Network security protection method and device based on internet of things communication protocol

Abstract

The application provides a network security protection method and device based on an Internet of Things communication protocol.The method comprises steps 1 to 5.The application establishes two TCP channels between an MQTT client and an MQTT server, processes security data and normal data respectively, uses TLS for encrypted transmission, and introduces a Token management function.The platform checks a Token carried by a device, the designed Internet of Things communication protocol can identify whether the requested connection is safe at the protocol control layer, the cracking difficulty of an attacker is increased, and the network security protection level is improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of network security technology, and in particular to a network security protection method and device based on an Internet of Things (IoT) communication protocol. Background Technology

[0002] In recent years, with the increasing maturity of IoT technology, it has been widely applied in agriculture, energy, transportation, healthcare, home, and military fields, driving economic and social development. However, due to the wide spatial distribution of IoT terminal devices, complex deployment environments, and limited device resources, it suffers from incomplete security measures, weak protection capabilities, and insufficient protection. It is generally believed that IoT faces more serious security threats than traditional networks. Network information security in the IoT platform environment relies on encryption and digital signature technologies to achieve secure data transmission. Data encryption and decryption consume significant computing resources, especially for terminal devices that need to transmit large amounts of data. The platform and terminal devices waste considerable computing power to solve security problems, greatly increasing hardware costs. Therefore, developing a network security protection method and device based on IoT communication protocols to effectively overcome the shortcomings of the aforementioned related technologies has become a pressing technical problem for the industry. Summary of the Invention

[0003] To address the aforementioned problems in existing technologies, embodiments of the present invention provide a network security protection method and device based on an Internet of Things (IoT) communication protocol.

[0004] In a first aspect, embodiments of the present invention provide a network security protection method based on an Internet of Things (IoT) communication protocol, comprising: step 1, the client initiates identity authentication with the server based on a secure channel; step 2, the client establishes a connection with the server based on a secure channel and performs data interaction; step 3, the client requests a token from the server based on a secure channel; step 4, the client disconnects from the server based on a secure channel; and step 5, the client establishes a connection with the server based on a normal channel and performs data interaction.

[0005] Based on the above method embodiments, the network security protection method based on the Internet of Things communication protocol provided in this embodiment of the invention includes the following steps in step 2: Step 2.1: The client requests a connection to the server; Step 2.2: The server returns connection feedback information; Step 2.3: The client sends a PING message to the server; Step 2.4: The server returns PING feedback information; Step 2.5: The client sends a message to the server; Step 2.6: The server confirms the message, and sets the flag bit containing the control message type in all messages to a first preset value (specifically, it can be 0) to distinguish whether it is a secure channel.

[0006] Based on the above method embodiments, the network security protection method based on the Internet of Things communication protocol provided in this embodiment of the invention includes the following steps in step 3: Step 3.1: The client requests a Token from the server through a secure channel; Step 3.2: The server responds through the secure channel and returns the Token to the client; Step 3.3: After obtaining the Token, the client stores the Token in memory.

[0007] Based on the above method embodiments, the network security protection method based on the Internet of Things communication protocol provided in this embodiment of the invention includes the following steps in step 5: Step 5.1: The client obtains a token from its local memory; Step 5.2: The client and the server establish a normal connection channel; Step 5.3: The server returns connection feedback information; Step 5.4: The client sends a PING message to the server; Step 5.5: The server returns PING feedback information; Step 5.6: The client sends a message to the server; Step 5.7: The server confirms the message; Step 5.8: The connection is disconnected, and the flag bit containing the control message type in all messages is set to a second preset value (specifically, it can be 1) to distinguish whether it is a normal channel.

[0008] Based on the above method embodiments, the network security protection method based on the Internet of Things communication protocol provided in this embodiment of the invention further includes step 2.1: adding a control message with a value of 0 to the MQTT protocol for requesting CONNECTREQ; the CONNECTREQ control message includes a fixed header, a variable header, and a payload.

[0009] Based on the above method embodiments, the network security protection method based on the Internet of Things communication protocol provided in this embodiment of the invention further includes, in step 3.1: adding a control message with a value of 15 to the MQTT protocol for requesting TOKENREQ; the TOKENREQ control message includes a fixed header.

