithm for security authentication.

[0081] The computation time of the first algorithm is the computation time required for signature generation and verification using the SM2 algorithm. Time metrics include: computation time of the first algorithm, round-trip latency of one interaction between the target communication device and the server, execution time required for the target communication device to execute the Online Certificate Status Protocol (OCSP), and the number of interactions corresponding to the SM2 algorithm. The target policy parameter set includes: a first identifier; the first identifier indicates whether the target communication device executes OCSP. If the certificate validity is verified using a Certificate Revocation List (CRL) or communication with the OCSP server is unavailable, the first identifier is 0; otherwise, it is 1.

[0082] In this embodiment, the first communication transmission duration is obtained by multiplying the round-trip delay between the target communication device and the server by the number of interactions corresponding to the SM2 algorithm; the certificate status verification duration is determined based on the first identifier contained in the target policy parameter set and the execution duration required for the target communication device to perform OCSP; then, the first communication transmission duration and the certificate status verification duration are multiplied by the network quality coefficient, respectively, and the two products are added to the first algorithm calculation duration to obtain the time sub-cost generated by the target communication device using the SM2 algorithm for security authentication.

[0083] In this embodiment of the application, the calculation formula for the time sub-cost generated by the target communication device using the SM2 algorithm for security authentication can be specifically expressed as follows:

[0084] in, The calculation time for the first algorithm is fixed for each communication device and can be determined using historical measurement data; η / (1-p) is the network quality coefficient; m SM2 This represents the number of interactions corresponding to the SM2 algorithm, typically 6 times; RTT is the round-trip time between the target communication device and the server, which can be extracted from the most recent communication (including business communication) or obtained by sending a test packet before security authentication; δ T The first identifier; tOCSP The execution time required for the target communication device to perform OCSP is obtained by sending a test packet before security authentication.

[0085] Thus, for the SM2 algorithm, the "certificate status verification time" is explicitly included, which accurately reflects the additional time overhead brought about by the PKI-based algorithm in addition to security. This ensures the accuracy of the time sub-cost evaluation and is the key to the correct operation of adaptive selection.

[0086] Scenario 2: When a candidate national cryptographic asymmetric algorithm is the SM9 algorithm, based on the time index, determine the second algorithm calculation time and the second communication transmission time generated by the target communication device using the SM9 algorithm for security authentication. Based on the second algorithm calculation time and the second communication transmission time, determine the time sub-cost generated by the target communication device using the SM9 algorithm for security authentication.

[0087] The computation time of the second algorithm is the computation time required for the bilinear pairing and dot product operations of the SM9 algorithm. Other time metrics include: the computation time of the second algorithm and the number of interactions required by the SM9 algorithm.

[0088] In this embodiment, the second communication transmission duration is obtained by multiplying the round-trip delay between the target communication device and the server by the number of interactions corresponding to the SM9 algorithm; then, the second communication transmission duration is multiplied by the network quality coefficient, and the resulting product is added to the second algorithm calculation duration to obtain the time sub-cost generated by the target communication device using the SM9 algorithm for security authentication.

[0089] In this embodiment, the calculation formula for the time sub-cost generated by the target communication device using the SM9 algorithm for security authentication can be specifically expressed as follows:

[0090] in, The calculation time for the second algorithm is fixed for each communication device and can be determined using historical measurement data; η / (1-p) is the network quality coefficient; m SM9 The number of interactions corresponding to the SM9 algorithm is usually 4; RTT is the round-trip time between the target communication device and the server, which can be extracted from the most recent communication (including business communication) or obtained by sending a test packet before security authentication. S212: Based on the network quality coefficient, time and energy indicators in real-time status information, target policy parameter set, and cost calculation strategy corresponding to a candidate national cryptographic asymmetric algorithm, determine the energy sub-cost generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication.

[0091] Among them, the energy sub-cost is the sub-cost generated in the energy dimension by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication.

[0092] In this embodiment of the application, the energy quantum cost generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication is at least related to the remaining power ratio of the target communication device, the computational energy consumption of the execution algorithm operation generated by the target communication device using the SM2 algorithm for security authentication, and the communication power consumption of the communication process.

[0093] In this embodiment, when determining the energy sub-cost generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication, the following steps are taken: First, based on the remaining power ratio in the energy index and a first constant included in the target policy parameter set, the current power sensitivity adjustment factor corresponding to the target communication device is determined. Then, based on the power sensitivity adjustment factor, time index, energy index, and network quality coefficient, the energy sub-cost generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication is determined. The first constant is used to control the influence of the remaining power ratio on the energy sub-cost; the remaining power ratio is determined by the current remaining power and full power of the target communication device.

[0094] Optionally, in this embodiment of the application, the calculation of the energy quantum cost generated by the SM2 algorithm and the SM9 algorithm for security authentication of the target communication device is described in detail: Scenario 1: When a candidate national cryptographic asymmetric algorithm is the SM2 algorithm, based on time indicators, energy indicators and network quality coefficients, determine the first computational energy consumption and the first communication energy consumption generated by the target communication device using the SM2 algorithm for security authentication. Based on the first computational energy consumption, the first communication energy consumption and the power sensitivity adjustment factor, determine the energy quantum cost generated by the target communication device using the SM2 algorithm for security authentication.

