Data security communication system of Internet of Things

Abstract

The invention discloses a data security communication system of the Internet of Things, which relates to the technical field of data security communication of the Internet of Things, and comprises the steps of equipment identity authentication, adoption of a Hash encryption and challenge response mechanism, dynamic key negotiation and combination with a Diffie-Hellman algorithm and an equipment operation state to generate a session key; the data encryption transmission uses AES-256 encryption and is transmitted through a TLS1.3 protocol, and abnormal traffic detection and prediction are carried out through DBSCAN clustering and an LSTM model; the data integrity is ensured through double verification of the receiving end; flexible access authority control is realized based on attributes in combination with fuzzy logic; recording an operation log and intelligently analyzing to complete safety audit; secret key updating is triggered according to a period or threat, and a new secret key is protected by a digital signature. According to the method, illegal access is prevented through multiple authentication, confidentiality is enhanced through a dynamic key, threats are intelligently detected, authority is flexibly controlled, logs are effectively audited, the key is updated in time, vulnerabilities are repaired, data leakage and attack loss are reduced, and a safety barrier is built for application of the Internet of Things.

Description

Technical Field

[0001] The present invention relates to the technical field of secure data communication of the Internet of Things, and in particular to a secure data communication system of the Internet of Things. Background Art

[0002] With the widespread adoption of IoT technology in industries such as industry, transportation, healthcare, and smart homes, a vast number of devices are interconnected. However, the sheer number and complexity of IoT devices, coupled with the fact that many operate unattended or under remote control, pose significant challenges to data security. Traditional network security measures are difficult to directly apply to IoT scenarios. For example, resource-constrained smart home devices cannot withstand the computational pressure of complex encryption algorithms. Industrial IoT devices require high real-time communication, and conventional security authentication mechanisms can cause communication delays, impacting production processes. Furthermore, the frequent communication between IoT devices makes data highly vulnerable to theft, tampering, and malicious attacks during transmission, storage, and processing. Any data security issues can lead to serious consequences, including personal privacy breaches, industrial accidents, and the collapse of critical infrastructure.

[0003] Existing IoT data communication security solutions have numerous shortcomings. For device authentication, most rely on static keys or simple username-password methods. Once the key or password is leaked, attackers can easily access the network and control the device. In the application of data encryption technology, some systems use low-strength encryption algorithms to ensure communication efficiency, which are vulnerable to increasingly sophisticated cracking methods. Some solutions that use high-strength encryption consume a lot of computing resources, leading to reduced device performance. Abnormal traffic detection often relies on fixed rule matching, which cannot effectively identify new attack patterns. It also lacks the ability to predict traffic trends and cannot promptly detect potential threats.

[0004] Regarding access control, the traditional role-based access control (RBAC) model struggles to adapt to the dynamic and ever-changing environment of the IoT, lacking the flexibility to adapt to real-time device status and user behavior. Regarding security audits, log records are fragmented and lack effective analysis methods, making it difficult to quickly locate the root cause of security incidents within massive log volumes. Furthermore, existing systems lack a single key management mechanism and fail to update keys promptly. This means keys cannot be quickly replaced when exposed to security risks, posing a serious threat to data communication security. Therefore, a comprehensive, efficient, and IoT-adapted data security communication system is urgently needed to ensure the secure and stable operation of IoT applications. Summary of the Invention

