Machine learning-based heterogeneous power internet of things terminal device access authentication method

Abstract

The present application relates to a kind of based on machine learning's heterogeneous power internet of things terminal equipment access authentication method, belong to power internet of things security technical field, including the following steps: collection power internet of things terminal historical access data, constructs terminal portrait feature vector, authentication feature vector, communication quality feature vector and scene risk level feature vector;Build the authentication mode selection model including shared feature encoding layer, security agent subnetwork, efficiency agent subnetwork, resource agent subnetwork and differentiable nash equilibrium solution layer;The security, efficiency and resource dimension authentication mode probability distribution of using shared feature vector is respectively output, and the final authentication mode probability distribution is obtained by differentiable nash equilibrium solution and training is completed;The most authentication mode is output to the terminal to be accessed.

Description

Technical Field

[0001] This invention relates to a machine learning-based access authentication method for heterogeneous power IoT terminal devices, belonging to the field of power IoT security technology. Background Technology

[0002] With the continuous development of new power systems and the Internet of Things (IoT) in the power sector, an increasing number of diverse terminal devices are being connected to the power business network, including data acquisition terminals, monitoring terminals, control terminals, edge computing nodes, and various intelligent sensing devices. These terminals exhibit significant differences in hardware capabilities, communication methods, deployment environments, security requirements, and real-time business requirements, demonstrating a clear heterogeneous characteristic.

[0003] In existing technologies, access authentication for power IoT terminals often employs fixed authentication strategies or authentication methods based on preset rules. For example, a unified authentication process is pre-configured for different terminals, or authentication modes are switched based on only a few conditions such as device type and access area. While these methods are relatively simple to implement, they suffer from the following problems in practical applications: First, it is difficult to balance security and access efficiency. For high-risk scenarios, the authentication strength may be insufficient, while for low-risk or resource-constrained terminals, it may lead to excessive authentication overhead. Second, there is a lack of comprehensive utilization of terminal resource capabilities, communication quality status, and historical authentication behavior, resulting in weak adaptability of the authentication strategy. Third, in complex access scenarios, a single rule is difficult to dynamically reflect the constraints between different authentication objectives, easily leading to large authentication delays, heavy communication burdens, or mismatched resource utilization.

[0004] Especially in the power IoT environment, with its large number of connected terminals, wide distribution across scenarios, and high requirements for business continuity, static or coarse-grained authentication decision-making mechanisms not only negatively impact the terminal access experience but may also reduce the overall access authentication system's responsiveness to complex scenarios. Therefore, there is an urgent need for an access authentication method that can adaptively select authentication modes based on terminal characteristics, historical authentication history, communication status, and scenario risks for heterogeneous power IoT terminals, thereby improving the rationality and adaptability of authentication decisions. Summary of the Invention

[0005] To address the problems existing in the prior art, this invention proposes a machine learning-based access authentication method for heterogeneous power IoT terminal devices.

[0006] The technical solution of the present invention is as follows: On the one hand, this invention provides a machine learning-based access authentication method for heterogeneous power IoT terminal devices, comprising the following steps: Historical access data of each power IoT terminal device is collected to construct terminal profile feature vectors, authentication feature vectors, communication quality feature vectors, and scenario risk level feature vectors for each terminal. An authentication mode selection model is constructed, including a shared feature encoding layer, a security proxy subnetwork, an efficiency proxy subnetwork, a resource proxy subnetwork, and a differentiable Nash equilibrium solution layer; Shared feature vectors are extracted from terminal profile feature vectors, authentication feature vectors, communication quality feature vectors, and scenario risk level feature vectors through a shared feature coding layer; Based on shared feature vectors, the probability distributions of security authentication patterns, efficiency authentication patterns, and resource authentication patterns are extracted through security proxy subnetwork, efficiency proxy subnetwork, and resource proxy subnetwork, respectively. The differentiable Nash equilibrium solution layer outputs the final authentication mode probability distribution based on the probability distributions of security authentication mode, efficiency authentication mode, and resource authentication mode. When the loss between the final authentication mode probability distribution and the actual authentication mode probability distribution reaches a preset threshold, the trained authentication mode selection model is obtained. Collect access data from terminals to be connected, and select the optimal authentication mode from the trained authentication mode to output the model.

[0007] Preferably, the device type, CPU performance, memory capacity, cryptographic algorithm support flag, communication type, and deployment scenario of the terminal are encoded to construct a terminal profile feature vector; The historical authentication patterns and authentication results of the terminal are encoded and then used to construct an authentication feature vector; The bandwidth usage, data round-trip latency, packet loss rate, and latency jitter in the historical authentication process of the terminal are encoded and constructed into a communication quality feature vector; The security level of each historical access scenario of the terminal is determined according to preset rules, and the security level is encoded to construct a scenario risk level feature vector.