[0095] The time indicators include the time consumed between encryption and signal transmission for the target communication device; the target strategy parameter set also includes the first constant; and the energy indicators include the computational energy consumption and communication energy consumption during the computation and communication processes for the target communication device.

[0096] In this embodiment, the first computing energy consumption is obtained by multiplying the computing energy consumption in the computing process of the target communication device and the computing time of the first algorithm; the first communication energy consumption is obtained by multiplying the first number of interactions, the communication energy consumption in the communication process of the target communication device, the time spent between encryption and signal transmission of the target communication device, and the network quality coefficient; then the sum of the first computing energy consumption and the first communication energy consumption is calculated to obtain the first total energy consumption; the first total energy consumption is multiplied by the power sensitivity adjustment factor to obtain the energy quantum cost generated by the target communication device using the SM2 algorithm for security authentication.

[0097] In this embodiment, the calculation formula for the energy quantum cost generated by the target communication device using the SM2 algorithm for security authentication can be specifically expressed as follows:

[0098] Among them, E remain E represents the current remaining battery power of the target communication device. full The target communication device is set to full charge, λ1 is the first constant, and the remaining charge and full charge are read directly from the target communication device. The introduction of the remaining charge ratio is to make the quantum cost only have a greater impact when the charge is low. The specific degree of impact is determined by the size of λ1. This refers to the computational energy consumption during the computation process corresponding to the target communication device. t represents the communication energy consumption during the communication process corresponding to the target communication device. comm The time consumed between encryption and signal transmission for the target communication device, for each communication device. , t comm It is fixed and can be determined through historical measurement data.

[0099] Scenario 2: When a candidate national cryptographic asymmetric algorithm is the SM9 algorithm, based on time indicators, energy indicators and network quality coefficients, determine the second computational energy consumption and the second communication energy consumption generated by the target communication device using the SM9 algorithm for security authentication. Based on the second computational energy consumption, the second communication energy consumption and the power sensitivity adjustment factor, determine the energy quantum cost generated by the target communication device using the SM9 algorithm for security authentication.

[0100] In this embodiment, the second computational energy consumption is obtained by multiplying the computational energy consumption during the computation process of the target communication device and the computation time of the second algorithm; the second communication energy consumption is obtained by multiplying the second number of interactions, the communication energy consumption during the communication process of the target communication device, the time consumed between encryption and signal transmission of the target communication device, and the network quality coefficient; then the sum of the second computational energy consumption and the second communication energy consumption is calculated to obtain the second total energy consumption; the second total energy consumption is multiplied by the power sensitivity adjustment factor to obtain the energy quantum cost generated by the target communication device using the SM9 algorithm for security authentication.

[0101] In this embodiment of the application, the calculation formula for the energy quantum cost generated by the target communication device using the SM9 algorithm for security authentication can be specifically expressed as follows:

[0102] By separately determining computational and communication energy consumption, it is possible to distinguish the different battery consumption patterns caused by algorithm computational complexity and network interaction overhead, ensuring the accuracy of energy consumption calculation. Furthermore, through the "power-sensitive adjustment factor," the energy cost is non-linearly correlated with the device's current remaining power. Thus, when the power is sufficient, the energy cost can be ignored, prioritizing performance or safety; when the power is low, the energy cost is drastically amplified, and energy-saving algorithms are prioritized to extend battery life.

[0103] S213: Based on the risk indicators in the real-time status information, the target strategy parameter set, and the cost calculation strategy corresponding to a candidate national cryptographic asymmetric algorithm, determine the risk sub-cost generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication.

[0104] Among them, the risk sub-cost is the sub-cost generated in the risk dimension when the target communication device uses a candidate national cryptographic asymmetric algorithm for security authentication.

[0105] In this way, the calculation of the total cost is explicitly decomposed into the determination of three sub-costs: time, energy, and risk. Furthermore, the network quality coefficient, a key intermediate variable, is introduced, making the complex environmental perception and decision-making process modular and clear, providing a structural foundation for the accurate calculation of each sub-cost. This satisfies the algorithm's requirements of ensuring the timely transmission of perceived information by the target communication device, maximizing battery life to avoid downtime due to battery replacement or charging, and preventing authentication interruptions caused by factors such as certificate expiration when selecting targets.

[0106] In this application embodiment, the risk sub-cost for the SM2 algorithm includes at least: the risk of device certificate failure and the risk of server certificate verification failure; the risk sub-cost for the SM9 algorithm includes at least: the inherent security risk penalty constant of the algorithm relative to the SM2 algorithm.

[0107] Optionally, in this embodiment of the application, the calculation of the risk sub-costs generated by the security authentication of the target communication device using the SM2 algorithm and the SM9 algorithm is described in detail respectively: Scenario 1: When a candidate national cryptographic asymmetric algorithm is the SM2 algorithm, based on risk indicators and target policy parameter set, determine the risk of device certificate failure and server certificate verification failure caused by the current target communication device using the SM2 algorithm for security authentication, and based on the risk of device certificate failure and server certificate verification failure, determine the risk sub-cost caused by the target communication device using the SM2 algorithm for security authentication.

