WO2020133655A1

WO2020133655A1 - Lightweight authentication method supporting anonymous access of heterogeneous terminal in edge computing scenario

Info

Publication number: WO2020133655A1
Application number: PCT/CN2019/075660
Authority: WO
Inventors: 尚文利; 曾鹏; 陈春雨; 赵剑明; 刘贤达; 尹隆
Original assignee: 中国科学院沈阳自动化研究所
Priority date: 2018-12-26
Filing date: 2019-02-21
Publication date: 2020-07-02
Also published as: CN111371730B; CN111371730A

Abstract

Provided by the present invention is a lightweight authentication method supporting anonymous access of heterogeneous terminal in an edge computing scenario. The present invention uses a cloud platform to create a pseudo identity for each terminal device to hide the true identity information, and can meanwhile trace a malicious terminal device. During the authentication process of terminal devices accessing an edge computing node, the edge computing node can verify the legality of the identities of all accessing devices without communicating with the cloud platform, and will not learn the true identity information of the terminals. The present invention guarantees the identity privacy of terminal devices, improves the efficiency of access authentication, and can resist common threats such as replay attacks, thereby enhancing the security and reliability of the entire edge computing system, and solving the problem of access authentication of terminal devices with limited resources in an edge computing scenario.

Description

Lightweight authentication method supporting anonymous access of heterogeneous terminals in edge computing scenarios

Technical field

The invention belongs to the field of edge computing information security, and specifically is a lightweight authentication mechanism that supports anonymous access of heterogeneous terminals in an edge computing scenario.

Background technique

As the trend of the Internet of Everything continues to deepen, the Internet of Things technology and smart devices are increasingly permeating people's daily life. Smart technology has been the first to be applied in industries such as manufacturing, power, and transportation. Edge computing expands traditional cloud services To the edge of the network, with network edge equipment as the core, services can reside on the edge equipment, while processing massive data, it can also ensure efficient network operation and service delivery, closer to users, suitable for networks with low latency requirements Services, but the rise of edge computing has also brought new challenges to the information security protection of users, edge nodes, and cloud servers in edge computing networks, especially in terms of security and privacy.

Edge computing equipment is a development platform that integrates connectivity, computing, storage, and applications. As a small data center located on the edge of the network, it is closer to users. Heterogeneous access environments and diverse business requirements make edge equipment face more complex In the network environment, attacks from the user layer and cloud servers will bring serious security threats to the entire edge computing network. Traditional network security technologies are difficult to resist such multi-source, cross-domain, layered attacks and intrusions. Not only that, edge computing nodes/servers need to provide services to large-scale end users. The deployment locations of edge computing nodes and terminal devices have natural distributed characteristics, and their computing and storage capabilities are poor, and they cannot support traditional asymmetric passwords. The resource overhead of the network security protection technology learned, and the interconnection of massive terminal devices requires an efficient identity authentication and trust management system. When massive terminal devices need to send access requests to edge computing nodes, the traditional centralized security authentication mechanism faces huge The performance pressure, especially when the equipment is centralized access, authentication system is often overwhelmed.

Identity authentication is an important issue of edge computing security. An efficient identity authentication mechanism is the first line of defense for information security protection of edge computing nodes. The traditional PKI-based identity verification mechanism will be implemented in a three-tier "cloud-edge-end" architecture. No longer applicable, the efficiency is not high and its scalability is poor. In addition, when the edge device needs to use the services provided by the edge computing, if there is no authentication service, a flowing edge computing node/server can pretend to be a legitimate edge computing device or edge computing instance and induce the edge side The terminal device is connected to it. Once the terminal device is connected to the fake edge computing node, the adversary can manipulate the incoming and outgoing requests from the end user or the cloud, secretly collect or tamper with the terminal device data, and easily initiate further attacks. The fake edge computing node Or, the existence of a server is a serious threat to user data security and privacy.