[0005] The present invention proposes a data security communication system for the Internet of Things to solve the problems mentioned in the above-mentioned prior art.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions: A data security communication system for the Internet of Things, comprising the following modules: Device identity authentication module: When an IoT device first accesses the network, it sends an authentication request containing a unique ID and hardware signature code HWC to the authentication server; the server authenticates the device through a hash function. Encrypted , compared with the pre-stored information; using the challenge-response mechanism, the server sends a random number , the device private key encrypts and returns, and the server public key decrypts and verifies, and access is allowed only after both sides pass; Dynamic key negotiation module: Before the authenticated device and the communication peer transmit data, the Diffie-Hellman key exchange algorithm is used to negotiate the initial key. The device processes parameters such as CPU usage U and memory usage M through the function F(U,M) to obtain the adjustment coefficient , modify the initial key to generate the final session key ; Data encryption transmission module: divides data into fixed-length data blocks; uses the negotiated session key Encrypt the data block, the encrypted data Transmitted via TLS 1.3 protocol; Abnormal traffic detection module: extracts characteristic parameters of network traffic and sets density thresholds and neighborhood radius , when the density of flow data points And not at any core point When it is within the neighborhood, it is determined to be abnormal traffic and triggers an alarm; Data integrity verification module: Receive encrypted data After the check code C is calculated, the check code C' of the received data is recalculated by the CRC-32 algorithm, and C and C' are compared to see if they are consistent. If they are inconsistent, the sender retransmits the data; after the data is decrypted, the hash function is used Calculate the hash value of the data , and the hash value transmitted along with the data at the sender Make a comparison; Access control module: This module establishes an ABAC model, defines attributes for IoT devices and users, and writes access policies using a policy description language. When a user requests access, the system determines whether access is permitted based on the attributes and policies of both parties. Security Audit Module: This module records device operation behaviors and regularly analyzes audit logs using regular expression matching and machine learning algorithms. If any anomalies are found, a report is generated and sent to the security administrator. Key update module: Set the key update period T. When the period is reached or a security threat is encountered, an update is triggered. The device and the authentication server renegotiate the dynamic key and use the initial algorithm and improved mechanism to generate a new session key. After the update, both parties are notified.

[0007] Furthermore, the device identity authentication module also includes a biometric-assisted authentication process: for security-level devices, after completing basic authentication, the user is required to enter fingerprint and iris biometric information; the collected information is matched with the pre-stored template through the biometric recognition algorithm, and the probability of successful matching P must satisfy P>0.9 before the device is allowed to finally access.

[0008] Furthermore, the abnormal traffic detection module also uses a machine learning long short-term memory network model to predict traffic: the LSTM model is trained using historical traffic data, and the model input is a sequence of traffic feature parameters for the past n time intervals; when the deviation between the actual traffic and the predicted traffic exceeds a set threshold, When an abnormality occurs, it is determined to be a potential abnormality and an early warning is issued.

[0009] Furthermore, in the data encryption transmission module, the AES-256 encryption algorithm is improved: a chaotic sequence is introduced in the encryption process, and the pseudo-random sequence generated by the chaotic system is XORed with the encrypted data; the chaotic system adopts Logistic mapping ,in is the value of the current iteration, is the value produced by the next iteration, The control parameter has a value range of 3.57 to 4. The values generate different chaotic sequences to enhance encryption security.

[0010] Furthermore, in the access permission control module, fuzzy logic is used to process attributes: for fuzzy attribute descriptions, fuzzy sets and membership functions are defined; the specific performance parameters of the device are mapped to the fuzzy set through the membership function, and access permission judgment is performed based on fuzzy inference rules, making access control more flexible.

[0011] Furthermore, in the security audit module, the audit log analysis uses an association rule mining algorithm: the Apriori algorithm is used to mine the association between different operation behaviors in the log, and the support S and confidence C are calculated; when the support of certain operation combinations is found, And confidence , To set thresholds, determine the existence of security risks and analyze them.

[0012] Furthermore, in the dynamic key negotiation module, the adjustment coefficient The calculation method is: , when U+M>1, By incorporating device resource usage into the key generation process, the key can change dynamically with the device's operating status.

[0013] Furthermore, in the data integrity verification module, the hash function Use the SHA-3 algorithm to perform 256-bit hash calculation on the data; to prevent hash collision attacks, add a random salt value when calculating the hash value , the final hash value , the salt value is transmitted along with the data but does not participate in the data encryption process.

[0014] Furthermore, in the key update module, the new key is protected by digital signature technology after it is generated: the authentication server uses the private key to sign the new key to generate signature information; after the device receives the new key and signature information, it uses the server public key to verify it. Only when the verification is successful will the device use the new key.