[0108] The target policy parameter set also includes: a second identifier, a third identifier, a second constant, and a third constant. The second identifier indicates whether the CA service of the target communication device is available; it is set to 1 if available and 0 otherwise. The third identifier indicates whether the OCSP service or CRL service of the target communication device is available; it is set to 1 if available and 0 otherwise. The second constant controls the shape and sensitivity of the curve of the impact of the device certificate expiration risk on the final risk sub-cost. The third constant controls the weight of the two types of risks, device certificate expiration risk and server certificate verification failure risk, in the risk sub-cost. Risk indicators include: the remaining validity period and the maximum validity period of the CA certificate.

[0109] In this embodiment, based on the second identifier, the remaining validity period of the CA certificate, the maximum validity period of the CA certificate, and the second constant, the risk of device certificate failure caused by the current target communication device using the SM2 algorithm for security authentication is determined; based on the third identifier and the third constant, the risk of server certificate verification failure (i.e., the risk of being unable to verify the server certificate) caused by the current target communication device using the SM2 algorithm for security authentication is determined; then, the sum of the device certificate failure risk and the server certificate verification failure risk is calculated to obtain the risk sub-cost caused by the target communication device using the SM2 algorithm for security authentication.

[0110] In this embodiment of the application, the calculation formula for the risk sub-cost generated by the target communication device using the SM2 algorithm for security authentication can be specifically expressed as follows:

[0111] Where, δ R1 For the second identifier; δ R2 For the second identifier; T remain The remaining validity period of the CA certificate; T max λ1 represents the maximum validity period of the CA certificate; λ2 is the second constant; and λ3 is the third constant.

[0112] Case 2: When a candidate national cryptographic asymmetric algorithm is the SM9 algorithm, the risk sub-cost generated by the target communication device using the SM9 algorithm for security authentication is determined based on the fourth constant contained in the target policy parameter set.

[0113] The fourth constant is used to impose a certain risk penalty on the security of the SM9 algorithm. The target policy parameter set also includes the fourth constant, which is a non-negative constant.

[0114] In this embodiment, the SM9 algorithm itself does not have the risk of certificate invalidation. Considering the scenario where the SM2 algorithm is not mandatory but there are certain security requirements, a certain cost penalty is imposed on the lower security of the SM9 algorithm through the fourth constant. The fourth constant is used as the risk sub-cost generated by the target communication device using the SM9 algorithm for security authentication.

[0115] In this embodiment of the application, the calculation formula for the risk sub-cost generated by the target communication device using the SM2 algorithm for security authentication can be specifically expressed as follows:

[0116] Where λ4 is the second constant.

[0117] Thus, the risks of the SM2 algorithm are decomposed into "device certificate expiration risk" and "server certificate verification failure risk," which precisely correspond to the two main types of operational risks under the PKI system. This allows the use of the SM2 algorithm to be automatically avoided when certificate services are abnormal, ensuring business continuity. For the SM9 algorithm, a constant is used to characterize its inherently lower security risk, ensuring that a security trade-off can still be made in non-mandatory scenarios.

[0118] S22: Select the target national cryptographic asymmetric algorithm with the minimum total cost from the candidate national cryptographic asymmetric algorithm set, and use the target national cryptographic asymmetric algorithm to perform security authentication on the target communication device.

[0119] In this embodiment of the application, after obtaining the total cost of each candidate national cryptographic asymmetric algorithm, the total cost of each candidate national cryptographic asymmetric algorithm is compared, and the candidate national cryptographic asymmetric algorithm with the smallest total cost is selected as the target national cryptographic asymmetric algorithm. The target national cryptographic asymmetric algorithm is then used to perform security authentication on the target communication device.

[0120] For example, assuming scenario one, the target communication device has a good network environment, sufficient energy, and a healthy certificate. In this case, the time sub-cost of the SM2 algorithm is about tens of milliseconds, while the time sub-cost of the SM9 algorithm can reach hundreds of milliseconds due to computational complexity. Since the target communication device has sufficient energy and the power sensitivity adjustment factor is close to 0, the energy sub-cost of the SM2 algorithm is approximately equal to that of the SM9 algorithm. Since the network environment is good and OCSP and CRL services are available, the risk sub-cost of the SM2 algorithm is 0. Therefore, the total cost of the SM2 algorithm is less than that of the SM9 algorithm, and the target communication device uses the SM2 algorithm for security authentication.

[0121] For example, assuming scenario two, the target communication device is in a weak network environment with sufficient energy but insufficient certificate validity. The SM2 algorithm is not mandatory, but certificate verification is required. In this case, the SM2 algorithm has a high packet loss rate due to the need to transmit the certificate, and the overhead of certificate verification needs to be considered, making the time sub-cost of the SM2 algorithm greater than that of the SM9 algorithm. The energy sub-cost of the SM2 algorithm is also approximately equal to that of the SM9 algorithm. The risk of device certificate failure is close to 1. Since λ3 is much greater than λ4, the risk sub-cost of the SM2 algorithm is much greater than that of the SM9 algorithm. Therefore, the final output total cost of the SM9 algorithm is less than that of the SM2 algorithm, and the target communication device uses the SM9 algorithm for security authentication.

