Security testing method, device and medium for narrowband Internet of Things devices

Abstract

The present disclosure provides a security testing method, apparatus, device, medium, and computer program product for narrowband Internet of Things (NIoT) devices, including: generating a control instruction for controlling the operation of the NIoT device and sending the control instruction to the NIoT device; generating baseband test data for baseband security testing and Ethernet test data for Ethernet security testing, and sending the baseband test data and Ethernet test data to the NIoT device; monitoring the operating status of the NIoT device with respect to the baseband test data and the Ethernet test data, and determining a test result for the NIoT device; and determining the baseband security and Ethernet security of the NIoT device based on the test result.

Description

Technical Field

[0001] The present disclosure relates to Internet of Things (IoT) technology, and more particularly to a security testing method, apparatus, device, medium, and computer program product for narrowband IoT devices. Background Art

[0002] Today, the Internet of Things (IoT) is rapidly developing and gaining popularity. Narrowband IoT (NB-IoT) is a key branch of the IoT. NB-IoT is typically built on cellular networks, supporting cellular data connections for low-power devices over wide area networks (WANs), making it a key technology for low-power wide area networks (LPWANs). NB-IoT technology has broad application prospects and is widely used in scenarios such as smart homes, smart parking, smart healthcare, and smart agriculture. Consequently, the security of NB-IoT terminal devices has become crucial. However, current attention to security in the NB-IoT technology field remains low, with limited research and results. There are also no security testing solutions for NB-IoT terminal devices on the market. Therefore, a security testing method for evaluating the security of NB-IoT devices is urgently needed. Summary of the Invention

[0003] To this end, the present disclosure provides a security testing method, apparatus and device, medium, and computer program product for narrowband Internet of Things devices.

[0004] According to one aspect of an embodiment of the present disclosure, a security testing method for a narrowband Internet of Things device is provided, comprising: generating a control instruction for controlling the operation of the narrowband Internet of Things device, and sending the control instruction to the narrowband Internet of Things device, wherein the control instruction is used to instruct the narrowband Internet of Things device to perform a baseband security test and an Ethernet security test; generating baseband test data for the baseband security test and Ethernet test data for the Ethernet security test, and sending the baseband test data and the Ethernet test data to the narrowband Internet of Things device; monitoring the operating status of the narrowband Internet of Things device with respect to the baseband test data and the Ethernet test data, and determining a test result for the narrowband Internet of Things device; and determining the baseband security and Ethernet security of the narrowband Internet of Things device based on the test result.

[0005] According to an example of an embodiment of the present disclosure, generating a control instruction for controlling the operation of a narrowband Internet of Things device and sending the control instruction to the narrowband Internet of Things device includes: determining a current test item, the current test item including at least one of the baseband security test and the Ethernet security test; and generating the control instruction for controlling the operation of the narrowband Internet of Things device based on the current test item, and sending the control instruction to the narrowband Internet of Things device.

[0006] According to an example of an embodiment of the present disclosure, generating baseband test data for baseband security testing and sending the baseband test data to the narrowband Internet of Things device includes: generating the baseband test data according to the test content of the baseband security test; and sending the baseband test data to the narrowband Internet of Things device through a narrowband Internet of Things base station connected to the narrowband Internet of Things device using the narrowband Internet of Things base station protocol.

[0007] According to an example of an embodiment of the present disclosure, generating Ethernet test data for Ethernet security testing and sending the Ethernet test data to the narrowband Internet of Things device includes: generating the Ethernet security test data according to the test content of the Ethernet security test; and sending the Ethernet test data to the narrowband Internet of Things device by adopting the same wireless network protocol as the narrowband Internet of Things device.

[0008] According to an example of an embodiment of the present disclosure, generating Ethernet test data for an Ethernet security test and sending the Ethernet test data to the narrowband Internet of Things device includes: generating the Ethernet security test data according to the test content of the Ethernet security test; and sending the Ethernet test data to the narrowband Internet of Things device through a server connected to the narrowband Internet of Things device.

[0009] According to an example of an embodiment of the present disclosure, determining the baseband security and Ethernet security of the narrowband Internet of Things device based on the test results includes: sending the test results to a local processor and / or a cloud processor to analyze and process the test results to determine the baseband security and Ethernet security of the narrowband Internet of Things device.

[0010] According to an example of an embodiment of the present disclosure, analyzing and processing the test results to determine the baseband security and Ethernet security of the narrowband Internet of Things device includes: comparing the test results with preset security rules, and when the test results match the preset security rules, determining that the narrowband Internet of Things device has a baseband security risk or an Ethernet security risk.

[0011] According to an example of an embodiment of the present disclosure, analyzing and processing the test results to determine the baseband security and Ethernet security of the narrowband Internet of Things device also includes: when there is a baseband security risk or Ethernet security risk in the narrowband Internet of Things device, determining the security risk level of the baseband security risk or the Ethernet security risk; and generating a security risk prompt and a security repair suggestion based on the security risk level.

[0012] According to an example of an embodiment of the present disclosure, the security testing method for a narrowband Internet of Things device further includes: updating the test content of the baseband security test and the Ethernet security test to perform security testing on the narrowband Internet of Things device based on the updated test content.

[0013] According to an example of an embodiment of the present disclosure, the baseband security test includes at least one of a master information block (MIB) security test, a system information block (SIB) security test, and a non-access stratum (NAS) protocol security test, and the Ethernet security test includes at least one of a transmission control protocol / user datagram protocol (TCP / UDP) resolution security test, a domain name system (DNS) resolution security test, and a lightweight machine-to-machine (LWM2M) interface security test.

[0014] According to another aspect of an embodiment of the present disclosure, a security testing apparatus for a narrowband Internet of Things device is provided, the apparatus comprising: a control unit configured to generate a control instruction for controlling the operation of the narrowband Internet of Things device, and send the control instruction to the narrowband Internet of Things device, wherein the control instruction is used to instruct the narrowband Internet of Things device to perform a baseband security test and an Ethernet security test; a test data generation unit configured to generate baseband test data for a baseband security test and Ethernet test data for an Ethernet security test, and send the baseband test data and the Ethernet test data to the narrowband Internet of Things device; a monitoring unit configured to monitor an operating state of the narrowband Internet of Things device with respect to the baseband test data and the Ethernet test data, and determine a test result for the narrowband Internet of Things device; and a determination unit configured to determine the baseband security and Ethernet security of the narrowband Internet of Things device based on the test result.