[0008] Preferably, the specific steps for the shared feature encoding layer to extract the shared feature vector are as follows: The terminal profile feature vector, authentication feature vector, communication quality feature vector, and scene risk level feature vector of each terminal are encoded into query vector, key vector, and value vector, respectively. Attention weights between each modality are calculated through cross-modal attention, and the features of each modality are fused according to the attention weights to obtain a fused feature vector. The fused feature vectors are input into a multilayer fully connected network to extract shared feature vectors.

[0009] Preferably, the goal of the security proxy sub-network is to maximize the authentication security strength, and the probability distribution of the security authentication mode is extracted, as shown in the following formula: ; in: Indicates the first Probability distribution of security authentication modes for each terminal; This represents the softmax function; , This indicates that the security agent subnetwork can learn the weight matrix; Indicates the first Shared feature vectors of all terminals; , This indicates the security proxy subnetwork bias term; Represents the ReLU function; The goal of the efficiency-oriented proxy subnetwork is to minimize authentication communication overhead. The probability distribution of efficiency-oriented authentication patterns is extracted, as shown in the following formula: ; in: Indicates the first Probability distribution of efficiency authentication modes for each terminal; , This represents the learnable weight matrix of the efficient agent subnetwork; , This represents the efficiency of the proxy subnetwork bias term; The resource proxy subnetwork aims to maximize the matching degree of terminal resource utilization and extracts the probability distribution of resource authentication modes, as shown in the following formula: ; in: Indicates the first Probability distribution of resource authentication modes for each terminal; , This represents the learnable weight matrix of the resource agent subnetwork; , This indicates the resource proxy sub-network bias term.

[0010] Preferably, the differentiable Nash equilibrium solution layer evaluates the utility values ​​of the probability distributions of the security authentication mode, efficiency authentication mode, and resource authentication mode after each iteration based on the security utility function, efficiency utility function, and resource utility function. The parameters of the security proxy subnetwork, efficiency proxy subnetwork, and resource proxy subnetwork are updated based on the utility values ​​of the security authentication mode probability distribution, efficiency authentication mode probability distribution, and resource authentication mode probability distribution in each iteration, as shown in the following formula: ; ; ; in: Indicates the first The security proxy subnetwork parameters for the next iteration; Indicates the first Efficient agent subnetwork parameters for each iteration; Indicates the first Parameters of the resource proxy subnetwork in the next iteration; Indicates the first The probability distribution of security authentication modes output by the next iteration of the security proxy subnetwork; Indicates the first The probability distribution of efficiency authentication patterns output by the next iteration efficiency proxy subnetwork; Indicates the first The probability distribution of resource authentication modes output by the next iteration of the resource proxy subnetwork; Indicates the learning rate; Indicates the first The utility value of the probability distribution of the next iteration security authentication mode; Indicates the first The utility value of the probability distribution of the next iteration efficiency authentication pattern; Indicates the first The utility value of the probability distribution of the next iteration resource authentication mode; This indicates that the parameters of the security agent subnetwork can be learned using a projection function; This indicates that the efficient agent subnetwork can learn the projection function; This indicates that the parameters of the resource proxy subnetwork can be learned using a projection function; If, after this iteration, the utility values ​​of the authentication mode probability distributions output by the three sub-networks reach a balance, then the iteration stops, and the authentication mode probability distributions output by the three sub-networks in this iteration are weighted and aggregated to obtain the final authentication mode probability distribution.

[0011] Preferably, the safety utility function is as follows: ; in: This represents the utility value of the probability distribution of the security authentication mode in this iteration; Indicates the total number of authentication modes; This represents the probability distribution of the security authentication mode in this iteration. The probability of each authentication mode; Indicates the security agent subnetwork to the first The scenario benefit weight of each authentication mode; Represents the feature vector of the scenario risk level; This represents the penalty coefficient for safety utility. This represents the probability distribution of resource authentication modes in this iteration; This represents the probability distribution of the efficiency authentication mode in this iteration; Indicates KL divergence; Indicates a splicing operation; The efficiency utility function is shown in the following formula: ; in: This represents the utility value of the probability distribution of the efficiency authentication mode in this iteration; This represents the probability distribution of the efficiency authentication mode in this iteration. The probability of each authentication mode; Indicates the efficiency of the agent subnetwork for the first The communication benefit weight of each authentication mode; Represents the communication quality feature vector; This represents the efficiency-based utility penalty coefficient; This represents the probability distribution of the security authentication mode in this iteration; The resource utility function is shown in the following formula: ; in: This represents the utility value of the probability distribution of the resource authentication mode in this iteration; This represents the probability distribution of the resource authentication mode in this iteration. The probability of each authentication mode; Indicates the resource proxy subnetwork to the first Each authentication mode's capability is matched with a benefit weight; Represents the feature vector of the terminal profile; This represents the resource utility penalty coefficient.