[0010] Based on the above method embodiments, the network security protection method based on the Internet of Things communication protocol provided in this embodiment of the invention further includes, in step 3.2: adding a control message with a value of 15 to the MQTT protocol for responding to TOKENRSP; the TOKENRSP control message includes a fixed header and a variable header.

[0011] Secondly, embodiments of the present invention provide a network security protection device based on an Internet of Things (IoT) communication protocol, comprising: a first main module for implementing step 1, whereby the client initiates identity authentication with the server based on a secure channel; a second main module for implementing step 2, whereby the client establishes a connection with the server based on a secure channel and performs data interaction; a third main module for implementing step 3, whereby the client requests a token from the server based on a secure channel; a fourth main module for implementing step 4, whereby the client obtains the token and stores it in memory; and a fifth main module for implementing step 5, whereby the client establishes a connection with the server based on a normal channel and performs data interaction.

[0012] Thirdly, embodiments of the present invention provide an electronic device, comprising:

[0013] At least one processor; and

[0014] At least one memory communicatively connected to the processor, wherein:

[0015] The memory stores program instructions that can be executed by the processor. The processor can call the program instructions to execute the network security protection method based on the Internet of Things communication protocol provided by any of the various implementations of the first aspect.

[0016] Fourthly, embodiments of the present invention provide a non-transitory computer-readable storage medium storing computer instructions that cause a computer to execute a network security protection method based on an Internet of Things communication protocol provided by any of the various implementations of the first aspect.

[0017] The network security protection method and device based on the Internet of Things (IoT) communication protocol provided in this invention establishes two TCP channels between the MQTT client and the MQTT server to process secure data and ordinary data respectively, uses TLS for encrypted transmission, and introduces a token management function. The platform verifies the token carried by the device. The designed IoT communication protocol can identify whether the requested connection is secure at the protocol control layer, which increases the difficulty for attackers to crack and improves the level of network security protection. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1A flowchart illustrating a network security protection method based on an Internet of Things (IoT) communication protocol, as provided in an embodiment of the present invention.

[0020] Figure 2 A schematic diagram of a network security protection device based on an Internet of Things (IoT) communication protocol provided in an embodiment of the present invention;

[0021] Figure 3 A schematic diagram of the physical structure of an electronic device provided in an embodiment of the present invention;

[0022] Figure 4 This is a schematic diagram of the TLS handshake process provided in an embodiment of the present invention;

[0023] Figure 5 An interactive diagram of request and response provided for the implementation of this invention. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. In addition, the technical features of the various embodiments or individual embodiments provided by the present invention can be arbitrarily combined with each other to form feasible technical solutions. Such combinations are not constrained by the order of steps and / or structural composition patterns, but must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.

[0025] This invention provides a network security protection method based on an Internet of Things (IoT) communication protocol. (See also...) Figure 1 The method includes: Step 1, the client initiates identity authentication with the server based on a secure channel; Step 2, the client establishes a connection with the server based on a secure channel and performs data interaction; Step 3, the client requests a token from the server based on a secure channel; Step 4, the client disconnects based on a secure channel; Step 5, the client establishes a connection with the server based on a normal channel and performs data interaction. Step 1 can be found in [link to details]. Figure 4 .

[0026] The functional attributes of this invention are characterized by the following: Feature 1: First, the client interacts with the server via a secure channel, authenticating the connection. Because it's a secure channel, the entire MQTT communication needs to be encrypted; this invention uses TLS for encryption and employs username and password fields for authentication and authorization. Feature 2: Based on Feature 1, the client requests permissions from the server via the secure channel. The server verifies the client's permissions; if successful, the server generates a token and persists the returned token locally, mapping the client's permissions and token information, and finally returns the token to the client. Feature 3: Based on Feature 1, the client transmits high-security data to the server via the secure channel. Upon receiving the secure data, the server processes it directly. Feature 4: Based on Feature 2, the client uses the token returned by the server as a parameter to transmit low-security data to the server via a normal connection channel. The server verifies the token; if successful, it processes the data transmitted by the client.