[0015] According to an example of an embodiment of the present disclosure, the control unit is configured to: determine a current test item, the current test item including at least one of the baseband security test and the Ethernet security test; and generate the control instruction for controlling the operation of the narrowband Internet of Things device based on the current test item, and send the control instruction to the narrowband Internet of Things device.

[0016] According to another aspect of an embodiment of the present disclosure, a security testing device for a narrowband Internet of Things device is provided, comprising: one or more processors; and one or more memories, wherein the memories store computer-readable instructions, and when the computer-readable instructions are executed by the one or more processors, the one or more processors execute any one of the methods described above.

[0017] According to another aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided, on which computer-readable instructions are stored. When the computer-readable instructions are executed by a processor, the processor executes any one of the methods described above.

[0018] According to another aspect of an embodiment of the present disclosure, a computer program product is provided, which includes computer-readable instructions. When the computer-readable instructions are executed by a processor, the processor is caused to perform any one of the methods described above.

[0019] By utilizing the security testing method, apparatus and equipment, medium, and computer program product for NB-IoT devices according to the above-mentioned embodiments of the present disclosure, it is possible to effectively perform security testing on the baseband security and Ethernet security of NB-IoT devices, and support updating and expansion of security test items, thereby providing an efficient and updateable security testing framework for NB-IoT devices, helping to improve the security and reliability of NB-IoT devices in various development and production links, and ensuring the safe application of NB-IoT technology in various IoT smart scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The above and other purposes, features, and advantages of the embodiments of the present disclosure will become more apparent through a more detailed description of the embodiments of the present disclosure in conjunction with the accompanying drawings. The accompanying drawings are intended to provide a further understanding of the embodiments of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the present disclosure and are not intended to limit the present disclosure. In the drawings, the same reference numerals generally represent the same components or steps.

[0021] Figure 1 A schematic diagram illustrating an application scenario of a security testing method for an NB-IoT device according to an embodiment of the present disclosure is shown;

[0022] Figure 2 A flowchart of a security testing method for an NB-IoT device according to an embodiment of the present disclosure is shown;

[0023] Figure 3 A schematic diagram illustrating analysis and processing of test results according to an example of an embodiment of the present disclosure is shown;

[0024] Figure 4 A schematic structural diagram of a security testing device for NB-IoT devices according to an embodiment of the present disclosure is shown;

[0025] Figure 5 A system architecture diagram of a security testing apparatus for NB-IoT devices according to an example of an embodiment of the present disclosure is shown;

[0026] Figure 6 The present invention shows a security testing process of a security testing apparatus for NB-IoT devices according to an example of an embodiment of the present disclosure;

[0027] Figure 7 A schematic diagram illustrating the architecture of an exemplary computing device according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0028] The following will be combined with the accompanying drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the embodiments described are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0029] The supply chain involved in narrowband Internet of Things (NB-IoT) devices is complex, encompassing device developers, communication module manufacturers, and chip manufacturers. Device developers are responsible for developing NB-IoT terminal devices and enabling them to interact with communication modules via AT (Attention) commands. Communication module manufacturers provide built-in AT code logic within their modules, which, in addition to providing an interface for device developers, also requires integration with the chip manufacturer's underlying communication modules. Due to inconsistent security awareness across various stages of development or deployment among various manufacturers, ensuring security compliance throughout the development and deployment of NB-IoT devices is difficult. Once a security risk is introduced at a particular stage, it will be integrated into the final NB-IoT device along with the code from each stage, ultimately introducing this risk into the various smart scenario solutions used by NB-IoT devices.

[0030] However, there is currently no security testing method for NB-IoT devices that can address the aforementioned security risks. In light of this, the present disclosure provides a security testing method, apparatus, device, medium, and computer program product for NB-IoT devices, aiming to conduct comprehensive security testing of NB-IoT devices and provide security risk warnings and remediation recommendations based on the final test results.

[0031] Figure 1The following is a schematic diagram showing an application scenario of a security testing method for NB-IoT devices according to an embodiment of the present disclosure. Figure 1 As shown, there are multiple NB-IoT devices 110 in NB-IoT, such as smart home devices such as smart water and electricity meters and smart door locks, smart medical devices, smart parking systems, etc. Figure 1 The present disclosure only schematically illustrates some examples of NB-IoT devices and does not limit the NB-IoT devices in this disclosure in any meaningful sense. The security testing method for NB-IoT devices according to an embodiment of the present disclosure can be implemented as an NB-IoT device security testing device 120, for example. The NB-IoT device security testing device 120 can perform security testing and evaluation on each NB-IoT device 110, and can provide security risk warnings and repair suggestions for these NB-IoT devices 110 based on the security test results, so as to further enhance the security of each device in the NB-IoT, thereby providing a more secure and reliable Internet of Things application environment.

[0032] Refer to the following Figure 2 The present invention describes a security testing method for NB-IoT devices according to an embodiment of the present disclosure. Figure 2 A flowchart of a security testing method 200 for an NB-IoT device according to an embodiment of the present disclosure is shown. The security testing method 200 can be executed by, for example, a computer or a mobile device, or implemented as a security testing apparatus or security testing device for performing security testing on an NB-IoT device.

[0033] like Figure 2 As shown, in step S210, a control instruction for controlling the operation of the NB-IoT device is generated and sent to the NB-IoT device. The NB-IoT device can be any NB-IoT device whose security is to be tested, and the embodiments of the present disclosure do not impose specific restrictions on this. The control instruction is used to control the operation of the NB-IoT device, or to enable the NB-IoT device to perform a corresponding function. For example, it can be an AT (Attention) instruction commonly used to control the interaction between terminal devices, or it can be any other suitable instruction form, and the embodiments of the present disclosure do not impose specific restrictions on this.