[0122] In this embodiment of the application, after the target national cryptographic asymmetric algorithm is selected, the target communication device sends a formal authentication request to the server for security authentication. The authentication request includes the identifier of the selected target national cryptographic asymmetric algorithm.

[0123] Specifically, in this embodiment, if the target national cryptographic asymmetric algorithm is the SM2 algorithm, the following steps are performed: (1) After the server verifies the validity of the device certificate, it generates a timestamp and a one-time valid random challenge value. The server combines its own device identifier and uses its own pre-set SM2 private key to digitally sign the timestamp, the random challenge value, and the server device identifier to generate negotiated signature information. The server then sends the random challenge value and the negotiated signature information to the target communication device. (2) After the target communication device verifies the legitimacy of the server, it generates its own timestamp and random number, uses its own SM2 private key to sign and form an identity response, and sends it to the server. (3) The server uses the SM2 public key in the device certificate to verify the signature and verify the legitimacy of the device identity. (4) The server negotiates the session key according to the SM2 key exchange protocol. If the target national cryptographic asymmetric algorithm is the SM9 algorithm, the following steps are performed: (1) The server generates a timestamp and a one-time valid random challenge value according to the device identifier and the preset SM9 system parameters, signs it with its own SM9 private key and sends it to the target communication device; (2) After verifying the legitimacy of the server, the target communication device generates its own timestamp and random number, signs it with its own SM9 identifier private key to form an identity response and sends it to the server; (3) The server uses the device identifier and SM9 public key to verify the signature and verify the legitimacy of the device identity; (4) Negotiate the session key according to the SM9 key exchange protocol.

[0124] In this embodiment of the application, the security authentication of the target communication device using the target national cryptographic asymmetric algorithm includes an identity authentication step and a session key exchange step. For example, taking the security authentication using the SM2 algorithm as an example, (1) the identity authentication step includes: first, the target communication device sends the device unique identifier, authentication algorithm, and authentication request identifier to the server to request authentication; then the server receives the authentication request, extracts the device unique identifier, and verifies the device identity; then it generates a timestamp T2 and a random challenge value N2, and combines T2 and N2 as a message to be signed (M2=T2||N2); the SM2 digital signature generation algorithm is used on M2 to calculate the digital signature (r2, s2), and (r2, s2) is sent to the target communication device. The target communication device receives the message M2' and the digital signature (r2', s2'), and uses the SM2 digital signature verification algorithm on M2' and (r2', s2') to verify the server identity. Similarly, the server verifies the identity of the target communication device to complete the two-way authentication. (2) The session key exchange process includes: the server and the target communication device calculate a temporary key according to the SM2 key exchange protocol. The key exchange protocol is initiated by the target communication device and then several rounds of interaction are performed. The shared secret key K corresponding to the target communication device is calculated using the key derivation function. A Shared secret key K corresponding to the server BUsing a cryptographic hash function, a hash value S1 is obtained from the target communication device during the key confirmation phase, and a hash value S is calculated and sent to the server by the target communication device during the key confirmation phase. A The server calculates and sends a hash value S to the target communication device. B The server receives S A A hash value S2 is calculated later, and the target communication device and the server respectively verify that S1=S B S2=S A The key exchange is complete, and the final session key K=K A =K B Complete security certification.

[0125] Furthermore, in this embodiment, after security authentication, it is determined whether the security authentication result is successful. When the security authentication result of the target communication device is unsuccessful, the total number of consecutive unsuccessful security authentication results of the target communication device is counted. If the total number of consecutive unsuccessful results is greater than the threshold, an alarm message is generated and the identifier of the target communication device recorded in the whitelist is deleted. At this time, the target communication device cannot actively apply for security authentication. The administrator needs to manually add the identifier of the target communication device back to the whitelist before the target communication device can actively apply for security authentication. If the total number of consecutive unsuccessful results is less than or equal to the threshold, the target communication device re-applies for security authentication (i.e., steps S20-S22 are re-executed). In this way, by counting the number of consecutive failures and automatically deleting the device identifier from the whitelist after exceeding the threshold, this can effectively and automatically block such automated attack flows, prevent attackers from making unlimited attempts in a short period of time, identify and isolate such abnormal devices, release server resources that are ineffectively occupied, ensure that the system can provide stable and efficient services to other legitimate devices, and improve system stability and resource utilization efficiency. Furthermore, in this embodiment, after security authentication, it is determined whether the security authentication result is passed. When the security authentication result of the target communication device is passed, the target communication device is in an authenticated state. At this time, no authentication is required when transmitting data between the target communication device and the server. Communication is conducted through a temporary session key K and other encryption algorithms (e.g., SM4), and the session key is updated periodically to ensure communication security. The authenticated state remains valid for a preset duration (e.g., one day). After the timeout, the authentication expires, and the target communication device re-enters security authentication (i.e., steps S20-S22 are re-executed). Additionally, if the target communication device restarts for some reason, the authentication immediately expires, and steps S20-S22 are re-executed to enter the authenticated state.

