A data security protection system and method based on the Internet of Things

Abstract

The present invention discloses a data security protection system and method based on the Internet of Things, comprising: an Internet of Things terminal identity authentication module, a terminal network traffic encryption module, a background traffic decryption module, a background identity authentication module, a traffic protocol analysis module, a sensitive data detection module and a physical encryption machine control module; the present invention combines multiple data security software and hardware to achieve more transparent, user-imperceptible sensitive data protection and automatic data desensitization in the Internet of Things scenario, thereby achieving the effect of data security protection.

Description

Technical Field

[0001] The present invention relates to the field of data security protection technology, and in particular to a data security protection system and method based on the Internet of Things. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] The Internet of Things (IoT) refers to the use of various devices and technologies, such as information sensors, radio frequency identification technology, global positioning systems, infrared sensors, and laser scanners, to collect real-time information about any object or process that requires monitoring, connection, and interaction. This information is then collected through various possible network accesses to achieve ubiquitous connectivity between objects and between objects and people, enabling intelligent perception, identification, and management of objects and processes. The IoT is an information carrier based on the internet and traditional telecommunications networks, enabling all independently addressable ordinary physical objects to form an interconnected network.

[0004] The data security protection system is a product independently developed based on the security level protection standards and regulations for important information systems, as well as the digital intellectual property protection needs of enterprises. It is designed with the organic combination of comprehensive data file security strategies, encryption and decryption technologies, and mandatory access control. It implements different security levels of control on various data assets on information media, effectively preventing the leakage and theft of confidential information. Protecting data security by collecting information through IoT devices is also a technology that is often used nowadays. When protecting data security, a data security protection system is needed.

[0005] The existing data security protection system has the following technical problems during use:

[0006] 1. Current data security protection systems are mostly single software or hardware protection. The security level of single protection is not high, which can easily lead to the loss of keys or user sensitive data.

[0007] 2. The current data security protection system under the Internet of Things uses weak terminal authentication methods such as passwords, and identity information is easily attacked and leaked.

[0008] 3. In the current data security protection system under the Internet of Things, data traffic from devices is transmitted in plain text over the Internet, and sensitive data can be easily intercepted and tampered with during transmission; the analysis and identification accuracy of device-related sensitive data during transmission is not high; the encrypted storage of sensitive data does not involve encryption hardware, and the encryption key is stored in plain text, which poses management loopholes and security risks; at the same time, sensitive data lacks desensitization and watermarking processing, making private data easy to leak and difficult to trace after leakage.

[0009] 4. The data security access system in the IoT environment lacks the log security analysis and auditing function throughout the entire life cycle, and is unable to timely analyze, locate, warn, and handle security threat incidents. Summary of the Invention

[0010] In order to solve the above problems, the present invention proposes a data security protection system and method based on the Internet of Things, which adopts a combination of software and hardware to solve the problem of easy data loss in the existing technology of single software and hardware protection. At the same time, digital certificates are introduced during terminal device authentication to ensure the credibility of the terminal identity; the terminal's network communication process is transparently encrypted throughout to achieve terminal data security; an AI model is used to efficiently identify sensitive data in communication data, and data desensitization and data watermarking are performed to improve the security of sensitive data sharing and traceability in the event of loss. The system incorporates a security audit mechanism throughout the process to achieve efficient identification of security threats and timely warnings.

[0011] In some embodiments, the following technical solutions are adopted:

[0012] A data security protection system based on the Internet of Things, comprising:

[0013] The IoT terminal identity authentication module is configured to register and authorize terminal devices to obtain terminal digital certificates and device information;

[0014] The terminal network traffic encryption module is configured to establish a secure encryption channel through key negotiation, send the terminal original protocol data traffic over the secure encryption channel, and carry in the terminal certificate and device information for authentication and authorization;

[0015] The background traffic decryption module is configured to decrypt the ciphertext of the original protocol data traffic of the terminal to obtain the original protocol data traffic;

[0016] The backend identity authentication module is configured to obtain the terminal certificate and device information in the traffic, and verify the legitimacy of the IoT terminal's identity based on the digital certificate and terminal device information;

[0017] The traffic protocol analysis module is configured to replicate all received TCP and Http traffic to the mirror server in real time. The mirror server decodes the received data and stores the data that meets the business rules in the message queue based on the logic screening rules. The message queue is used to reduce the instantaneous traffic peak.