[0034] Specifically, when generating a control instruction, the current test item should first be determined, that is, the test content to be performed on the NB-IoT device. Using the security testing method 200 according to the embodiment of the present disclosure, the baseband security and Ethernet security of the NB-IoT device can be tested, wherein baseband security refers to the communication security between the chip included in the NB-IoT device and the NB-IoT base station, and Ethernet security testing refers to the Ethernet communication security of the NB-IoT device. Accordingly, the test items for the NB-IoT device may include at least baseband security testing and Ethernet security testing. Baseband security testing may include, for example, master information block (MIB) security testing, system information block (SIB) security testing, and non-access stratum (NAS) protocol security testing, etc. Ethernet security testing may include, for example, transmission control protocol / user datagram protocol (TCP / UDP) resolution security testing, domain name system (DNS) resolution security testing, and lightweight machine-to-machine (LWM2M) interface security testing, etc. However, the embodiment of the present disclosure is not limited thereto, and more other security test items may also be set according to actual needs. The specific content of the current test item may be preset, or may be input from an external source or notified in other ways, and the embodiment of the present disclosure does not impose any specific limitation on this.

[0035] After determining the current test item, control instructions for controlling the NB-IoT device can be generated based on the current test item. These control instructions can cause the NB-IoT device to perform specific functions. For example, when the current test item includes a baseband security test, the generated control instructions can cause the NB-IoT device to perform operations such as searching for nearby base stations. For another example, when the current test item includes a DNS resolution security test or a TCP / UDP resolution security test in an Ethernet security test, the generated control instructions can cause the NB-IoT device to perform operations such as DNS queries or opening TCP / UDP ports. For another example, when the current test item includes an LWM2M interface security test in an Ethernet security test, the generated control instructions can cause the NB-IoT device to perform operations such as connecting to an LWM2M server. For another example, when the current test item includes a baseband security test and an Ethernet security test, the generated control instructions can instruct the NB-IoT device to perform both the baseband security test and the Ethernet security test.

[0036] The control instruction can be sent to the NB-IoT device through wired communication or wireless communication, etc., and the embodiments of the present disclosure do not impose specific restrictions on this. According to the example of the embodiments of the present disclosure, when the control instruction is an AT instruction, the AT instruction can be sent to the NB-IoT device through wired communication. For example, the corresponding components of the security test device that executes the security test method 200 can be connected to the NB-IoT device via USB, and then the AT instruction can be sent to the NB-IoT device via the USB connection. After receiving the control instruction, the NB-IoT device performs the corresponding function according to the control instruction, such as searching for nearby base stations, performing DNS queries, opening TCP / UDP ports, connecting to the LWM2M server, etc.

[0037] In step S220, baseband test data for baseband security testing and Ethernet test data for Ethernet security testing are generated, and the baseband test data and Ethernet test data are sent to the NB-IoT device. Specifically, for each current test item, corresponding test data is generated according to the test content of the current test item. For example, the baseband security test includes at least one baseband security test sub-item, and the at least one baseband security test sub-item may include an MIB / SIB security test sub-item and a NAS protocol security test sub-item, and the Ethernet security test includes at least one Ethernet security test sub-item, and the at least one Ethernet security test sub-item may include a TCP / UDP resolution security test sub-item, a DNS resolution security test sub-item, and an LWM2M interface security test sub-item. The number of test data can be one or more, which can be set according to actual test requirements, and the embodiments of the present disclosure do not impose specific restrictions on this.

[0038] According to an example of an embodiment of the present disclosure, when the current test items include baseband security tests, such as MIB / SIB security tests, NAS protocol security tests, etc., baseband test data is generated accordingly and sent to the NB-IoT device. In this case, for example, the baseband test data can be sent to the NB-IoT device by using the NB-IoT base station protocol through the NB-IoT base station connected to the NB-IoT device. Specifically, for example, when a user identity module (SIM) card configured as programmable is inserted into the NB-IoT device and the NB-IoT device searches for a nearby NB-IoT base station engine, the NB-IoT base station engine uses the NB-IoT base station protocol to send the baseband test data to the NB-IoT device.

[0039] According to an example embodiment of the present disclosure, when the current test item includes an Ethernet security test, such as a TCP / UDP resolution security test, a DNS resolution security test, or a LWM2M interface security test, Ethernet test data is generated accordingly and sent to the NB-IoT device. According to an example embodiment of the present disclosure, when the current test item is a TCP / UDP resolution security test or a DNS resolution security test, the Ethernet test data can be sent to the NB-IoT device using the same wireless network protocol as the NB-IoT device. Specifically, for example, the Ethernet test data can be sent to the NB-IoT device via a terminal engine configured with a SIM card using the same carrier as the NB-IoT device. According to another example embodiment of the present disclosure, when the current test item is an LWM2M interface security test, the Ethernet test data can be sent to the NB-IoT device via a server connected to the NB-IoT device. Since LWM2M is a universal basic protocol for NB-IoT devices to connect to IoT cloud platforms, in this case, for example, the Ethernet test data can be sent to the NB-IoT device via a server engine located in the cloud to test the security of the NB-IoT device with respect to the LWM2M interface protocol.

[0040] Next, in step S230, the NB-IoT device's operational status with respect to the baseband test data and Ethernet test data is monitored, and the test results for the NB-IoT device are determined. For example, when performing a baseband security test, the NB-IoT device is monitored to determine whether it can correctly transmit and receive the baseband test data. When performing an Ethernet security test, the NB-IoT device is monitored to determine whether it can correctly parse test data such as TCP / UDP data and DNS data within the Ethernet test data. Furthermore, the NB-IoT device's operational status or operational response with respect to the baseband test data and Ethernet test data is obtained as the test results for the NB-IoT device.

