Mobile terminal security protection design method based on edge intelligence
By assessing mobile terminal threats using graph theory and topological potential functions, and combining P2P architecture and load balancing technology, the problem of slow security threat identification and response speed in edge intelligent systems is solved, improving the security and resource utilization efficiency of mobile terminals and preventing DoS attacks.
Patent Information
- Application Number
- CN202410479357.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-04-19
- Publication Date
- 2025-10-24
AI Technical Summary
Edge intelligent systems face challenges such as low latency, high reliability, and limited terminal resources, which lead to data leakage and attack risks in secure communication. In particular, existing technologies struggle to effectively identify and respond to security threats in the areas of edge access, edge servers, and edge management.
This approach combines graph theory and topological potential functions to assess mobile terminal security threats. It utilizes a P2P architecture to store and share threat information, and uses edge servers to statistically analyze idle resources and traffic in real time for load balancing, dispersing DoS attack traffic and improving system security protection capabilities.
It enables rapid identification and response to security threats to mobile terminals, improves system security and resource utilization efficiency, effectively prevents DoS attacks, and ensures the security of user data and terminal devices.
Smart Images
Figure CN120834929A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application relates to a mobile terminal security protection design method based on edge intelligence and belongs to the field of information security. BACKGROUND
[0002] In recent years, the revolution of computing and communication has changed the way of communication between people and things, and more and more intelligent devices have been produced. At the same time, a large amount of data also needs efficient and intelligent processing.
[0003] Although applying AI technology to the edge has great advantages in terms of delay, accuracy, energy consumption, privacy and communication overhead, edge intelligence still faces many challenges. Due to the characteristics of low latency, high reliability and limited terminal resources of edge computing service mode, edge computing brings many new features and also brings more threats to system security communication. The privacy involved in edge intelligent systems includes geographic location, user identity, trust management and other information. During the data sharing process between nodes, it is easy to be attacked by data leakage and other possible attacks. Attackers can maliciously pretend to be legitimate edge nodes and induce users to access these nodes by giving certain benefits. In this case, important information such as user's account and password may be leaked to attackers. Usually, such security attacks mainly occur in the fields of edge access, edge server and edge management.
[0004] Therefore, by timely evaluating the security threats of mobile terminals, possible attacks can be discovered and prevented early, and by using cloud edge cooperation, attack information received by mobile terminals can be shared with the cloud and edge, so that attack information can be centrally stored and managed, and the identification and response ability to threats can be improved. Through load balancing technology, security events from mobile terminals can be distributed to multiple processing nodes to realize parallel processing and real-time response, improving processing efficiency and speed. The security of mobile terminals can be effectively improved, and the sharing and response ability of attack information can be strengthened, so as to better protect the safety and privacy of mobile terminal users. SUMMARY
[0005] The technical problem to be solved by the application is how to realize the security protection of mobile terminals based on edge intelligence.
[0006] In order to achieve the above purpose, the technical scheme adopted by the application is:
[0007] A mobile terminal security protection method based on edge intelligence, comprising the following steps:
[0008] A method combining graph theory and topological potential function is used to evaluate the security threats of mobile intelligent terminals. The importance of each node in the threat graph is determined by calculating the entropy value of each node, and the various potential risks faced by the mobile intelligent terminal are comprehensively evaluated, and the corresponding security measures are taken to ensure the security of the terminal device and user data.
[0009] Based on the storage and sharing mechanism of threat information based on P2P architecture, the edge server in the system adds the malicious node to the local malicious node blacklist after detecting the DoS attack of the malicious node, and uploads the metadata information to the P2P network, which is stored by other edge servers, so that the attack information is shared, and the edge server can query the blacklist information at any time;
[0010] Idle resources are counted in real time by the edge server, and traffic conditions are monitored and analyzed. When the group is subjected to DoS attack, the attack traffic is forwarded to the standby edge server node in the group to reduce the burden of the main server. Through traffic load balancing, these standby edge servers can jointly cope with DoS attacks and improve the security protection capability of the edge servers in the whole group. This mechanism can effectively disperse attack traffic and protect the system from DoS attacks.
[0011] A computer readable storage medium for storing the above-mentioned edge intelligent based mobile terminal security protection design method.
