Power wide narrowband wireless terminal authentication method and system

Abstract

The embodiment of the specification provides a power wide / narrow band wireless terminal authentication method and system based on a radio frequency unclonable function, wherein the method comprises the following steps: in a registration stage, a terminal sends a standard radio frequency signal, an intelligent fusion terminal receives the standard radio frequency signal and extracts physical features thereof, and an authentication server generates a high-entropy key and auxiliary data by using a fuzzy extractor in combination with an error correction code and stores the high-entropy key and the auxiliary data; in an authentication stage, the terminal sends a quasi-radio frequency signal again, the intelligent fusion terminal extracts a noisy feature and generates a noisy code word in combination with the auxiliary data, the authentication server performs error correction decoding on the noisy code word, recovers the key and performs hash verification, and completes terminal identity confirmation.

Description

Technical Field

[0001] This document relates to the field of communication technology, and in particular to a power broadband and narrowband wireless terminal authentication method and system based on radio frequency non-cloning functions. Background Technology

[0002] In modern power systems, with the development of intelligence and information technology, a large number of broadband and narrowband wireless terminals have been widely deployed for real-time monitoring, data acquisition, and control of distribution networks, substations, and distributed energy sources. These terminals range from high-data-rate broadband communication equipment to low-power narrowband terminals, undertaking key tasks such as power system load monitoring, status acquisition, remote dispatching, and alarm reporting. Their number and distribution density continue to increase, making unified management of terminal identities and secure access a crucial foundation for system security.

[0003] Because these terminals are typically located in open or semi-open environments, they are vulnerable to attacks such as physical intrusion, malicious impersonation, and communication interception, making reliable identity verification and secure access urgently needed. Secure identity authentication not only needs to verify the terminal's identity but also needs to ensure the secure transmission of communication keys during the authentication process to prevent session hijacking and terminal forgery attacks. However, existing secure identity authentication technologies have limitations in power system broadband and narrowband terminal scenarios: some solutions require the installation of additional software or hardware modules on the terminal, which low-cost terminals cannot support; broadband and narrowband terminals have significantly different hardware architectures, often requiring different authentication technologies and protocols, resulting in a complex and difficult-to-manage authentication system.

[0004] Radio frequency fingerprinting and physically unclonable function (PUF) technologies have demonstrated potential in wireless terminal authentication. By utilizing the terminal's own radio frequency characteristics or embedding a PUF module to generate a unique identifier, both uniqueness of identity and authentication security can be achieved without the need for the terminal to store keys or perform complex calculations. This approach can accommodate the heterogeneous characteristics of different types of terminals, providing a unified authentication scheme for both broadband and narrowband terminals, and possesses inherent advantages in preventing cloning and tampering.

[0005] However, applying radio frequency PUF technology to power system terminals still faces challenges. First, environmental noise, channel fading, and power fluctuations can lead to instability in radio frequency characteristics, affecting authentication reliability. Second, hardware differences between different terminals make unified feature extraction and key generation difficult. Third, publicly available auxiliary data or modeling attacks may jeopardize identity key security. Furthermore, how to achieve highly reliable, high-entropy key generation and differentiated authentication services while ensuring zero hardware modifications to weak node terminals is also a core issue that urgently needs to be addressed.

[0006] In power systems, various wireless terminal devices have been deployed on a large scale to achieve real-time monitoring, status acquisition, and remote control of business units such as distribution networks, substations, and distributed energy resources. These devices can be mainly divided into two categories according to communication technology and business requirements: broadband wireless terminals and narrowband wireless terminals. Broadband wireless terminals are typically based on communication standards such as LTE and 5G, capable of carrying high data rates and low latency services, and are suitable for high-bandwidth scenarios such as video surveillance and real-time status transmission; narrowband wireless terminals are typically based on NB-IoT... Technologies such as IoT and LoRa are characterized by low power consumption, wide coverage, and massive access, making them suitable for low-speed data acquisition, event alarms, and periodic reporting. In power systems, these two types of devices jointly undertake key data acquisition tasks such as line current, voltage, and equipment health, and are fundamental components of power automation, distribution dispatching, and intelligent operation and maintenance. They are collectively referred to as broadband and narrowband wireless terminals.

[0007] Because these terminals operate in open wireless environments, their communication links are vulnerable to attacks such as spoofing, replay attacks, interference, and interception, directly threatening the security and stability of power systems. Therefore, implementing a unified, secure, and scalable identity recognition and access authentication mechanism for both broadband and narrowband wireless terminals is a fundamental requirement for secure communication technology in power systems. However, existing identity authentication technologies have significant limitations in power system applications: First, most security authentication schemes require terminals to perform complex cryptographic operations or run error-correcting code decoding, which is unsustainable for computationally limited, low-power wireless terminals. Second, some schemes require the addition of dedicated hardware modules or the installation of specific software on the terminal, which not only increases equipment costs but also prevents many third-party devices from undergoing secondary software or hardware development and modification. Third, the communication protocol stacks, hardware architectures, and processing capabilities of different types of terminals vary significantly, making it difficult for existing schemes to provide a unified identity authentication system. Therefore, in practical engineering, the availability and scalability of existing identity authentication schemes are insufficient, making it difficult to meet the secure access requirements of large-scale, heterogeneous wireless terminals.