[0041] In step S240, the baseband security and Ethernet security of the NB-IoT device are determined based on the test results of the NB-IoT device. According to an example embodiment of the present disclosure, the test results can be sent to a local processor and / or a cloud processor for analysis and processing to determine the baseband security and Ethernet security of the NB-IoT device. Specifically, the analysis and processing can include, for example, comparing the test results with preset security rules and determining that the NB-IoT device presents a baseband security risk or an Ethernet security risk when the test results match the preset security rules. The preset security rules can include, for example, preset security risk characteristics, which indicate, for example, possible abnormal operational responses of the NB-IoT device to baseband test data or Ethernet test data. The analysis and processing can be performed on the local processor, on the cloud processor, or on both the local and cloud processors. For example, after the local processor performs preliminary analysis and processing on the test data, the cloud processor can further analyze and process the test data using a security risk characteristic database stored in the cloud to obtain a more refined security risk analysis result.

[0042] In addition, when the analysis determines that there is a baseband security risk or Ethernet security risk in the NB-IoT device, the security testing method according to the embodiment of the present disclosure can also determine the security risk level of the baseband security risk or Ethernet security risk, such as different security risk levels divided according to the severity of the security risk, and further generate corresponding security risk prompts and security repair suggestions for different security risks according to the determined security risk level, so as to facilitate users or manufacturers to improve the security issues of NB-IoT devices.

[0043] It should be understood that although the baseband security test and the Ethernet security test are described together in steps S210-S230, the security testing method according to the embodiment of the present disclosure does not limit the baseband security test and the Ethernet security test to be performed simultaneously. According to the embodiment of the present disclosure, the baseband security test and the Ethernet security test can be performed simultaneously. For example, the control instruction can instruct to perform both the baseband security test and the Ethernet security test; or the baseband security test and the Ethernet security test can be performed successively. For example, the first control instruction can instruct to perform the baseband security test, and then the second control instruction can instruct to perform the Ethernet security test. Moreover, according to the embodiment of the present disclosure, for a specific narrowband Internet of Things device, only the baseband security test or the Ethernet security test can also be performed.

[0044] Figure 3 FIG. 1 shows a schematic diagram of analyzing and processing test results according to an example of an embodiment of the present disclosure. Figure 3As shown, the test results are analyzed and processed. For example, Ethernet security analysis and baseband security analysis can be performed separately to determine whether the NB-IoT device faces Ethernet and baseband security risks. For example, Ethernet security analysis can include TCP / UDP parsing security analysis, DNS parsing security analysis, and LWM2M interface security analysis. Baseband security analysis can include MIB / SIB security analysis and NAS protocol security analysis to determine whether the NB-IoT device faces Ethernet and baseband security risks and determine the corresponding security risk levels. Furthermore, after identifying different security risks and their security risk levels, security risk alerts and security remediation recommendations can be generated to provide reference for users and manufacturers.

[0045] In addition, in the embodiments of the present disclosure, in addition to the test results, other data of the NB-IoT device can also be monitored, such as the network traffic used by the NB-IoT device, etc., and the received test results and other data can be clustered and analyzed in combination with a machine learning algorithm to obtain more information about the NB-IoT device, so as to provide a more flexible security testing mechanism.

[0046] In addition, according to the examples of the embodiments of the present disclosure, the test contents of test items such as baseband security testing and Ethernet security testing can also be updated to perform security testing on NB-IoT devices based on the updated test contents. The update operation can be performed locally or in the cloud. For example, when a new type of security risk or security vulnerability appears, a test item for the new type of security risk or security vulnerability can be added locally by updating the security test device that executes the security risk testing method 200; or, the new type of security risk or security vulnerability can be added to the test item in the cloud, and then an update patch can be issued to the security test device, so that the NB-IoT device can be security tested for the new type of security risk or security vulnerability, thereby further improving the security and reliability of the NB-IoT device.

[0047] The following further illustrates steps S210-S240 with reference to specific examples. For example, if the current test item is the DNS resolution security test within the Ethernet security test, first, in step S210, a corresponding control instruction is generated for the DNS resolution security test and sent to the NB-IoT device. Upon receiving the control instruction, the NB-IoT device may perform a DNS query operation, such as sending a DNS query request.

[0048] At this time, on the other hand, in step S220, Ethernet test data can be generated for the DNS resolution security test and sent to the NB-IoT device, wherein the Ethernet test data can include, for example, DNS data used for the test. After receiving the Ethernet test data, the NB-IoT device can parse the test DNS data included therein and generate different operating states based on the resolution results. For example, if the resolution is successful, an operation success response can be issued; if the resolution fails or is abnormal, an operation failure or abnormal response can be issued, and so on. In step S230, by monitoring the different operating states of the NB-IoT device with respect to the Ethernet test data, the test result of the NB-IoT device with respect to the current test item can be determined. For example, the operating state or operating response of the NB-IoT device with respect to the Ethernet test data can be used as the test result of the current test item.

[0049] Next, in step S240, based on the test results of the current DNS resolution security test, the DNS resolution security within the Ethernet security of the NB-IoT device can be determined, that is, whether there is a DNS resolution security risk. For example, if the test DNS data in the Ethernet test data contains security risks such as malformed DNS response packets, and the NB-IoT device triggers a device exception or denial of service when resolving this test DNS data, it indicates that the NB-IoT device has a DNS resolution security risk. Furthermore, the security risk level of the DNS resolution security risk of the NB-IoT device can be determined, and corresponding DNS resolution security risk warnings and security remediation suggestions can be generated to provide reference for users or manufacturers.

[0050] By utilizing the security testing method for NB-IoT devices according to the above-mentioned embodiment of the present disclosure, it is possible to effectively perform security testing on the baseband security and Ethernet security of NB-IoT devices, and support updating and expansion of security test items, thereby providing an efficient and updateable security testing framework for NB-IoT devices, helping to improve the security and reliability of NB-IoT devices in various development and production links, and ensuring the safe application of NB-IoT technology in various IoT smart scenarios.

[0051] Refer to the following Figure 4 A security testing apparatus for NB-IoT devices according to an embodiment of the present disclosure is described. Figure 4 A schematic structural diagram of a security testing device 400 for an NB-IoT device according to an embodiment of the present disclosure is shown.

