Giant chain database enabled Internet of Things equipment data security aggregation method

Abstract

The invention relates to a giant chain database enabled Internet of Things equipment data security aggregation method, which comprises the following steps of: accessing a certificate management module, generating an equipment temporary identity certificate based on equipment information stored in a giant chain database, and performing data compliance uploading by the equipment by using the certificate. And the data aggregation portal module cooperates with the equipment access credential management module to identify the identity credential of the railway Internet of Things equipment, and then detects and processes the equipment request and data. And the data management module is used for storing the data uploaded by the railway Internet of Things equipment, providing the data for the anomaly detection module and providing the data required by the equipment. And the anomaly detection module is used for constructing an abnormal data detection model by adopting a federated learning technology based on the multi-chain data in the data storage module, and identifying abnormal equipment. According to the method, efficient and safe access of railway Internet of Things equipment and efficient and safe loading of equipment data can be realized in a large-scale railway Internet of Things system, and privacy protection of sensitive data is realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of Internet of Things, and relates to a method for securely aggregating data of Internet of Things devices enabled by a giant chain database. Background Art

[0002] The Internet of Things technology refers to connecting any object to the network through information sensors in accordance with the agreed protocol. Objects exchange and communicate information through information transmission media to achieve intelligent identification, positioning, tracking, supervision and other functions. In recent years, the Internet of Things technology has been widely used in the railway field. By embedding sensors into trains and integrating them into key components such as train tracks, signal systems and platforms, engine performance, overall health status, and wear and potential failures can be monitored. At the same time, the railway department can collect data on the railway Internet of Things to analyze and make decisions for the overall railway system.

[0003] However, the security of data collected from different IoT devices is a challenging issue. When abnormal devices upload abnormal data, it will seriously affect the data quality, thus affecting the decision-making of the railway system. At the same time, passenger data in the railway system, as private data, also needs to be protected. It is also necessary to pay attention to the fact that direct storage of massive railway data will take up a lot of space and the query speed is slow, so it is necessary to choose a suitable storage query method.

[0004] Federated learning, as an encrypted distributed machine learning paradigm, enables all parties to collaborate without leaving the local data, achieving knowledge sharing without sharing data. Blockchain is a decentralized distributed ledger that is tamper-proof, secure and reliable, and combines distributed storage, peer-to-peer transmission, consensus mechanism, cryptography and other technologies. It records transactions and information through a growing data block chain to ensure data security and transparency. Applying federated learning and blockchain technology to the field of railway Internet of Things can play an important role in data privacy protection.

[0005] The BigChain database is an open source distributed database system that combines the advantages of blockchain technology and traditional databases. Compared with traditional distributed databases, it is tamper-proof; compared with ordinary blockchain technology, it has the advantages of high throughput and low latency. At the same time, the BigChain database can store the information of standard and abnormal devices separately, which can help detect abnormal devices.

[0006] The Interstellar File System identifies files by generating independent hash values ​​based on the file content, rather than by the file storage location. Files with the same content will only exist in one copy in the system, saving storage space and enabling quick query.

[0007] In order to solve the problems of abnormal equipment and abnormal data, sensitive data privacy protection and massive data storage in the railway Internet of Things, this patent proposes a method for secure aggregation of IoT device data based on the giant chain database. Summary of the invention

[0008] The purpose of the present invention is to propose a railway Internet of Things device data security aggregation method based on a giant chain database to address the problems of abnormal devices and abnormal data, passenger data privacy protection, and massive data storage and query in the railway Internet of Things system, which can remove abnormal data, protect passenger privacy data, and realize the storage and query of massive data.

[0009] On the first aspect, the embodiment of the present application provides a method for data security aggregation of IoT devices enabled by a giant chain database, and the method is applied to four modules. The first module is a device access credential management module, which generates a temporary identity credential for the device based on the device information stored in the giant chain database, and the device uses this credential to upload data; the second module is a data aggregation portal module, which is composed of multiple smart contract components. The aggregation module has its own public and private key pair. The module cooperates with the device credential management module to identify the identity of the connected railway IoT device, and then detects and processes the device request and data; the third module is a data management module, whose functions include storing data uploaded by railway IoT devices, providing data for the anomaly detection module, and providing data required by the device; the fourth module is an anomaly detection module, which uses federated learning technology based on multi-chain data in the data storage module to build an abnormal data detection model and identify abnormal devices; the giant chain database is used to store device feature information, each device has its own unique identifier UID, and all devices are divided into two categories: compliant devices and abnormal devices;

[0010] The method comprises:

[0011] Process 1, device access credential generation: the device access credential management module generates a temporary identity credential for the device based on the request information of the railway IoT device and the device information stored in the giant chain database, which is used for identity authentication when accessing the data aggregation portal module;

[0012] Process 2: Device access identity credential authentication: The data aggregation portal module and the device access credential management module work together to authenticate the identity of the connected railway IoT device and perform anomaly detection on the access data;

[0013] Process 3, device data management, for devices authenticated by the data aggregation portal module, the data management module processes the device’s data request according to the data classification results;

[0014] Process 4, anomaly detection, the anomaly detection module builds an abnormal data detection model based on the device information and data in the data management module and combines the expert library information to identify abnormal devices.