[0126] Based on the above embodiments, see Figure 3The diagram shown is a logical schematic of a security authentication method for a communication device provided in an embodiment of this application, which specifically includes the following steps: S30: System initialization.

[0127] S31: Determine whether a new target policy parameter set has been received from the server. If yes, execute S32; otherwise, execute S33.

[0128] S32: Load the new target policy parameter set.

[0129] S33: Based on the target policy parameter set, the real-time status information of the target communication device, and the cost calculation strategies corresponding to the SM2 and SM9 algorithms, determine the total cost generated by the target communication device using the SM2 and SM9 algorithms for security authentication.

[0130] S34: Determine whether the total cost corresponding to the SM2 algorithm is less than the total cost corresponding to the SM9 algorithm. If yes, execute S35; otherwise, execute S36.

[0131] S35: Employs the SM2 algorithm for security authentication.

[0132] S36: Employs the SM9 algorithm for security authentication.

[0133] S37: Determine whether the security authentication result is passed. If yes, proceed to S38; otherwise, proceed to S310.

[0134] S38: Enter / maintain authentication status.

[0135] S39: Determine if the authentication status is invalid. If yes, execute S31; otherwise, execute S38.

[0136] S310: Determine whether the total number of consecutive failures is greater than the threshold. If yes, execute S311; otherwise, execute S31.

[0137] S311: Delete the identifier of the target communication device recorded in the whitelist.

[0138] Furthermore, based on the same technical concept, embodiments of this application provide a security authentication device for a communication device, which is used to implement the above-described method flow of the embodiments of this application. For example, see [link to relevant documentation]. Figure 4 As shown, the security authentication device 400 of the communication device may include: a receiving module 401, a cost calculation module 402, and a security authentication module 403, wherein: The receiving module 401 is used to receive the target policy parameter set of the target communication device sent by the server. The target policy parameter set is determined based on the characteristic information of the target communication device. The cost calculation module 402 is used to perform the following operations for each candidate national cryptographic asymmetric algorithm in the candidate national cryptographic asymmetric algorithm set: based on the target policy parameter set, the real-time status information of the target communication device, and the cost calculation strategy corresponding to a candidate national cryptographic asymmetric algorithm, determine the sub-costs of each of the multiple cost dimensions generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication, and based on each sub-cost and the target policy parameter set, determine the total cost generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication, wherein the multiple cost dimensions include: time dimension, energy dimension, and risk dimension; The security authentication module 403 is used to select the target national cryptographic asymmetric algorithm with the minimum total cost from the candidate national cryptographic asymmetric algorithm set, and to use the target national cryptographic asymmetric algorithm to perform security authentication on the target communication device.

[0139] In one optional embodiment, the target policy parameter set is obtained by the server clustering each device according to each feature dimension based on the feature information of each device, obtaining each type of cluster corresponding to each feature dimension, and selecting from each candidate policy parameter set based on the target cluster to which the target communication device belongs in each feature dimension. The target communication device belongs to each device, and each feature dimension includes: device performance, packet loss type and certificate coverage.

[0140] In an optional embodiment, when determining the sub-costs of each of the multiple cost dimensions generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication based on the target policy parameter set, the real-time status information of the target communication device, and the cost calculation strategy corresponding to a candidate national cryptographic asymmetric algorithm, the cost calculation module 402 is further configured to: Based on the current packet loss rate in the real-time status information and the target penalty coefficient for congestion packet loss, the network quality coefficient of the target communication device is determined. Based on the network quality coefficient, the time index in the real-time status information, the target policy parameter set, and the cost calculation strategy corresponding to a candidate national cryptographic asymmetric algorithm, the time sub-cost generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication is determined. Based on the network quality coefficient, time and energy indicators in real-time status information, target policy parameter set, and cost calculation strategy corresponding to a candidate national cryptographic asymmetric algorithm, the energy sub-cost generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication is determined. Based on the risk indicators in the real-time status information, the target policy parameter set, and the cost calculation strategy corresponding to a candidate national cryptographic asymmetric algorithm, the risk sub-cost generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication is determined.

[0141] In an optional embodiment, when determining the time sub-cost generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication based on the network quality coefficient, the time index in the real-time status information, the target policy parameter set, and the cost calculation strategy corresponding to a candidate national cryptographic asymmetric algorithm, the cost calculation module 402 is further used to: When a candidate national cryptographic asymmetric algorithm is the SM2 algorithm, based on the time index and the target policy parameter set, the first algorithm calculation time, the first communication transmission time, and the certificate status verification time generated by the current target communication device using the SM2 algorithm for security authentication are determined. Based on the first algorithm calculation time, the first communication transmission time, the certificate status verification time, and the network quality coefficient, the time sub-cost generated by the target communication device using the SM2 algorithm for security authentication is determined. When a candidate national cryptographic asymmetric algorithm is the SM9 algorithm, based on the time index, the second algorithm calculation time and the second communication transmission time generated by the target communication device using the SM9 algorithm for security authentication are determined. Based on the second algorithm calculation time and the second communication transmission time, the time sub-cost generated by the target communication device using the SM9 algorithm for security authentication is determined.