[0027] Based on the above method embodiments, as an optional embodiment, the network security protection method based on the Internet of Things communication protocol provided in this embodiment of the invention specifically includes the following steps in step 2: Step 2.1, the client requests a connection to the server; Step 2.2, the server returns connection feedback information; Step 2.3, the client sends a PING message to the server; Step 2.4, the server returns PING feedback information; Step 2.5, the client sends a message to the server; Step 2.6, the server confirms the message.

[0028] Specifically, step 2.1: The client initiates a secure connection request to the server based on a secure channel.

[0029] The MQTT protocol adds a control message with a value of 0 (i.e., bits 7-4 in Byte 1 of Table 1) to request a CONNECTREQ. This CONNECTREQ control message includes a fixed header, a variable header, and a payload.

[0030] In addition to TOKENREQ and TOKENRSP mentioned in this article, one bit from Bit0 to Bit4 of other messages must be used to represent either security or normal, but the specific order is not limited, as long as it is agreed upon and does not affect the implementation. Bit0 is used as an example below.

[0031] The CONNECTREQ control message uses a fixed header flag of 0 to identify whether a secure or normal channel is being created (0 for secure, 1 for normal). Flags 1, 2, and 3 are reserved fields, as shown in Table 1. The variable header, payload protocol, and the protocol with a value of 1 in the standard MQTT protocol used for client connection requests to the server are consistent.

[0032] The format definition specifications for the variable header and payload are the same as those for the standard MQTT control message type CONNECT.

[0033] Table 1: Fixed headers for the CONNECTREQ control request message

[0034]

[0035]

[0036] Step 2.2: The server returns connection confirmation information through a secure channel.

[0037] To distinguish between secure and normal connection channels, in this embodiment, the control message type flag bit in the fixed header of the CONNACK control message of the MQTT protocol indicates whether the connection confirmation is for a secure channel or a normal channel (0 for secure channel, 1 for normal channel). See Table 2 for details.

[0038] Table 2: Fixed header of CONNACK control message

[0039]

[0040] Step 2.3: The client sends a PINGREQ message to the server through a secure channel.

[0041] To distinguish between secure and normal connection channels, in this embodiment, the PINGREQ control message header of the MQTT protocol has a fixed control message type flag bit 0 indicating whether the connection keep-alive request is for a secure or normal channel; 0 indicates a secure channel, and 1 indicates a normal channel. See Table 3 for details.

[0042] Table 3: Fixed headers for PINGREQ control messages

[0043]

[0044] Step 2.4: The server returns the PING feedback information PINGRESP through a secure channel.

[0045] To distinguish between secure and normal connection channels, in this embodiment, the PINGRESP control message header of the MQTT protocol has a fixed control message type flag bit 0 indicating whether the connection keep-alive request is for a secure or normal channel; 0 indicates a secure channel, and 1 indicates a normal channel. See Table 4 for details.

[0046] Table 4: PINGRESP Control Message Fixed Header

[0047]

[0048]

[0049] Step 2.5: The client sends a message to the server via a secure channel.

[0050] To distinguish between secure and normal connection channels, in this embodiment, the PUBLISH control message header of the MQTT protocol has a fixed control message type flag bit 0 indicating whether the connection keep-alive request is for a secure or normal channel; 0 indicates a secure channel, and 1 indicates a normal channel. See Table 5 for details.

[0051] Table 5: PUBLISH Control Message Fixed Headers

[0052]

[0053] Step 2.6: The server confirms the message through a secure channel.

[0054] To distinguish between secure and normal connection channels, in this embodiment, the control message type flag bit 0 in the fixed header of the MQTT protocol's PUBACK control message indicates whether the connection keep-alive request is for a secure or normal channel; 0 indicates a secure channel, and 1 indicates a normal channel. See Table 6 for details.

[0055] Table 6: Fixed headers for PUBACK control messages

[0056]

[0057] Based on the above method embodiments, as an optional embodiment, the network security protection method based on the Internet of Things communication protocol provided in this embodiment of the invention specifically includes the following steps in step 3: Step 3.1: The client requests a Token from the server based on a secure channel; Step 3.2: The server responds based on the secure channel and returns the Token to the client; Step 3.3: After obtaining the Token, the client stores the Token in memory.

[0058] Specifically, step 3.1: The client requests a token from the server through a secure channel.