[0008] In the field of security authentication for broadband and narrowband wireless terminals in power systems, existing technologies can be mainly divided into the following categories: One category is server-centric authentication schemes based on terminal keys or pre-set identity information. These schemes complete identity verification and secure access by storing keys or identity parameters on the terminal and interacting with an authentication server. For example, in the method proposed in patent CN111372247A, "A Terminal Security Access Method and System Based on Narrowband Internet of Things," the narrowband wireless terminal sends identity information and pre-set parameters to the server upon access. The server generates a security key and completes two-way authentication through digital signature, achieving end-to-end data protection and secure access control. Similarly, patent CN105553666B, "A Smart Power Terminal Security Authentication System and Method," establishes a three-layer architecture of terminal, authentication center, and database. The terminal needs to store or maintain its own keys and identity information, and performs identity verification and access control through the server. This type of scheme relies on the terminal to perform encryption and key management operations, increasing the computational burden and storage pressure on low-resource devices. Another category is multi-level or multi-stage identity authentication schemes, which focus on ensuring terminal access security through layered authentication and complex processes. Patent CN114286331A, "Identity Authentication Method and System for 5G Data Terminals in the Power Internet of Things," proposes a method that generates identity features by collecting terminal attributes and historical communication behavior, and implements multi-stage verification in conjunction with a network access authentication server, including attribute collection, feature encoding, authentication verification, and key exchange. While this type of scheme improves security, it requires the terminal to participate in dynamic state maintenance and calculation, making it unsuitable for large-scale, heterogeneous, low-power terminal deployment. The third type is a physical layer feature-based or non-intrusive terminal identification scheme that utilizes the terminal's own physical characteristics for identity authentication. Patent CN118199957A, "A Non-Intrusive Power Internet of Things Terminal Secure Access Authentication Method and System," proposes to complete identity authentication by collecting terminal identifiers and access request information and comparing them with pre-set security policies. This method emphasizes non-intrusiveness, but still requires the terminal to cooperate with the collected parameters and support policy adaptation; therefore, it is still not applicable to third-party terminals that cannot be further developed or have hardware limitations.

[0009] Overall, while these existing technical solutions cover secure access and authentication for power wireless terminals, they generally suffer from limitations such as high terminal computational burden, the need for hardware or software modifications, and difficulty in unifying authentication systems for heterogeneous terminals. In large-scale power systems, these limitations reduce the practical feasibility and scalability of the solutions.

[0010] In summary, existing broadband and narrowband wireless terminal authentication schemes for power systems have significant technical drawbacks. Most schemes require terminals to participate in complex cryptographic operations, digital signatures, and key management, which places a heavy burden on computationally limited and low-power broadband and narrowband terminals, resulting in slow authentication response times and high error rates. Some schemes also require the addition of dedicated hardware modules or the installation of specific software on the terminal to support authentication or key storage, significantly increasing equipment costs and preventing secondary development or modification of third-party terminals, thus reducing the practical deployment feasibility of the scheme. Furthermore, the hardware architectures of different types of terminals vary greatly; broadband and narrowband terminals often require different authentication technologies or protocols, leading to complex authentication systems that are difficult to manage uniformly, and also affecting the scalability and maintenance efficiency of large-scale systems. Summary of the Invention

[0011] The purpose of this invention is to provide a power broadband and narrowband wireless terminal authentication method and system based on radio frequency non-clonable functions, aiming to solve the above-mentioned problems in the prior art.

[0012] This invention provides a power line broadband and narrowband wireless terminal authentication method based on radio frequency non-cloning functions, comprising: During the registration phase, the terminal sends a standard radio frequency signal, the intelligent fusion terminal receives the standard radio frequency signal and extracts its physical features, and the authentication server uses a fuzz extractor combined with error correction code to generate a high-entropy key and auxiliary data and stores them. During the authentication phase, the terminal sends a quasi-radio frequency signal again. The intelligent fusion terminal extracts the noisy features and combines them with auxiliary data to generate noisy codewords. The authentication server performs error correction and decoding on the noisy codewords, recovers the key, and performs hash verification to complete the terminal identity confirmation.

[0013] This invention provides a power line broadband and narrowband wireless terminal authentication system based on radio frequency non-cloning functions, comprising: The terminal is used to transmit standard radio frequency signals; The intelligent fusion terminal is used to receive the standard radio frequency signal and extract its physical features during the registration phase; and during the authentication phase, it receives the quasi-radio frequency signal retransmitted by the terminal, extracts the noisy features, and combines them with auxiliary data to generate noisy codewords. An authentication server is used to generate and store high-entropy keys and auxiliary data by combining a fuzz extractor with error correction codes during the registration phase; and to perform error correction decoding on the noisy codewords during the authentication phase, recover the key, and perform hash verification to complete the terminal identity confirmation.

[0014] The embodiments of the present invention solve the problem of unified identity recognition for broadband and narrowband wireless terminals in power systems in the prior art. By using an authentication mechanism based on radio frequency PUF and fuzzy extractor, it solves technical problems such as terminal heterogeneity, environmental interference, low-cost weak node authentication and key security, and achieves high reliability, unified management and differentiated security services. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in one or more embodiments of this specification or in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a flowchart of a power broadband and narrowband wireless terminal authentication method based on radio frequency non-cloning functions according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the three-element authentication architecture according to an embodiment of the present invention; Figure 3 This is a schematic diagram of the data flow and processing sequence during the registration and authentication phases of an embodiment of the present invention; Figure 4 This is a schematic diagram illustrating the time sequence of terminal signal transmission, intelligent fusion terminal processing, server error correction decoding, and identity verification in an embodiment of the present invention. Figure 5 This is a schematic diagram of a power broadband and narrowband wireless terminal authentication system based on radio frequency non-cloning functions according to an embodiment of the present invention. Detailed Implementation

[0017] To enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the technical solutions in one or more embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of the embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of this document.