[0012] The beneficial effects achieved by the present application are: the mobile intelligent terminal performs security threat evaluation by using graph and topological potential function, the importance of each node in the threat graph is determined by calculating the entropy value of each node, and the purpose of security evaluation of the mobile intelligent terminal is achieved, secondly, based on the GeoHash technology of geographic location, the mobile intelligent terminals and mobile nodes in the same range are organized into a group, a mobile intelligent terminal with strong computing capability is set as an edge server in the group, the convenience of P2P network information sharing is used to overcome the shortage of resource information of a single edge server node, and the sharing and distributed storage of DoS attack information are realized. The idle resources of the standby edge server in the group are counted in real time by the edge server, and when subjected to DoS attack, the attack traffic is forwarded to the standby edge server node in the group, and the DoS attack is relieved through traffic load balancing to improve the security protection capability of the edge server. The present application solves the problems of slow identification and response speed of security threats faced by mobile terminals, poor attack information sharing, and unbalanced system resource utilization, and improves the security and overall performance of the mobile terminal. BRIEF DESCRIPTION OF DRAWINGS In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings described below only constitute a part of the embodiments of the present application, and all other drawings obtained by those of ordinary skill in the art without creative effort based on these drawings are within the scope of the present application. Figure 1 A flow chart of a mobile terminal security protection method based on edge intelligence is provided for the present application. Figure 2 A flow chart of a mobile terminal security threat assessment method is provided for the embodiments of the present application. Figure 3 A schematic diagram of mobile terminal attack information sharing and collaborative storage is provided for the embodiments of the present application. Figure 4 A flow chart of a mobile terminal blacklist query is provided for the embodiments of the present application. Figure 5 A schematic diagram of a collaborative emergency mechanism in a mobile terminal group is provided for the embodiments of the present application. DETAILED DESCRIPTION
[0013] In order to make the purpose, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be described in detail below in combination with specific embodiments of the present application and corresponding drawings. Obviously, the described embodiments only constitute a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of the present application. The technical solutions provided by the embodiments of the present application will be described in detail below in combination with the drawings.
[0014] A method combining graph theory and topological potential function is used to assess the security threats of mobile intelligent terminals. By calculating the entropy value of each node in the threat graph, the importance of the node in the threat graph is determined, the various potential risks faced by the mobile intelligent terminal are comprehensively assessed, and corresponding security measures are taken accordingly to ensure the security of the terminal device and user data.
[0015] Based on the threat information storage and sharing mechanism of the P2P architecture, after detecting the DoS attack of the malicious node, the edge server in the system adds it to the local malicious node blacklist and uploads the metadata information to the P2P network for collaborative storage by other edge servers, so as to realize the sharing of attack information, and the edge server can query the blacklist information at any time.
[0016] Edge servers collect real-time statistics on idle resources and monitor and analyze traffic. When a cluster experiences a DoS attack, this mechanism forwards attack traffic to backup edge servers within the cluster, reducing the burden on the primary servers. By load balancing traffic, these backup edge servers can collectively mitigate DoS attacks, improving the security protection capabilities of the entire cluster's edge servers. This mechanism effectively disperses attack traffic and protects the system from DoS attacks.
[0017] Figure 1 It is a technical framework diagram of the method of the present invention.
[0018] The present invention will be further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention and are not intended to limit the scope of protection of the present invention.
[0019] Topological potential considers each mobile terminal as a node constituting a graph G, which consists of n nodes and their interactions. Each node is assumed to generate an interaction field in a logical space. Each node in this space is affected by other nodes. This interaction is limited and related to the logical distance between nodes, decreasing rapidly as the distance between nodes increases. A node's position in a topological network reflects its ability to influence adjacent nodes, and vice versa. The following steps are involved:
[0020] Given a graph G = {V, E}, where V = {v1, v2, ...v m} represents the set of nodes in the graph, E is the set of edges, and |E| is the number of edges in the graph. The formula for the interaction between nodes is defined as follows:
[0021]
[0022] in, Represents node v i For node v j The role of m i ≥0 means node v i(i＝1，2，...n) The quality of a node is an inherent property of the node.
[0023] d ij Represents node v i To node v j is the shortest path length, σ is the influence factor, which indicates the influence range of the node.
[0024] Node v in graph G i The action it receives is the superposition of the forces exerted on it by all nodes in the graph, and its topological potential is shown in formula (2):
[0025]
[0026] Let the node quality m i = 1, then formula (1), formula (2) is simplified as follows:
[0027]
[0028]
[0029] Determination of influencing factors
[0030] For the graph node G = {V, E}, v1, v2,... v n The topological potential is The topological potential entropy H of the graph is:
[0031]
[0032] Wherein, Is the standard factor.