[0052] like Figure 4As shown, the safety test device 400 may include a control unit 410, a test data generating unit 420, a monitoring unit 430, and a determining unit 440. In addition to these four units, the safety test device 400 may also include other units, but since they are not related to the content of the embodiment of the present invention, the detailed description of these units is omitted here. In addition, since the functions of the safety test device 400 are similar to those of the reference Figure 2 The details of the described security testing method 200 are similar, and repeated descriptions of some of the same contents are omitted here.

[0053] The control unit 410 is configured to generate a control instruction for controlling the operation of the NB-IoT device and send the control instruction to the NB-IoT device. The NB-IoT device can be any NB-IoT device whose security is to be tested, and the embodiments of the present disclosure do not impose specific restrictions on this. The control instruction is used to control the operation of the NB-IoT device, or to enable the NB-IoT device to perform a corresponding function. For example, it can be an AT (Attention) instruction commonly used to control the interaction between terminal devices, or it can be any other suitable instruction form, and the embodiments of the present disclosure do not impose specific restrictions on this.

[0054] Specifically, when generating a control instruction, the control unit 410 should first determine the current test item, that is, the test content to be performed on the NB-IoT device. Using the security testing method 200 according to the embodiment of the present disclosure, the baseband security and Ethernet security of the NB-IoT device can be tested, wherein baseband security refers to the communication security between the chip included in the NB-IoT device and the NB-IoT base station, and Ethernet security testing refers to the Ethernet communication security of the NB-IoT device. Accordingly, the test items for the NB-IoT device may include at least baseband security testing and Ethernet security testing. Baseband security testing may include, for example, master information block (MIB) security testing, system information block (SIB) security testing, and non-access stratum (NAS) protocol security testing, etc. Ethernet security testing may include, for example, transmission control protocol / user datagram protocol (TCP / UDP) resolution security testing, domain name system (DNS) resolution security testing, and lightweight machine-to-machine (LWM2M) interface security testing, etc. However, the embodiment of the present disclosure is not limited to this, and more other security test items may also be set according to actual needs. The specific content of the current test item may be preset, or may be input from an external source or notified in other ways, and the embodiment of the present disclosure does not impose any specific limitation on this.

[0055] After determining the current test item, the control unit 410 can generate control instructions for controlling the NB-IoT device based on the current test item. These control instructions can enable the NB-IoT device to perform specific functions. For example, when the current test item is a baseband security test, the generated control instructions can enable the NB-IoT device to perform operations such as searching for nearby base stations. For another example, when the current test item is a DNS resolution security test or a TCP / UDP resolution security test in an Ethernet security test, the generated control instructions can enable the NB-IoT device to perform operations such as DNS queries or opening TCP / UDP ports. For another example, when the current test item is an LWM2M interface security test in an Ethernet security test, the generated control instructions can enable the NB-IoT device to perform operations such as connecting to an LWM2M server.

[0056] The control instruction can be sent to the NB-IoT device via wired communication or wireless communication, and the embodiments of the present disclosure do not impose specific restrictions on this. According to an example of the embodiment of the present disclosure, when the control instruction is an AT instruction, the AT instruction can be sent to the NB-IoT device via wired communication. For example, the corresponding components of the security test device that performs the security test method 200 can be connected to the NB-IoT device via USB, and then the AT instruction can be sent to the NB-IoT device via the USB connection. After receiving the control instruction, the NB-IoT device performs the corresponding function according to the control instruction, such as searching for nearby base stations, performing DNS queries, etc.

[0057] The test data generation unit 420 is configured to generate baseband test data for baseband security testing and Ethernet test data for Ethernet security testing, and transmit the baseband test data and Ethernet test data to the NB-IoT device. Specifically, for each current test item, the test data generation unit 420 generates corresponding test data based on the test content of the current test item. The number of test data can be one or more, and can be set based on actual testing requirements. This is not specifically limited in the present embodiment.

[0058] According to an example of an embodiment of the present disclosure, when the current test item is a baseband security test, such as an MIB / SIB security test, a NAS protocol security test, etc., the test data generation unit 420 generates baseband test data accordingly and sends it to the NB-IoT device. In this case, for example, the baseband test data can be sent to the NB-IoT device using the NB-IoT base station protocol through the NB-IoT base station connected to the NB-IoT device. Specifically, for example, when a user identity module (SIM) card configured as a programmable card is inserted into the NB-IoT device and the NB-IoT device searches for a nearby NB-IoT base station engine, the NB-IoT base station engine uses the NB-IoT base station protocol to send the baseband test data to the NB-IoT device.

[0059] According to an example embodiment of the present disclosure, when the current test item is an Ethernet security test, such as a TCP / UDP resolution security test, a DNS resolution security test, or a LWM2M interface security test, the test data generation unit 420 generates Ethernet test data accordingly and sends it to the NB-IoT device. According to an example embodiment of the present disclosure, when the current test item is a TCP / UDP resolution security test or a DNS resolution security test, the Ethernet test data can be sent to the NB-IoT device using the same wireless network protocol as the NB-IoT device. Specifically, for example, the Ethernet test data can be sent to the NB-IoT device via a terminal engine configured with a SIM card from the same carrier as the NB-IoT device. According to another example embodiment of the present disclosure, when the current test item is an LWM2M interface security test, the Ethernet test data can be sent to the NB-IoT device via a server connected to the NB-IoT device. Since LWM2M is a universal basic protocol for NB-IoT devices to connect to IoT cloud platforms, in this case, for example, the Ethernet test data can be sent to the NB-IoT device via a server engine located in the cloud to test the security of the NB-IoT device with respect to the LWM2M interface protocol.

[0060] The monitoring unit 430 is configured to monitor the operating status of the NB-IoT device with respect to baseband test data and Ethernet test data, and determine the test results for the NB-IoT device. For example, when performing a baseband security test, the monitoring unit 430 can monitor whether the NB-IoT device can correctly send and receive the baseband test data. When performing an Ethernet security test, the monitoring unit 430 can monitor whether the NB-IoT device can correctly parse test data such as TCP / UDP data and DNS data in the Ethernet test data, and so on. The monitoring unit 430 can also obtain the operating status or operational response of the NB-IoT device with respect to the baseband test data and Ethernet test data as the test results for the NB-IoT device.