[0012] On the other hand, the present invention also provides a machine learning-based heterogeneous power IoT terminal device access authentication system, including a feature construction module, an authentication mode selection model construction module, and an authentication strategy output module. The feature construction module is used to collect historical access data of each power IoT terminal device to construct terminal profile feature vector, authentication feature vector, communication quality feature vector and scenario risk level feature vector for each terminal. The authentication mode selection model construction module is used to construct an authentication mode selection model, including a shared feature encoding layer, a security proxy sub-network, an efficiency proxy sub-network, a resource proxy sub-network, and a differentiable Nash equilibrium solution layer. The shared feature encoding layer extracts shared feature vectors from terminal profile feature vectors, authentication feature vectors, communication quality feature vectors, and scenario risk level feature vectors. Based on these shared feature vectors, the security proxy sub-network, efficiency proxy sub-network, and resource proxy sub-network extract the security authentication mode probability distribution, efficiency authentication mode probability distribution, and resource authentication mode probability distribution, respectively. The differentiable Nash equilibrium solution layer outputs the final authentication mode probability distribution based on these distributions. When the loss between the final authentication mode probability distribution and the actual authentication mode probability distribution reaches a preset threshold, the trained authentication mode selection model is obtained. The authentication strategy output module is used to collect access data from terminals to be accessed, and selects the optimal authentication mode from the trained authentication mode selection model.

[0013] In another aspect, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in the present invention.

[0014] In another aspect, the present invention also provides a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the method described in the present invention.

[0015] The present invention has the following beneficial effects: 1. This invention comprehensively characterizes the authentication requirements of terminals by integrating terminal profiles, historical authentication information, communication quality information, and scenario risk information. It can select more suitable authentication modes for different device types, deployment environments, and communication states, thereby improving the matching degree between authentication strategies and actual terminal access conditions.

[0016] 2. By jointly modeling multi-source features and outputting the optimal authentication mode, this invention can more accurately reflect the access requirements of the terminal in the current scenario, which helps to reduce the blindness of authentication mode selection, reduce the increase in latency, bandwidth waste or excessive terminal resource consumption caused by unreasonable authentication, and thus improve the overall reliability and practicality of the power IoT terminal access authentication process.

[0017] 3. This invention provides a unified authentication mode selection mechanism for heterogeneous terminals, which can achieve good universality in scenarios with complex terminal types and large differences in access requirements. It helps to improve the level of authentication automation and operation and maintenance efficiency in the process of large-scale terminal access management. Attached Figure Description

[0018] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] It should be understood that the step numbers used in the text are for ease of description only and are not intended to limit the order in which the steps are performed.

[0021] It should be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0022] The terms “comprising” and “including” indicate the presence of the described feature, whole, step, operation, element and / or component, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or collections thereof.

[0023] The term “and / or” refers to any combination of one or more of the associated listed items, as well as all possible combinations, and includes these combinations.

[0024] See Figure 1 In some embodiments, a machine learning-based access authentication method for heterogeneous power IoT terminal devices is proposed, comprising the following steps: Historical access data of each power IoT terminal device is collected to construct terminal profile feature vectors, authentication feature vectors, communication quality feature vectors, and scenario risk level feature vectors for each terminal. An authentication mode selection model is constructed, including a shared feature encoding layer, a security proxy subnetwork, an efficiency proxy subnetwork, a resource proxy subnetwork, and a differentiable Nash equilibrium solution layer; Shared feature vectors are extracted from terminal profile feature vectors, authentication feature vectors, communication quality feature vectors, and scenario risk level feature vectors through a shared feature coding layer; Based on shared feature vectors, the probability distributions of security authentication patterns, efficiency authentication patterns, and resource authentication patterns are extracted through security proxy subnetwork, efficiency proxy subnetwork, and resource proxy subnetwork, respectively. The differentiable Nash equilibrium solution layer outputs the final authentication mode probability distribution based on the probability distributions of security authentication mode, efficiency authentication mode, and resource authentication mode. When the loss between the final authentication mode probability distribution and the actual authentication mode probability distribution reaches a preset threshold, the trained authentication mode selection model is obtained. Collect access data from terminals to be connected, and select the optimal authentication mode from the trained authentication mode selection model.

[0025] In one specific embodiment, the preprocessing of the collected historical access data includes outlier removal, missing value imputation, time alignment, and normalization. In some embodiments, the device type, CPU performance, memory capacity, cryptographic algorithm support flag, communication type, and deployment scenario of the terminal are encoded to construct a terminal profile feature vector; The historical authentication patterns and authentication results of the terminal are encoded and then used to construct an authentication feature vector; The bandwidth usage, data round-trip latency, packet loss rate, and latency jitter in the historical authentication process of the terminal are encoded and constructed into a communication quality feature vector; The security level of each historical access scenario of the terminal is determined according to preset rules, and the security level is encoded to construct a scenario risk level feature vector.