[0018] A sensitive data detection module is configured to detect sensitive data in the instantaneous traffic after peak clipping;

[0019] The physical encryption machine control module is configured to realize automatic encryption and decryption of sensitive data, permission management, data desensitization and data watermark function control.

[0020] As a further solution, it also includes:

[0021] A data storage module is configured to perform a storage operation on automatically encrypted sensitive data;

[0022] The security audit engine module is configured to detect system intrusions during or after the event through continuous information collection and analysis.

[0023] As a further solution, the data watermark function is specifically as follows:

[0024] The numerical attribute watermark embedding method and the category attribute watermark embedding method are used to automatically add database watermarks to different sensitive data; wherein, the numerical attribute watermark embedding method modifies the original numerical value to embed a "0" or "1" watermark bit; the category attribute watermark embedding method embeds a carriage return character and a line feed character at the end of the category attribute value to represent a "0" or "1" watermark bit.

[0025] As a further solution, the security audit engine module includes:

[0026] Log integration unit, used to collect log information generated during system operation and centrally store and manage logs in a unified format;

[0027] Anomaly detection unit, used to identify abnormal host status, risky access terminals, and abnormal access requests and access traffic by pre-setting multiple event correlation rules;

[0028] Automatic alarm unit, used to automatically send alarm notifications for identified abnormal events;

[0029] The exception handling unit is used to provide corresponding handling suggestions for monitored security events.

[0030] In other embodiments, the following technical solutions are adopted:

[0031] A data security protection method based on the Internet of Things, comprising:

[0032] Register and authorize terminal devices, and obtain terminal digital certificates and device information;

[0033] Negotiate and exchange keys between the terminal device and the backend to create a TLS1.2 secure channel;

[0034] The terminal device sends the original protocol data traffic in the secure channel and carries the terminal certificate and device information for authentication and authorization;

[0035] When the traffic reaches the backend system, the traffic ciphertext is decrypted to obtain the original protocol data traffic and terminal certificate and device information, and the identity legitimacy of the IoT terminal is verified based on the digital certificate and terminal device information;

[0036] If the terminal identity verification fails, the original protocol data traffic will be intercepted and no longer forwarded to the network message analysis module, and the exception will be written to the log file; if the terminal identity verification passes, the original protocol data traffic will be subjected to protocol decoding, sensitive data detection and security audit operations.

[0037] As a further solution, protocol decoding is performed on the original protocol data traffic, specifically including:

[0038] Collect all data packets on the server in real time and copy all received traffic to the mirror server;

[0039] The analysis module deployed on the mirror server decodes the received data through TCP and HTTP protocols, matches the logical filtering rules to the specific business data, filters out the data that does not match the rules, and stores the data that meets the business rules in the message queue.

[0040] As a further solution, sensitive data detection is performed on the original protocol data traffic, specifically including:

[0041] Obtain IoT terminal device data from the message queue, perform data cleaning, remove stop words, and perform text standardization on the data to obtain an IoT terminal device dataset;

[0042] Obtain a text set annotated with sensitive data as an auxiliary dataset;

[0043] For samples in the auxiliary dataset, the word importance is calculated and ranked, and the top m words form the auxiliary dataset keyword set; for samples in the IoT terminal device dataset, the word importance is calculated and ranked, and the top m words form the IoT terminal device dataset keyword set;

[0044] Calculate the similarity between the auxiliary data keyword set and the IoT terminal device data keyword set, and calculate the similarity between the auxiliary data set sentences and the IoT terminal device data set sentences;

[0045] Expand auxiliary data keywords and auxiliary dataset sentence samples with similarity higher than the set threshold to IoT terminal device dataset samples;

[0046] The trained sensitive data detection model is used to expand the IoT terminal device dataset for sensitive data identification. The sensitive data detection model obtains word vectors for the data through the BERT model, learns contextual data features through a bidirectional long short-term memory neural network to identify sensitive data, and finally uses CRF for serialization processing.

[0047] As a further solution, the importance of words is calculated and ranked for samples in the auxiliary dataset and the IoT terminal device dataset, specifically including:

[0048] Calculate sentence keyword frequency and anti-sentence frequency for IoT terminal device data;

[0049] Calculate sentence keyword frequency and anti-sentence frequency for the auxiliary dataset;

[0050] Based on the product of sentence keyword frequency and anti-sentence frequency, the importance of a certain word i in sentence j in the auxiliary dataset and the importance of a certain word i in sentence j in the IoT terminal device data are obtained respectively.