[0061] The determination unit 440 is configured to determine the baseband security and Ethernet security of the NB-IoT device based on the test results of the NB-IoT device. According to an example embodiment of the present disclosure, the determination unit 440 can determine the baseband security and Ethernet security of the NB-IoT device by sending the test results to a local processor and / or a cloud processor for analyzing and processing the test results.

[0062] Specifically, the determination unit 440 can compare the test results with the preset security rules through the local processor and / or the cloud processor, and when the test results match the preset security rules, determine that the NB-IoT device has a baseband security risk or an Ethernet security risk. The preset security rules may include, for example, some preset security risk features, which, for example, represent possible abnormal operation responses of the NB-IoT device to baseband test data or Ethernet test data. The above-mentioned analysis and processing process can be performed on the local processor, or on the cloud processor, or on both the local processor and the cloud processor. For example, after the local processor performs preliminary analysis and processing on the test data, the cloud processor can use the security risk feature database stored in the cloud to further analyze and process the test data to obtain a more refined security risk analysis result.

[0063] In addition, when the analysis determines that there is a baseband security risk or Ethernet security risk in the NB-IoT device, the determination unit 440 can also determine the security risk level of the baseband security risk or the Ethernet security risk, such as different security risk levels divided according to the severity of the security risk, and further generate corresponding security risk prompts and security repair suggestions for different security risks according to the determined security risk levels, so as to facilitate users or manufacturers to improve the security issues of NB-IoT devices.

[0064] In addition, in the embodiment of the present disclosure, in addition to the test results, the monitoring unit 430 can also monitor other data of the NB-IoT device, such as the network traffic used by the NB-IoT device, etc., and the determination unit 440 can combine the machine learning algorithm to perform cluster analysis on the received test results and other data to obtain more information about the NB-IoT device, so as to provide a more flexible security testing mechanism.

[0065] In addition, according to the examples of the embodiments of the present disclosure, the test content of the baseband security test and the Ethernet security test can also be updated to perform security testing on the NB-IoT device based on the updated test content. The update operation can be performed locally or in the cloud. For example, when a new type of security risk or security vulnerability appears, the security test device 400 can be updated locally to add test items for the new type of security risk or security vulnerability; or the new type of security risk or security vulnerability can be added to the test items in the cloud, and then an update patch can be sent to the security test device 400, so that the NB-IoT device can be security tested for the new type of security risk or security vulnerability, thereby further improving the security and reliability of the NB-IoT device.

[0066] The following is a further description of the security testing device for NB-IoT devices according to an embodiment of the present disclosure with reference to specific examples. Figure 5 A system architecture diagram of a security testing apparatus 500 for NB-IoT devices according to an example of an embodiment of the present disclosure is shown.

[0067] like Figure 5 As shown, in this example, the security testing device 500 may include two parts: a terminal testing end 510 and a cloud analysis end 520. The terminal testing end may include an automatic execution module 511 and a test data module 512, and the cloud analysis end 520 may include an analysis and processing module 521 and a risk display module 522.

[0068] The automatic execution module 511 may correspond to the above reference Figure 3 The control unit 310 and the monitoring unit 330 described above can be implemented using a computer or a mobile device, or can be included in a computer or a mobile device. Figure 6 , Figure 6 FIG. 5 shows a security test process of a security test apparatus 500 for NB-IoT devices according to an example of an embodiment of the present disclosure. Figure 6As shown, in step S610, the automatic execution module 511 may first be initialized, for example, by performing preparatory operations such as starting and setting parameters. Subsequently, in step S620, based on the current test item, the automatic execution module 511 may generate an AT command and send it to the NB-IoT device 530 under test, causing the NB-IoT device 530 to perform the corresponding operation. For example, if the current test item is a baseband security test, the automatic execution module 511 may send an AT command to cause the NB-IoT device 530 to search for nearby base stations. For another example, if the current test item is a DNS resolution security test or a TCP / UDP resolution security test within an Ethernet security test, the automatic execution module 511 may send an AT command to cause the NB-IoT device 530 to perform a DNS query or open a TCP / UDP port. For another example, if the current test item is a LWM2M interface security test within an Ethernet security test, the automatic execution module 511 may send an AT command to cause the NB-IoT device 530 to connect to the LWM2M server.

[0069] The test data module 512 may correspond to the test data module 512 described above. Figure 3 The test data generating unit 320 described above may include a data generating engine 5121 and a terminal engine 5122 and / or a server engine 5123. Figure 6 As shown, in step S630, the data generation engine 5121 can generate baseband test data for baseband security testing and Ethernet test data for Ethernet security testing based on different test items. For example, if the current test item is a baseband security test, the data generation engine 5121 can generate the baseband test data and, using the terminal engine 5122, send the baseband test data to the NB-IoT device 530 via the NB-IoT base station and a SIM card programmed for the NB-IoT base station protocol. If the current test item is an Ethernet security test, the data generation engine 5121 can generate Ethernet test data and, using the terminal engine 5122, send the Ethernet test data to the NB-IoT device 530 using the same wireless network protocol as the NB-IoT device 530, such as using the same SIM card as the NB-IoT device 530. Alternatively, the Ethernet test data can be sent to the NB-IoT device 530 via the server engine 5123 connected to the NB-IoT device 530.

[0070] Before sending the current test data to the NB-IoT device 530, the terminal engine 5122 and / or the server engine 5123 may send the serial number of the current test data to the automatic execution module 511 so that the automatic execution module 511 is associated with the current test data and subsequent test results. Figure 6As shown, in step S640, based on the serial number of the current test data, the automatic execution module 511 can monitor the operation status or response status of the NB-IoT device 530 to the current test data as a test result, and can perform a preliminary analysis on the test result, for example, comparing the test result with the preset security rules to determine whether the NB-IoT device 530 has a baseband security risk or an Ethernet security risk for the current test item. At this time, the automatic execution module 511 can further correspond to or include the above reference Figure 3 Determination unit 340 of the description.

