TWI754464B - Authentication system and method for interent of things device based on edge computing and edge authentication server thereof - Google Patents

Abstract

The present invention is an authentication system and method for IOT device based on edge computing and an edge authentication server thereof. The fast authentication is distributed to the edge authentication server of the edge node, and each edge authentication server can intelligently calculate the appropriate token timeliness to effectively reduce the authentication delay and the burden of a core authentication server, and can improve the security of fast authentication. The security problems extended by the traditional centralized authentication heavy load, authentication delay, and the timeliness of the fixed token used for fast authentication can be solved in the present invention.

Description

IoT device authentication system, method and edge authentication server based on edge computing

The present disclosure relates to device authentication technology, and more specifically, to an IoT device authentication system and method based on edge computing, and an edge authentication server thereof.

At present, the authentication and authorization mechanism of IoT devices is centralized authentication and authorization. For example, the IoT device authentication and authorization system is a centralized core authentication system, which can provide general authentication (AAA authentication) and fast authentication mechanisms. As shown in FIG. 1 , the IoT device 11 sends an authentication request to the core authentication system 12. After the core authentication system 12 receives the user information, it will first perform data verification, that is, general authentication. After the general authentication is passed, the core authentication system 12 will give the object The networking device 11 has a set of tokens. After that, the IoT device 11 will use the token to send an authentication request to the core authentication system 12 again. The core authentication system 12 will first verify whether the token is valid. General authentication is not required, which is called fast authentication. If invalid, general authentication is required and the token is re-acquired.

The existing core authentication system adopts a single system authentication mechanism. Although it is simple, there are still other problems. For example, a single core authentication system can provide centralized and rapid authentication, but it is centralized in a single system. For authentication and authorization, it is still easy to cause the burden of the system or the situation of authentication delay. Moreover, the fixed token validity period is not the most suitable. For example, if the validity period is too long, the token will be easily stolen or stolen. Security concerns, but if the time limit is too short, the token will easily fail, which will lead to the burden of general authentication.

In view of this, how to find a device authentication mechanism that can authenticate IoT devices without the need for complex procedures and system configuration, especially to reduce system burden and avoid authentication delay, will be highly desired by those skilled in the art. problem to be solved.

In order to solve the above-mentioned problems of the prior art, the present invention proposes an IoT device authentication system based on edge computing, which includes: an edge authentication server, which is used for receiving an authentication request including user data and tokens sent by the IoT device and judging The validity period of the token is to send an authentication success message to the IoT device when the validity period of the token is valid; and the core authentication server is used for determining the validity of the token at the edge authentication server When the period expires, receive the user data sent by the edge authentication server for general authentication.

In one embodiment, the core authentication server responds to the edge authentication server that the general authentication is a success or a failure, so as to respond with a new token when the authentication succeeds, and the edge authentication server stores the new token. The token is sent to an edge authentication database, and the new token is returned to the IoT device for subsequent rapid authentication.

In one embodiment, the edge authentication server periodically creates authentication factor data according to the authentication result of the edge authentication server, so as to store the authentication factor data in the edge authentication database.

The above authentication factor data includes incoming line traffic, fast authentication success rate and response time of the core authentication server.

In one embodiment, the edge authentication server further includes a dynamic adjustment token aging unit, which obtains the validity of the token according to the authentication factor data and using the token aging adjustment algorithm analysis method, and evaluates the validity period of the token by evaluating the validity period of the token. The result of the judgment and the analysis of the impact of the evaluation are used to adjust the validity period of the token.

In one embodiment, the edge authentication server further includes: a process control unit, which is used for receiving the authentication request and the response of the authentication result, checking the validity period of the token and judging whether to perform the core authentication; the evaluation algorithm analysis unit, It is used for the weight setting of authentication factors, data statistics and evaluation calculation; and the time-sensitive decision-making calculation and analysis unit is used for the analysis of the landing point of the evaluation to determine the validity of the token.

In one embodiment, the edge computing-based IoT device authentication system further includes an authentication center connected to the core authentication server for performing user authentication and key negotiation.