In the identity authentication mechanism under the hierarchical architecture of edge computing, the current research on the identity authentication mechanism of edge computing has not yet formed a relatively complete research system and method, and most of the existing research programs are used to solve the identity authorization of edge-side devices And the problem of identity authentication within a single scope, the present invention proposes an access authentication mechanism based on a lightweight signature and verification mechanism. This solution does not need to be incorporated into the traditional PKI system, but only needs to save one for each terminal device during the registration phase The pseudo-identity information distributed by the cloud platform can allow any terminal device to perform access authentication with any edge computing node in the edge computing network system under the authorization of the cloud platform, which can effectively resist replay attacks and middlemen Attacks and other types of attacks can be applied to devices with limited computing resources and storage resources on the edge, and support anonymous access authentication to ensure the privacy of the terminal device's identity information.

Summary of the invention

In view of the problem that the authentication system is overwhelmed and does not support anonymity in the centralized access of massive heterogeneous devices on the edge side proposed in the background technology, the present invention proposes a lightweight authentication mechanism that supports anonymous access of heterogeneous terminals in an edge computing scenario , Reduces the computing resources in the authentication process, and guarantees the identity privacy of the terminal device, and improves the authentication efficiency.

The technical solution adopted by the present invention to achieve the above object is: a lightweight authentication method supporting anonymous access of heterogeneous terminals in an edge computing scenario, including the following steps:

Initialization stage: The cloud platform first selects its own master key information and keeps it privately, then establishes public parameters, and at the same time, the edge computing node initializes its own public and private key pair and sends the public key information to the cloud platform;

Terminal device registration and pseudo-identity generation: each terminal device uses its own identity information to send a registration request to the cloud platform. The cloud platform uses the master key information to create pseudo-identity information and public key information for the terminal device, and uses the public computing of the edge computing node The key information encrypts the pseudo identity of the registered terminal and sends it to the designated edge computing node, and then the edge computing node decrypts it through its own private key, and stores the decrypted registered device pseudo identity information list locally;

Terminal device access authentication: When the edge computing node receives the access request sent by the terminal device, it will verify the request time stamp and identity legitimacy of the terminal device, and then verify the access request through signature and signature verification; if If the verification fails, the access request of the terminal device is rejected; otherwise, the access request of the terminal device is received.

The initialization phase includes the following steps:

Cloud platform generation system public parameter PP = {q, G, g, A, H ₀ , H ₁ , H ₂ , H ₃ }; where, select the cyclic group G and large integer group of order q

The generator of the group is g, from the integer group

Randomly select the integer a as the master key information, and then calculate A = g ^a ; select four different Hash functions

The edge computing node generates its own public-private key pair (PK _ES , SK _ES ) from the cyclic group G, which is used to encrypt and sign the transmitted data, and sends the public key PK _ES and identity information ID _ES to the cloud platform.

The terminal device registration and pseudo-identity generation include the following steps:

The cloud platform generates pseudo identity information for the terminal device based on its identity information ID

And public key information PK=g ^k , where k is an integer; the terminal device generates its own private key information SK=b·H ₁ (PID) based on the public key information PK and pseudo-identity PID fed back by the cloud platform, and b is an integer;

The cloud platform uses the public key PK _ES of the edge computing node to encrypt the pseudo-identity, and sends the generated ciphertext data M=E(PK _ES , PID) to the edge computing node, and sends the registered terminal device pseudo-identity information to The designated edge computing node, the edge computing node receives the ciphertext data M sent by the cloud platform, decrypts it with the private key to restore the registered terminal device pseudo identity information, and saves the registered terminal device pseudo identity information in a list To complete the registration of the terminal device.

The specific steps of the terminal device access authentication are as follows:

The terminal device generates a timestamp T for message validity verification, which is used to resist replay attacks, and then uses its own private key to generate a signature for the message Sig=H ₃ (R-SK·H′)·r ^-1 , integer

R = ^gr , H'= H ₂ (M, PID, ID _ES , R, T), SK is the private key information of the terminal device, ID _ES is the identity information of the edge computing node; then send the request message and signature to Registered edge computing nodes;

After receiving the information sent by the terminal device, the edge computing node first judges whether the timestamp is valid. If the timestamp T has expired, the received data packet is discarded and the terminal is denied access. At the same time, the verification is terminated. If the timestamp T is not If it expires, it will receive the data packet and accept the access of the terminal device;

Then determine whether the PID information of the terminal device belongs to the locally stored list of registered devices. If it does not, discard the received data packet and reject the terminal's access, and terminate the verification; if it belongs, receive the data packet and accept the terminal device's Access

Use the identity verification of the terminal device to verify whether the following formula holds:

If the equation holds, the terminal device's access authentication request is accepted, otherwise the data packet is discarded and the terminal's access is denied.