[0071] For each test item, the test data module 512 can generate one or more test data. After completing the security test for each test data, the automatic execution module 511 can feed back the test results of the current test data to the test data module 512 and notify the test data module 512 to start sending the next test data.

[0072] In addition, the terminal test end 510 may further include a feedback reporting module 513. After each test item is completed, the automatic execution module 511 may send the test result to the feedback reporting module 513, and may further report the test result to the cloud analysis end 520 through the feedback reporting module 513. Figure 6 The analysis and processing module 521 of the cloud analysis terminal 520 can further analyze and process the test results to determine whether the NB-IoT device 530 has a baseband security risk or an Ethernet security risk for the current test item, and determine the corresponding security risk level, such as Figure 6 At this time, the analysis and processing module 521 may correspond to the above reference Figure 3 The risk display module 522 of the cloud analysis terminal 520 can provide security risk prompts and security repair suggestions based on the determined security risk items and corresponding security risk levels, such as Figure 6 As shown in S670.

[0073] In addition, in the embodiment of the present disclosure, in addition to the test results, the analysis and processing module 521 can also receive other data of the NB-IoT device 530 monitored by the automatic execution module 511 from the feedback reporting module 513, such as the network traffic used by the NB-IoT device 530, etc., and can combine the machine learning algorithm to perform cluster analysis on the received test results and other data to obtain more information about the NB-IoT device 530, so as to provide a more flexible security testing mechanism.

[0074] Furthermore, the analysis and processing module 521 of the cloud analysis terminal 520 can quickly update and expand the test content of test items such as baseband security testing and Ethernet security testing, so that security testing can be performed on the NB-IoT device 530 based on the updated test content. Specifically, once a new type of security risk or security vulnerability emerges, the analysis and processing module 521 can quickly add it to the test items and issue the corresponding update patch to the terminal test terminal 510, allowing the terminal test terminal 510 to perform security testing on the NB-IoT device 530 based on the new type of security risk or security vulnerability, further improving the security and reliability of the NB-IoT device 530.

[0075] By utilizing the security testing device for NB-IoT devices according to the above-mentioned embodiment of the present disclosure, it is possible to effectively perform security testing on the baseband security and Ethernet security of NB-IoT devices, and support updating and expansion of security test items, thereby providing an efficient and updateable security testing framework for NB-IoT devices, helping to improve the security and reliability of NB-IoT devices in various development and production links, and ensuring the safe application of NB-IoT technology in various IoT smart scenarios.

[0076] In addition, the device according to the embodiment of the present disclosure (for example, a security test device for NB-IoT devices, etc.) can also be used with the help of Figure 7 The exemplary computing device architecture shown is implemented. Figure 7 Schematic diagram showing the architecture of an exemplary computing device according to an embodiment of the present disclosure. Figure 7 As shown, the computing device 700 may include a bus 710, one or more CPUs 720, a read-only memory (ROM) 730, a random access memory (RAM) 740, a communication port 750 connected to a network, an input / output component 760, a hard disk 770, etc. The storage device in the computing device 700, such as the ROM 730 or the hard disk 770, may store various data or files used for computer processing and / or communication and program instructions executed by the CPU. The computing device 700 may also include a user interface 780. Of course, Figure 7 The architecture shown is only exemplary and can be omitted according to actual needs when implementing different devices. Figure 7 One or more components in the computing device shown. The device according to an embodiment of the present disclosure can be configured to perform the security testing method for NB-IoT devices according to the above-mentioned various embodiments of the present disclosure, or to implement the security testing apparatus for NB-IoT devices according to the above-mentioned various embodiments of the present disclosure.

[0077] The embodiments of the present disclosure may also be implemented as a computer-readable storage medium. Computer-readable instructions are stored on a computer-readable storage medium according to an embodiment of the present disclosure. When the computer-readable instructions are executed by a processor, the security testing method for NB-IoT devices according to the embodiment of the present disclosure described with reference to the above figures may be executed. The computer-readable storage medium includes, but is not limited to, for example, volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache memory (cache), etc. Non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc.

[0078] According to an embodiment of the present disclosure, a computer program product or computer program is also provided. The computer program product or computer program includes computer-readable instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer-readable instructions from the computer-readable storage medium and execute the computer-readable instructions, causing the computer device to perform the security testing method for an NB-IoT device described in each of the above embodiments.

[0079] Those skilled in the art will appreciate that the contents disclosed in this disclosure may be subject to various modifications and improvements. For example, the various devices or components described above may be implemented through hardware, software, firmware, or a combination of some or all of the three.

[0080] In addition, as shown in this disclosure and the claims, unless the context clearly indicates an exception, the words "a", "an", "an" and / or "the" do not specifically refer to the singular, but also include the plural. The words "first", "second" and similar words used in this disclosure do not indicate any order, quantity or importance, but are only used to distinguish different components. Similarly, words such as "include" or "comprise" mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects. Words such as "connect" or "connected" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect.

[0081] In addition, flowcharts are used in this disclosure to illustrate the operations performed by the system according to the embodiments of the present disclosure. It should be understood that the preceding or following operations do not necessarily need to be performed in exact order. Instead, various steps can be processed in reverse order or simultaneously. Furthermore, other operations can be added to these processes, or one or more operations can be removed from these processes.

[0082] Unless otherwise defined, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs. It should also be understood that terms such as those defined in common dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and should not be interpreted in an idealized or highly formal sense, unless explicitly defined as such herein.

[0083] While the present disclosure has been described in detail above, it will be apparent to those skilled in the art that the present disclosure is not limited to the embodiments described herein. The present disclosure may be implemented in various modifications and variations without departing from the spirit and scope of the present disclosure as defined by the claims. Therefore, the descriptions in this specification are for illustrative purposes only and are not intended to be limiting of the present disclosure.