[0015] Furthermore, it also includes a security vulnerability automatic repair module: the system regularly scans for security vulnerabilities in devices and communication protocols, and uses vulnerability scanning tools to detect them; when a vulnerability is found, the corresponding patch program is automatically downloaded from the security patch library and sent to the device through a secure transmission channel; the device automatically installs the patch during idle time and performs security checks after the patch is installed to ensure system security.

[0016] Compared with the existing technology, the beneficial effects of the present invention are: During device authentication, multiple authentication methods are combined to prevent unauthorized device access. Biometric-assisted authentication further raises the bar for high-security devices. Dynamic key negotiation incorporates device operating status into key generation, allowing keys to change in real time with device status. Even if the key is intercepted, it becomes invalid due to the change in device status, significantly enhancing key security.

[0017] Data encryption transmission utilizes improved algorithms and protocols, ensuring data confidentiality while also ensuring transmission accuracy through the addition of checksums. Abnormal traffic detection, combining clustering algorithms with LSTM models, not only identifies existing abnormal traffic but also predicts potential threats, enabling proactive defense. Data integrity verification provides multiple safeguards to effectively prevent data tampering. Attribute-based access control, incorporating fuzzy logic, flexibly adapts to complex and ever-changing IoT scenarios. Security audits promptly identify security risks through intelligent analysis, while a key update mechanism ensures key security. Automatic remediation of security vulnerabilities ensures closed-loop problem resolution. This system comprehensively safeguards IoT data security, reduces the risk of attacks, and minimizes the losses from security incidents, building a solid security defense for IoT development. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a schematic block diagram of a data security communication system for the Internet of Things proposed by the present invention; Figure 2 A line chart comparing the number of illegal accesses under different authentication methods; Figure 3 Compare the time consumption of encrypted data transmission with a bar chart; Figure 4 A bar chart comparing key update times. DETAILED DESCRIPTION

[0019] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0020] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise" and the like to indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as limiting the present invention.

[0021] In addition, the terms "first" and "second" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the said features. In the description of the present invention, the meaning of "multiple" is two or more, unless otherwise clearly and specifically defined. In addition, the terms "installed", "connected" and "connected" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be a connection between the two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances. The present invention will be further described in detail below with reference to the accompanying drawings.

[0022] Reference Figures 1 to 4 :A data security communication system for the Internet of Things, including the following modules: Device identity authentication module: When a device first accesses the network, it sends an authentication request containing a unique ID and hardware signature code HWC to the authentication server. The server uses a hash function to Encrypt ID and HWC using the following formula: ,in Use an algorithm with strong anti-collision properties (such as SHA-256) to ensure that the hash values of different input data are unique and the original information cannot be reversed. Compare with the pre-stored device registration information, if they are consistent, the challenge-response mechanism is activated: the server generates a random number Sent to the device, the device uses the private key right After encryption, the server returns the public key Decryption verification: Only when both bidirectional verifications are passed, the device is allowed to access the network.

[0023] For devices with higher security levels, biometric-assisted authentication is required after passing basic authentication. The user enters biometric information, such as fingerprint or iris. The system processes the collected data using a feature point extraction algorithm (such as minutiae extraction of fingerprints) and matches it against a pre-stored template using a biometric recognition algorithm. When the probability of a successful match (P) exceeds 0.9, the device completes final authentication and is connected.

[0024] Dynamic key negotiation module: Before the authenticated device prepares to transmit data with the communication peer, it will use the Diffie-Hellman key exchange algorithm to negotiate the initial key. This algorithm builds a secure foundation based on the discrete logarithm problem. The two communicating parties each hold a private key. The device private key is a and the peer private key is b. The two parties agree in advance on the generator g and the large prime number p. g participates in the calculation as a finite field element, and p limits the calculation range. The device Calculate A and send it to the other end, and the other end presses Calculate B and send it to the device. Then the device calculates the same value by B and the other end calculates the same value by A. In this process, even if A and B are intercepted, it is difficult for a third party to calculate , ensuring the security of initial key negotiation.