Terminal device batch access authentication, specifically batch authentication when multiple terminal devices request access to an edge computing node at the same time, first verify the request time stamp and identity legitimacy of the terminal device, and reject the illegal terminal device , Through the method of exponential multiplication to achieve batch verification of the request, if the verification is successful, the access request is accepted, otherwise the request is authenticated one by one, and the illegal terminal equipment is reported to the cloud platform to realize the traceability of the illegal terminal equipment.

The terminal device batch access authentication specifically includes the following steps:

When the edge computing node simultaneously receives the access request sent by n terminal devices, the edge computing node first judges whether the time stamp T _i is valid, if the time stamp T _i has expired, the corresponding terminal device has expired, otherwise, the corresponding terminal The device has not expired; the terminal device whose time stamp has expired is rejected;

Then it is determined whether the identity information PID _i of all the terminal devices remaining excluding the terminal device whose time stamp has expired exists in the locally stored list of registered devices; if it exists, the device is registered, indicating that the identity is legal; otherwise, the device is not registered, Means illegal; reject unregistered terminal equipment;

Finally, the edge computing node uses exponential multiplication and terminal device identity information to calculate and determine whether the following formula holds:

Where H′ _i = H ₂ (M _i , PID _i , ID _ES , R _i , T _i ), M _i , T _i , sig _i, and R _i represent the information and time stamp sent by the i-th terminal device, respectively , Signature and random number; ID _ES is the identity information of the edge computing node;

If the equation is established, the terminal devices that exclude the timestamp that has expired and the remaining unregistered terminal devices send requests are legal, and receive the access request of the terminal device, otherwise there is an illegal terminal device, and then through the terminal device access authentication to achieve the illegal Traceability of terminal equipment.

The invention has the following advantages and beneficial effects:

1. The present invention proposes a lightweight authentication method that supports anonymous access of heterogeneous terminals in an edge computing scenario in combination with the three-tier system architecture of "cloud-edge-end" in an edge computing scenario. This method can be applied to computing Terminal equipment with limited resources and storage resources.

2. The lightweight access authentication method proposed by the present invention can support batch authentication when a mass device sends an access request at the same time, and can realize the anonymous authentication of the terminal device and the traceback of malicious terminal devices, improving the mass of heterogeneous terminals The efficiency and privacy of identity authentication for concurrent access.

BRIEF DESCRIPTION

1 is a schematic diagram of the three-layer architecture of the edge computing of the present invention;

Figure 2 is a flow chart of lightweight authentication supporting anonymous access to heterogeneous terminals in an edge computing scenario.

detailed description

The present invention will be further described in detail below with reference to the drawings and embodiments.

As shown in Figure 1, the lightweight access authentication mechanism supporting anonymous terminals in the edge computing scenario includes three entities, namely a cloud platform, edge computing nodes and terminal devices. The cloud platform is responsible for issuing fake identities for each terminal device Information, the edge computing node can authenticate the terminal device that is accessed.

As shown in Figure 2, a lightweight authentication mechanism that supports anonymous access to heterogeneous terminals in an edge computing scenario includes the following steps:

1) Initialization stage: The cloud platform will first initialize and generate its own public and private key pair and master key information, and then use the master key information to calculate and publish the public parameter information. The public and private key information is stored in the cloud platform and is used to carry out the transmission data. Sign to prevent data from being tampered with.

2) Terminal device registration and pseudo-identity generation: the terminal device uses its real identity information to send a registration request to the cloud platform, and the cloud platform generates a pseudo-signal for access authentication for the terminal device based on the master key information and the terminal's identity information Identity and public key information, and send the pseudo-identity information authorized to register to the edge computing node.