[0018] Before describing the technical solutions of the embodiments of the present invention, the technical terms involved will be explained first: Power system broadband and narrowband wireless terminals: These refer to wireless communication devices deployed in power systems, including broadband and narrowband terminals, used to collect power grid status, service data, and event alarms. Broadband terminals are generally used for high-speed data transmission, while narrowband terminals are used for low-speed status monitoring and control.

[0019] Radio frequency physically unclonable function (RFPUF): Utilizes the unclonable physical characteristics of radio frequency signals of wireless terminals (such as I / Q imbalance and oscillator phase noise) to generate a unique identifier sequence for terminal identification and key generation.

[0020] I / Q imbalance: refers to the difference in amplitude and phase between the in-phase (I) and quadrature (Q) components of a radio frequency signal. This asymmetry can be quantified for identity feature extraction.

[0021] Oscillator phase noise: The random fluctuation of the phase of the output signal of the terminal RF oscillator over time can be quantized into a binary sequence and used as a feature of the RF PUF.

[0022] Stable RF PUF sequence (R_stable): A stable binary feature sequence obtained by sampling the same terminal RF signal multiple times and removing unstable bits, used for key generation and auxiliary data calculation.

[0023] Auxiliary Data (AUX): Public data generated during the registration phase, obtained by XORing a stable radio frequency PUF sequence with a BCH encoded codeword, used to recover the key during the authentication phase without revealing the key content.

[0024] High-entropy key (K): A binary key sequence generated by a stable radio frequency PUF sequence and a pseudo-random function, with a sufficiently high entropy value to ensure security, used for encrypted communication and authentication.

[0025] Pseudo-random function (PRF): A function that generates a seemingly random key output based on an input sequence and a random seed. In this invention, it is implemented with low resources and is used to map a stable radio frequency PUF sequence to a high-entropy key.

[0026] BCH encoding: A linear error-correcting code used to encode a key into codewords, capable of correcting certain bit errors and ensuring reliable key recovery under noisy radio frequency characteristics.

[0027] Noisy codeword (C′): The codeword generated during the authentication phase, obtained by XORing the current noisy radio frequency feature with auxiliary data, and used as input for BCH decoding to recover the key.

[0028] The three-element authentication architecture is an identity authentication structure consisting of a terminal, an intelligent converged terminal (Authenticator), and an authentication server. The terminal provides radio frequency characteristics, the intelligent converged terminal performs feature quantization and noisy codeword generation, and the authentication server performs key recovery and identity verification, enabling secure access for low-resource terminals.

[0029] Hamming distance (HD): A metric used to compare differences in binary sequences. This invention is used for multiple sampling stability calculations to eliminate unstable bits.

[0030] Method Implementation Examples According to embodiments of the present invention, a power line broadband and narrowband wireless terminal authentication method based on radio frequency non-cloning functions is provided. Figure 1 This is a flowchart of a power line broadband and narrowband wireless terminal authentication method based on radio frequency non-cloning functions according to an embodiment of the present invention, as shown below. Figure 1 As shown, the power broadband and narrowband wireless terminal authentication method based on radio frequency non-cloning functions according to an embodiment of the present invention specifically includes: Step S101: During the registration phase, the terminal sends a standard radio frequency signal, the intelligent fusion terminal receives the standard radio frequency signal and extracts its physical features, and the authentication server uses a fuzzy extractor combined with error correction codes to generate a high-entropy key and auxiliary data and stores them; specifically including: During the registration phase, the terminal sends a standard radio frequency (RF) signal. The intelligent fusion terminal performs I / Q sampling on the standard RF signal through the RF receiving module to obtain discrete time sequences I[n] and Q[n]. I[n] and Q[n] represent the sampled values ​​of the in-phase I and quadrature Q components of the signal, respectively, where n = 1, 2, ..., N, and N is the total number of sampling points. After the I / Q samples are processed by bandpass filtering and analog-to-digital conversion, the I / Q amplitude ratio is calculated for each sampling point, and the phase difference is calculated using the arctangent function. The carrier phase and oscillator phase noise are extracted, and the I / Q amplitude ratio and phase difference are quantized into a first binary sequence using a threshold. The oscillator phase noise is quantized into a second binary sequence using a threshold. The first binary sequence and the second binary sequence are concatenated to obtain a complete RF PUF feature sequence, which is then sent to the authentication server.

[0031] The authentication server calculates the frequency of occurrence of each bit based on the complete radio frequency PUF feature sequence sampled multiple times, and performs stabilization processing based on the frequency of occurrence to obtain a stable radio frequency PUF sequence. The authentication server takes a stable radio frequency PUF sequence and an initial random vector as input, and uses a pseudo-random function. Generate a key K, encode the key K into a codeword C using the BCH encoding algorithm, XOR the stable RF PUF sequence with the codeword C to generate auxiliary data AUX, and combine the terminal ID, auxiliary data AUX, and the hash value of key K. Stored in a database.

[0032] Step S102: During the authentication phase, the terminal retransmits the quasi-radio frequency signal. The intelligent fusion terminal extracts the noisy features and combines them with auxiliary data to generate noisy codewords. The authentication server performs error correction decoding on the noisy codewords, recovers the key, and performs hash verification to complete the terminal identity confirmation. Specifically, this includes: During the authentication phase, the terminal sends the quasi-radio frequency signal again. After receiving the quasi-radio frequency signal sent by the terminal again, the intelligent fusion terminal performs I / Q demodulation and analog front-end processing to obtain the noisy radio frequency feature sequence. The intelligent fusion terminal will perform a bitwise XOR operation on the auxiliary data AUX obtained during the registration phase and the noisy radio frequency feature sequence to generate a noisy codeword, and then send the noisy codeword to the authentication server.