The present invention further proposes an IoT device authentication method based on edge computing, which includes: causing the IoT device to issue an authentication request including user data and tokens; and causing an edge authentication server to receive the authentication request from the IoT device and execute the authentication request. Judgment of the validity period of the token; and when the edge authentication server determines that the validity period of the token is valid, the edge authentication server responds with an authentication success message to the IoT device, and the edge authentication server When it is determined that the validity period of the token is invalid, the edge authentication server transmits the user data to the core authentication server for general authentication.

In the above method, the core authentication server responds to the edge authentication server that the general authentication is success or failure, so that when the authentication succeeds, it also responds with a new token, and the edge authentication server The device stores the new token in an edge authentication database, and returns the new token to the IoT device for subsequent quick authentication.

In the above method, the edge authentication server periodically creates authentication factor data to store the authentication factor data in the edge authentication database. In addition, the authentication factor data includes incoming line traffic, rapid authentication success rate and response time of the core authentication server.

In one embodiment, the edge authentication server further includes evaluating the judgment result of the validity period of the token and performing a point analysis according to the result of the evaluation, so as to adjust the validity period of the token accordingly.

The present invention further provides an edge authentication server, which includes: a receiving unit for receiving an authentication request including user data and a token sent by an IoT device; and a judging unit for judging the validity period of the token, so as to When the validity period of the token is valid, an authentication success message is sent to the IoT device, and when the validity period of the token is invalid, the user information is transmitted for general authentication.

To sum up, the present invention is an authentication system and method for IoT devices based on edge computing, and an edge authentication server thereof, and relates to an efficient authentication method that can maintain token security. The IoT device will first use the token Perform fast authentication at the edge authentication server. The edge authentication server then determines whether the token is valid and records the fast authentication result. If the token is valid, fast authentication with low latency can be performed at the edge. The authentication result is periodically adjusted to achieve self-optimization. For example, the success rate of fast authentication is low, the incoming traffic is large, and a large number of users must perform general authentication, which makes the core authentication server busy, which will lead to poor user experience. At the same time, the edge authentication server can automatically extend the token validity period, which greatly increases the opportunity for IoT devices to authenticate at the edge, and greatly improves the success rate of rapid authentication, which will reduce the burden on the core authentication server and effectively improve the user experience.

11, 20: IoT devices

12: Core Authentication System

2: IoT device authentication system based on edge computing

21: Edge Authentication Server

211: Process Control Unit

212: Evaluation Calculus Analysis Unit

213: Time-sensitive decision-making calculus analysis unit

214: Dynamically adjust the token aging unit

215: Receiver unit

216: Judgment unit

22: Core Authentication Server

23: Edge Authentication Repository

24: Certification Center

A1-A6: Steps

B1-B3: Steps

S51-S53: Steps

FIG. 1 is a system architecture diagram of an authentication and authorization mechanism of an existing IoT device.

FIG. 2 is a system architecture diagram of an IoT device authentication system based on edge computing of the present invention.

FIG. 3 is a detailed structural diagram of the edge authentication server of the present invention.

FIG. 4 is a system architecture diagram of a specific embodiment of an IoT device authentication system based on edge computing of the present invention.

FIG. 5 is a step diagram of an IoT device authentication method based on edge computing of the present invention.

FIG. 6 is a sequence diagram of an authentication method for an IoT device based on edge computing of the present invention.

FIG. 7 is a schematic diagram of the present invention performing evaluation drop point analysis.

FIG. 8 is a schematic diagram of token aging adjustment according to the present invention.

FIG. 9 is a schematic diagram of a situation of multiple edge authentication systems of the present invention.

FIG. 10 is a schematic flow chart of the rapid authentication failure of the present invention.

FIG. 11 is a schematic flow chart of a successful rapid authentication of the present invention.

The following describes the technical content of the present invention through specific embodiments, and those skilled in the art can easily understand the advantages and effects of the present invention from the content disclosed in this specification. However, the present invention can also be implemented or applied by other different specific embodiments.