[0051] As a further solution, security audit operations are performed on the original protocol data traffic, including:

[0052] Collect logs generated by log sources;

[0053] Through the pre-set multiple event correlation rules, correlation analysis is carried out to realize event monitoring of abnormal host status, risky access terminals, abnormal access requests, and abnormal access traffic; and alarm notification is issued for abnormal events;

[0054] Take appropriate measures for any abnormalities or security incidents detected.

[0055] As a further solution, the above-mentioned corresponding handling of the detected abnormalities or security events specifically includes:

[0056] For hosts with abnormal status, external access to other systems is restricted. The cause of the abnormality is traced and the risky access subject is identified.

[0057] For risky access terminals, restrict access rights until the terminal risk is remedied;

[0058] For abnormal requests, restrict the access rights of the request subject;

[0059] For abnormal access traffic, trace back to the access subject and restrict or block the access rights of the subject.

[0060] Compared with the prior art, the present invention has the following beneficial effects:

[0061] (1) The present invention uses digital certificates to authenticate terminal devices under the Internet of Things, thereby ensuring the trustworthiness of the terminals and realizing the management and controllability of the Internet of Things terminals; the protocol traffic transmission process of the Internet of Things terminal devices is transparently encrypted throughout the process, ensuring the security and reliability of sensitive data during the transmission process.

[0062] (2) This invention efficiently replicates data collected by terminal devices in the IoT environment and automatically identifies it using a bidirectional long short-term memory neural network and conditional random field algorithm integrated with the BERT model, effectively resolving the problem of low accuracy in detecting sensitive data of various data types, including structured and unstructured data, in existing technologies. It also provides real-time risk warnings at different levels, such as email, text messages, and phone calls, for any discovered sensitive data issues, alerting security and business managers to data risk issues.

[0063] (3) The present invention adopts a sensitive data encryption and decryption mode that combines software and hardware, and uses a physical encryption machine to encrypt and decrypt sensitive data and control key access, solving the problems of difficult key management and easy loss; at the same time, it introduces data desensitization and data watermarking technology to improve data security issues when sensitive data is shared and enhance traceability when data is leaked.

[0064] (4) The present invention has a log security analysis and audit function for the entire operation cycle, which enables timely analysis, positioning, early warning and processing of security threat events. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 This is a structural block diagram of the data security protection system of this embodiment. DETAILED DESCRIPTION

[0066] It should be noted that the following detailed description is illustrative and is intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used in the present invention have the same meaning as commonly understood by those skilled in the art to which the present application belongs.

[0067] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or combinations thereof.

[0068] Example 1

[0069] In one or more embodiments, a data security protection system based on the Internet of Things is disclosed. It utilizes multiple data security software and hardware modules, fully utilizes AI detection models and sensitive data rule models, and realizes more transparent sensitive data protection and automatic data desensitization in the Internet of Things scenario, thereby achieving the effect of data security protection.

[0070] Specifically, refer to Figure 1 , the data security protection system based on the Internet of Things includes:

[0071] (1) IoT terminal identity authentication module, configured to register and authorize terminal devices to obtain terminal digital certificates and device information;

[0072] (2) The terminal network traffic encryption module is configured to establish a TLS1.2 secure encryption channel by negotiating a key with the backend system, send the terminal's original protocol data traffic over this secure channel, and bring in the terminal certificate and device information for authentication and authorization;

[0073] (3) a background traffic decryption module configured to decrypt the ciphertext of the original protocol data traffic of the terminal to obtain the original protocol data traffic;

[0074] (4) a background identity authentication module, configured to obtain terminal certificates and device information in traffic, and verify the legitimacy of the identity of the IoT terminal based on the digital certificate and terminal device information;

[0075] (5) The traffic protocol analysis module includes a traffic replication module and a data analysis module. The traffic replication module is deployed on the web server and replicates all received TCP and HTTP traffic to the mirror server in real time based on application layer data. The analysis module deployed on the mirror server decodes the received data, matches the logical filtering rules to the specific business data, and stores the data that meets the business rules in the message queue. The message queue then cuts the instantaneous traffic peak and smoothly pushes it to the sensitive data detection module.