[0033] The authentication server performs BCH decoding on the noisy codeword to obtain the decoded and recovered key. Calculate the key after decoding and recovery. hash value and the hash value With stored hash value The system performs a comparison; if the authentication is successful, the terminal's identity is confirmed, a secure communication session is established, and the decoded and recovered key is used. Encrypt business data for communication; The authentication server returns the authentication result and necessary session information to the smart converged terminal.

[0034] The technical solution of the present invention adopts an authentication mechanism based on radio frequency PUF and fuzzy extractor, which realizes zero-modification of terminal, unified identity recognition, high-reliability authentication and high-entropy key generation, overcoming the shortcomings of existing solutions in resource-constrained and heterogeneous environments.

[0035] The technical solutions of the embodiments of the present invention will be described below with reference to the accompanying drawings.

[0036] This invention proposes a unified identity recognition and secure access scheme for broadband and narrowband wireless terminals suitable for power systems. The invention introduces a three-element authentication architecture during the authentication process, where the terminal, authentication server, and auxiliary or trusted nodes collaborate to complete identity verification and key generation. During registration, the terminal sends radio frequency (RF) signals through normal communication. The authentication server extracts the terminal's RF physical features and uses a fuzzy extractor combined with error correction codes to generate a high-entropy key, while simultaneously generating auxiliary data for subsequent authentication. During authentication, the auxiliary node or server uses this auxiliary data to correct errors in the received noisy RF features and recover the key, thereby achieving rapid verification of the terminal's identity. This three-element architecture design eliminates the need for the terminal to perform any cryptographic calculations or storage operations, solving the problem of low-resource terminals being unable to handle complex computations, and also avoiding hardware or software modifications to existing third-party devices. The combination of the RF PUF and the fuzzy extractor ensures the uniqueness of the identity identifier and the generation of the high-entropy key, while the collaborative processing of the three-element architecture enables unified authentication and differentiated security services for broadband and narrowband terminals, improving authentication reliability, response speed, and scalability, while reducing system maintenance and management complexity.

[0037] The technical solutions of the embodiments of the present invention are based on, for example, Figure 2 The illustrated three-element authentication architecture constructs a unified identity recognition and secure access system for broadband and narrowband wireless terminals. In one embodiment of the invention, the system consists of three parts: terminal devices, intelligent converged terminals (Authenticators), and an authentication server. The terminal devices include broadband and narrowband wireless terminals in the power system, used to collect power grid status, service data, and event alarms. The terminals are only responsible for normal service communication and transmit radio frequency signals as an identity feature source; they do not store keys or auxiliary data, nor do they perform encryption operations, thereby achieving low-power, zero-modification deployment.

[0038] The intelligent fusion terminal, acting as the authenticator, is located between the terminal and the authentication server. It receives the terminal's radio frequency (RF) signals and extracts physical features. The quantized RF response sequence is then input into a fuzzy extractor module for processing, combining it with auxiliary data to generate a key for authentication. This module uses an XOR operation to combine the noisy RF response with the auxiliary data to form error-correcting codewords. Decoding and key recovery are then performed at either the intelligent fusion terminal or the authentication server. Through this process, the terminal's noisy features are converted into a verifiable high-entropy key, enabling rapid and reliable verification of the terminal's identity while reducing the terminal's computational load.

[0039] As the core management node of the three-element authentication architecture, the authentication server generates a high-entropy random key for each terminal during the registration phase. This key is then encoded into codewords using linear error-correcting codes and combined with the terminal's radio frequency response to generate auxiliary data. The terminal ID, auxiliary data, and key hash value are stored in the database. During the authentication phase, the authentication server receives noisy key information from the smart converged terminal, recovers the original key through the error correction module, and compares it with the hash value in the database to complete identity verification. Throughout the entire process, the authentication server centrally performs computation and error correction operations, ensuring that low-resource terminals do not need to participate in complex calculations or store sensitive information, while simultaneously achieving unified identity management and secure access for both broadband and narrowband terminals.

[0040] In the method flow of this invention, during the registration phase, the terminal first sends a standard radio frequency signal. The intelligent fusion terminal receives and extracts its physical features. The authentication server generates a high-entropy key, encodes it into error-correcting codewords, and generates auxiliary data storage, forming a complete record of terminal identity and key binding. During the authentication phase, the terminal sends the radio frequency signal again. The intelligent fusion terminal extracts noisy features and combines them with the auxiliary data to generate noisy codewords. The authentication server performs error correction decoding on the noisy codewords, recovers the key, and performs hash verification to complete terminal identity confirmation. The entire process ensures zero terminal modification, low bit error rate, and high reliability, while supporting large-scale heterogeneous terminal access.

[0041] Figure 3 This is a data flow and processing sequence during the registration and authentication phases of an embodiment of the present invention, illustrating the steps of terminal signal acquisition, feature extraction, auxiliary data generation, key encoding, and recovery; Figure 4 This is a schematic diagram illustrating the time sequence of terminal signal transmission, intelligent fusion terminal processing, server error correction decoding, and identity verification in an embodiment of the present invention. Figure 3 , 4 The specific processing shown includes the following: Step 1: Terminal signal acquisition and RF PUF feature generation.

[0042] Step 1.1, Signal Acquisition.