FIG. 2 is a system architecture diagram of an IoT device authentication system based on edge computing of the present invention. As shown in the figure, the IoT device authentication system 2 based on edge computing at least includes an edge authentication server 21 and a core authentication server 22 .

The edge authentication server 21 is used for receiving an authentication request including user information and a token sent by the IoT device 20 and judging the validity period of the token, so as to send an authentication success message to the token when the validity period of the token is valid. IoT device 20 .

The core authentication server 22 is used for receiving the user data sent by the edge authentication server 21 to perform general authentication when the edge authentication server 21 determines that the validity period of the token is invalid. Specifically, the core authentication server 22 responds to the edge authentication server 21 that the general authentication is successful or unsuccessful, so as to respond with a new token when the authentication succeeds, and the edge authentication server 21 stores the new token The token is sent to an edge authentication database 23, and the new token is returned to the IoT device 20 for subsequent quick authentication.

In one embodiment, the core authentication server 22 is connected to an authentication center 24, and the authentication center 24 is used to perform user authentication and key negotiation. 22 performs general authentication, and the core authentication server 22 transmits relevant data to the authentication center 24 to authenticate the user pair and negotiate the communication key.

In order to achieve fast authentication, the present invention verifies the token provided by the IoT device 20 in the edge authentication server 21 to confirm whether it is valid, but the efficiency problem still needs to be considered, that is, the edge authentication server 21 has to bear the burden When a large number of authentication works, the authentication time is delayed due to the token relationship, which may not be the best situation. Therefore, the edge authentication server 21 of the present invention has an adjustment mechanism, that is, the edge authentication server 21 can rely on the authentication result of the edge authentication server 21. , periodically establishing authentication factor data to store the authentication factor data in the edge authentication database 23, and the authentication factor data may include incoming line traffic, rapid authentication success rate and response time of the core authentication server.

It can be seen from the above that the edge authentication server 21 is used to perform fast authentication, collect and evaluate the authentication results, dynamically adjust the token aging, use the token to perform fast authentication, and determine whether the token has It can be used to determine whether the quick authentication is successful. Furthermore, it can dynamically analyze and adjust the token validity period of the edge authentication system after calculating the evaluation periodically according to the authentication factor data, while the core authentication server 22 is used for user identity authentication. That is, general authentication, providing trusted token information.

FIG. 3 is a detailed structural diagram of the edge authentication server of the present invention. As shown in the figure, the edge authentication server 21 includes a process control unit 211, an evaluation calculation analysis unit 212, a timeliness decision calculation analysis unit 213, a dynamic adjustment token aging unit 214, a receiving unit 215 and a judgment unit 216, wherein each The units are electrically connected to each other.

The receiving unit 215 of the edge authentication server 21 is used for receiving the authentication request including user data and token sent by the IoT device; When the validity period of the token is valid, an authentication success message is sent to the IoT device, and when the validity period of the token is invalid, the user information is sent for general authentication.

The flow control unit 211 of the edge authentication server 21 is used for receiving the authentication request and the authentication result response, checking the validity period of the token and judging whether to perform core authentication, that is, involving information transmission and checking the validity period of the token, and According to the token check result, it is decided whether to perform core authentication; the evaluation algorithm analysis unit 212 of the edge authentication server 21 is used for weight setting of authentication factors, data statistics and evaluation calculation. In short, the evaluation algorithm analysis unit 212 executes relevant data statistics , in order to perform evaluation calculation and weight setting of authentication factors; the time-sensitive decision-making calculation and analysis unit 213 of the edge authentication server 21 is used for the analysis of the impact of the evaluation to determine the time-effectiveness of the token, which is also the time-sensitive decision-making calculation and analysis unit 213 may perform a drop point analysis on the evaluation, and then decide whether to adjust the validity period of the token according to the result of the drop point analysis.

The dynamic adjustment token aging unit 214 obtains the validity of the token according to the authentication factor data and the token aging adjustment algorithm analysis method, and adjusts the validity of the token by evaluating the judgment result of the validity period of the token and analyzing the impact of the evaluation. The validity period of this token. As mentioned above, the edge authentication server 21 will The validity period of the token is adjusted according to the authentication situation, and the basis is to evaluate the judgment result of the validity period of the token, and analyze the impact of the evaluation, thereby obtaining the basis for whether to adjust the validity period of the token.