[0025] In order to allow the key to change dynamically with the device status, the device operation status parameters are introduced. The CPU usage U and memory usage M are selected, which directly reflect the device resource usage. The device uses the function F(U,M) to process these two parameters. When U+M≤1, the coefficient is adjusted. , indicating that the device resource usage is low; when U+M>1, =1, indicating high device resource usage. In this way, device resource usage is integrated into the key generation process.

[0026] With the initial key and adjustment coefficient α, generate the final session key through XOR operation ,Right now The XOR operation is performed by comparing the binary bits and changing binary bit. This makes This is not only tied to the initial key, but also to the device's operating state. Even on the same network, devices in different operating states will have different session keys. This significantly improves key randomness and security, building a strong barrier for secure data transmission between IoT devices, preventing keys from being easily cracked or guessed, and effectively ensuring the confidentiality of data during transmission.

[0027] Data encryption transmission module: The module uses AES-256 encryption combined with chaotic sequence to enhance data security and transmits data through TLS1.3 protocol. The specific implementation is as follows: First, the transmission data D is divided into data blocks of fixed length, and the negotiated session key is used. Perform AES-256 symmetric encryption to obtain encrypted data To further enhance security, chaotic sequences are introduced for improvement: the chaotic system uses Logistic mapping: , where μ is a control parameter with a value range of 3.57 to 4. Different pseudo-random sequences are generated by adjusting μ. The chaotic sequence has ergodic and pseudo-random properties. It is XORed with the AES-256 encrypted data to further scramble the data binary bits.

[0028] Encrypted data Transmitted via the TLS 1.3 protocol, which ensures the confidentiality and integrity of data transmission. A CRC-32 checksum C is added during transmission, calculated as follows: The CRC-32 algorithm generates a checksum using polynomial division to detect errors during data transmission. The receiver recalculates the checksum C′ and compares it with C. If they do not match, the sender is asked to retransmit the data.

[0029] Abnormal traffic detection module: Deploy an abnormal traffic detection module at the network gateway, which is a key node for network data inflow and outflow, to facilitate comprehensive collection of network traffic data. During the real-time collection process, a series of traffic characteristic parameters are extracted. The number of data packets per unit time, N, reflects the frequency of data transmission; the average size of data packets, S, reflects the scale of data transmission; the frequency of source and destination IP address changes, S, and S are all related to the traffic flow. These parameters describe traffic characteristics from different dimensions and provide basic data for subsequent analysis.

[0030] Then we enter the analysis phase based on the DBSCAN clustering algorithm. The DBSCAN clustering algorithm is a density-based clustering method that can effectively identify core points, boundary points, and noise points in the data set. Set the density threshold and neighborhood radius ϵ, density threshold The neighborhood radius ϵ is used to define the density of data points. For a certain flow data point, its density ρ is calculated. When ρ< If the point is not within the ϵ neighborhood of any core point, it is considered abnormal traffic and an alarm is triggered. This is because under normal traffic conditions, data points usually show a certain degree of clustering, and data points that do not meet this clustering feature are likely to be abnormal.

[0031] Next, traffic forecasting is performed using the LSTM model. The LSTM (Long Short-Term Memory) model is a specialized recurrent neural network that excels at processing time series data and can learn long-term dependencies within the data. The LSTM model is trained using historical traffic data, using a sequence of traffic characteristic parameters from the past n time intervals as input. This allows the model to learn the temporal patterns of traffic flow. In practice, the model predicts future traffic flow based on these learned patterns. When the deviation between actual and predicted traffic exceeds a set threshold δ, it is identified as a potential anomaly and an early warning is issued. The threshold δ is set to reasonably define the normal range of fluctuations; traffic fluctuations outside this range may indicate an anomaly, such as a network attack or equipment failure.