[0043] During the registration phase, both broadband and narrowband wireless terminals transmit standard radio frequency signals s(t) according to the power system communication protocol. The intelligent fusion terminal samples these signals through its radio frequency receiving module, obtaining discrete-time sequences I[n] and Q[n], representing the sampled values ​​of the in-phase (I) and quadrature (Q) components of the signal, respectively, where n = 1, 2, ..., N, and N is the total number of sampling points. The I / Q samples undergo bandpass filtering and analog-to-digital conversion to ensure that the signal remains undistorted within the sampling range.

[0044] Step 1.2, I / Q amplitude and phase characteristics calculation.

[0045] Calculate the I / Q amplitude ratio for each sampling point:

[0046] Where I[n] and Q[n] are the I-path and Q-path amplitudes of the nth sampling point, respectively. This indicates the amplitude value. The amplitude ratio A[n] is used to reflect the degree of I / Q imbalance.

[0047] The phase difference is calculated using the defined arctangent function:

[0048] in This represents the arctangent function, which returns... Angle values ​​within the range. This function is used to calculate the instantaneous I / Q phase difference at each sampling point, quantifying I / Q asymmetry. This represents the corresponding phase difference.

[0049] Step 1.3, carrier phase and oscillator phase noise extraction.

[0050] carrier phase Extract from the received signal by: representing the I / Q samples in complex numbers:

[0051] in Then, the carrier phase is calculated using the amplitude of the complex signal:

[0052] in It is the signed arctangent function, which returns... Angle values ​​within a certain range. The change of this angle over time is the instantaneous phase, used for oscillator phase noise analysis. Oscillator phase noise sequence. The phase difference between adjacent sampling points is calculated to obtain:

[0053] The variance of the phase shift is calculated using a sliding window W:

[0054] in This represents the average phase offset within the window. This indicates the intensity of random fluctuations in the oscillator phase.

[0055] Step 1.4, Feature quantization.

[0056] I / Q amplitude ratio A[n] and phase difference Quantized into a binary sequence by thresholding. The rule is: if or Output 1 if the output is positive, otherwise output 0. Oscillator phase noise variance. According to the threshold Quantized into binary sequence ,like Output 1 if the output is 1, otherwise output 0. , , This is the preset threshold.

[0057] Step 1.5 RF PUF Feature Sequence Generation and Stability Processing I / Q imbalanced sequence With oscillator phase noise sequence The complete radio frequency PUF feature sequence is obtained by splicing:

[0058] Step 2: Registration phase key generation and auxiliary data generation.

[0059] Step 2.1, Radio frequency characteristic stability processing.

[0060] During the registration phase, the terminal performs multiple radio frequency signal samples to obtain a sequence set. For each bit l, calculate the frequency of 1 across all samples:

[0061] like or This bit is considered stable; if This bit is considered unstable and is either removed from the final sequence or covered by redundancy error correction. The resulting stable RF PUF sequence is denoted as... This is used for subsequent key generation.

[0062] Step 2.2, high-entropy key generation.

[0063] The authentication server uses a stable radio frequency sequence. Using an initial random vector Seed as input, and passing it through a pseudo-random function Generate key:

[0064] Among them, pseudo-random function The specific calculation steps are as follows: Employing a minimally simplistic linear feedback shift register with a random seed As the initial stimulus, the iterative generation length is... A random permutation sequence of integers: Furthermore, shifting is used instead of division to achieve a fast mapping from pseudo-random integers to valid index ranges. Executing one operation from the algorithm will execute one operation from the... arrive The cycle. In the first... In the next iteration, the algorithm will extract from the set Take out the first one For each element, perform the following calculation:

[0065] In the formula: The original pseudo-random integer generated for LFSR; The maximum index threshold for the current iteration; To A logical right shift operation of bit length.

[0066] Further based on the valid index obtained from the mapping traverse the loop index In each iteration, with For random indexing, the binary vector Inside The position of the element and the first The elements in the positions are swapped to form the final result. .

[0067] This random function construction method can achieve uniform random shuffling, ensuring that the key entropy is greater than the original. The available entropy. Compared with traditional cryptographic random function generation methods, random generation is achieved simply by changing the position of values, thus reducing computational resources.

[0068] Step 2.3, BCH encoding key.

[0069] The generated key K is encoded into codewords using the BCH encoding algorithm. The codeword is n bits long and has an error correction capability of t bits. Variable descriptions: C is the encoded codeword, and t is the error correction capability, ensuring that even if the terminal's radio frequency characteristics are affected by environmental noise, K can still be recovered through decoding.

[0070] Step 2.4, Auxiliary data generation.

[0071] Auxiliary data AUX is achieved by stabilizing the radio frequency sequence. XOR generation with codeword C:

[0072] in, This is a bitwise XOR operation. AUX is public auxiliary data that can be stored in a database or transmitted in communications without revealing the key K. Variable description: AUX is auxiliary data with the same length as the codeword C.

[0073] Step 2.5, data storage.

[0074] The server will store the terminal ID, auxiliary data AUX, and hash value. Stored in a database, providing a basis for key recovery during the authentication phase. The key is generated using a secure hash function (such as SHA-256) to ensure its irreversibility. Auxiliary data is returned via AUX to the intelligent fused terminal for storage.

[0075] Step 3: Noisy feature processing and key recovery during the authentication phase.

[0076] Step 3.1, terminal signal transmission and feature acquisition.

[0077] During the authentication phase, the terminal transmits radio frequency signals according to the normal communication process. Its I-path and Q-path sampling sequences are and The sampling method is consistent with that used in the registration phase. After receiving the signal, the intelligent fusion terminal performs I / Q demodulation and analog front-end processing to obtain a noisy radio frequency characteristic sequence. , where n is the stable feature length. A noisy sequence can be represented as:

[0078] in This is the error vector, with each bit taking the value 0 or 1, indicating whether the corresponding bit was flipped due to environmental noise. The error Hamming weight represents the total number of error bits.