[0059] The MQTT protocol adds a control message with a value of 15 to request a TOKENREQ. This TOKENREQ control message includes a fixed header.

[0060] Bit0 to Bit4 contain 4 bits to represent request / destroy; read / write; request / response; security / normal, but the specific order is not limited, as long as it is agreed upon and does not affect the implementation. Table 7 is an example.

[0061] The fixed header of the TOKENREQ control message is shown in Table 7. Flag 0 of the control message type indicates whether a secure channel or a normal channel is being created (0 for secure channel, 1 for normal channel). Flags 1, 2, and 3 are reserved fields. Flag 1 of the control message type indicates whether it is a request or response message (0 for request token, 1 for response token). Flag 2 of the control message type indicates the permissions of the requested token (0 for read permission, 1 for write permission). Flag 3 of the control message type indicates the operation type of the requested token (0 for requesting token, 1 for destroying token). When flag 1 of the control message type indicates a response message, flags 2 and 3 are reserved fields.

[0062] TOKENREQ does not have variable messages or payloads.

[0063] Table 7: Fixed headers for TOKENREQ / TOKENRSP control messages

[0064]

[0065] Step 3.2: The server responds through a secure channel and returns a token to the client.

[0066] In the TOKENRSP response control message of this embodiment, the control message type flag bit 15 of the fixed header, the value of control message type flag bit 1 is response 1, and control message type flag bits 2 and 3 are both reserved fields, as shown in Table 7. The message identifier of the variable header is the returned TOKEN value, as shown in Table 8.

[0067] Table 8: Variable headers for control messages responding to TOKENRSP

[0068] Bit meaning Byte1 TOKEN identifier high byte Byte2 TOKEN identifier low byte

[0069] Step 3.3: After the client obtains the Token, it stores the Token in memory.

[0070] After the client obtains the token returned by the server, it stores the token information in local memory for management.

[0071] Based on the above method embodiments, as an optional embodiment, the present invention provides a network security protection method based on the Internet of Things communication protocol.

[0072] Step 4: The client disconnects via a secure channel.

[0073] To distinguish between secure and normal connection channels, in this embodiment, the DISCONNECT control message header of the MQTT protocol has a fixed control message type flag bit 0 indicating whether the connection keep-alive request is for a secure or normal channel; 0 indicates a secure channel, and 1 indicates a normal channel. See Table 9 for details.

[0074] Table 9: Fixed headers for DISCONNECT control messages

[0075]

[0076] Based on the above method embodiments, as an optional embodiment, the network security protection method based on the Internet of Things communication protocol provided in this embodiment of the invention specifically includes the following steps in step 5: Step 5.1: The client obtains a token from its local memory; Step 5.2: The client and the server establish a normal connection channel; Step 5.3: The server returns connection feedback information; Step 5.4: The client sends a PING message to the server; Step 5.5: The server returns PING feedback information; Step 5.6: The client sends a message to the server; Step 5.7: The server confirms the message; Step 5.8: The connection is disconnected.

[0077] Based on the above method embodiments, as an optional embodiment, the network security protection method based on the Internet of Things communication protocol provided in this embodiment of the invention specifically includes step 5.3 as follows: in the fixed header of the CONNACK control message of the MQTT protocol, the control message type flag bit confirms whether the connection is a secure channel or a normal channel, with 0 for the first secure channel and 1 for the first normal channel.

[0078] Based on the above method embodiments, as an optional embodiment, the network security protection method based on the Internet of Things communication protocol provided in this embodiment of the invention specifically includes step 5.5: in the fixed header of the PINGRESP control message of the MQTT protocol, the control message type flag bit of the connection confirmation keep-alive request is a secure channel or a normal channel, 0 for the second secure channel and 1 for the second normal channel.

[0079] Specifically, step 5: The client establishes a connection with the server based on a normal channel and performs data interaction.

[0080] Step 5.1: The client retrieves the token from local memory.

[0081] Step 5.2: The client initiates a request for a normal connection channel to the server.