Claims

1. A security testing method for a narrowband Internet of Things device, comprising: generating a control instruction for controlling the operation of a narrowband Internet of Things device, and sending the control instruction to the narrowband Internet of Things device, wherein the control instruction is used to instruct the narrowband Internet of Things device to perform a baseband security test and an Ethernet security test, and baseband security refers to the communication security between a chip included in the narrowband Internet of Things device and a narrowband Internet of Things base station; Generate baseband test data for baseband security testing and Ethernet test data for Ethernet security testing, and send the baseband test data and the Ethernet test data to the narrowband Internet of Things device; monitoring an operating status of the NB-IoT device with respect to the baseband test data and the Ethernet test data, and determining a test result for the NB-IoT device; and Determine the baseband security and Ethernet security of the narrowband IoT device based on the test results, In which, when the current test item includes a baseband security test, the narrowband Internet of Things device is inserted into a programmable user identification module card, and the control instruction causes the narrowband Internet of Things device to search for nearby base stations. When the narrowband Internet of Things device searches for nearby base stations, the baseband test data is sent to the narrowband Internet of Things device through the narrowband Internet of Things base station connected to the narrowband Internet of Things device using the narrowband Internet of Things base station protocol.

2. The safety testing method according to claim 1, wherein: Generating a control instruction for controlling an operation of a narrowband Internet of Things device and sending the control instruction to the narrowband Internet of Things device includes: determining the current test item, wherein the current test item includes at least one of the baseband security test and the Ethernet security test; and The control instruction for controlling the operation of the narrowband Internet of Things device is generated based on the current test item, and the control instruction is sent to the narrowband Internet of Things device.

3. The safety testing method according to claim 1, wherein: Generating baseband test data for baseband security testing includes: The baseband test data is generated according to the test content of the baseband security test.

4. The safety testing method according to claim 1, wherein: Generating Ethernet test data for Ethernet security testing and sending the Ethernet test data to the narrowband Internet of Things device includes: Generating the Ethernet security test data according to the test content of the Ethernet security test; and The Ethernet test data is sent to the narrowband Internet of Things device by adopting the same wireless network protocol as the narrowband Internet of Things device.

5. The safety testing method according to claim 1, wherein: Generating Ethernet test data for Ethernet security testing and sending the Ethernet test data to the narrowband Internet of Things device includes: Generating the Ethernet security test data according to the test content of the Ethernet security test; and The Ethernet test data is sent to the narrowband Internet of Things device through a server connected to the narrowband Internet of Things device.

6. The safety testing method according to claim 1, wherein: Determining, based on the test results, the baseband security and Ethernet security of the narrowband IoT device includes: The test results are sent to a local processor and / or a cloud processor to analyze and process the test results to determine the baseband security and Ethernet security of the narrowband Internet of Things device.

7. The safety testing method according to claim 6, wherein: Analyzing and processing the test results to determine the baseband security and Ethernet security of the narrowband Internet of Things device includes: The test result is compared with a preset security rule, and when the test result matches the preset security rule, it is determined that the narrowband Internet of Things device has a baseband security risk or an Ethernet security risk.

8. The safety testing method according to claim 6, wherein: Analyzing and processing the test results to determine the baseband security and Ethernet security of the narrowband Internet of Things device also includes: When the narrowband Internet of Things device has a baseband security risk or an Ethernet security risk, determining a security risk level of the baseband security risk or the Ethernet security risk; and Based on the security risk level, generate security risk warnings and security repair suggestions.

9. The security testing method according to claim 1, further comprising: The test content of the baseband security test or the Ethernet security test is updated to generate baseband test data or Ethernet security test for performing a security test on the narrowband Internet of Things device based on the updated test content.

10. The safety testing method according to claim 1, wherein: The baseband security test includes at least one of a master information block (MIB) security test, a system information block (SIB) security test, and a non-access stratum (NAS) protocol security test, and the Ethernet security test includes at least one of a transmission control protocol / user datagram protocol (TCP / UDP) resolution security test, a domain name system (DNS) resolution security test, and a lightweight machine-to-machine (LWM2M) interface security test.

11. A security testing device for a narrowband Internet of Things device, the device comprising: a control unit configured to generate a control instruction for controlling the operation of a narrowband Internet of Things device and send the control instruction to the narrowband Internet of Things device, wherein the control instruction is used to instruct the narrowband Internet of Things device to perform a baseband security test and an Ethernet security test, and baseband security refers to communication security between a chip included in the narrowband Internet of Things device and a narrowband Internet of Things base station; a test data generating unit, configured to generate baseband test data for a baseband security test and Ethernet test data for an Ethernet security test, and send the baseband test data and the Ethernet test data to the narrowband Internet of Things device; a monitoring unit configured to monitor an operating status of the NB-IoT device with respect to the baseband test data and the Ethernet test data, and determine a test result for the NB-IoT device; and a determining unit configured to determine the baseband security and Ethernet security of the narrowband Internet of Things device based on the test result, In which, when the current test item includes a baseband security test, the narrowband Internet of Things device is inserted into a programmable user identification module card, the control instruction causes the narrowband Internet of Things device to search for nearby base stations, and the test data generation unit is configured to send the baseband test data to the narrowband Internet of Things device through the narrowband Internet of Things base station connected to the narrowband Internet of Things device using the narrowband Internet of Things base station protocol when the narrowband Internet of Things device searches for nearby base stations.

12. The safety testing device according to claim 11, wherein: The control unit is configured to: Determining the current test items, where the current test items include the baseband security test and the Ethernet security test; as well as The control instruction for controlling the operation of the narrowband Internet of Things device is generated based on the current test item, and the control instruction is sent to the narrowband Internet of Things device.

13. A security testing device for a narrowband Internet of Things device, comprising: one or more processors; as well as One or more memories, wherein computer-readable instructions are stored in the memories, and when the computer-readable instructions are executed by the one or more processors, the one or more processors are caused to perform the method according to any one of claims 1 to 10.

14. A computer-readable storage medium having computer-readable instructions stored thereon, wherein when the computer-readable instructions are executed by a processor, the processor is caused to perform the method according to any one of claims 1 to 10.

15. A computer program product comprising computer-readable instructions, which, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 10.

Images