[0079] Step 3.2, Noisy codeword generation.

[0080] The intelligent fusion terminal reads the mask information of codeword C from the publicly available auxiliary data AUX obtained during the registration phase. (Noisy codeword) It is generated by bitwise XORing the auxiliary data AUX with the current noisy sequence R':

[0081] Substitute the AUX definition into the registration phase Then, it can be expanded as follows:

[0082] This step separates radio frequency noise from the sequence, enabling the authentication server to recover the key using an error correction algorithm.

[0083] Step 3.3, BCH decodes the recovery key.

[0084] The authentication server performs BCH decoding on the noisy codeword C':

[0085] Variable description: To decode the recovered key, The BCH decoding algorithm has an error correction capability of t bits. As long as... The decoder can fully recover This ensures that the impact of bit errors on key recovery is eliminated.

[0086] Step 3.4, Key verification and terminal identity confirmation.

[0087] Authentication server calculation hash value and the hash value stored during the registration phase. If the comparison is successful and authentication is confirmed, the terminal's identity is verified, and a secure communication session can be established with the authentication server using the recovered key. Encrypt business data. Throughout the process, the terminal does not need to participate in key calculation or store auxiliary data, ensuring zero-modification access for low-resource devices.

[0088] Step 3.5: The authentication result is returned.

[0089] The authentication server returns the authentication result and necessary session information to the smart converged terminal, which can then forward the result to the terminal or use it for management recording, thus completing the entire authentication process.

[0090] As can be seen from the above technical aspects, in the embodiments of the present invention: (1) A method for generating low-resource terminal identity features based on radio frequency PUF is proposed: This embodiment of the invention proposes to collect the radio frequency signal transmitted by the terminal, extract the I / Q imbalance features and oscillator phase noise features, and generate a stable radio frequency PUF feature sequence through quantization and sequence splicing. This feature sequence can be used to uniquely identify the terminal identity, realizing identity binding under low power consumption and zero hardware modification conditions.

[0091] (2) A method for multiple sampling and filtering of stable radio frequency PUF sequences is proposed: In this embodiment of the invention, multiple radio frequency samples are taken from the same terminal, the frequency of occurrence of each bit is calculated, and stable bits are filtered out to generate the final stable radio frequency PUF sequence. This method ensures that the impact of environmental noise and channel fluctuations on identity features is minimized, providing a reliable foundation for subsequent key generation and auxiliary data generation.

[0092] (3) Low-resource pseudo-random key generation and BCH encoding binding method: This embodiment of the invention proposes using a stable radio frequency PUF sequence as input, generating a high-entropy key through a pseudo-random function, and using BCH encoding to generate codewords, which are then XORed with the stable radio frequency sequence to generate public auxiliary data. This method achieves low-resource, high-reliability key binding while ensuring that the public auxiliary data does not reveal the key content.

[0093] (4) Low-Resource Pseudo-Random Function Design: This embodiment of the invention proposes a low-resource pseudo-random function (PRF) generation method based on a stable radio frequency PUF sequence. A random seed is initialized using an LFSR, and a high-entropy key is generated by combining position mapping and sequence reordering operations. Compared to traditional cryptographic PRFs, this design achieves key randomness and high entropy guarantees in low-resource terminal environments without complex computations, providing key technical support for secure access of low-power terminals.

[0094] (5) Noisy Feature Processing and Key Recovery Method in the Authentication Stage: This embodiment of the invention proposes that the intelligent fusion terminal receives noisy radio frequency signals, calculates noisy codewords and transmits them to the authentication server, recovers the key through BCH decoding, and verifies the hash value to complete the terminal identity authentication. This method minimizes the computational load of the terminal while ensuring high reliability authentication under environmental noise interference.

[0095] (6) Three-element authentication architecture collaborative processing method: The embodiments of the present invention adopt a three-element authentication architecture of terminal, intelligent fusion terminal and authentication server, clearly defining the functions and data flow of each entity. The terminal only provides radio frequency signals, the intelligent fusion terminal performs feature extraction and noisy codeword generation, and the authentication server completes key recovery and identity verification. This architecture realizes unified access for broadband and narrowband heterogeneous terminals, zero modification for low-resource terminals, and ensures that the entire system is scalable, reliable and secure.

[0096] (7) Security design of public auxiliary data: The embodiments of the present invention clearly define the auxiliary data as public information, which is generated by XORing the radio frequency PUF sequence with the BCH encoded codeword, ensuring that the public data can be used for key recovery without leaking the key.

[0097] In summary, the radio frequency PUF three-element authentication scheme proposed in this invention can achieve unique identity recognition and key generation with zero terminal modification and low computing resources. The terminal only provides the radio frequency signal, while the intelligent fusion terminal and authentication server handle the computation and error correction operations, thereby significantly reducing terminal deployment costs and ensuring high reliability. This design is suitable for scenarios with massive terminal access and can maintain low bit error rate and high success rate authentication even under environmental noise and channel interference.

[0098] Meanwhile, this embodiment of the invention combines a stable radio frequency PUF sequence with a low-resource pseudo-random function to generate a high-entropy key, and generates publicly available auxiliary data through BCH encoding, ensuring the key remains secure even when publicly disclosed. Under the three-element authentication architecture, the terminal, intelligent converged terminal, and authentication server work collaboratively to achieve unified identity recognition and secure access for heterogeneous broadband and narrowband terminals. The overall solution ensures efficient, stable, and secure operation of the system even under large-scale concurrent terminal access, meeting the practical requirements of power system business security, low cost, and high reliability.