[0015] In an optional design, the specific steps of process 1 are as follows:

[0016] Step 1.1, the railway IoT device sends the device's unique identifier UID and device feature information to the device access credential management module;

[0017] Step 1.2, the device access credential management module searches for the device feature information in the giant chain database. If there is no device feature information in the database, the device is rejected and the device request is terminated; if there is device feature information, step 1.3 is performed;

[0018] Step 1.3, the device access credential management module first generates a random number r, takes the current system time t, and then uses the public key of the data aggregation portal module to encrypt the hash value of (UID, r, t) as the credential of the device; finally, the device access credential management module saves UID, r and t, and sends the credential to the device.

[0019] In an optional design, the specific steps of process 2 are as follows:

[0020] Step 2.1, the railway IoT device sends information to the data aggregation portal module, including a data storage request, as well as the device UID, credentials, and data that needs to be stored or queried.

[0021] Step 2.2, after receiving the UID, the data aggregation portal module sends it to the giant chain database in the device access credential management module, and the giant chain database returns r, t and the category of the device;

[0022] Step 2.3, the data aggregation portal module calculates hash (UID, r, t) and compares it with the information obtained by decrypting the credential with the private key. If they do not match, the device is rejected and the device request processing is terminated. Otherwise, proceed to step 2.4;

[0023] Step 2.4, if the device type is abnormal and it is a data query request, reject the device and end the device request processing, otherwise proceed to step 2.5;

[0024] Step 2.5, if the device type is abnormal and it is a data storage request, execute process 3; otherwise, execute step 2.6;

[0025] Step 2.6, if the device type is compliant, the data aggregation portal module calls the abnormal data detection model to detect the uploaded data. If there is no abnormality, process 3 is executed; if there is an abnormality, the data is sent to the abnormality detection module for analysis. If the analysis result is abnormal, the abnormality detection module sets the device type as abnormal, and notifies the device access credential management module to update the device information in the giant chain database; at the same time, the data aggregation portal module is notified to set the device type as abnormal, and then process 3 is executed.

[0026] In an optional design, the specific steps of process 3 are as follows:

[0027] Step 3.1, for data storage requests of compliant devices, if the device data is marked as device sensitive data, the data is stored in the device sensitive blockchain system in the compliant data repository; if the data is marked as non-sensitive data, the data is stored in the InterPlanetary File System in the compliant data repository, and in addition, the InterPlanetary File System generates a hash value for the data, and stores the hash value in the non-sensitive data blockchain system in the compliant data repository;

[0028] Step 3.2, for the data storage request of the abnormal device, if the device data is marked as device sensitive data, the data is stored in the device sensitive blockchain in the abnormal data repository; the data is marked as railway non-privacy data, the data is stored in the InterPlanetary File System in the abnormal data repository. In addition, the InterPlanetary File System generates a hash value for the data and stores the hash value in the data blockchain system in the abnormal data repository.

[0029] Step 3.3, in response to the data query request of the compliant device, the data is obtained from the compliant data repository and fed back to the device through the data aggregation portal module.

[0030] In an optional design, the specific steps of process 4 are as follows:

[0031] Step 4.1, the anomaly detection module uses federated learning technology to build an anomaly data detection model training based on normal and abnormal data and expert knowledge, and sends the anomaly data detection model to the data aggregation portal module;

[0032] In step 4.2, the anomaly detection module periodically uses federated learning technology to detect whether the device is abnormal based on normal and abnormal data and expert knowledge, and sends the detection results to the device access credential management module. After receiving the information, the device access credential management module updates the giant chain database.

[0033] The advantages of the present invention are:

[0034] (1) Utilize the decentralized and tamper-proof characteristics of the giant chain database to store device information and participate in the management of device access identity credentials, supporting efficient and secure verification of device identities in large-scale IoT systems.

[0035] (2) Identification of compliant devices and abnormal devices. The device status in the BigChain database will change according to the data classification results. When the device is in an abnormal device status, the request for data query will be rejected.

[0036] (3) Federated learning technology is used to create a data classification model, which is included in the smart contract. The model is used to test the data when storing data to ensure that abnormal data is not stored.

[0037] (4) Enhance privacy protection by storing sensitive and non-sensitive private data in different blockchain systems.