[0033] In the case of node quality m i = 1, the standard factor is:
[0034]
[0035] When sigma tends to 0, H tends to the maximum value H max = log(n), with the increase of sigma, H gradually decreases from the maximum value to a minimum value H min , and then gradually increases to the maximum value H max = log(n). When H min The uncertainty of the graph is the smallest, and the distribution of topological potential is the most uneven, and the corresponding sigma value is the optimal value.
[0036] A method combining graph theory and topological potential function is used to evaluate the security threat of mobile intelligent terminal. The flow chart of mobile terminal security threat evaluation method is shown in Figure 2 By calculating the entropy value of each node in the threat graph, the importance of the node in the threat graph is determined, the various potential risks faced by the mobile intelligent terminal are comprehensively evaluated, and the corresponding security measures are taken accordingly to ensure the safety of the terminal equipment and user data. Example 2
[0037] A mobile terminal security protection method based on edge intelligence, comprising the following steps:
[0038] The threat information storage and sharing mechanism based on the P2P architecture, after detecting the DoS attack of the malicious node, the edge server in the system adds it to the local malicious node blacklist, and uploads the metadata information to the P2P network, which is stored by other edge servers, realizes the sharing of attack information, and the edge server can query the blacklist information at any time; The schematic diagram of mobile terminal attack information sharing and collaborative storage is as shown in Figure 3
[0039] Idle resources are counted in real time by the edge server, and the traffic situation is monitored and analyzed. When the group is attacked by DoS, this mechanism will forward the attack traffic to the standby edge server node in the group to reduce the burden of the main server. Through traffic load balancing, these standby edge servers can jointly cope with DoS attacks and improve the security protection capability of the entire group of edge servers. This mechanism can effectively disperse attack traffic and protect the system from DoS attacks.
[0040] The monitoring nodes and mobile nodes are grouped according to geographical location by using the GeoHash technology, and the monitoring nodes and mobile nodes within the same geographical range are organized into a group, and a powerful edge server is set in each group. Through P2P network, we solve the problem of insufficient resources of a single edge server, and successfully realize the sharing and distributed storage of DoS attack information. When the edge server of each group detects DoS attack, it will add the attack node to the local blacklist, and publish the blacklist information to the P2P network. Other nodes can query the blacklist information in the P2P network at any time. Improve the response ability to malicious attacks and ensure the security of the system.
[0041] The edge server E1 detects the DoS attack of the malicious mobile node (red M node), and stores the information of the mobile node in the local attack node blacklist, including the IP and port of the mobile node, the mobile phone number and license plate number of the owner represented by the node, and the proof of DoS attack.
[0042] The edge server E1 publishes the IP and port information of the malicious node as metadata to the upper Chord ring, according to the P2P keyword storage protocol, first calculates the metadata keyword Key value through SHA-1 hash algorithm, and then locates to the group that should be stored according to the Finger Table of E1, E2 is the group of edge servers.
[0043] E2 receives the keyword Key value published by E1 and stores it locally, and in order to avoid the single point failure problem caused by accidental exit of E2 from the network, E2 will flood the Key value to other standby edge servers in the group for storage.
[0044] When the edge server E3 accepts the request of the Mobile, it first locally queries whether the Mobile is in the blacklist of malicious nodes. If there is no information about the Mobile node in the local blacklist, it queries other standby edge servers in the group. If no information is found in the group, it queries the upper layer network. If the edge server E3 queries the metadata information of the malicious node at E2, it is considered that the Mobile node has been identified as a malicious attack node by other edge server nodes, and the connection request of the Mobile node is rejected and added to the local blacklist. If no information is found, it is considered that the Mobile is a normal node, and the connection request is approved. The blacklist query process of the Mobile terminal is as shown in Figure 4 .
[0045] There are a large number of idle resources and computing resources in each standby edge server. After the standby edge server is added to the group, it registers the number of idle resources of itself to the edge server, and provides the idle resource configuration with the maximum capacity that can be provided in response to the DoS attack.
[0046] When the edge server detects that a DoS attack occurs, according to the registration of the idle resources of each standby edge server, the mixed traffic (including normal traffic and DoS attack traffic) on the current edge server is forwarded to the standby edge server with idle resources according to a certain proportion.