FIG. 4 is a system architecture diagram of a specific embodiment of an IoT device authentication system based on edge computing of the present invention. Please refer to FIG. 2 and FIG. 3 together. Specifically, the IoT device authentication system based on edge computing may include architectures such as an IoT device, an edge authentication system, and a core authentication system.

The edge authentication system accepts the authentication request from the IoT device 20 through the Internet transmission protocol. The authentication request includes the user information and the token as the authentication credential. When the token is invalid, the edge authentication system will pass the Internet The network transport protocol sends user information to the core authentication system (Entitlement System, ES) for general authentication.

The edge authentication systems are independent and each includes an edge authentication server 21 and an edge authentication database 23 for storing token data and authentication factor data of the IoT device 20 , wherein, if the edge authentication server 21 accepts the authentication of the IoT device 20 The request means that it is the closest edge authentication system to the IoT device 20 . The edge authentication server 21 includes a process control unit 211, an evaluation algorithm analysis unit 212, and a timeliness decision algorithm analysis unit 213, wherein the process control unit 211 is responsible for connecting the software and database providing services to complete the execution of service logic , the main functions include receiving IoT device authentication requests and responses, checking whether the token validity period has expired, and judging whether to perform core authentication. The evaluation calculus analysis will be described in detail later, and the time-sensitive decision-making calculus analysis unit 213 is responsible for evaluating the placement point analysis and determining the token aging. The time-sensitive decision-making calculus analysis will be described in detail later.

The core authentication system may include a core authentication server 22 and an authentication center 24 connected to the core authentication server 22, wherein the authentication server 22 is also called an entitlement server (Entitlement Server), which is responsible for obtaining a token after passing the authentication by the authentication center, and pass it back to the edge authentication system, and the authentication center 24 It is AAA (Authentication, Authorization, Accounting) authentication, responsible for core authentication, user authentication and key negotiation.

FIG. 5 is a step diagram of an IoT device authentication method based on edge computing of the present invention.

As shown in the figure, in step S51, the IoT device is made to issue an authentication request including user information and a token. In this step, the IoT device sends an authentication request, and the authentication request includes user information and tokens.

In step S52, the edge authentication server is made to receive the authentication request from the IoT device and execute the judgment of the validity period of the token. In this step, after the edge authentication server receives the authentication request, it determines whether the validity period of the token is valid.

In step S53, when the edge authentication server determines that the validity period of the token is valid, the edge authentication server returns an authentication success message to the IoT device, and the edge authentication server determines the validity of the token. When the period expires, make the edge authentication server transmit the user data to the core authentication server for general authentication. In this step, when the validity period of the token is valid, the edge authentication server responds with an authentication success message to the IoT device, and when the validity period of the token is invalid, the edge authentication server transmits the user data to the core authentication Server for general authentication.

In the above-mentioned step S53, it further includes that the core authentication server responds to the edge authentication server that the general authentication is successful or failed, so that when the authentication succeeds, it also responds with a new token, and the edge authentication server stores the new token. The new token is sent to an edge authentication database, and the new token is returned to the IoT device for subsequent rapid authentication. In short, the core authentication server performs general verification, and if successful, a new token is generated and the token at the edge authentication server is updated to facilitate subsequent quick authentication.

In one embodiment, the above-mentioned method further includes that the edge authentication server periodically establishes authentication factor data to store the authentication factor data in the edge authentication database, wherein the authentication factor data includes incoming line traffic, rapid authentication success rate and the response time of the core authentication server.

In one embodiment, the above-mentioned method further includes the edge authentication server evaluating the result of judging the validity period of the token, and performing a point analysis according to the result of the evaluation, so as to adjust the validity period of the token accordingly. In short, the edge authentication server uses the evaluation algorithm and analysis unit to evaluate the authentication result according to the authentication factor data, and then uses the time-sensitive decision algorithm and analysis unit to analyze the impact of the evaluation. , then prolonging the validity period of the token can increase the success rate of rapid authentication and improve the user experience. If the evaluation falls well, the validity period of the token can be shortened, which can improve the security of the token and improve the risk of the token being stolen or stolen. , if the evaluation falls in the medium point, no adjustment will be made, which means that the fast authentication is efficient and the token security is maintained. The present invention achieves the effect of self-optimization through the above method of dynamically adjusting the token aging.