[0038] (5) Use the Interstellar File System to store massive amounts of railway data for research, generate independent hash values ​​for the data, and then store the hash value of each data in the blockchain for easy storage and quick query. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a schematic diagram of the association of various modules in the security aggregation method;

[0040] Figure 2 It is a schematic diagram of the data management module. DETAILED DESCRIPTION

[0041] In order to achieve the purpose of the invention, the present invention adopts the following technical means and processes:

[0042] Process 1, device access credential generation. The device access credential management module generates a temporary identity credential for the device based on the request information of the railway IoT device and the device information stored in the giant chain database, which is used for identity authentication when accessing the data aggregation portal module.

[0043] Process 2, device access identity credential authentication, the data aggregation portal module and the device access credential management module work together to identify the identity of the accessed railway IoT device and perform anomaly detection on the access data.

[0044] Process 3, device data management, for devices authenticated by the data aggregation portal module, the data management module processes the device's data request according to the data classification results.

[0045] Process 4, anomaly detection, the anomaly detection module builds an abnormal data detection model based on the device information and data in the data management module and combines the expert library information to identify abnormal devices.

[0046] The specific steps of process 1 are as follows:

[0047] Step 1.1, the railway IoT device sends the device's unique identifier UID and device feature information to the device access credential management module;

[0048] Step 1.2, the device access credential management module searches for the device feature information in the giant chain database. If there is no device feature information in the database, the device is rejected and the device request is terminated; if there is device feature information, step 1.3 is performed;

[0049] Step 1.3, the device access credential management module first generates a random number r, takes the current system time t, and then uses the public key PubK of the data aggregation portal module to encrypt the hash value of (UID, r, t) as the credential of the device; finally, the device access credential management module saves UID, r and t, and sends the credential to the device.

[0050] The specific steps of process 2 are as follows:

[0051] Step 2.1, the railway IoT device sends information to the data aggregation portal module, including a data storage request, as well as the device UID, credentials, and data that needs to be stored or queried.

[0052] Step 2.2, after receiving the UID, the data aggregation portal module sends it to the giant chain database in the device access credential management module, and the giant chain database returns r, t and the category of the device;

[0053] Step 2.3, the data aggregation portal module calculates hash (UID, r, t) and compares it with the information obtained by decrypting the credential with the private key PriK. If they do not match, the device is rejected and the device request processing is terminated. Otherwise, proceed to step 2.4;

[0054] Step 2.4, if the device type is abnormal and it is a data query request, reject the device and end the device request processing, otherwise proceed to step 2.5;

[0055] Step 2.5, if the device type is abnormal and it is a data storage request, execute process 3; otherwise, execute step 2.6;

[0056] Step 2.6, if the device type is compliant, the data aggregation portal module calls the abnormal data detection model to detect the uploaded data. If there is no abnormality, process 3 is executed; if there is an abnormality, the data is sent to the abnormality detection module for analysis. If the analysis result is abnormal, the abnormality detection module sets the device type as abnormal, and notifies the device access credential management module to update the device information in the giant chain database; at the same time, the data aggregation portal module is notified to set the device type as abnormal, and then process 3 is executed.

[0057] The specific steps of process 3 are as follows:

[0058] Step 3.1, for data storage requests of compliant devices, if the device data is marked as device sensitive data, the data is stored in the device sensitive blockchain system in the compliant data repository; if the data is marked as non-sensitive data, the data is stored in the InterPlanetary File System in the compliant data repository, and in addition, the InterPlanetary File System generates a hash value for the data, and stores the hash value in the non-sensitive data blockchain system in the compliant data repository;

[0059] Step 3.2, for the data storage request of the abnormal device, if the device data is marked as device sensitive data, the data is stored in the device sensitive blockchain in the abnormal data repository; the data is marked as railway non-privacy data, the data is stored in the InterPlanetary File System in the abnormal data repository. In addition, the InterPlanetary File System generates a hash value for the data and stores the hash value in the data blockchain system in the abnormal data repository.

[0060] Step 3.3, in response to the data query request of the compliant device, the data is obtained from the compliant data repository and fed back to the device through the data aggregation portal module.

[0061] The specific steps of process 4 are as follows:

[0062] Step 4.1, the anomaly detection module uses federated learning technology to build an anomaly data detection model training based on normal and abnormal data and expert knowledge, and sends the anomaly data detection model to the data aggregation portal module;

[0063] In step 4.2, the anomaly detection module periodically uses federated learning technology to detect whether the device is abnormal based on normal and abnormal data and expert knowledge, and sends the detection results to the device access credential management module. After receiving the information, the device access credential management module updates the giant chain database.

[0064] Therefore, this method completes the secure aggregation of railway IoT device data based on the giant chain database.