[0047] When the standby edge server accepts the mixed traffic, it identifies the attack traffic and the normal traffic through the DoS attack detection tool of itself, filters out the DoS attack traffic, and directly processes most of the requests for the remaining normal traffic because the standby edge server has the same function as the edge server. The schematic diagram of the cooperative emergency mechanism in the Mobile terminal group is as shown in Figure 5 .
[0048] The advantage of the scheme is that the cooperative defense mechanism of the nodes in the group fully utilizes the idle resources and has a lower operation cost. Based on the idea of edge intelligence, the attack traffic on the edge server is forwarded to the standby edge server close to it to realize the load balancing of the attack traffic, has a lower delay, and the expansion of the standby edge server is more flexible and convenient.
[0049] A computer readable storage medium for storing the above-mentioned mobile terminal security protection design method based on edge intelligence.
[0050] Those skilled in the art will appreciate that embodiments of the application can be devised for a method, a system, or a computer program product. Accordingly, the present application can be embodied in the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media having computer-usable program code embodied in the medium.
[0051] The present application is described in reference to the flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.
[0052] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.
[0053] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.
[0054] The above description is only preferred embodiments of the application. It should be pointed out that for those skilled in the art, some improvements and modifications can be made without departing from the technical principles of the application, and these improvements and modifications should also be considered as falling within the scope of the application.
Claims
1. An edge intelligence-based mobile terminal security protection design method, characterized in that, The method comprises: A method combining graph theory and topological potential function is used to evaluate the security threats of mobile intelligent terminals. The importance of each node in the threat graph is determined by calculating the entropy value of each node in the threat graph, the various potential risks faced by the mobile intelligent terminal are comprehensively evaluated, and corresponding security measures are taken accordingly to ensure the security of the terminal device and user data. Based on the storage and sharing mechanism of threat information based on P2P architecture, after detecting the DoS attack of the malicious node, the edge server in the system adds it to the local malicious node blacklist and uploads the metadata information to the P2P network for collaborative storage by other edge servers, realizing the sharing of attack information, and the edge server can query the blacklist information at any time; the idle resources are counted in real time by the edge server, and the traffic situation is monitored and analyzed. When the group is subjected to DoS attack, the mechanism forwards the attack traffic to the standby edge server nodes in the group to reduce the burden of the main server. Through traffic load balancing, these standby edge servers can jointly cope with DoS attack and improve the security protection capability of the entire group of edge servers. This mechanism can effectively disperse attack traffic and protect the system from DoS attack. 2.The edge intelligence based mobile terminal security protection design method according to claim 1, characterized in that The specific process of the mobile intelligent terminal security threat evaluation method based on graph topology potential function is as follows: 1) Establish a threat graph Determine the nodes of the threat graph. According to the currently known attack methods, security threats and system vulnerabilities of the mobile intelligent terminal to be tested, test and analyze the security vulnerabilities and security mechanism defects of the mobile intelligent terminal to be tested, design the nodes in the threat graph, and tabulate for easy query; Determine the corresponding attack path by analyzing the relationship between the nodes in the attack table, and establish the threat graph. 2) Analyze the network nodes in the threat graph. 3.The edge intelligence based mobile terminal security protection design method of claim 2, characterized in that The specific process of analyzing the network nodes in the threat graph is as follows: 1) According to the topology structure of the threat graph, determine the adjacency matrix of the graph. If two nodes are directly connected, assign a value of 1; if two points are not directly connected, assign a value of 0; 2) Determine the degree of each node according to the adjacency matrix of the graph; 3) Calculate the shortest path of the nodes in the threat graph to other nodes to obtain the shortest path matrix of the threat graph; 4) Calculate the value of the influence factor σ to determine the influence range of each node. Superimpose the topological potential value of each node in the graph, and when the topological potential entropy reaches the minimum value, the obtained σ is the optimal influence factor; 5) Calculate the topological potential generated by each node to the node to be tested, and superimpose. When the node distance is greater than the influence range obtained in step 4, the topological potential is 0. The larger the obtained topological potential, the higher the importance of the node in the graph. 