FIG. 6 is a sequence diagram of an authentication method for an IoT device based on edge computing of the present invention. As shown in the figure, it is divided into the authentication phase and the dynamic adjustment token aging phase. The execution steps of the authentication stage include: step A1, the IoT device uses the token to perform fast authentication to the edge authentication server; step A2, the edge authentication server judges the validity of the token and stores the fast authentication result; step A3, if the token is valid, It means that the quick authentication is successful at the edge authentication server, and the authentication success message is returned to the IoT device.

The following steps are executed when the token is invalid and the quick authentication fails. In step A4, if the quick authentication fails at the edge authentication server, it will be transferred to the core authentication server for general authentication; in step A5, the core authentication server returns the success or failure result of the general authentication to the edge authentication server, and the general authentication is performed. When successful, the token of the IoT device is updated at the same time; in step A6, the edge authentication server returns a general authentication success or failure result to the IoT device, and when the general authentication succeeds, the token of the IoT device is simultaneously updated.

The dynamic adjustment token aging stage is executed periodically and is executed on the edge authentication server. The execution steps include: step B1, establishing authentication factor data according to the quick authentication result recorded in step A2; step B2, using the token aging adjustment algorithm to analyze The validity period of the token is obtained by the method; in step B3, the edge authentication server automatically adjusts the validity period of the token, and this step will affect the result of judging whether the token is valid in step A2.

The authentication factor data discusses factors that are likely to cause the core authentication server to be crowded or cause poor user experience, including incoming traffic, rapid authentication success rate, and core authentication server response time. Specifically, the incoming line traffic refers to the number of traffic from the edge authentication server to the core authentication server within a period of time. The larger the traffic, the easier it is to cause congestion on the core authentication server. The success rate of fast authentication in the total traffic of the edge authentication server. If the success rate is higher, it means that most users of this edge authentication server can perform fast authentication, and it is not easy to cause the core authentication server to be crowded. On the contrary, it is easy to cause the core authentication server The server is crowded; the response time of the core authentication server refers to the current response time of the core authentication server. If the response time is long, it means that the user needs to wait for a long time, resulting in a poor user experience.

The above-mentioned token aging adjustment algorithm analysis method includes the steps of setting the weight value of the authentication factor data, evaluating the algorithm analysis, and the timeliness decision algorithm analysis. Setting the weight value of the authentication factor data means that the system experts can set the weight value of different factors according to the observation data. For example, if the expert thinks that the rapid authentication success rate is more important, it can set a larger weight; The TOPSIS (Technique for Order Preference by Similarity to an Ideal Solution, TOPSIS) method calculates the evaluation of the certification results within this time, and the evaluation will fall between 0 and 1; the time-sensitive decision calculus analysis refers to the evaluation point Analysis, as shown in Figure 7, the closer the authentication situation is to 0, the worse it is, and vice versa.

Here, the evaluation can be divided into 3 parts: severe, moderate and good. Seriously indicates that the incoming traffic is large, the success rate of fast authentication is low, or the core authentication server is busy. The greater the chance that the core authentication server load will be reduced, but at the same time the security will be reduced. Good means that the load of the core authentication server is not too large, which can reduce the validity of the token. The shortening of the validity period means that the security is improved, but if the validity period is too short and it is easy to expire, it must return to the core authentication server for authentication, which will also lead to The core authentication server load has increased. Therefore, the compromise method is that it falls within the convergence range when it falls in the middle evaluation range, which means that at this time, the authentication is both efficient and the token validity is secure, so there is no need to adjust the token validity.

The token aging adjustment formula can be as follows, where T' is the current system token aging, and t is the adjustment unit time.