[0142] In an optional embodiment, when determining the energy sub-cost generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication based on the network quality coefficient, time and energy indicators in the real-time status information, the target policy parameter set, and the cost calculation strategy corresponding to a candidate national cryptographic asymmetric algorithm, the cost calculation module 402 is further used to: Based on the remaining power ratio in the energy index and the first constant contained in the target strategy parameter set, the power sensitivity adjustment factor corresponding to the target communication device is determined. The first constant is used to control the impact of the remaining power ratio on the energy quantum cost. When a candidate national cryptographic asymmetric algorithm is the SM2 algorithm, based on time indicators, energy indicators and network quality coefficients, the first computational energy consumption and the first communication energy consumption generated by the target communication device using the SM2 algorithm for security authentication are determined. Based on the first computational energy consumption, the first communication energy consumption and the power sensitivity adjustment factor, the energy quantum cost generated by the target communication device using the SM2 algorithm for security authentication is determined. When a candidate national cryptographic asymmetric algorithm is the SM9 algorithm, based on time indicators, energy indicators and network quality coefficients, the second computational energy consumption and the second communication energy consumption generated by the target communication device using the SM9 algorithm for security authentication are determined. Based on the second computational energy consumption, the second communication energy consumption and the power sensitivity adjustment factor, the energy quantum cost generated by the target communication device using the SM9 algorithm for security authentication is determined.

[0143] In an optional embodiment, when determining the risk sub-cost generated by the target communication device using a candidate national cryptographic asymmetric algorithm for security authentication based on the risk indicators in the real-time status information, the target policy parameter set, and the cost calculation strategy corresponding to a candidate national cryptographic asymmetric algorithm, the cost calculation module 402 is further configured to: When a candidate national cryptographic asymmetric algorithm is the SM2 algorithm, based on risk indicators and target policy parameter set, the risk of device certificate failure and server certificate verification failure caused by the current target communication device using the SM2 algorithm for security authentication are determined, and based on the risk of device certificate failure and server certificate verification failure, the risk sub-cost caused by the target communication device using the SM2 algorithm for security authentication is determined. When a candidate national cryptographic asymmetric algorithm is the SM9 algorithm, the risk sub-cost generated by the target communication device using the SM9 algorithm for security authentication is determined based on the fourth constant contained in the target policy parameter set. The fourth constant is used to impose a certain risk penalty on the security of the SM9 algorithm.

[0144] In an optional embodiment, the cost calculation module 402 is further configured to: Obtain the current signal-to-noise ratio (SNR) of the target communication device, and determine the current packet loss rate using the mapping function between SNR and packet loss rate; The mapping function contains mapping parameters, which are obtained by iteratively updating observation sample pairs using a recursive least squares algorithm. The observation sample pairs are the historical signal-to-noise ratio and historical packet loss rate obtained by the target communication device during historical communication.

[0145] In an optional embodiment, the cost calculation module 402 is further configured to: Based on the relative changes of the recent mean signal-to-noise ratio (SNR) of the target communication device to the long-term mean SNR, and the relative changes of the recent mean round-trip time (RTT) of the target communication device to the long-term mean RTT, the current congestion and packet loss percentage of the target communication device is determined. Based on the initial penalty coefficient and the proportion of congestion-induced packet loss, the target penalty coefficient is determined. The initial penalty coefficient represents the penalty coefficient when all packet loss types are congestion-induced packet loss.

[0146] In an optional embodiment, the security authentication module is further configured to: When the security level of the target communication device is determined to meet the preset high security conditions, the SM2 algorithm is used to perform security authentication on the target communication device.

[0147] Based on the description of the method and apparatus embodiments above, an exemplary embodiment of the present invention also provides an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor. The memory stores a computer program executable by the at least one processor, which, when executed by the at least one processor, causes the electronic device to perform the method according to an embodiment of the present invention.

[0148] This application also provides a non-transitory computer-readable storage medium storing a computer program, wherein the computer program, when executed by a computer's processor, is used to cause the computer to perform a method according to an embodiment of this application.

[0149] This application also provides a computer program product, including a computer program, wherein the computer program, when executed by a computer's processor, is used to cause the computer to perform a method according to an embodiment of this application.

[0150] See Figure 5 The diagram shown below illustrates the structure of an electronic device 500 that can serve as a server or client in this application, and is an example of a hardware device that can be applied to various aspects of this application. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the application described and / or claimed herein.

[0151] like Figure 5 As shown, the electronic device 500 includes a computing unit 501, which can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) 502 or a computer program loaded from a storage unit 508 into a random access memory (RAM) 503. The RAM 503 may also store various programs and data required for the operation of the device 500. The computing unit 501, ROM 502, and RAM 503 are interconnected via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0152] Multiple components in electronic device 500 are connected to I / O interface 505, including: input unit 506, output unit 507, storage unit 508, and communication unit 509. Input unit 506 can be any type of device capable of inputting information to electronic device 500. Input unit 506 can receive input digital or character information and generate key signal inputs related to user settings and / or function control of electronic device. Output unit 507 can be any type of device capable of presenting information and may include, but is not limited to, a display, speaker, video / audio output terminal, vibrator, and / or printer. Storage unit 508 may include, but is not limited to, disks and optical discs. Communication unit 509 allows electronic device 500 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks, and may include, but is not limited to, modems, network cards, infrared communication devices, wireless communication transceivers and / or chipsets, such as Bluetooth devices, WiFi devices, worldwide interoperability for microwave access (WiMax) devices, cellular communication devices, and / or the like.