[0026] In one specific embodiment, for the terminal to be authenticated, the terminal's basic attributes, historical authentication behavior, historical communication quality, and access scenario risk information are extracted respectively, and corresponding feature vectors are constructed as inputs for subsequent authentication mode selection or authentication strategy generation. Taking a certain power IoT terminal T001 as an example, statistical analysis was performed on its four most recent historical access records, and the following features were constructed: Terminal profile feature vector construction: First, the device type, CPU performance, memory capacity, cryptographic algorithm support flags, communication type, and deployment scenario of the terminal are encoded. The encoding rules are set as follows: 1. Equipment type code: Sensor terminal: 1; Camera terminals: 2; Controller terminal: 3; Gateway terminals: 4; 2. CPU performance coding: Normalize according to the main frequency, with a value range of 0 to 1; In this embodiment, the normalization formula is: CPU_norm = Actual clock speed / 2.5GHz; Wherein, CPU_norm represents the normalized CPU performance value; actual clock frequency represents the operating clock frequency of the terminal processor; 2.5GHz represents the preset reference clock frequency limit.

[0027] 3. Memory capacity encoding: Normalize according to capacity, with a value range of 0 to 1; Memory_norm = Actual memory capacity / 8GB; Here, memory_norm represents the normalized memory capacity value; 8GB represents the preset reference memory limit.

[0028] 4. The cryptographic algorithm supports flag bit encoding: SM2 Support: Rank 1; Supports SM3; 2nd position; SM4 Support: 3rd Position; RSA Support: 4th bit; AES Support: 5th position; If supported, record it as 1; otherwise, record it as 0.

[0029] 5. Communication type encoding: Wired Ethernet: 1; WI-FI: 2; 4G / 5G cellular network: 3; LoRa / NB-IoT: 4; 6. Deployment Scenario Coding: Substation core area: 1; Power distribution room: 2; Edge of the platform area: 3; User-side site: 4; The actual parameters of the existing terminal T001 are as follows: Device type: Controller terminal; CPU clock speed: 1.8GHz; Memory capacity: 4GB; Supports SM2, SM3, SM4, and AES, but not RSA; Communication type: 4G; Deployment scenario: edge of the transformer area.

[0030] Then we can obtain: Device type code = 3; CPU performance coding = 1.8 / 2.5 = 0.72; Memory capacity encoding = 4 / 8 = 0.50; The cryptographic algorithm supports flags of [1, 1, 1, 0, 1]. Communication type code = 3; Deployment scenario code = 3; Therefore, the terminal profile feature vector can be constructed as follows: P_dev = [3, 0.72, 0.50, 1, 1, 1, 0, 1, 3, 3]; Wherein, P_dev represents the terminal profile feature vector; the first dimension represents the device type encoding; the second dimension represents the CPU performance encoding; the third dimension represents the memory capacity encoding; the fourth to eighth dimensions represent the cryptographic algorithm support flags; the ninth dimension represents the communication type encoding; and the tenth dimension represents the deployment scenario encoding.

[0031] Authentication feature vector construction: The authentication mode encoding is set as follows: Minimalist Mode M1:1; Lightweight mode M2:2; Standard Mode M3: 3; Enhanced Mode M4:4; High-security mode M5:5; The authentication result is encoded as follows: Success: 1; Failures: 0; The four most recent authentication records of terminal T001 are shown in the table below:

[0032] By concatenating the encoding sequences of the four most recent historical authentication patterns with the encoding sequence of the authentication result, the authentication feature vector can be constructed as follows: P_auth = [3, 4, 5, 3, 1, 1, 0, 1]; Wherein, P_auth represents the authentication feature vector; the first 4 dimensions represent the historical authentication pattern codes arranged in chronological order; and the last 4 dimensions represent the authentication result codes corresponding to each authentication pattern.

[0033] Furthermore, statistical features can also be extracted, for example: The success rate of the last 4 authentication attempts = 3 / 4 = 0.75; The percentage of times the highest security mode was used in the last four instances = 1 / 4 = 0.25; The percentage of the most recent 4 standard and above patterns = 4 / 4 = 1.00; The expanded authentication feature vector can then be represented as: P_auth' = [3, 4, 5, 3, 1, 1, 0, 1, 0.75, 0.25, 1.00].