[0099] System Implementation Examples According to embodiments of the present invention, a power line broadband and narrowband wireless terminal authentication system based on radio frequency non-cloning functions is provided. Figure 5 This is a schematic diagram of a power line broadband and narrowband wireless terminal authentication system based on radio frequency non-cloning functions, according to an embodiment of the present invention. Figure 5 As shown, the power broadband and narrowband wireless terminal authentication system based on radio frequency non-cloning functions according to an embodiment of the present invention specifically includes: Terminal 50 is used to transmit standard radio frequency signals; The intelligent fusion terminal 52 is used to receive the standard radio frequency signal and extract its physical features during the registration phase; and during the authentication phase, it receives the quasi-radio frequency signal retransmitted by the terminal, extracts noisy features, and generates noisy codewords by combining auxiliary data. Specifically, it is used for: During the registration phase, the standard radio frequency signal is sampled in I / Q mode by the radio frequency receiving module to obtain discrete time sequences I[n] and Q[n], where I[n] and Q[n] represent the sampled values ​​of the in-phase I and quadrature Q components of the signal, respectively, where n = 1, 2, ..., N, and N is the total number of sampling points. After the I / Q samples are processed by bandpass filtering and analog-to-digital conversion, the I / Q amplitude ratio is calculated for each sampling point, and the phase difference is calculated by the arctangent function. The carrier phase and oscillator phase noise are extracted, and the I / Q amplitude ratio and phase difference are quantized into a first binary sequence by thresholding. The oscillator phase noise is quantized into a second binary sequence by thresholding. The first binary sequence and the second binary sequence are concatenated to obtain a complete radio frequency PUF feature sequence, and the complete radio frequency PUF feature sequence is sent to the authentication server.

[0100] During the authentication phase, after the receiving terminal retransmits the quasi-radio frequency signal, I / Q demodulation and analog front-end processing are performed to obtain a noisy radio frequency feature sequence. The auxiliary data AUX obtained during the registration phase is XORed bit by bit with the noisy radio frequency feature sequence to generate a noisy codeword, and the noisy codeword is sent to the authentication server.

[0101] Authentication server 54 is used to generate and store high-entropy keys and auxiliary data during the registration phase using a fuzzy extractor combined with error-correcting codes; and during the authentication phase, it performs error-correcting decoding on the noisy codewords, recovers the key, and performs hash verification to complete terminal identity confirmation. Specifically, it is used for: During the registration phase, based on the complete radio frequency PUF feature sequence sampled multiple times, the frequency of occurrence of each bit is calculated, and stabilization processing is performed based on the frequency of occurrence to obtain a stable radio frequency PUF sequence. During the registration phase, a stable radio frequency PUF sequence and an initial random vector are used as inputs, and a pseudo-random function is applied. Generate a key K, encode the key K into a codeword C using the BCH encoding algorithm, XOR the stable RF PUF sequence with the codeword C to generate auxiliary data AUX, and combine the terminal ID, auxiliary data AUX, and the hash value of key K. Stored in a database.

[0102] During the authentication phase, BCH decoding is performed on the noisy codeword to obtain the decoded and recovered key. Calculate the key after decoding and recovery. hash value and the hash value With stored hash value The system performs a comparison; if the authentication is successful, the terminal's identity is confirmed, a secure communication session is established, and the decoded and recovered key is used. Encrypt business data for communication; return authentication results and necessary session information to the intelligent converged terminal.

[0103] This invention organically combines RF PUF feature stabilization processing, high-entropy key generation using low-resource pseudo-random functions, BCH-encoded auxiliary data, and a complete ternary authentication architecture to form a unique design for broadband and narrowband wireless terminals in power systems. This design can achieve terminal identity uniqueness, high key entropy, and authentication reliability under low-resource conditions, while supporting massive concurrent access from terminals.

[0104] The embodiments of the present invention are device embodiments corresponding to the above method embodiments. The specific operation of each module can be understood with reference to the description of the method embodiments, and will not be repeated here.

[0105] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A power line broadband and narrowband wireless terminal authentication method based on radio frequency non-cloning functions, characterized in that, include: During the registration phase, the terminal sends a standard radio frequency signal, the intelligent fusion terminal receives the standard radio frequency signal and extracts its physical features, and the authentication server uses a fuzz extractor combined with error correction code to generate a high-entropy key and auxiliary data and stores them. During the authentication phase, the terminal sends a quasi-radio frequency signal again. The intelligent fusion terminal extracts the noisy features and combines them with auxiliary data to generate noisy codewords. The authentication server performs error correction and decoding on the noisy codewords, recovers the key, and performs hash verification to complete the terminal identity confirmation.

2. The method according to claim 1, characterized in that, During the registration phase, the terminal sends a standard radio frequency signal, and the intelligent fusion terminal receives the standard radio frequency signal and extracts its physical features, specifically including: During the registration phase, the terminal sends a standard radio frequency (RF) signal. The intelligent fusion terminal performs I / Q sampling on the standard RF signal through the RF receiving module to obtain discrete time sequences I[n] and Q[n]. I[n] and Q[n] represent the sampled values ​​of the in-phase I and quadrature Q components of the signal, respectively, where n = 1, 2, ..., N, and N is the total number of sampling points. After the I / Q samples are processed by bandpass filtering and analog-to-digital conversion, the I / Q amplitude ratio is calculated for each sampling point, and the phase difference is calculated using the arctangent function. The carrier phase and oscillator phase noise are extracted, and the I / Q amplitude ratio and phase difference are quantized into a first binary sequence using a threshold. The oscillator phase noise is quantized into a second binary sequence using a threshold. The first binary sequence and the second binary sequence are concatenated to obtain a complete RF PUF feature sequence, which is then sent to the authentication server.