The aforementioned TOPSIS method is described below. First, a feature matrix is established, in which there are usually m evaluation targets D ₁ , D ₂ ,…, D _m , and each target has n evaluation indicators X ₁ , X ₂ ,…, X _n .

Next, the normalization matrix is calculated. The feature matrix is normalized to obtain a vector r _ij , and a normalized matrix about the vector r _ij is established.

i =1,2,..., m , j =1,2,..., n .

Next, the weights normalize the matrix. By calculating the weight normalization value v _ij , a weight normalization matrix about the weight normalization value vi _ij is established, and Wj is the weight of the jth index.

v _ij = ω _j r _ij , i =1,2,…, m , j =1,2,…, n .

Next, determine the positive ideal solution and the negative ideal solution. Determine the positive ideal solution A ^* and the negative ideal solution A ^- according to the weight normalization value v _ij , where J1 is the set of profitability indicators, representing the optimal value on the i-th indicator, and J2 is the set of loss indicators, representing the The worst value on the ith index. The larger the profitability index and the smaller the loss index, the more favorable the evaluation result. On the contrary, it will be detrimental to the evaluation results.

Next, the distance scale is calculated.

i =1,2,…, m .

1。當

=0時，A_i=A^-，表示該目標為最劣目標，當

=1時，A_i=A^*，表示該目標為最優目標。在實際的多目標決策中，最優目標和最劣目標存在的可能性很小。 Finally, calculate the closeness to the positive ideal solution. In the following formula, 0

1. when

When =0, A _i =A ^- , indicating that the target is the worst target, when

When =1, A _i =A ^* , indicating that the target is the optimal target. In the actual multi-objective decision-making, the possibility of the existence of the optimal objective and the worst objective is very small.

， i=1,2,…,m。

, i = 1,2,…, m .

FIG. 9 is a schematic diagram of a scenario of multiple edge authentication systems of the present invention, FIG. 10 is a schematic flowchart of a failed quick authentication of the present invention, and FIG. 11 is a schematic flowchart of a successful quick authentication of the present invention. The present invention is described below through a practical example. There are three edge authentication servers A, B, and C, covering areas such as north, middle, and south. A user Tom located in the south belongs to the service area of edge authentication server C. Therefore, Tom's smartwatch will be quickly authenticated with the closest edge authentication server C. In short, the edge authentication server C determines whether the token is valid and stores the quick authentication result. If the token is valid, it means that the quick authentication is successful at the edge authentication server C. When multiple authentications are performed within the valid period, the authentication is only performed on the edge node. That's it. The above process also corresponds to steps A1-A3 in FIG. 6 .

In addition, steps A4-A6 in FIG. 6 are executed only when the token fails and the fast authentication fails. The example scenario is as follows. As shown in Figure 10, if the edge authentication server C is a crowded place, the current response time of the core authentication server is 30 seconds, and the current token validity period is 1 minute, the user Tom's smart watch has been re-authenticated for more than 1 minute. Minutes, when the token expires, you must go to the core authentication center to re-authenticate the user identity and obtain a new token, that is, general authentication, and you need to wait at least 30 seconds to complete the authentication, resulting in poor user experience.

The edge authentication server C uses the quick authentication result in step A2 of FIG. 6 and the dynamic adjustment token aging module to determine that the core authentication server is crowded, so the token aging of the edge authentication server C is adjusted to 11 minutes. When the user Tom's smart watch is re-authenticated, step A2 in Figure 6 determines that the token is valid, which means that the user Tom's smart watch can continue to perform low-latency fast authentication at the edge authentication server C, and the user experience is good, as shown in Figure 11 Show.

An example of dynamically adjusting token aging is as follows, please refer to Figure 6 together. Step B1, the example of the authentication factor data structure is shown in the following table, that is, the authentication data is collected every 10 minutes.

Step B2, the current time is 00:20, 30% of the users fail the quick authentication within 10 minutes, they must go to the core authentication server for general authentication, and the waiting time is at least 30 seconds. Further explanation below Adjust the algorithm analysis method steps for the token aging, and evaluate the authentication result at this time to prove that the authentication situation is serious, resulting in poor user experience.