[0032] By combining the DBSCAN clustering algorithm and the LSTM model, the abnormal traffic detection module can not only detect current abnormal traffic in a timely manner, but also provide early warning of potential anomalies, greatly improving the ability to detect abnormal network traffic and providing strong protection for secure communication of IoT data.

[0033] Data integrity verification module: In the IoT data security communication system, the data integrity verification module is responsible for ensuring that the data has not been tampered with during transmission and is intact. Once the receiving end receives the encrypted data The first round of verification is immediately carried out by using the CRC-32 algorithm to check the received encrypted data. Recalculate the check code C'. The CRC-32 algorithm uses a specific polynomial division operation as a means to convert the data Treated as a binary sequence, C′ is obtained by performing operations on the generator polynomial. C′ is then compared with C from the sender. If the two differ, this indicates that the data may have been altered during transmission due to noise interference, link failure, or other factors. The receiver will then request a retransmission to ensure data accuracy.

[0034] After the first round of verification is passed and the data is decrypted, it enters the more rigorous secondary verification stage. At this time, the hash function is enabled. , specifically using the SHA-3 algorithm. The SHA-3 algorithm is the "guardian" of data security, which can perform 256-bit hash calculations on data. To resist hash collision attacks, a random salt value is added when calculating the hash value of the data. The random salt value is a randomly generated string of characters or numbers, which is concatenated with the original data D and hashed to obtain The salt value is transmitted with the data but does not participate in encryption. In this way, even if someone attempts to forge data to match the hash value, it will be difficult to succeed because they do not know the salt value. With the sender If the comparison is the same, it indicates that the data was transmitted safely and intact. If it is different, it indicates that the data may have been illegally tampered with, and the receiving end will take subsequent measures accordingly. This module uses a dual verification mode using the CRC-32 algorithm and the SHA-3 algorithm with a random salt value. Like a solid shield, it safeguards the integrity and security of IoT data transmission, preventing data corruption or tampering during transmission and ensuring the stable and reliable operation of the communication system.

[0035] Access control module: Build an attribute-based access control (ABAC) model. In this model, the various attributes of IoT devices and users must be defined in detail. For devices, the device type is one of the important attributes. For example, sensor devices are mainly responsible for collecting data, while actuator devices are used to execute instructions. The access rules for different types of devices will vary. The security level is also critical. Devices involving critical business or sensitive information have a higher security level, and access to them requires stricter control. For users, identity attributes distinguish between different roles such as administrators and ordinary users. Administrators usually have more permissions, while ordinary users have relatively limited permissions. Department attributes indicate the department to which the user belongs. For example, the R&D department may need to frequently access certain devices for testing, while the operation and maintenance department focuses more on monitoring the operating status of the equipment.

[0036] The next step is to develop access policies. Rules are written using a specialized policy description language, defining the conditions under which users can access device data. For example, a rule like "Access is allowed if the user is an administrator and the device security level is below level 3" can be set. A complete access policy system is constructed through a series of similar rules to ensure that access operations are systematic and well-defined. Considering the existence of ambiguous attribute descriptions in practice, such as "good device performance," which is difficult to precisely define, the module utilizes fuzzy logic. Fuzzy sets are first defined. For example, for "good device performance," sets such as "good," "average," and "poor" can be defined. Specific device performance parameters, such as CPU usage and response time, are then mapped to these fuzzy sets using specific methods. For example, high CPU usage is more likely to be mapped to the "good" set; long response times may be mapped to the "poor" set.

[0037] Finally, access rights are determined based on fuzzy inference rules. By comprehensively considering the results of multiple fuzzy attribute mappings, a logical judgment method similar to "and" and "or" is used to determine whether the user is allowed to access device data. For example, when determining whether a user can access a device, the system not only considers the user's identity attributes but also considers fuzzy attributes such as device performance. This allows permission control to better adapt to complex, changing, and ambiguous real-world scenarios, achieving more flexible and reasonable permission management and effectively ensuring the security of IoT data access.