[0034] Construction of communication quality feature vectors: The bandwidth usage, data round-trip latency, packet loss rate, and latency jitter of the terminal in the last four historical authentication processes are collected and encoded. The communication quality parameters for the four most recent historical authentications of terminal T001 are shown in the table below:

[0035] Encoding can be done using the mean, maximum value, and degree of fluctuation: 1. Mean characteristics Average bandwidth usage = (1.2 + 1.8 + 2.5 + 1.4) / 4 = 1.725Mbps; Average RTT = (35 + 52 + 96 + 41) / 4 = 56ms; Average packet loss rate = (0.3 + 0.8 + 2.1 + 0.5) / 4 = 0.925%; Average latency jitter = (4 + 6 + 14 + 5) / 4 = 7.25ms; 2. Maximum value characteristics Maximum bandwidth usage = 2.5Mbps; Maximum RTT = 96ms; Maximum packet loss rate = 2.1%; Maximum latency jitter = 14ms; 3. Characteristics of dispersion RTT range = 96 - 35 = 61ms; Packet loss rate range = 2.1 - 0.3 = 1.8%; Therefore, the communication quality feature vector is constructed as follows: P_net = [1.725, 56, 0.925, 7.25, 2.5, 96, 2.1, 14, 61, 1.8]; Wherein, P_net represents the communication quality feature vector; the first to fourth dimensions represent the mean bandwidth usage, mean round-trip delay, mean packet loss rate, and mean delay jitter, respectively; the fifth to eighth dimensions represent the maximum values ​​of the above indicators, respectively; and the ninth and tenth dimensions represent the range of round-trip delay and the range of packet loss rate, respectively.

[0036] Construction of scenario risk level feature vector: The security level of each historical access scenario of the terminal is determined according to preset rules.

[0037] The following are examples of preset rules: When the terminal is deployed in the core area of ​​a substation and uses public network access, the security level is determined to be level 5; When the terminal is deployed at the edge of the transformer area and uses 4G access, the security level is determined to be level 4; When the terminal is deployed at the user's site and the business data is only status collection data, the security level is determined to be Level 2; When the terminal is in an isolated intranet environment and the business only reports periodically, the security level is determined to be Level 1.

[0038] The following table shows the four most recent historical access scenarios for terminal T001:

[0039] The scenario risk level coding sequence can then be obtained as follows: P_risk = [4, 4, 5, 4]; Further extraction of statistical features: Average risk level = (4 + 4 + 5 + 4) / 4 = 4.25; Maximum risk level = 5; Percentage of high-risk scenarios (level ≥ 4) = 4 / 4 = 1.00; The expanded scenario risk level feature vector is then: P_risk' = [4, 4, 5, 4, 4.25, 5, 1.00]; Where P_risk' represents the extended scenario risk level feature vector; the first 4 dimensions represent the risk level encoding of historical access scenarios; the 5th dimension represents the average risk level; the 6th dimension represents the maximum risk level; and the 7th dimension represents the proportion of high-risk scenarios.

[0040] In this embodiment, the terminal profile feature vector, authentication feature vector, communication quality feature vector, and scenario risk level feature vector can be concatenated to form a comprehensive input feature vector for the terminal.

[0041] In some embodiments, the specific steps for the shared feature coding layer to extract the shared feature vector are as follows: The terminal profile feature vector, authentication feature vector, communication quality feature vector, and scene risk level feature vector of each terminal are encoded into query vector, key vector, and value vector, respectively. Attention weights between each modality are calculated through cross-modal attention, and the features of each modality are fused according to the attention weights to obtain a fused feature vector. The fused feature vectors are input into a multilayer fully connected network to extract shared feature vectors.

[0042] In some embodiments, the security proxy subnetwork aims to maximize authentication security strength by extracting a probability distribution of security authentication patterns, as shown in the following formula: ; in: Indicates the first Probability distribution of security authentication modes for each terminal; This represents the softmax function; , This indicates that the security agent subnetwork can learn the weight matrix; Indicates the first Shared feature vectors of all terminals; , This indicates the security proxy subnetwork bias term; Represents the ReLU function; Their strategy tends to choose high-security authentication modes; The goal of the efficiency-oriented proxy subnetwork is to minimize authentication communication overhead. The probability distribution of efficiency-oriented authentication patterns is extracted, as shown in the following formula: ; in: Indicates the first Probability distribution of efficiency authentication modes for each terminal; , This represents the learnable weight matrix of the efficient agent subnetwork; , This represents the efficiency of the proxy subnetwork bias term; They tend to choose the lightweight authentication mode; The resource proxy subnetwork aims to maximize the matching degree of terminal resource utilization and extracts the probability distribution of resource authentication modes, as shown in the following formula: ; in: Indicates the first Probability distribution of resource authentication modes for each terminal; , This represents the learnable weight matrix of the resource agent subnetwork; , Indicates the resource proxy sub-network bias term; Maximizing the matching degree of terminal resource utilization refers to whether the resource capabilities that the current terminal itself can provide are matched, coordinated, not overloaded, and not excessively wasted with the resources required when a certain candidate authentication mode is executed. For example, if a terminal has a weak CPU, limited memory, and high network latency, assigning it a high-complexity authentication mode, such as multi-round handshakes, complex encryption calculations, or frequent challenge-response, while the terminal can theoretically execute the commands, will result in the following problems: Excessive CPU usage; memory shortage; excessively long authentication time; increased communication burden; and even an increase in authentication failure rate.