Claims

1. A method for secure data aggregation of IoT devices enabled by a giant chain database, characterized in that: The method is applied to four modules. The first module is the device access credential management module. This module generates a temporary device identity credential based on the device information stored in the giant chain database. The device uses this credential to upload data. The second module is the data aggregation portal module, which consists of multiple smart contract components. The aggregation module has its own public and private key pairs. This module cooperates with the device credential management module to identify the identity of the connected railway Internet of Things device, and then detects and processes the device request and data. The third module is the data management module, whose functions include storing data uploaded by railway IoT devices, providing data for the anomaly detection module, and providing data required by the device; the fourth module is the anomaly detection module, which uses federated learning technology based on the multi-chain data in the data storage module to build an abnormal data detection model and identify abnormal devices; the giant chain database is used to store device feature information. Each device has its own unique identifier UID, and all devices are divided into two categories: compliant devices and abnormal devices; The method comprises: Process 1, device access credential generation: the device access credential management module generates a temporary identity credential for the device based on the request information of the railway IoT device and the device information stored in the giant chain database, which is used for identity authentication when accessing the data aggregation portal module; Process 2: Device access identity credential authentication: The data aggregation portal module and the device access credential management module work together to authenticate the identity of the connected railway IoT device and perform anomaly detection on the access data; Process 3, device data management, for devices authenticated by the data aggregation portal module, the data management module processes the device’s data request according to the data classification results; Process 4, anomaly detection, the anomaly detection module builds an abnormal data detection model based on the device information and data in the data management module and combines the expert library information to identify abnormal devices.

2. The method according to claim 1, characterized in that The specific steps of process 1 are as follows: Step 1.1, the railway IoT device sends the device's unique identifier UID and device feature information to the device access credential management module; Step 1.2, the device access credential management module searches for the device feature information in the giant chain database. If there is no device feature information in the database, the device is rejected and the device request is terminated; if there is device feature information, step 1.3 is performed; Step 1.3, the device access credential management module first generates a random number r, takes the current system time t, and then uses the public key of the data aggregation portal module to encrypt the hash value of (UID, r, t) as the credential of the device; finally, the device access credential management module saves UID, r and t, and sends the credential to the device.

3. The method according to claim 1, characterized in that The specific steps of process 2 are as follows: Step 2.1, the railway IoT device sends information to the data aggregation portal module, including a data storage request, as well as the device UID, credentials, and data that needs to be stored or queried. Step 2.2, after receiving the UID, the data aggregation portal module sends it to the giant chain database in the device access credential management module, and the giant chain database returns r, t and the category of the device; Step 2.3, the data aggregation portal module calculates hash (UID, r, t) and compares it with the information obtained by decrypting the credential with the private key. If they do not match, the device is rejected and the device request processing is terminated. Otherwise, proceed to step 2.4; Step 2.4, if the device type is abnormal and it is a data query request, reject the device and end the device request processing, otherwise proceed to step 2.5; Step 2.5, if the device type is abnormal and it is a data storage request, execute process 3; Otherwise, proceed to step 2.6; Step 2.6, if the device type is compliant, the data aggregation portal module calls the abnormal data detection model to detect the uploaded data. If there is no abnormality, process 3 is executed; if there is an abnormality, the data is sent to the abnormality detection module for analysis. If the analysis result is abnormal, the abnormality detection module sets the device type as abnormal, and notifies the device access credential management module to update the device information in the giant chain database; at the same time, the data aggregation portal module is notified to set the device type as abnormal, and then process 3 is executed.

4. The method according to claim 1, characterized in that The specific steps of process 3 are as follows: Step 3.1, for data storage requests of compliant devices, if the device data is marked as device sensitive data, store this data in the device sensitive blockchain system in the compliant data repository; The data is marked as non-sensitive data and the data is stored in the InterPlanetary File System in the compliant data repository. In addition, the InterPlanetary File System generates a hash value for the data and stores the hash value in the non-sensitive data blockchain system in the compliant data repository. Step 3.2, for the data storage request of the abnormal device, if the device data is marked as device sensitive data, store the data in the device sensitive blockchain in the abnormal data repository; The data is marked as railway non-privacy data and stored in the InterPlanetary File System in the abnormal data repository. In addition, the InterPlanetary File System generates a hash value for the data and stores the hash value in the data blockchain system in the abnormal data repository. Step 3.3, in response to the data query request of the compliant device, the data is obtained from the compliant data repository and fed back to the device through the data aggregation portal module.

5. The method according to claim 1, characterized in that The specific steps of process 4 are as follows: Step 4.1, the anomaly detection module uses federated learning technology to build an anomaly data detection model training based on normal and abnormal data and expert knowledge, and sends the anomaly data detection model to the data aggregation portal module; In step 4.2, the anomaly detection module periodically uses federated learning technology to detect whether the device is abnormal based on normal and abnormal data and expert knowledge, and sends the detection results to the device access credential management module. After receiving the information, the device access credential management module updates the giant chain database.

Images