[0038] Security Audit Module: The system records various behaviors, including device authentication, data transmission, and access operations. It also records operation times down to the exact moment, facilitating subsequent event tracing. It also identifies operation types, including device access, encrypted data transmission, and user access. It also records the device IDs involved, providing a basis for pinpointing issues. These detailed records form a crucial foundation for audit analysis.

[0039] The module employs multiple methods to analyze audit logs. For one thing, it combines regular expression matching with machine learning algorithms. Regular expression matching can quickly screen for anomalies with fixed patterns, such as illegal login attempts with specific formats. Machine learning algorithms learn normal operating patterns from massive amounts of historical logs and build behavioral models. When real-time log data deviates significantly from the model, it may be identified as an anomaly. For example, if the normal access frequency of a certain type of device is regular, but the actual frequency suddenly changes significantly, exceeding the allowed range, an alarm will be triggered.

[0040] On the other hand, we use association rule mining algorithms to conduct in-depth analysis. We use the Apriori algorithm to explore the associations between different operation behaviors in the logs. It will find frequently occurring operation combinations and calculate the support S and confidence C in the process. The support S measures the frequency of the operation combination in all logs. When the support of certain operation combinations is found, ( is the set threshold), it means that the operation combination occurs more frequently. The confidence C represents the probability that another operation will occur at the same time when a certain operation occurs. ( is the set threshold), indicating that there is a strong possibility of correlation between the two operations. And confidence When the number of active logins exceeds the threshold, it indicates a potential security risk and requires further investigation. For example, if the combination of "frequent and abnormal device logins" and "large amounts of data downloads" exceeds the threshold, be vigilant against data leakage.

[0041] Once abnormal behavior is detected, the module automatically generates a comprehensive audit report, including details of the abnormal behavior, the time of occurrence, the devices involved, and the users, and promptly sends it to the security administrator. Based on the report, the security administrator can quickly implement security reinforcement, source tracing, and personnel investigation measures to fully maintain the stability and security of the IoT data security communication system.

[0042] Key Update Module: The system first sets a key update cycle, T, which can be determined based on actual security requirements and application scenarios, such as one week or one month. When this update cycle is reached, the key update process is triggered. Furthermore, if the system detects a security threat, such as a network attack or potential key compromise, the key update process is also immediately triggered. These two triggering conditions work together to ensure that keys are updated at the appropriate time, maintaining communication security. Once the key update process is triggered, the device and the authentication server will re-negotiate dynamic keys. This process uses the same algorithms and improved mechanisms as the initial negotiation. Specifically, the Diffie-Hellman key exchange algorithm may be combined with device operating status parameters to generate a new session key. As in the initial negotiation process, the device and authentication server each use their own calculation methods, processing and calculating a series of parameters to ultimately jointly generate a new session key.

[0043] During this process, the algorithm's security and the effectiveness of the improved mechanism ensure the randomness and scalability of the new key, enabling it to provide reliable encryption for subsequent data communications. Once generated, the new key is protected using digital signature technology to prevent tampering or forgery during transmission and use. The authentication server signs the new key using its own private key, generating a signature. This private key is unique and confidential, unique to the authentication server.

[0044] After receiving the new key and signature, the device uses the authentication server's public key to verify it. Public and private keys are paired and have a specific mathematical relationship. The public key can verify the signature of the private key. The verification process is like an identity verification process. If the verification succeeds, it indicates that the new key has not been tampered with during transmission and was indeed generated by the authentication server. The device will then use the new key for subsequent data encryption and decryption operations. If the verification fails, the device will not use the new key and may request the authentication server to resend the key and signature or implement other security measures. After the new key is verified and adopted by the device, the updated key is promptly notified to both communicating parties. The old key does not expire immediately but only expires after any unfinished data transmission is completed. This design ensures that ongoing data transmission is not interrupted by a sudden key change, ensuring communication continuity. Once all unfinished data transmissions using the old key are completed, the old key is completely invalidated, and both communicating parties will use the new key for subsequent secure data communication. This ensures a smooth key transition and ensures the security and stability of the IoT data security communication system.