[0043] This indicates that the authentication mode does not match the terminal resource status.

[0044] If terminal resources are plentiful, such as high-performance edge gateways or low-latency private network environments, but only a simplified authentication mode is assigned to it, then although authentication can be completed, the following will occur: insufficient utilization of security redundancy; idle terminal computing power; ineffective use of network bandwidth and cryptographic capabilities; and failure to fully realize the value of device resources. This indicates that while the mode is usable, it does not match the sufficiency of the current resource utilization.

[0045] In some embodiments, the differentiable Nash equilibrium solution layer evaluates the utility values ​​of the security authentication mode probability distribution, efficiency authentication mode probability distribution, and resource authentication mode probability distribution after each iteration based on the security utility function, efficiency utility function, and resource utility function. The parameters of the security proxy subnetwork, efficiency proxy subnetwork, and resource proxy subnetwork are updated based on the utility values ​​of the security authentication mode probability distribution, efficiency authentication mode probability distribution, and resource authentication mode probability distribution in each iteration, as shown in the following formula: ; ; ; in: Indicates the first The security proxy subnetwork parameters for the next iteration; Indicates the first Efficient agent subnetwork parameters for each iteration; Indicates the first Parameters of the resource proxy subnetwork in the next iteration; Indicates the first The probability distribution of security authentication modes output by the next iteration of the security proxy subnetwork; Indicates the first The probability distribution of efficiency authentication patterns output by the next iteration efficiency proxy subnetwork; Indicates the first The probability distribution of resource authentication modes output by the next iteration of the resource proxy subnetwork; Indicates the learning rate; Indicates the first The utility value of the probability distribution of the next iteration security authentication mode; Indicates the first The utility value of the probability distribution of the next iteration efficiency authentication pattern; Indicates the first The utility value of the probability distribution of the next iteration resource authentication mode; This indicates that the parameters of the security agent subnetwork can be learned using a projection function; This indicates that the efficient agent subnetwork can learn the projection function; This indicates that the parameters of the resource proxy subnetwork can be learned using a projection function; If, after this iteration, the utility values ​​of the authentication mode probability distributions output by the three sub-networks reach a balance, then the iteration stops, and the authentication mode probability distributions output by the three sub-networks in this iteration are weighted and aggregated to obtain the final authentication mode probability distribution.

[0046] In some embodiments, the security utility function is specifically shown in the following equation: ; in: This represents the utility value of the probability distribution of the security authentication mode in this iteration; Indicates the total number of authentication modes; This represents the probability distribution of the security authentication mode in this iteration. The probability of each authentication mode; Indicates the security agent subnetwork to the first The scenario benefit weight of each authentication mode; Represents the feature vector of the scenario risk level; This represents the penalty coefficient for safety utility. This represents the probability distribution of resource authentication modes in this iteration; This represents the probability distribution of the efficiency authentication mode in this iteration; Indicates KL divergence; Indicates a splicing operation; The efficiency utility function is shown in the following formula: ; in: This represents the utility value of the probability distribution of the efficiency authentication mode in this iteration; This represents the probability distribution of the efficiency authentication mode in this iteration. The probability of each authentication mode; Indicates the efficiency of the agent subnetwork for the first The communication benefit weight of each authentication mode; Represents the communication quality feature vector; This represents the efficiency-based utility penalty coefficient; This represents the probability distribution of the security authentication mode in this iteration; The resource utility function is shown in the following formula: ; in: This represents the utility value of the probability distribution of the resource authentication mode in this iteration; This represents the probability distribution of the resource authentication mode in this iteration. The probability of each authentication mode; Indicates the resource proxy subnetwork to the first Each authentication mode's capability is matched with a benefit weight; Represents the feature vector of the terminal profile; This represents the resource utility penalty coefficient.

[0047] In some embodiments, a machine learning-based heterogeneous power IoT terminal device access authentication system is proposed, including a feature construction module, an authentication mode selection model construction module, and an authentication strategy output module. The feature construction module is used to collect historical access data of each power IoT terminal device to construct terminal profile feature vector, authentication feature vector, communication quality feature vector and scenario risk level feature vector for each terminal. The authentication mode selection model construction module is used to construct an authentication mode selection model, including a shared feature encoding layer, a security proxy sub-network, an efficiency proxy sub-network, a resource proxy sub-network, and a differentiable Nash equilibrium solution layer. The shared feature encoding layer extracts shared feature vectors from terminal profile feature vectors, authentication feature vectors, communication quality feature vectors, and scenario risk level feature vectors. Based on these shared feature vectors, the security proxy sub-network, efficiency proxy sub-network, and resource proxy sub-network extract the security authentication mode probability distribution, efficiency authentication mode probability distribution, and resource authentication mode probability distribution, respectively. The differentiable Nash equilibrium solution layer outputs the final authentication mode probability distribution based on these distributions. When the loss between the final authentication mode probability distribution and the actual authentication mode probability distribution reaches a preset threshold, the trained authentication mode selection model is obtained. The authentication strategy output module is used to collect access data from terminals to be accessed, and selects the optimal authentication mode from the trained authentication mode selection model.