[0076] (6) Sensitive data detection module, which is configured as a sensitive data detection function module based on rules and deep learning, such as names of people, places, institutions, bank card numbers, and mobile phone numbers.

[0077] (7) A physical encryption machine control module configured to realize automatic encryption and decryption of sensitive data, authority management, data desensitization, and data watermark function control.

[0078] Among them, the sensitive data automatic encryption and decryption unit uses sensitive data encryption and decryption algorithms that support national and industry standards to encrypt and calculate the sensitive data produced by the AI ​​model. This module supports symmetric encryption algorithms, asymmetric encryption algorithms, digest algorithms, etc.

[0079] The permission management unit has established a strict user identity authentication system and a key management system with separation of rights and responsibilities. This ensures that access to the encryption machine's keys and data is secure and controllable. Users and applications can only use the encryption machine's keys and data after being authorized.

[0080] The data desensitization unit uses efficient desensitization algorithms to transform, shield, replace, and encrypt sensitive data generated by AI models, effectively desensitizing private data. While ensuring normal business operations, it effectively prevents the leakage of sensitive data on IoT terminals.

[0081] In this embodiment, the specific process of data desensitization is as follows:

[0082] Step 1: Sensitive data sorting: sort out the target data to be desensitized. The sensitive information processed by this invention includes personal identity sensitive information (name, ID number, bank card number, mobile phone number, email address, etc.), enterprise sensitive information (business license, social unified trust code, tax registration certificate number), key sensitive information (symmetric key, asymmetric key private key information), device sensitive information (device ID, IP address, MAC address, IPV6 address), location sensitive information (latitude and longitude, province, city, GPS location, address), and general sensitive information (date).

[0083] Step 2: Configure desensitization rules and processing algorithms. The encryption machine has several pre-set desensitization rules for desensitization. Supported desensitization algorithms include hash desensitization, encryption desensitization, character masking, keyword replacement, deletion desensitization, and rounding desensitization. Hash desensitization uses a hash function to desensitize sensitive data and supports SHA256 and SHA512. Encryption desensitization generates an encryption configuration using an encryption algorithm and an encryption master key to achieve data desensitization. In the generated desensitization result, the first 16 bytes are the initial vector (IV), and the remaining portion is the encrypted ciphertext. The character masking desensitization algorithm uses the specified character * or random characters, including random numbers, random letters, or random numbers and letters, to mask part of the content. Keyword replacement searches for keywords in the specified column and replaces them. The deletion desensitization algorithm sets the specified field to null or empty, the null desensitization algorithm sets the field to NULL, and the empty value desensitization sets the field content to empty. Rounding desensitization performs rounding operations on dates or numbers.

[0084] The desensitization algorithms in this embodiment are applicable to data usage, data sharing, and data storage. Selectable desensitization algorithms for sensitive data usage include character masking and rounding; for sensitive data sharing, selectable desensitization algorithms include character masking, keyword replacement, and deletion; and for sensitive data storage, selectable desensitization algorithms include hashing, encryption, keyword replacement, deletion, and rounding.

[0085] Step 3: Create a data desensitization task. Based on the data tables containing sensitive fields identified by the AI ​​model and in combination with actual applications, determine the tables and fields that require desensitization and create a desensitization task. During the desensitization process, ensure that upstream and downstream processes operate normally and do not affect the normal production and storage of sensitive information that has not been desensitized.

[0086] Step 4: Execute the desensitization task to complete the desensitization of sensitive data.

[0087] The data watermark module automatically adds database watermarks to sensitive data, solving the problems of data leakage being difficult to track and data copyright being difficult to protect during data sharing and exchange. Two watermark embedding methods, numerical attribute and categorical attribute, are used for tuples: numerical attributes (such as age and timestamp) and categorical attributes (such as ID number and address information). The numerical attribute embedding method modifies the original numerical value by embedding a "0" or "1" watermark bit based on certain rules. At the same time, to ensure data availability, the least significant bit algorithm is used for numerical replacement. The categorical attribute embedding method is not suitable for directly modifying numerical codes, and instead embeds carriage returns and line feeds at the end of the categorical attribute value to represent "0" and "1" watermark bits.

[0088] (8) A data storage module configured to store automatically encrypted sensitive data in a database; database storage supports multi-site disaster recovery and master-slave switching.

[0089] (9) The security audit engine module is configured to detect system intrusions during or after the event through continuous information collection and analysis.