4.The edge intelligence based mobile terminal security protection design method of claim 3, characterized in that The specific process of the interaction between nodes in the topological potential field is as follows: 1) Given a graph G = {V, E}, where V = {v1, v2, ...v n } represents the set of nodes in the graph, E is the set of edges, and |E| is the number of edges in the graph. The formula for the interaction between nodes is defined as follows: where, denotes the node v i the role of the node v j . m i ≥ 0 denotes the quality of the node v i(i＝1，2，...n) , which is an inherent attribute of the node. d ij denotes the shortest path length from the node v i to the node v j , and σ is an influence factor, which denotes the influence range of the node. 2) the node v in the graph G i The force acting on the node v is the superposition of all the forces acting on it from the nodes in the graph G, and its topological potential is given by equation (2): Let the node mass m i be 1, then equation (1), equation (2) are simplified as follows: 5.The edge intelligence based mobile terminal security protection design method according to claim 3, characterized in that The specific process of determining the influence factor σ is as follows: For a graph node G = {V, E}, v1, v2,... v n the topological potential is The topological potential entropy H of the graph is: wherein is a standard factor. In the case of a node quality mi = 1, the standard factor is: When σ tends to 0, H tends to the maximum value H max = log(n), with the increase of σ, H gradually decreases from the maximum value to a minimum value H min , and then gradually increases to the maximum value H max = log(n). H min The uncertainty of the graph is the smallest, the distribution of topological potential is the most uneven, and the corresponding σ value is the optimal value. 6.The edge intelligence based mobile terminal security protection design method according to claim 1, characterized in that The specific process of the threat information storage and sharing mechanism based on P2P architecture is as follows: 1)Edge server E1 detects the DoS attack of malicious Mobile node (red M node), and stores the information of the Mobile node into the local attack node blacklist, including the IP and port of the Mobile node, the mobile phone number of the owner represented by the node, the license plate number, and the proof of DoS attack, etc. 2) Edge server E1 publishes the IP and port information of the malicious node as metadata to the upper Chord ring, according to the P2P keyword storage protocol, first calculates the metadata key value Key through SHA-1 hash algorithm, and then locates to the group that should be stored according to the Finger Table of E1, E2 is the group of edge servers. 3) E2 receives the key value Key published by E1 and stores it locally, and in order to avoid the single point failure problem caused by the accidental exit of E2 from the network, E2 will flood the Key value to other standby edge servers in the group for storage. 4) When edge server E3 accepts the request of Mobile, it first queries whether the Mobile is in the malicious node blacklist locally, if there is no information about the Mobile node in the local blacklist, it queries other standby edge servers in the group, if there is no query in the group, it queries the upper network, if E3 queries the metadata information of malicious nodes at E2, it is considered that the Mobile node has been identified as a malicious attack node by other edge server nodes, and the connection request of the Mobile node is refused and listed in the local blacklist. If there is no query, it means that the Mobile is a normal node, and the connection request is agreed. 7.The edge-intelligent based mobile terminal security protection design method according to claim 1, characterized in that The cooperative emergency mechanism in the group is as follows: 1) Each standby edge server has a large amount of idle resources and computing resources, and the standby edge server will register its idle resource quantity after joining the group, and provide the maximum idle resource configuration that can be provided when responding to DoS attack, which is also an important basis for ranking among standby edge servers. 2) When the edge server detects that DoS attack occurs, according to the registration of each standby edge server, the mixed traffic (including normal traffic and DoS attack traffic) on the current edge server is forwarded to the standby edge server with idle resources according to a certain proportion. 3) When the standby edge server accepts the mixed traffic, it identifies the attack traffic and normal traffic through its DoS attack detection tool, filters out the DoS attack traffic, and since the standby edge server has the same function as the edge server, for the remaining normal traffic, the standby edge server can directly handle most of the requests, and for the specific parking lot function requests such as reservation of parking space, query of vehicle status, etc., the standby edge server needs to continue to forward to the edge server for processing. 8.The edge intelligence based mobile terminal security protection design method of claim 1, wherein Dynamic stability, the specific process is as follows: When the edge server suffers from DoS attack traffic that is too large, and the resources in the group are insufficient to mitigate the DoS attack, the edge server initiates an attack mitigation service request to the cloud, forwards the traffic to the cloud server, and lets the cloud complete the DoS attack traffic cleaning, identifies and detects malicious traffic and filters it out, and forwards the normal traffic to the edge server. When the edge server load is too high and is about to crash, the edge server will timely select a new edge server according to the capacity of the standby edge server, so that the malicious node cannot continue to attack the edge server, avoiding group failure, and recording the information of the malicious node to the local malicious node list, and no longer accepting any request of the node. Through the standby rotation mechanism of the edge server, the dynamic stability of the group is realized by continuously switching the edge server. 9.A computer readable storage medium, used for storing the edge intelligence-based mobile terminal security protection design method of any one of claims 1-8.