[0153] The computing unit 501 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 501 performs the various methods and processes described above. For example, in some embodiments, the above-described security authentication method based on a communication device can be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as storage unit 508. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 500 via ROM 502 and / or communication unit 509. In some embodiments, the computing unit 501 can be configured to perform the above-described security authentication method for a communication device by any other suitable means (e.g., by means of firmware).

[0154] The program code used to implement the methods of this application may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0155] In the context of this application, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, RAM, ROM, erasable programmable read-only memory (EPROM) or flash memory, optical fibers, compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0156] As used in this application, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, device, and / or apparatus (e.g., disk, optical disk, memory, programmable logic device, PLD) used to provide machine instructions and / or data to a programmable processor, including machine-readable media that receive machine instructions as machine-readable signals. The term "machine-readable signal" refers to any signal used to provide machine instructions and / or data to a programmable processor.

[0157] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a cathode ray tube (CRT) or liquid crystal display (LCD) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0158] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0159] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other.

[0160] Furthermore, it should be understood that the above-disclosed embodiments are merely preferred embodiments of this application and should not be construed as limiting the scope of the invention. Therefore, any equivalent variations made in accordance with the claims of this invention are still within the scope of this application.

Claims

1. A security authentication method for a communication device, characterized in that, include: The system receives a target policy parameter set for the target communication device from the server. The target policy parameter set is determined based on the characteristic information of the target communication device. For each candidate national cryptographic asymmetric algorithm in the candidate national cryptographic asymmetric algorithm set, the following operations are performed: based on the target policy parameter set, the real-time status information of the target communication device, and the cost calculation strategy corresponding to a candidate national cryptographic asymmetric algorithm, determine the sub-costs of each of the multiple cost dimensions generated by the target communication device using the candidate national cryptographic asymmetric algorithm for security authentication, and based on each sub-cost and the target policy parameter set, determine the total cost generated by the target communication device using the candidate national cryptographic asymmetric algorithm for security authentication, wherein the multiple cost dimensions include: time dimension, energy dimension, and risk dimension; From the set of candidate national cryptographic asymmetric algorithms, the target national cryptographic asymmetric algorithm with the minimum total cost is selected, and the target national cryptographic asymmetric algorithm is used to perform security authentication on the target communication device.

2. The method as described in claim 1, characterized in that, The target policy parameter set is obtained by the server clustering the devices according to each feature dimension based on the feature information of each device, obtaining each type of cluster corresponding to each feature dimension, and filtering from each candidate policy parameter set based on the target cluster to which the target communication device belongs in each feature dimension. The target communication device belongs to each device, and each feature dimension includes: device performance, packet loss type and certificate coverage.

3. The method as described in claim 1, characterized in that, The method, based on the target policy parameter set, the real-time status information of the target communication device, and a cost calculation strategy corresponding to a candidate national cryptographic asymmetric algorithm, determines the sub-costs of each of the multiple cost dimensions generated by the target communication device using the candidate national cryptographic asymmetric algorithm for security authentication, including: Based on the current packet loss rate in the real-time status information and the target penalty coefficient for congestion packet loss, the network quality coefficient of the target communication device is determined. Based on the network quality coefficient, the time index in the real-time status information, the target policy parameter set, and the cost calculation strategy corresponding to the candidate national cryptographic asymmetric algorithm, the time sub-cost generated by the target communication device using the candidate national cryptographic asymmetric algorithm for security authentication is determined. Based on the network quality coefficient, the time and energy indicators in the real-time status information, the target policy parameter set, and the cost calculation strategy corresponding to the candidate national cryptographic asymmetric algorithm, the energy sub-cost generated by the target communication device using the candidate national cryptographic asymmetric algorithm for security authentication is determined. Based on the risk indicators in the real-time status information, the target strategy parameter set, and the cost calculation strategy corresponding to the candidate national cryptographic asymmetric algorithm, the risk sub-cost generated by the target communication device using the candidate national cryptographic asymmetric algorithm for security authentication is determined.

4. The method as described in claim 3, characterized in that, The determination of the time sub-cost generated by the target communication device using the candidate national cryptographic asymmetric algorithm for security authentication, based on the network quality coefficient, the time index in the real-time status information, the target policy parameter set, and the cost calculation strategy corresponding to the candidate national cryptographic asymmetric algorithm, includes: When one of the candidate national cryptographic asymmetric algorithms is the SM2 algorithm, based on the time index and the target policy parameter set, the first algorithm calculation time, the first communication transmission time, and the certificate status verification time generated by the target communication device using the SM2 algorithm for security authentication are determined. Based on the first algorithm calculation time, the first communication transmission time, the certificate status verification time, and the network quality coefficient, the time sub-cost generated by the target communication device using the SM2 algorithm for security authentication is determined. When one of the candidate national cryptographic asymmetric algorithms is the SM9 algorithm, based on the time index, the second algorithm calculation time and the second communication transmission time generated by the target communication device using the SM9 algorithm for security authentication are determined, and based on the second algorithm calculation time and the second communication transmission time, the time sub-cost generated by the target communication device using the SM9 algorithm for security authentication is determined.