[0090] The security audit engine module includes a log integration unit, an anomaly detection unit, an automatic alarm unit, and an anomaly handling unit.

[0091] The log integration unit collects log information generated during system operation and centrally stores and manages logs in a unified format.

[0092] The anomaly detection unit identifies abnormal host status, risky access terminals, and abnormal access requests and access traffic by pre-setting multiple event correlation rules;

[0093] The automatic alarm unit automatically sends alarm notifications based on abnormal events identified by the abnormality detection module;

[0094] The exception handling unit provides corresponding handling suggestions for security events detected by the exception detection module.

[0095] Example 2

[0096] In one or more embodiments, a data security protection method based on the Internet of Things is disclosed. The method is based on the system in Example 1 and specifically includes the following process:

[0097] Step 1: Register and authorize the terminal device, and obtain the terminal digital certificate and device information;

[0098] Step 2: The terminal negotiates and exchanges keys with the backend to establish a TLS 1.2 secure channel.

[0099] Step 3: The terminal sends the original protocol data traffic on the secure channel and carries out authentication and authorization by including the terminal certificate and device information;

[0100] Step 4: When traffic reaches the backend system, the backend traffic decryption module decrypts the ciphertext, obtains the original protocol data flow, terminal certificate, and device information, and verifies the legitimacy of the IoT terminal's identity based on the digital certificate and terminal device information. If the terminal identity verification fails, the original protocol data flow is intercepted and no longer forwarded to the network message analysis module. The exception is logged. If the terminal identity verification passes, the original protocol data flow undergoes protocol decoding, sensitive data detection, and security auditing.

[0101] In this embodiment, performing protocol decoding on the original protocol data traffic specifically includes:

[0102] All received TCP and HTTP traffic is replicated to the mirror server in real time. The analysis module deployed on the mirror server decodes the received data, matches the specific business data with logical filtering rules, and stores the data that meets the business rules in the message queue, which then reduces the instantaneous traffic peak.

[0103] In this embodiment, performing sensitive data detection on the original protocol data traffic specifically includes:

[0104] Step 1: Obtain IoT terminal device data from the message queue and perform data preprocessing such as data cleaning, stop word removal, and text normalization.

[0105] (1-1) Obtaining the original data of IoT terminal devices from the message queue;

[0106] (1-2) Use regular expressions to clean the original data, remove useless data and some symbolic text data, process punctuation marks according to priority, and retain important punctuation marks such as commas and periods.

[0107] (1-3) Use the Jieba word segmentation method to segment the IoT terminal device data to obtain the IoT terminal device data segmentation text;

[0108] (1-4) Load stop words and a custom dictionary. The custom dictionary consists of different words that you do not want to be separated by the Jieba word segmenter.

[0109] Step 2: Use the auxiliary dataset to train the BERT+BiLSTM+CRF sensitive data recognition model. Specifically, the data is passed through the BERT model to obtain word vectors, the bidirectional long short-term memory neural network is used to learn contextual data features for sensitive data recognition, and finally CRF is used for serialization processing.

[0110] (2-1) The auxiliary dataset is a text set collected from the dataset that is labeled with sensitive data such as names of people and places. The auxiliary dataset is input into BERT, and BERT outputs word vectors.

[0111] (2-2) The sensitive data identification algorithm inputs the word vector in step (2-1) and uses the BiLSTM algorithm to extract context information;

[0112] (2-3) Use the CRF algorithm to serialize the output of BiLSTM and combine it with the state transition matrix to obtain a global optimal sequence.

[0113] (2-4) The output of the sensitive data identification algorithm is the predicted entity label and sensitive data identification model M.

[0114] Step 3: Use the word2Vec algorithm to train the model for IoT terminal device data. The trained Word2Vec model is called the IoT terminal device data word vectorization model;

[0115] (3-1) Use the Jieba word segmentation method to segment the auxiliary data set to obtain the auxiliary data set segmentation text;

[0116] (3-2) Load stop words and custom dictionary. The custom dictionary consists of different words, which are words that you do not want to be separated by the Jieba word segmenter;

[0117] (3-3) Use the auxiliary data set segmentation text to train the word2Vec model to obtain the auxiliary data word vectorization model, and use the IoT terminal device data segmentation text in (1-3) to train the word2Vec model to obtain the IoT terminal device data word vectorization model.