In step (1) of the token aging adjustment algorithm analysis method, the weights set by the system experts according to the importance of each factor are as follows.

In step (2) of the algorithm analysis method for token aging adjustment, the evaluation score is obtained after calculating the positive ideal distance and the negative ideal distance by using the evaluation algorithm analysis method. The TOPSIS method calculation example is as follows.

Step (T1) of the TOPSIS method, convert the certification data of step B1 into a feature matrix of performance performance values, according to the expert-determined scoring standard, this example is scored as 1-10 points.

TOPSIS method step (T2), the normalized performance value of the certification data.

TOPSIS method step (T3), normalized performance value after weighting.

The TOPSIS method step (T4) is to determine the positive and negative ideal solutions, where the positive ideal solution means that the less incoming line traffic, the better, the higher the success rate of rapid authentication, the better, and the less ES response time, the better, otherwise it is a negative ideal solution.

In the TOPSIS method step (T5), the ideal distance of each certification data is obtained, and the closeness of the positive ideal solution is calculated as the evaluation.

The step (3) of the algorithm analysis method of token aging adjustment adopts the algorithm analysis method of time-sensitive decision-making proposed by the present invention, and the implementation example is as follows: the convergence range of the evaluation landing analysis is 0.4~0.6, wherein, T' is the current token Timeliness (1 minute), t is adjusted for 10 minutes each time, as shown in Figure 8, the evaluation score of 0.33 is considered severe, and the new validity period is calculated to be 11 minutes using the token aging adjustment formula.

Finally, returning to step B3, the edge authentication server automatically adjusts the token validity period to 11 minutes.

When the subsequent user performs quick authentication, the edge authentication server will use the new validity period to judge whether the token is valid or not. The extension of the token validity period increases the chances of the user completing the quick authentication at the edge. Therefore, at the next cycle time 00: 30 Perform authentication factor data collection, an example of which is shown in the following table.

When the success rate of quick authentication reaches 90%, and the incoming line traffic and the response time of the core authentication server do not change, the evaluation calculation and analysis are carried out. The evaluation results are shown in the following table.

The evaluation score obtained is 0.49, and the time-sensitive decision-making algorithm analysis method is used to judge that the evaluation is in the middle, and there is no need to adjust the token validity period, which means that the token validity period is 11 minutes. At this edge, 90% of users can perform low-latency fast authentication, which improves the Authentication efficiency improves user experience, and the token remains secure. On the other hand, if the improvement of the evaluation score falls within the good range, the token validity period can be shortened, thereby improving the security of the token.

In summary, the present invention is an IoT device authentication system and method based on edge computing, and an edge authentication server thereof, wherein the IoT device can quickly authenticate to edge nodes, and each edge node will collect the authentication at each time Factor data, including rapid authentication success rate, incoming line traffic, and response time of the core authentication server. Each edge node judges the authentication status of the edge authentication server by dynamically adjusting the token aging unit based on the authentication data. If the authentication situation is serious, then Extending the token validity period greatly increases the opportunities for IoT devices to be authenticated at the edge, thereby reducing the burden on the core authentication server. If the authentication status is good, the token validity period is shortened, which improves the security of rapid authentication.

The above-mentioned embodiments are only illustrative, and are not intended to limit the present invention. Any person skilled in the art can modify and change the above embodiments without departing from the spirit and scope of the present invention. Therefore, the scope of the right protection of the present invention is defined by the scope of the patent application attached to the present invention, as long as the effect and implementation purpose of the present invention are not affected, it shall be included in the technical content disclosed herein.