[0048] In some embodiments, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method as described in any embodiment of the present invention.

[0049] In some embodiments, a computer-readable storage medium is provided on which a computer program is stored, which, when executed by a processor, implements the method as described in any embodiment of the present invention.

[0050] In this application embodiment, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent the existence of A alone, A and B simultaneously, or B alone. A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of singular or plural items. For example, at least one of a, b, and c can represent: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, and c can be single or multiple.

[0051] Those skilled in the art will recognize that the units and algorithm steps described in the embodiments disclosed herein can be implemented using electronic hardware, computer software, or a combination of electronic hardware and software. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0052] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0053] In the several embodiments provided in this application, any function, if implemented as a software functional unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0054] The above description is merely an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A machine learning-based access authentication method for heterogeneous power IoT terminal devices, characterized in that, Includes the following steps: Historical access data of each power IoT terminal device is collected to construct terminal profile feature vectors, authentication feature vectors, communication quality feature vectors, and scenario risk level feature vectors for each terminal. An authentication mode selection model is constructed, including a shared feature encoding layer, a security proxy subnetwork, an efficiency proxy subnetwork, a resource proxy subnetwork, and a differentiable Nash equilibrium solution layer; Shared feature vectors are extracted from terminal profile feature vectors, authentication feature vectors, communication quality feature vectors, and scenario risk level feature vectors through a shared feature coding layer; Based on shared feature vectors, the probability distributions of security authentication patterns, efficiency authentication patterns, and resource authentication patterns are extracted through security proxy subnetwork, efficiency proxy subnetwork, and resource proxy subnetwork, respectively. The differentiable Nash equilibrium solution layer outputs the final authentication mode probability distribution based on the probability distributions of security authentication mode, efficiency authentication mode, and resource authentication mode. When the loss between the final authentication mode probability distribution and the actual authentication mode probability distribution reaches a preset threshold, the trained authentication mode selection model is obtained. Collect access data from terminals to be connected, and select the optimal authentication mode from the trained authentication mode to output the model.

2. The method for access authentication of heterogeneous power IoT terminal devices based on machine learning according to claim 1, characterized in that, The terminal's device type, CPU performance, memory capacity, cryptographic algorithm support flags, communication type, and deployment scenario are encoded to construct a terminal profile feature vector; The historical authentication patterns and authentication results of the terminal are encoded and then used to construct an authentication feature vector; The bandwidth usage, data round-trip latency, packet loss rate, and latency jitter in the historical authentication process of the terminal are encoded and constructed into a communication quality feature vector; The security level of each historical access scenario of the terminal is determined according to preset rules, and the security level is encoded to construct a scenario risk level feature vector.

3. The method for access authentication of heterogeneous power IoT terminal devices based on machine learning according to claim 1, characterized in that, The specific steps for extracting shared feature vectors in the shared feature coding layer are as follows: The terminal profile feature vector, authentication feature vector, communication quality feature vector, and scene risk feature level vector of each terminal are encoded into query vector, key vector, and value vector, respectively. Attention weights between each modality are calculated through cross-modal attention, and the features of each modality are fused according to the attention weights to obtain a fused feature vector. The fused feature vectors are input into a multilayer fully connected network to extract shared feature vectors.

4. The method for access authentication of heterogeneous power IoT terminal devices based on machine learning according to claim 1, characterized in that, The goal of the security proxy sub-network is to maximize authentication security strength, and it extracts the probability distribution of security authentication modes, as shown in the following formula: ； in: Indicates the first Probability distribution of security authentication modes for each terminal; This represents the softmax function; , This indicates that the security agent subnetwork can learn the weight matrix; Indicates the first Shared feature vectors of all terminals; , This indicates the security proxy subnetwork bias term; Represents the ReLU function; The goal of the efficiency-oriented proxy subnetwork is to minimize authentication communication overhead. The probability distribution of efficiency-oriented authentication patterns is extracted, as shown in the following formula: ； in: Indicates the first Probability distribution of efficiency authentication modes for each terminal; , This represents the learnable weight matrix of the efficient agent subnetwork; , This represents the efficiency of the proxy subnetwork bias term; The resource proxy subnetwork aims to maximize the matching degree of terminal resource utilization and extracts the probability distribution of resource authentication modes, as shown in the following formula: ； in: Indicates the first Probability distribution of resource authentication modes for each terminal; , This represents the learnable weight matrix of the resource agent subnetwork; , This indicates the resource proxy sub-network bias term.