[0118] Step 4: For the samples in the auxiliary dataset, calculate the word importance and sort them, and the top m words form the auxiliary dataset keyword set; for the samples in the IoT terminal device dataset, calculate the word importance and sort them, and the top m words form the IoT terminal device dataset keyword set;

[0119] (4-1) Calculate the sentence keyword frequency KF for IoT terminal device data i,j , calculate the sentence keyword frequency KF for the auxiliary data set i,j ′, where the i-th keyword frequency KF i,j The calculation method is:

[0120] Where KF i,i represents the frequency of occurrence of keyword i in sentence j, n i,j Indicates the number of times keyword i appears in sentence j.

[0121] (4-2) Calculate the inverse sentence frequency ISF for the auxiliary data set and calculate the inverse sentence frequency ISF′ for the IoT terminal device data;

[0122] Among them: SF (Sentence Frequency) represents sentence frequency, ISF (Inverse Sentence Frequency) represents inverse sentence frequency, ISF i represents the frequency of the inverse sentence of word i, |S| the total number of sentences, |j:t i ∈S j | indicates t i ∈S j The number of occurrences is increased by 1 to prevent the denominator from becoming zero and causing meaninglessness.

[0123] (4-3) Calculate the importance of a word i in sentence j for the auxiliary data set. The calculation formula is: I(i,j) = KF i,j *ISF i ;

[0124] (4-4) Calculate the importance of a word i in sentence j for IoT terminal device data. The calculation formula is: I(i,j) = KF i,j ′*ISF i ′.

[0125] Step 5: Calculate the similarity between the auxiliary data keyword set obtained in step 4 and the IoT terminal device data keyword set, and set the keyword set similarity threshold;

[0126] (5-1) Keywords for auxiliary data Use the auxiliary data word vectorization model trained in step 3 to calculate L word ={l1,l2,…,l n};

[0127] (5-2) Keywords for IoT terminal device data The word vectorization model of IoT terminal device data trained in step 3 is used to calculate M word ={m1,m2,…,m n};

[0128] (5-3) Yes and Calculate keyword similarity based on cosine similarity. The calculation method is:

[0129] (5-4) Set the keyword similarity threshold (0.4, 0.6).

[0130] Step 6: Calculate the similarity between the sentences in the auxiliary dataset and the sentences in the IoT terminal device dataset, and set the sentence similarity threshold;

[0131] (6-1) For each sentence x in the auxiliary dataset s Use the auxiliary data word vectorization model trained in step 3 to calculate the sentence vector to obtain L sen ={l1,l2,…,l n};

[0132] (6-2) For each sentence x in the word vectorization model of IoT terminal device data s Use the IoT terminal device data word vectorization model trained in step 3 to calculate the sentence vector to obtain M sen ={m1,m2,…,m n};

[0133] (6-3) to L sen and M sen Sentence-level similarity is calculated based on cosine similarity, which is calculated as:

[0134] (6-4) Set the sentence level similarity threshold (0.4, 0.6).

[0135] Step 7: Calculate the auxiliary data set sample availability value and set the auxiliary data availability threshold;

[0136] (7-1) Based on sim sen ,sim word ,Depend on Calculate the sample availability SU where α is the SU weight of sentence-level similarity and β is the SU weight of keyword similarity;

[0137] (7-2) Set the SU threshold to (0.4, 0.6).

[0138] Step 8: Use auxiliary dataset samples to expand the IoT terminal device dataset; use the sensitive data detection model M to identify sensitive data in the expanded IoT terminal device data.

[0139] (8-1) Based on the keyword similarity threshold, samples with high keyword similarity in the auxiliary data are expanded to the IoT terminal device data sample set;

[0140] (8-2) Based on the sentence-level similarity threshold, the samples with high sentence similarity in the auxiliary dataset are expanded to the IoT terminal device data samples;

[0141] (8-3) According to the sample availability threshold, the samples with high availability in the auxiliary dataset are expanded to the IoT terminal device data samples, and the expanded IoT terminal device data is recorded as T;

[0142] (8-4) Use the sensitive data detection model M obtained in step 2 on T to obtain the sensitive data contained in the IoT terminal device data.

[0143] In this embodiment, security audit operations are performed on the original protocol data traffic, specifically including:

[0144] Step 1: Collect logs generated by log sources to achieve centralized log management and storage.