3) Terminal device access authentication: When the terminal device needs to access an edge computing node, the edge computing node can verify the legitimacy of the terminal identity without using a third-party cloud platform, which improves the efficiency of access authentication .

4) Terminal device batch access authentication: batch authentication is performed on a large number of terminal devices that simultaneously send access requests to edge computing nodes, reducing authentication delay and ensuring real-time service processing,

Initialization stage: The cloud platform first selects its own master key information and keeps it privately, then instantiates the relevant group, hash function and other information as public parameters, and at the same time the edge computing node initializes its own public and private key pair and sends the public key information to the cloud platform.

Terminal device registration and pseudo-identity generation: each terminal device uses its own real identity information to send a registration request to the cloud platform. The cloud platform uses the master key to create pseudo-identity information and public key information for the terminal device, and uses the public computing of the edge computing node The key encrypts the pseudo identity of the registered terminal and sends it to the designated edge computing node, and then the edge computing node decrypts it by its own private key, and stores the decrypted registered device pseudo identity information list locally.

Terminal device access authentication: When the edge computing node receives the access request sent by the terminal device, it will verify the request time stamp and identity legitimacy of the terminal device to ensure that the sender is a legitimate user, and then pass the lightweight The signature and verification methods verify the access request. If the verification fails, the access request of the terminal device is rejected.

Terminal device batch access authentication: The present invention supports batch access authentication when multiple terminal devices request simultaneous access to edge computing nodes. First, the request time stamp and identity legitimacy of the terminal device are verified, and illegal terminals are rejected After the device, the batch verification of a large number of requests is realized through exponential multiplication. If the verification is successful, the access request is accepted. Otherwise, the request is authenticated one by one, and the illegal terminal device is reported to the cloud platform to trace the illegal terminal device.

During the initialization phase, the cloud platform generates the master key, public parameters, and public and private key pair information for each edge computing node, including the following steps:

The cloud platform performs a series of preparations, including given a bilinear pairing group, selecting the system master key and selecting four different hash functions, generating its own public and private key pairs, etc. The cloud platform calculates and discloses system parameters.

The edge computing node then generates its own public and private key pair information, which is used to encrypt and sign the transmitted data, and sends the public key and identity information to the cloud platform.

In terminal device registration and pseudo-identity generation, the terminal device uses its real identity information to send a registration request to the cloud platform. The cloud platform generates pseudo-identity information and corresponding public key information for the terminal device based on the identity information of the terminal device, including the following steps:

The cloud platform generates a pseudo-identity and public key information for the terminal device based on its identity information. After that, the pseudo-identity information is used not only to communicate with the edge computing node, but also to track the true identity of the malicious terminal device. The feedback public key and pseudo-identity information are calculated to generate their own private key information.

The cloud platform uses the public key information of the edge computing node to encrypt the pseudo identity, and sends the generated encrypted data to the edge computing node, and sends the registered terminal device pseudo identity information to the designated edge computing node. The edge computing node receives The ciphertext data sent to the cloud platform is decrypted using the private key to restore the pseudo identity information of the registered terminal device, and the pseudo identity information of the registered terminal device is saved in a list to complete the registration of the terminal device.

In terminal device access authentication, when a terminal device sends an access authentication request to an edge computing node, the lightweight signature and verification mechanism is used to verify the legitimacy of the terminal identity, and does not need to be performed with the cloud platform The specific steps are as follows:

The terminal device generates a timestamp for message validity verification, which is used to resist replay attacks, and then uses its own private key to generate a signature for the information, and then sends the request message and signature to the registered edge computing node.

After receiving the information sent by the terminal, the edge computing node first judges whether the timestamp is valid. If the timestamp has expired, the received data packet is discarded and the terminal is denied access. At the same time, the verification is terminated, and then the identity of the terminal device is judged It belongs to the list of registered devices stored locally, and judges the legality of the device's identity. If it does not, it discards the received data packets and denies access to the terminal. At the same time, the verification is terminated. Finally, the identity verification of the terminal device is used to verify whether the following formula is established. If the equation is established, the access authentication request of the terminal device is accepted, otherwise the data packet is discarded and the terminal is denied access.