5. The method as described in claim 3, characterized in that, The determination of the energy sub-cost generated by the target communication device using the candidate national cryptographic asymmetric algorithm for security authentication, based on the network quality coefficient, the time and energy indicators in the real-time status information, the target policy parameter set, and the cost calculation strategy corresponding to the candidate national cryptographic asymmetric algorithm, includes: Based on the remaining power ratio in the energy index and the first constant included in the target strategy parameter set, the power sensitivity adjustment factor corresponding to the target communication device is determined, wherein the first constant is used to control the influence of the remaining power ratio on the energy sub-cost; When the candidate national cryptographic asymmetric algorithm is the SM2 algorithm, based on the time index, the energy index and the network quality coefficient, the first computing energy consumption and the first communication energy consumption generated by the target communication device using the SM2 algorithm for security authentication are determined, and based on the first computing energy consumption, the first communication energy consumption and the power sensitivity adjustment factor, the energy quantum cost generated by the target communication device using the SM2 algorithm for security authentication is determined. When one of the candidate national cryptographic asymmetric algorithms is the SM9 algorithm, based on the time index, the energy index, and the network quality coefficient, the second computing energy consumption and the second communication energy consumption generated by the target communication device using the SM9 algorithm for security authentication are determined. Based on the second computing energy consumption, the second communication energy consumption, and the power sensitivity adjustment factor, the energy sub-cost generated by the target communication device using the SM9 algorithm for security authentication is determined.

6. The method as described in claim 3, characterized in that, The method for determining the risk sub-cost generated by the target communication device using the candidate national cryptographic asymmetric algorithm for security authentication, based on the risk indicators in the real-time status information, the target policy parameter set, and the cost calculation strategy corresponding to the candidate national cryptographic asymmetric algorithm, includes: When the candidate national cryptographic asymmetric algorithm is the SM2 algorithm, based on the risk index and the target policy parameter set, the risk of device certificate failure and server certificate verification failure caused by the target communication device using the SM2 algorithm for security authentication are determined, and based on the risk of device certificate failure and server certificate verification failure, the risk sub-cost caused by the target communication device using the SM2 algorithm for security authentication is determined. When one of the candidate national cryptographic asymmetric algorithms is the SM9 algorithm, the risk sub-cost generated by the target communication device using the SM9 algorithm for security authentication is determined based on the fourth constant contained in the target policy parameter set. The fourth constant is used to impose a certain risk penalty on the security of the SM9 algorithm.

7. The method according to any one of claims 3-6, characterized in that, The current packet loss rate is determined in the following way: The current signal-to-noise ratio of the target communication device is obtained, and the current packet loss rate is determined through the mapping function between the signal-to-noise ratio and the packet loss rate; The mapping function includes mapping parameters, which are obtained by iteratively updating observation sample pairs using a recursive least squares algorithm. The observation sample pairs are the historical signal-to-noise ratio and historical packet loss rate obtained by the target communication device during historical communication.

8. The method according to any one of claims 3-6, characterized in that, The target penalty coefficient is determined in the following manner: Based on the relative changes of the recent average signal-to-noise ratio (SNR) of the target communication device to the long-term average SNR, and the relative changes of the recent average round-trip time (RTT) of the target communication device to the long-term average RTT, the current congestion and packet loss percentage of the target communication device is determined. Based on the initial penalty coefficient and the congestion packet loss ratio, the target penalty coefficient is determined, wherein the initial penalty coefficient represents the penalty coefficient when all packet loss types are congestion packet loss.

9. The method as described in claim 1, characterized in that, The method further includes: When it is determined that the security level of the target communication device meets the preset high security conditions, the SM2 algorithm is used to perform security authentication on the target communication device.

10. A security authentication device for a communication device, characterized in that, include: The receiving module is used to receive the target policy parameter set of the target communication device sent by the server, wherein the target policy parameter set is determined based on the feature information of the target communication device; The cost calculation module is used to perform the following operations for each candidate national cryptographic asymmetric algorithm in the candidate national cryptographic asymmetric algorithm set: based on the target policy parameter set, the real-time status information of the target communication device, and the cost calculation strategy corresponding to a candidate national cryptographic asymmetric algorithm, determine the sub-costs of each of the multiple cost dimensions generated by the target communication device using the candidate national cryptographic asymmetric algorithm for security authentication, and based on each sub-cost and the target policy parameter set, determine the total cost generated by the target communication device using the candidate national cryptographic asymmetric algorithm for security authentication, wherein the multiple cost dimensions include: time dimension, energy dimension, and risk dimension; The security authentication module is used to select the target national cryptographic asymmetric algorithm with the minimum total cost from the candidate national cryptographic asymmetric algorithm set, and to use the target national cryptographic asymmetric algorithm to perform security authentication on the target communication device.

Images