[0145] Step 2: Perform correlation analysis based on the various event correlation rules pre-set in the engine to monitor abnormal host status, risky access terminals, abnormal access requests, and abnormal access traffic.

[0146] Step 3: Alert notification of abnormal events via email, SMS, voice, etc.

[0147] Step 4: Take appropriate action for any detected anomalies or security incidents. Hosts with abnormal status will be restricted from accessing other systems. The cause of the anomaly can be further traced to identify the risky access subject. Risky access terminals will have their access restricted until the risk is remedied. For abnormal requests, the requesting subject will have their access restricted. For abnormal access traffic, the access subject will be traced back and their access rights restricted. In severe cases, the access subject may be blocked.

[0148] In summary, when using this embodiment, the terminal device first registers and authorizes, obtains the terminal digital certificate and device information, then negotiates and exchanges keys with the backend to create a TLS1.2 secure channel. The original protocol data traffic is sent through this channel, and the terminal certificate and device information are brought in for authentication and authorization. When the traffic reaches the backend system, the traffic decryption module decrypts the traffic ciphertext, obtains the original protocol data traffic, the terminal certificate, and device information, and verifies the legitimacy of the IoT terminal's identity based on the digital certificate and terminal device information. This interactive process ensures the trustworthiness of the IoT terminal's identity, and the traffic data from the terminal is transparently encrypted throughout, greatly improving the security of data traffic. The network message collection and analysis module efficiently replicates the terminal device traffic data. Based on AI technology, it integrates the bidirectional long short-term memory neural network of the BERT model and the conditional random field algorithm for automatic recognition, effectively solving the problem of low accuracy in detecting sensitive data of various data types, such as structured and unstructured data, in existing technologies. The automatic sensitive data encryption module is connected to the physical encryption machine control module, invoking the data encryption and decryption module, data desensitization module, and data watermarking module provided by the physical encryption machine to perform encryption, decryption, desensitization, and watermarking operations on the sensitive data produced by the AI ​​model. This improves data security when sensitive data is shared and enhances traceability in the event of sensitive data leaks. The physical encryption machine's access control management function also ensures secure and standardized key management. The system's traffic analysis, detection, and encryption operations are all transparent to IoT terminals, achieving terminal-unaware sensitive data protection.

[0149] Although the above describes the specific embodiments of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without any creative work are still within the scope of protection of the present invention.

Claims

1. A data security protection system based on the Internet of Things, characterized in that: include: The IoT terminal identity authentication module is configured to register and authorize terminal devices to obtain terminal digital certificates and device information; The terminal network traffic encryption module is configured to establish a secure encryption channel through key negotiation, send the terminal original protocol data traffic over the secure encryption channel, and carry in the terminal certificate and device information for authentication and authorization; The background traffic decryption module is configured to decrypt the ciphertext of the original protocol data traffic of the terminal to obtain the original protocol data traffic; The backend identity authentication module is configured to obtain the terminal certificate and device information in the traffic, and verify the legitimacy of the IoT terminal's identity based on the digital certificate and terminal device information; Traffic protocol analysis module, configured to copy all received TCP and HTTP traffic to the mirror server in real time; The mirror server performs protocol decoding on the received data and stores the data that meets the business rules into the message queue based on the logic screening rules, and the message queue is used to cut the instantaneous traffic peak; A sensitive data detection module is configured to detect sensitive data in the instantaneous traffic after peak clipping; The physical encryption machine control module is configured to realize automatic encryption and decryption of sensitive data, rights management, data desensitization and data watermark function control; The specific process of data desensitization is as follows: Step 1: Sensitive data sorting: sort out the target data to be desensitized; Step 2: Configure desensitization rules and processing algorithms; Step 3: Create a data desensitization task; Step 4: Execute the desensitization task to complete the desensitization of sensitive data; The data watermark function is as follows: The numerical attribute watermark embedding method and the category attribute watermark embedding method are used to automatically add database watermarks to different sensitive data. Among them, the numerical attribute watermark embedding method modifies the original value and embeds a "0" or "1" watermark bit; the category attribute watermark embedding method embeds a carriage return character or a line feed character at the end of the category attribute value to represent a "0" or "1" watermark bit.

2. The data security protection system based on the Internet of Things according to claim 1, characterized in that: Also includes: A data storage module is configured to perform a storage operation on automatically encrypted sensitive data; The security audit engine module is configured to detect system intrusions during or after the event through continuous information collection and analysis.