In the terminal device batch access authentication, the edge computing node can batch verify the legitimacy of the terminal device that sends the access request at the same time, which specifically includes the following steps:

Suppose that when the edge computing node receives the access request sent by n terminal devices at the same time, the edge computing node first judges whether the time stamp T _i is valid and rejects the terminal device in which the time stamp has expired.

Then determine whether the identity information of all terminal devices exists in the locally stored list of registered devices, determine the legality of the device identity, and reject the unregistered terminal devices.

Finally, the edge computing node uses exponential multiplication and the identity information of the terminal device to calculate and determine whether the following formula is established. If the equation is established, the terminal device that sent the request is legal and receives the access request from the terminal device, otherwise there is an illegal terminal device. The illegal terminal equipment can be traced through one-to-one authentication.

1. Initialization phase

The cloud platform will first generate the authentication master key and public parameters, and the initialization phase is described as follows:

(1) The cloud platform first randomly selects an integer λ as a security parameter to ensure the efficiency and safety of the generated group, and generates a cyclic group G and a large integer group of order q

The generator of the group is g, from the integer group

Randomly select the integer a as the master key information, and then calculate A=g ^a as ^a part of the common parameters.

(2) Select the following four different Hash functions

As part of the public parameters, where

It is an integer group of order q, and public system public parameters PP = {q, G, g, A, H ₀ , H ₁ , H ₂ , H ₃ }.

(3) The cloud platform generates public and private key pairs (PK _C , SK _C ) from group G to sign the transmitted data to prevent the data from being tampered with.

(4) The edge computing node generates its own public and private key pair (PK _ES , SK _ES ) from group G for encryption and signature of the transmitted data, and then sends the public key PK _ES and identity information ID _ES to the cloud platform.

2. Terminal device registration and pseudo-identity generation

In order to ensure the anonymity of the identity, the terminal device uses its real identity information ID to send a registration request to the cloud platform, and the cloud platform generates it for the terminal device based on the identity information of the terminal device, its accessible edge computing nodes, and master key information a. Pseudo-identity information and public key information are described as follows:

(1) When the cloud platform receives the registration request sent by the terminal device U, firstly from the large integer group

Randomly select an integer k in, then generate public key information PK=g ^k and a pseudo-identity information for the terminal device

After that, the pseudo-identity information is used not only to communicate with the edge computing node, but also to track the true identity of the malicious terminal device.

(2) The cloud platform sends the generated PK and pseudo-identity information PID to the terminal device through a secure channel, and the terminal device selects from a large integer group

Randomly select the integer b in the calculation and generate its own private key information SK=b·H ₁ (PID).

(3) The cloud platform needs to send the registered terminal device pseudo-identity information to the designated edge computing node, use the edge computing node's public key information to encrypt the pseudo-identity M = E (PK _ES , PID), and the generated The encrypted data M is sent to the edge computing node, where PK _ES is the public key of the edge computing node, and E is an asymmetric encryption encryption algorithm, which means that PK _ES is used as the key to encrypt PID _i and generate ciphertext data M.

(4) After receiving the ciphertext data M sent by the cloud platform, the edge computing node decrypts it using the private key to restore the registered terminal device pseudo-identity information PID = D (SK _ES , M), where D is asymmetric encryption The decryption algorithm means that using SK _ES as the key to decrypt M restores the PID information, so that the edge computing node will generate a pseudo-identity information list of registered terminal devices.

3. Terminal device access authentication

When the terminal device U needs to access the edge computing node ID _ES and send information, in order to ensure information authentication and integrity, the edge computing node needs to authenticate the terminal device before receiving, and does not need to interact with the cloud platform, specific description as follows:

(1) U from large integer group

Random integer

Calculate R = ^gr and H'= H ₂ (M, PID, ID _ES , R, T), where T is the current timestamp number, used to resist replay attacks, M is the information being sent, and then use its own The private key SK is calculated to generate the signature Sig=H ₃ (R-SK·H′)·r ^-1 for the information M.