[0045] The present invention also includes an automatic security vulnerability remediation module: The system periodically launches a vulnerability scanner at pre-set intervals. Professional vulnerability scanning tools are used to comprehensively test devices and communication protocols. These vulnerability scanning tools possess powerful detection capabilities and can meticulously identify potential security vulnerabilities in various types of devices (such as sensors and gateways) and communication protocols (such as MQTT and HTTP), based on their respective characteristics and security specifications. For example, for IoT devices, the scanning tool checks the device operating system for known vulnerabilities, such as buffer overflows and weak passwords. For communication protocols, it detects protocol flaws, such as imperfect authentication mechanisms and insufficient data encryption. This comprehensive and in-depth scanning maximizes the potential security risks in the system. Once the vulnerability scanning tool discovers a security vulnerability, the system responds promptly by automatically searching and downloading the corresponding patch from the security patch library, which stores fixes for various known vulnerabilities. The system accurately locates and retrieves the appropriate patch based on the vulnerability type and the specific device or protocol.

[0046] After downloading, to ensure the security of the patch during transmission and prevent malicious tampering or theft, the system sends the patch to the device via a secure transmission channel (such as using the encryption protocol TLS for data transmission). During transmission, the data is encrypted, and only the device can correctly decrypt and receive the complete patch. After receiving the patch, the device does not install it immediately, but chooses to automatically install it during an off-hours period. This is to avoid the impact that installing a patch during busy equipment may have on normal business operations. For example, if a patch is installed on equipment on a production line during operation, it may cause brief downtime or data transmission interruption. The off-hours period is generally set based on the operating patterns of the device and business needs. For example, for some industrial IoT devices, installation may be performed at night when production is paused; for some IoT devices used daily, it may be installed in the early morning when user activity is low.

[0047] After installation is complete, the device immediately undergoes a security check. This involves a series of checks, including integrity checks on critical system files, testing various device functions, and rescanning for existing vulnerabilities, to ensure that the patch has been successfully installed and has not introduced new issues. Only when the test results confirm that the system is secure and functioning properly is the vulnerability remediation process considered complete. If any issues are discovered during the test, the device may attempt to reinstall the patch or alert the system administrator, requesting manual intervention to ensure the secure and reliable operation of the IoT data security communication system.

[0048] The above are only preferred specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with this technical field, within the technical scope disclosed by the present invention, who makes equivalent replacements or changes based on the technical solutions and inventive concepts of the present invention, should be covered by the scope of protection of the present invention.

Claims

1. A data security communication system for the Internet of Things, characterized in that: Includes the following modules: Device identity authentication module: When an IoT device first accesses the network, it sends an authentication request containing a unique ID and hardware signature code HWC to the authentication server; the server authenticates the device through a hash function. Encrypted , compared with the pre-stored information; using the challenge-response mechanism, the server sends a random number , the device private key encrypts and returns, and the server public key decrypts and verifies, and access is allowed only after both sides pass; Dynamic key negotiation module: Before the authenticated device and the communication peer transmit data, the Diffie-Hellman key exchange algorithm is used to negotiate the initial key. The device processes parameters such as CPU usage U and memory usage M through the function F(U,M) to obtain the adjustment coefficient , modify the initial key to generate the final session key ; Data encryption transmission module: divides data into fixed-length data blocks; uses the negotiated session key Encrypt the data block, the encrypted data Transmitted via TLS 1.3 protocol; Abnormal traffic detection module: extracts characteristic parameters of network traffic and sets density thresholds and neighborhood radius , when the density of flow data points And not at any core point When it is within the neighborhood, it is determined to be abnormal traffic and triggers an alarm; Data integrity verification module: Receive encrypted data After the check code C is calculated, the check code C' of the received data is recalculated by the CRC-32 algorithm, and C and C' are compared to see if they are consistent. If they are inconsistent, the sender retransmits the data; after the data is decrypted, the hash function is used Calculate the hash value of the data , and the hash value transmitted along with the data at the sender Make a comparison; Access control module: This module establishes an ABAC model, defines attributes for IoT devices and users, and writes access policies using a policy description language. When a user requests access, the system determines whether access is permitted based on the attributes and policies of both parties. Security Audit Module: This module records device operation behaviors and regularly analyzes audit logs using regular expression matching and machine learning algorithms. If any anomalies are found, a report is generated and sent to the security administrator. Key update module: Set the key update period T. When the period is reached or a security threat is encountered, an update is triggered. The device and the authentication server renegotiate the dynamic key and use the initial algorithm and improved mechanism to generate a new session key. After the update, both parties are notified.