3. The data security protection system based on the Internet of Things according to claim 2, characterized in that: The security audit engine module includes: Log integration unit, used to collect log information generated during system operation and centrally store and manage logs in a unified format; Anomaly detection unit, used to identify abnormal host status, risky access terminals, and abnormal access requests and access traffic by pre-setting multiple event correlation rules; Automatic alarm unit, used to automatically send alarm notifications for identified abnormal events; The exception handling unit is used to provide corresponding handling suggestions for monitored security events.

4. A method based on the data security protection system according to any one of claims 1 to 3, characterized in that: include: Register and authorize terminal devices, and obtain terminal digital certificates and device information; Negotiate and exchange keys between the terminal device and the backend to create a TLS1.2 secure channel; The terminal device sends the original protocol data traffic in the secure channel and carries the terminal certificate and device information for authentication and authorization; When the traffic reaches the backend system, the traffic ciphertext is decrypted to obtain the original protocol data traffic and terminal certificate and device information, and the identity legitimacy of the IoT terminal is verified based on the digital certificate and terminal device information; If the terminal identity verification fails, the original protocol data traffic will be intercepted and no longer forwarded to the network message analysis module, and the exception will be written to the log file; if the terminal identity verification passes, the original protocol data traffic will be subjected to protocol decoding, sensitive data detection and security audit operations.

5. The data security protection method based on the Internet of Things according to claim 4, characterized in that: Perform protocol decoding on the original protocol data traffic, including: Collect all data packets on the server in real time and copy all received traffic to the mirror server; The analysis module deployed on the mirror server decodes the received data through TCP and HTTP protocols, matches the logical filtering rules to the specific business data, filters out the data that does not match the rules, and stores the data that meets the business rules in the message queue.

6. The data security protection method based on the Internet of Things according to claim 4, characterized in that: Perform sensitive data detection on raw protocol data traffic, including: Obtain IoT terminal device data from the message queue, perform data cleaning, remove stop words, and perform text standardization on the data to obtain an IoT terminal device dataset; Obtain a text set annotated with sensitive data as an auxiliary dataset; For samples in the auxiliary dataset, the word importance is calculated and ranked, and the top m words form the auxiliary dataset keyword set; for samples in the IoT terminal device dataset, the word importance is calculated and ranked, and the top m words form the IoT terminal device dataset keyword set; Calculate the similarity between the auxiliary data keyword set and the IoT terminal device data keyword set, and calculate the similarity between the auxiliary data set sentences and the IoT terminal device data set sentences; Expand auxiliary data keywords and auxiliary dataset sentence samples with similarity higher than the set threshold to IoT terminal device dataset samples; The trained sensitive data detection model is used to expand the IoT terminal device dataset for sensitive data identification. The sensitive data detection model obtains word vectors for the data through the BERT model, learns contextual data features through a bidirectional long short-term memory neural network to identify sensitive data, and finally uses CRF for serialization processing.

7. A data security protection method based on the Internet of Things according to claim 6, characterized in that: For samples in the auxiliary dataset and the IoT terminal device dataset, the word importance is calculated and ranked, specifically including: Calculate sentence keyword frequency and anti-sentence frequency for IoT terminal device data; Calculate sentence keyword frequency and anti-sentence frequency for the auxiliary dataset; Based on the product of sentence keyword frequency and anti-sentence frequency, the importance of a certain word i in sentence j in the auxiliary dataset and the importance of a certain word i in sentence j in the IoT terminal device data are obtained respectively.

8. The data security protection method based on the Internet of Things according to claim 4, characterized in that: Perform security audits on raw protocol data traffic, including: Collect logs generated by log sources; Through the pre-set multiple event correlation rules, correlation analysis is carried out to realize event monitoring of abnormal host status, risky access terminals, abnormal access requests, and abnormal access traffic; and alarm notification is issued for abnormal events; Take appropriate measures for any abnormalities or security incidents detected.

9. The data security protection method based on the Internet of Things according to claim 8, characterized in that: The aforementioned measures will be taken for any abnormalities or security incidents detected, including: For hosts with abnormal status, external access to other systems is restricted. The cause of the abnormality is traced and the risky access subject is identified. For risky access terminals, restrict access rights until the terminal risk is remedied; For abnormal requests, restrict the access rights of the request subject; For abnormal access traffic, trace the access subject and restrict or block the access rights of the subject.

Images