3. The method according to claim 1, characterized in that, The authentication server uses a fuzz extractor combined with error-correcting codes to generate and store high-entropy keys and auxiliary data, specifically including: The authentication server calculates the frequency of occurrence of each bit based on the complete radio frequency PUF feature sequence sampled multiple times, and performs stabilization processing based on the frequency of occurrence to obtain a stable radio frequency PUF sequence. The authentication server takes a stable radio frequency PUF sequence and an initial random vector as input, and uses a pseudo-random function. Generate a key K, encode the key K into a codeword C using the BCH encoding algorithm, XOR the stable RF PUF sequence with the codeword C to generate auxiliary data AUX, and combine the terminal ID, auxiliary data AUX, and the hash value of key K. Stored in a database.

4. The method according to claim 1, characterized in that, During the authentication phase, the terminal retransmits the quasi-radio frequency signal. The intelligent fusion terminal extracts the noisy features and combines them with auxiliary data to generate noisy codewords, specifically including: During the authentication phase, the terminal sends the quasi-radio frequency signal again. After receiving the quasi-radio frequency signal sent by the terminal again, the intelligent fusion terminal performs I / Q demodulation and analog front-end processing to obtain the noisy radio frequency feature sequence. The intelligent fusion terminal will perform a bitwise XOR operation on the auxiliary data AUX obtained during the registration phase and the noisy radio frequency feature sequence to generate a noisy codeword, and then send the noisy codeword to the authentication server.

5. The method according to claim 1, characterized in that, The authentication server performs error correction decoding on the noisy codewords, recovers the key, and performs hash verification to complete the terminal identity confirmation process, specifically including: The authentication server performs BCH decoding on the noisy codeword to obtain the decoded and recovered key. Calculate the key after decoding and recovery. hash value and the hash value With stored hash value The system performs a comparison; if the authentication is successful, the terminal's identity is confirmed, a secure communication session is established, and the decoded and recovered key is used. Encrypt business data for communication; The authentication server returns the authentication result and necessary session information to the smart converged terminal.

6. A power line broadband and narrowband wireless terminal authentication system based on radio frequency non-cloning functions, characterized in that, include: The terminal is used to transmit standard radio frequency signals; A smart fusion terminal is used to receive the standard radio frequency signal and extract its physical characteristics during the registration phase; During the authentication phase, the receiving terminal retransmits the quasi-radio frequency signal, extracts the noisy features, and combines them with auxiliary data to generate noisy codewords. An authentication server is used during the registration phase to generate and store high-entropy keys and auxiliary data using a fuzz extractor combined with error-correcting codes. During the authentication phase, the noisy codewords are corrected and decoded, the key is recovered and hash verification is performed to complete the terminal identity confirmation.

7. The system according to claim 6, characterized in that, The intelligent fusion terminal is specifically used for: During the registration phase, the standard radio frequency signal is sampled in I / Q mode by the radio frequency receiving module to obtain discrete time sequences I[n] and Q[n], where I[n] and Q[n] represent the sampled values ​​of the in-phase I and quadrature Q components of the signal, respectively, where n = 1, 2, ..., N, and N is the total number of sampling points. After the I / Q samples are processed by bandpass filtering and analog-to-digital conversion, the I / Q amplitude ratio is calculated for each sampling point, and the phase difference is calculated by the arctangent function. The carrier phase and oscillator phase noise are extracted, and the I / Q amplitude ratio and phase difference are quantized into a first binary sequence by thresholding. The oscillator phase noise is quantized into a second binary sequence by thresholding. The first binary sequence and the second binary sequence are concatenated to obtain a complete radio frequency PUF feature sequence, and the complete radio frequency PUF feature sequence is sent to the authentication server.

8. The system according to claim 6, characterized in that, The authentication server is specifically used for: During the registration phase, based on the complete radio frequency PUF feature sequence sampled multiple times, the frequency of occurrence of each bit is calculated, and stabilization processing is performed based on the frequency of occurrence to obtain a stable radio frequency PUF sequence. During the registration phase, a stable radio frequency PUF sequence and an initial random vector are used as inputs, and a pseudo-random function is applied. Generate a key K, encode the key K into a codeword C using the BCH encoding algorithm, XOR the stable RF PUF sequence with the codeword C to generate auxiliary data AUX, and combine the terminal ID, auxiliary data AUX, and the hash value of key K. Stored in a database.

9. The system according to claim 6, characterized in that, The intelligent fusion terminal is specifically used for: During the authentication phase, after the receiving terminal retransmits the quasi-radio frequency signal, I / Q demodulation and analog front-end processing are performed to obtain a noisy radio frequency feature sequence. The auxiliary data AUX obtained during the registration phase is XORed bit by bit with the noisy radio frequency feature sequence to generate a noisy codeword, and the noisy codeword is sent to the authentication server.

10. The method according to claim 1, characterized in that, The authentication server is specifically used for: During the authentication phase, BCH decoding is performed on the noisy codeword to obtain the decoded and recovered key. Calculate the key after decoding and recovery. hash value and the hash value With stored hash value The system performs a comparison; if the authentication is successful, the terminal's identity is confirmed, a secure communication session is established, and the decoded and recovered key is used. Encrypt business data for communication; return authentication results and necessary session information to the intelligent converged terminal.

Images