2. The data security communication system of the Internet of Things according to claim 1, characterized in that: The device identity authentication module also includes a biometric-assisted authentication process: for devices at the security level, after completing basic authentication, the user is required to enter fingerprint and iris biometric information; the collected information is matched with the pre-stored template through the biometric recognition algorithm, and the probability of successful matching P must meet P>0.9 before the device is finally allowed to access.

3. The data security communication system of the Internet of Things according to claim 1, characterized in that: The abnormal traffic detection module also uses a machine learning long short-term memory network model to predict traffic: the LSTM model is trained using historical traffic data, and the model input is a sequence of traffic feature parameters over the past n time intervals; When the deviation between the actual flow and the predicted flow exceeds the set threshold When an abnormality occurs, it is determined to be a potential abnormality and an early warning is issued.

4. The data security communication system of the Internet of Things according to claim 1, characterized in that: In the data encryption transmission module, the AES-256 encryption algorithm is improved: a chaotic sequence is introduced in the encryption process, and the pseudo-random sequence generated by the chaotic system is XORed with the encrypted data; the chaotic system adopts Logistic mapping ,in is the value of the current iteration, is the value produced by the next iteration, The control parameter has a value range of 3.57 to 4. The values generate different chaotic sequences to enhance encryption security.

5. The data security communication system of the Internet of Things according to claim 1, characterized in that: In the access control module, fuzzy logic is used to process attributes: for fuzzy attribute descriptions, fuzzy sets and membership functions are defined; the specific performance parameters of the device are mapped to the fuzzy set through the membership function, and access rights are judged based on fuzzy inference rules, making access control more flexible.

6. The data security communication system of the Internet of Things according to claim 1, characterized in that: In the security audit module, the audit log analysis uses the association rule mining algorithm: the Apriori algorithm is used to mine the association between different operation behaviors in the log, and the support S and confidence C are calculated; when the support of certain operation combinations is found, And confidence , To set thresholds, determine the existence of security risks and analyze them.

7. The data security communication system of the Internet of Things according to claim 1, characterized in that: In the dynamic key negotiation module, the adjustment coefficient The calculation method is: , when U+M>1, ; By incorporating the device resource usage into the key generation process, the key can be dynamically changed according to the device operating status.

8. The data security communication system of the Internet of Things according to claim 1, characterized in that: In the data integrity verification module, the hash function Use the SHA-3 algorithm to perform 256-bit hash calculation on the data; to prevent hash collision attacks, add a random salt value when calculating the hash value , the final hash value , the salt value is transmitted along with the data but does not participate in the data encryption process.

9. The data security communication system of the Internet of Things according to claim 1, characterized in that: In the key update module, the new key is protected by digital signature technology after it is generated: the authentication server uses the private key to sign the new key to generate signature information; after the device receives the new key and signature information, it uses the server public key to verify it. Only when the verification is successful will the device use the new key.

10. The data security communication system of the Internet of Things according to claim 1, characterized in that: It also includes an automatic security vulnerability repair module: the system regularly scans for security vulnerabilities in devices and communication protocols, and uses vulnerability scanning tools for detection; when a vulnerability is found, the corresponding patch program is automatically downloaded from the security patch library and sent to the device through a secure transmission channel; the device automatically installs the patch during idle time and performs security checks after the patch is installed to ensure system security.

Images