2: IoT device authentication system based on edge computing

20: IoT Devices

21: Edge Authentication Server

22: Core Authentication Server

23: Edge Authentication Repository

24: Certification Center

Claims (11)

An IoT device authentication system based on edge computing, comprising: an edge authentication server, which is used for receiving an authentication request including user data and a token sent by the IoT device and judging the validity period of the token, so as to determine the validity period of the token. When the validity period of the card is valid, an authentication success message is sent to the IoT device, wherein the edge authentication server periodically establishes authentication factor data according to the authentication result of the edge authentication server, so as to store the authentication factor data in an edge authentication database; and a core authentication server for receiving the user data sent by the edge authentication server to perform general authentication when the edge authentication server determines that the validity period of the token is invalid. The IoT device authentication system based on edge computing as described in claim 1, wherein the core authentication server responds to the edge authentication server that the general authentication is success or failure, so as to respond with a new token when the authentication succeeds , and the edge authentication server stores the new token to the edge authentication database, and returns the new token to the IoT device for subsequent quick authentication. The IoT device authentication system based on edge computing according to claim 1, wherein the authentication factor data includes incoming traffic, rapid authentication success rate and response time of the core authentication server. The IoT device authentication system based on edge computing according to claim 3, wherein the edge authentication server further includes a dynamic adjustment token aging unit, which is obtained by using the token aging adjustment algorithm and analysis method according to the authentication factor data The validity period of the token is adjusted according to the judgment result of evaluating the validity period of the token and the analysis of the impact of the evaluation. An IoT device authentication system based on edge computing, comprising: The edge authentication server is used to receive the authentication request including user information and token sent by the IoT device and determine the validity period of the token, so as to send an authentication success message to the token when the validity period of the token is valid an IoT device; and a core authentication server, used for receiving the user data sent by the edge authentication server to perform general authentication when the edge authentication server determines that the validity period of the token is invalid, wherein the The edge authentication server further includes: a process control unit, which is used for receiving the authentication request and the response of the authentication result, checking the validity period of the token and judging whether to perform core authentication; an evaluation calculation and analysis unit, which is used for the weight of authentication factors Setting, data statistics and evaluation calculation; and a time-sensitive decision-making calculation and analysis unit, which are used for the analysis of the evaluation point to determine the time-effectiveness of the token. The IoT device authentication system based on edge computing as described in claim 1 or 5 further includes an authentication center connected to the core authentication server, which is used to perform user authentication and key negotiation. An IoT device authentication method based on edge computing, comprising: causing the IoT device to issue an authentication request including user data and a token; enabling an edge authentication server to receive the authentication request from the IoT device and execute the authentication request of the token. Judging the validity period; and when the edge authentication server judges that the validity period of the token is valid, the edge authentication server responds with an authentication success message to the IoT device, and the edge authentication server judges the token When the validity period is expired, make the edge authentication server transmit the user data to the core authentication server for normal authentication, wherein the edge authentication server periodically establishes authentication factor data to store the authentication factor data in an edge authentication database. The IoT device authentication method based on edge computing as described in claim 7, wherein the core authentication server responds to the edge authentication server as success or failure of the general authentication, so as to respond with a new token when the authentication succeeds , and the edge authentication server stores the new token to the edge authentication database, and returns the new token to the IoT device for subsequent quick authentication. The edge computing-based IoT device authentication method according to claim 7, wherein the authentication factor data includes incoming traffic, rapid authentication success rate and response time of the core authentication server. An IoT device authentication method based on edge computing, comprising: causing the IoT device to issue an authentication request including user data and a token; enabling an edge authentication server to receive the authentication request from the IoT device and execute the authentication request of the token. Judging the validity period; and when the edge authentication server judges that the validity period of the token is valid, the edge authentication server responds with an authentication success message to the IoT device, and the edge authentication server judges the token When the validity period of the token expires, make the edge authentication server transmit the user data to the core authentication server for general authentication, wherein the edge authentication server further includes evaluating the judgment result of the validity period of the token and According to the results of the evaluation, a placement analysis is made to adjust the validity period of the token accordingly. An edge authentication server, comprising: The receiving unit is used for receiving the authentication request including the user data and the token sent by the IoT device; and the judging unit is used for judging the validity period of the token, so as to send the authentication successfully when the validity period of the token is valid Send a message to the IoT device, and when the validity period of the token is expired, transmit the user data for general authentication, wherein the judging unit periodically establishes authentication factor data according to the authentication result of the judging unit, so as to The authentication factor data is stored in an edge authentication database.

Images