(2) U sends the information and signature Msg = {M, PID, R, T, Sig} to the registered edge computing node.

(3) After receiving the information Msg={M, PID, R, T, Sig} sent by the terminal U, the edge computing node first judges whether the time stamp T is valid, and discards the received data if the time stamp T has expired Packet and refuse the access of terminal U, at the same time terminate the following steps.

(4) Then determine whether the PID belongs to the locally stored list of registered devices, determine the legality of the device's identity, if not, discard the received data packet and reject the access of the terminal U, and terminate the following steps.

(5) Finally, use PID to calculate H ₁ (PID) and H′=H ₂ (M, PID, ID _ES , R, T), and verify whether equation (1) holds, if the equation holds, then accept the terminal The device's access authentication request, otherwise discard the data packet and refuse the terminal's access.

4. Terminal equipment batch access authentication

When a large number of terminal devices apply for access to edge computing nodes at the same time, if the edge computing nodes complete the authentication of the terminal devices one by one, it may have an impact on the real-time nature of the business, so the present invention supports multiple access terminals at the same time The device performs batch authentication to reduce latency and ensure the real-time performance of business processing. The specific description is as follows:

(1) Assuming that the edge computing node receives the message Msg _i ={M _i ,Pd _i ,R _i ,T _i ,Sig _i } sent by n terminal devices at the same time, M _i ,T _i ,sig _i and R _i represent The information, time stamp, signature and random number sent by the i-th terminal device are identified as PID _i . The edge computing node first judges whether the time stamp T _i is valid and rejects the terminal device in which the time stamp has expired, where 0< i≤n indicates the index, and n indicates the total number of terminal devices.

(2) Then determine whether all PID _i exists in the locally stored registered device list, determine the legality of the device identity, and reject the unregistered terminal device.

(3) The edge computing node uses PID _{i to} calculate H ₁ (PID _i ) and H′ _i = H ₂ (M _i , PID _i , ID _ES , R _i , T _i ), where 0< _i ≦n represents an index, and Determine whether equation (2) holds,

If the equation is established, the terminal device sending the request is legal and receives the access request of the terminal device, otherwise there is an illegal terminal device, and the illegal terminal device can be traced through one-to-one authentication.

Claims

The lightweight authentication method supporting anonymous access of heterogeneous terminals in an edge computing scenario is characterized by the following steps:

Initialization stage: The cloud platform first selects its own master key information and keeps it privately, then establishes public parameters, and at the same time, the edge computing node initializes its own public and private key pair and sends the public key information to the cloud platform;

Terminal device registration and pseudo-identity generation: each terminal device uses its own identity information to send a registration request to the cloud platform. The cloud platform uses the master key information to create pseudo-identity information and public key information for the terminal device, and uses the public computing of the edge computing node The key information encrypts the pseudo identity of the registered terminal and sends it to the designated edge computing node, and then the edge computing node decrypts it through its own private key, and stores the decrypted registered device pseudo identity information list locally;

Terminal device access authentication: When the edge computing node receives the access request sent by the terminal device, it will verify the request time stamp and identity legitimacy of the terminal device, and then verify the access request through signature and signature verification; if If the verification fails, the access request of the terminal device is rejected; otherwise, the access request of the terminal device is received.
The lightweight authentication method for supporting anonymous access of heterogeneous terminals in an edge computing scenario according to claim 1, wherein the initialization stage includes the following steps:

Cloud platform generation system public parameter PP = {q, G, g, A, H 0 , H 1 , H 2 , H 3 }; where, select the cyclic group G and large integer group of order q
The generator of the group is g, from the integer group
Randomly select the integer a as the master key information, and then calculate A = g a ; select four different Hash functions

The edge computing node generates its own public-private key pair (PK ES , SK ES ) from the cyclic group G, which is used to encrypt and sign the transmitted data, and sends the public key PK ES and identity information ID ES to the cloud platform.
The lightweight authentication method supporting anonymous access of heterogeneous terminals in an edge computing scenario according to claim 1, characterized in that the terminal device registration and pseudo identity generation include the following steps:

The cloud platform generates pseudo identity information for the terminal device based on its identity information ID
And public key information PK=g k , where k is an integer; the terminal device generates its own private key information SK=b·H 1 (PID) based on the public key information PK and pseudo-identity PID fed back by the cloud platform, and b is an integer;

The cloud platform uses the public key PK ES of the edge computing node to encrypt the pseudo-identity, and sends the generated ciphertext data M=E(PK ES , PID) to the edge computing node, and sends the registered terminal device pseudo-identity information to The designated edge computing node, the edge computing node receives the ciphertext data M sent by the cloud platform, decrypts it with the private key to restore the registered terminal device pseudo identity information, and saves the registered terminal device pseudo identity information in a list To complete the registration of the terminal device.
The lightweight authentication mechanism supporting anonymous access of heterogeneous terminals in an edge computing scenario according to claim 1, wherein the specific steps of the terminal device access authentication are as follows:

The terminal device generates a timestamp T for message validity verification, which is used to resist replay attacks, and then uses its own private key to generate a signature for the message Sig=H 3 (R-SK·H′)·r -1 , integer
R = gr , H'= H 2 (M, PID, ID ES , R, T), SK is the private key information of the terminal device, ID ES is the identity information of the edge computing node; then send the request message and signature to Registered edge computing nodes;

After receiving the information sent by the terminal device, the edge computing node first judges whether the timestamp is valid. If the timestamp T has expired, the received data packet is discarded and the terminal is denied access. At the same time, the verification is terminated. If the timestamp T is not If it expires, it will receive the data packet and accept the access of the terminal device;

Then determine whether the PID information of the terminal device belongs to the locally stored list of registered devices. If it does not, discard the received data packet and reject the terminal's access, and terminate the verification; if it belongs, receive the data packet and accept the terminal device's Access

Use the identity verification of the terminal device to verify whether the following formula holds:

If the equation holds, the terminal device's access authentication request is accepted, otherwise the data packet is discarded and the terminal's access is denied.
The lightweight authentication method for supporting anonymous access of heterogeneous terminals in an edge computing scenario according to claim 1, characterized in that the terminal device batch access authentication is specifically when multiple terminal devices simultaneously request access to an edge computing node For batch access authentication, first verify the request timestamp and identity legitimacy of the terminal device. After rejecting the illegal terminal device, implement batch verification of the request by exponential multiplication. If the verification is successful, the access request is accepted. Otherwise, the request is authenticated one by one, and the illegal terminal equipment is reported to the cloud platform, so as to trace the illegal terminal equipment.
The lightweight authentication method for supporting anonymous access of heterogeneous terminals in an edge computing scenario according to claim 5, wherein the terminal device batch access authentication specifically includes the following steps:

When the edge computing node simultaneously receives the access request sent by n terminal devices, the edge computing node first judges whether the time stamp T i is valid, if the time stamp T i has expired, the corresponding terminal device has expired, otherwise, the corresponding terminal The device has not expired; the terminal device whose time stamp has expired is rejected;

Then it is determined whether the identity information PID i of all the terminal devices remaining excluding the terminal device whose time stamp has expired exists in the locally stored list of registered devices; if it exists, the device is registered, indicating that the identity is legal; otherwise, the device is not registered, Means illegal; reject unregistered terminal equipment;

Finally, the edge computing node uses exponential multiplication and terminal device identity information to calculate and determine whether the following formula holds:

Where H′ i = H 2 (M i , PID i , ID ES , R i , T i ), M i , T i , sig i, and R i represent the information and time stamp sent by the i-th terminal device, respectively , Signature and random number; ID ES is the identity information of the edge computing node;

If the equation is established, the terminal devices that exclude the timestamp that has expired and the remaining unregistered terminal devices send requests are legal, and receive the access request of the terminal device, otherwise there is an illegal terminal device, and then through the terminal device access authentication to achieve the illegal Traceability of terminal equipment.