5. The method for access authentication of heterogeneous power IoT terminal devices based on machine learning according to claim 1, characterized in that, Differentiable Nash equilibrium solution layer evaluates the utility values ​​of the probability distributions of security authentication mode, efficiency authentication mode, and resource authentication mode after each iteration based on the security utility function, efficiency utility function, and resource utility function. The parameters of the security proxy subnetwork, efficiency proxy subnetwork, and resource proxy subnetwork are updated based on the utility values ​​of the security authentication mode probability distribution, efficiency authentication mode probability distribution, and resource authentication mode probability distribution in each iteration, as shown in the following formula: ； ； ； in: Indicates the first The security proxy subnetwork parameters for the next iteration; Indicates the first Efficient agent subnetwork parameters for each iteration; Indicates the first Parameters of the resource proxy subnetwork in the next iteration; Indicates the first The probability distribution of security authentication modes output by the next iteration of the security proxy subnetwork; Indicates the first The probability distribution of efficiency authentication patterns output by the next iteration efficiency proxy subnetwork; Indicates the first The probability distribution of resource authentication modes output by the next iteration of the resource proxy subnetwork; Indicates the learning rate; Indicates the first The utility value of the probability distribution of the next iteration security authentication mode; Indicates the first The utility value of the probability distribution of the next iteration efficiency authentication pattern; Indicates the first The utility value of the probability distribution of the next iteration resource authentication mode; This indicates that the parameters of the security agent subnetwork can be learned using a projection function; This indicates that the efficient agent subnetwork can learn the projection function; This indicates that the parameters of the resource proxy subnetwork can be learned using a projection function; If the utility values ​​of the authentication mode probability distributions output by the three sub-networks reach Nash equilibrium after this iteration, the iteration stops, and the authentication mode probability distributions output by the three sub-networks in this iteration are weighted and aggregated to obtain the final authentication mode probability distribution.

6. The method for access authentication of heterogeneous power IoT terminal devices based on machine learning according to claim 5, characterized in that, The specific formula for the safety utility function is as follows: ； in: This represents the utility value of the probability distribution of the security authentication mode in this iteration; Indicates the total number of authentication modes; This represents the probability distribution of the security authentication mode in this iteration. The probability of each authentication mode; Indicates the security agent subnetwork to the first The scenario benefit weight of each authentication mode; Represents the feature vector of the scenario risk level; This represents the penalty coefficient for safety utility. This represents the probability distribution of resource authentication modes in this iteration; This represents the probability distribution of the efficiency authentication mode in this iteration; Indicates KL divergence; Indicates a splicing operation; The efficiency utility function is shown in the following formula: ； in: This represents the utility value of the probability distribution of the efficiency authentication mode in this iteration; This represents the probability distribution of the efficiency authentication mode in this iteration. The probability of each authentication mode; Indicates the efficiency of the agent subnetwork for the first The communication benefit weight of each authentication mode; Represents the communication quality feature vector; This represents the efficiency-based utility penalty coefficient; This represents the probability distribution of the security authentication mode in this iteration; The resource utility function is shown in the following formula: ； in: This represents the utility value of the probability distribution of the resource authentication mode in this iteration; This represents the probability distribution of the resource authentication mode in this iteration. The probability of each authentication mode; Indicates the resource proxy subnetwork to the first Each authentication mode's capability is matched with a benefit weight; Represents the feature vector of the terminal profile; This represents the resource utility penalty coefficient.

7. A heterogeneous power IoT terminal device access authentication system based on machine learning, characterized in that, It includes a feature building module, an authentication mode selection model building module, and an authentication policy output module; The feature construction module is used to collect historical access data of each power IoT terminal device to construct terminal profile feature vector, authentication feature vector, communication quality feature vector and scenario risk level feature vector for each terminal. The authentication mode selection model construction module is used to construct the authentication mode selection model, including a shared feature encoding layer, a security proxy subnetwork, an efficiency proxy subnetwork, a resource proxy subnetwork, and a differentiable Nash equilibrium solution layer; it extracts shared feature vectors from terminal profile feature vectors, authentication feature vectors, communication quality feature vectors, and scenario risk level feature vectors through the shared feature encoding layer; based on... The shared feature vector extracts the security authentication mode probability distribution, efficiency authentication mode probability distribution, and resource authentication mode probability distribution through the security proxy sub-network, efficiency proxy sub-network, and resource proxy sub-network, respectively. The differentiable Nash equilibrium solution layer outputs the final authentication mode probability distribution based on the security authentication mode probability distribution, efficiency authentication mode probability distribution, and resource authentication mode probability distribution. When the loss between the final authentication mode probability distribution and the actual authentication mode probability distribution reaches a preset threshold, the trained authentication mode selection model is obtained. The authentication strategy output module is used to collect access data from terminals to be accessed, and selects the optimal authentication mode from the trained authentication mode selection model.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1 to 6.

Images