[0082] Upon receiving the response TOKENRSP, the client caches the TOKEN in the cache pool, uses a value of 0 for the control message requesting CONNECTREQ, and creates a normal channel using a fixed header flag value of 1. In this example, the Variable header in the CONNECTREQ request control message adds the TOKEN identifier to the standard MQTT protocol name, protocol level, connection flags, and keep-alive flags, as shown in Table 10.

[0083] Table 10: Variable headers for the CONNECTREQ control request message

[0084]

[0085] Step 5.3: The server returns connection confirmation information for the normal channel.

[0086] To distinguish between secure and normal connection channels, in this embodiment, the control message type flag bit in the fixed header of the CONNACK control message of the MQTT protocol indicates whether the connection confirmation is for a secure channel or a normal channel (0 for secure channel, 1 for normal channel). See Table 2 for details.

[0087] Step 5.4: The client sends a PINGREQ request message to the server through the normal channel.

[0088] To distinguish between secure and normal connection channels, in this embodiment, the PINGREQ control message header of the MQTT protocol has a fixed control message type flag bit 0 indicating whether the connection keep-alive request is for a secure or normal channel; 0 indicates a secure channel, and 1 indicates a normal channel. See Table 3 for details.

[0089] Step 5.5: The server returns PINGRESP's feedback information through the normal channel.

[0090] To distinguish between secure and normal connection channels, in this embodiment, the PINGRESP control message header of the MQTT protocol has a fixed control message type flag bit 0 indicating whether the connection keep-alive request is for a secure or normal channel; 0 indicates a secure channel, and 1 indicates a normal channel. See Table 4 for details.

[0091] Step 5.6: The client sends a message to the server through a normal channel.

[0092] To distinguish between secure and normal connection channels, in this embodiment, the PUBLISH control message header of the MQTT protocol has a fixed control message type flag bit 0 indicating whether the connection keep-alive request is for a secure or normal channel; 0 indicates a secure channel, and 1 indicates a normal channel. See Table 5 for details.

[0093] Step 5.7: The server confirms the message through a normal channel.

[0094] To distinguish between secure and normal connection channels, in this embodiment, the control message type flag bit 0 in the fixed header of the MQTT protocol's PUBACK control message indicates whether the connection keep-alive request is for a secure or normal channel; 0 indicates a secure channel, and 1 indicates a normal channel. See Table 6 for details.

[0095] Step 5.8: The client disconnects via the normal channel.

[0096] To distinguish between secure and normal connection channels, in this embodiment, the DISCONNECT control message header of the MQTT protocol has a fixed control message type flag bit 0 indicating whether the connection keep-alive request is for a secure or normal channel; 0 indicates a secure channel, and 1 indicates a normal channel. See Table 7 for details.

[0097] Based on the above method embodiments, as an optional embodiment, the network security protection method based on the Internet of Things communication protocol provided in this embodiment of the invention specifically includes step 2.1: requesting the fixed header flag bit of the CONNECTREQ control message to confirm whether the created channel is a secure channel or a normal channel, where 0 is the third secure channel and 1 is the third normal channel.

[0098] Based on the above method embodiments, as an optional embodiment, the network security protection method based on the Internet of Things communication protocol provided in this embodiment of the invention further includes step 2: adding a control message with a value of 0 to the MQTT protocol for requesting CONNECTREQ; the CONNECTREQ control message includes a fixed header, a variable header, and a payload.

[0099] The network security protection method based on the Internet of Things (IoT) communication protocol provided in this invention establishes two TCP channels between the MQTT client and the MQTT server to process secure data and ordinary data respectively, uses TLS for encrypted transmission, and introduces a token management function. The platform verifies the token carried by the device. The designed IoT communication protocol can identify whether the requested connection is secure at the protocol control layer, which increases the difficulty for attackers to crack and improves the level of network security protection.

[0100] The implementation of the various embodiments of the present invention is based on programmed processing through a device with processor functionality. Therefore, in practical engineering, the technical solutions and functions of the various embodiments of the present invention can be encapsulated into various modules. Based on this reality, and building upon the above embodiments, the embodiments of the present invention provide a network security protection device based on an Internet of Things (IoT) communication protocol. This device is used to execute the network security protection method based on an IoT communication protocol in the above method embodiments. See also... Figure 2 The device includes: a first main module for implementing step 1, whereby the client initiates identity authentication with the server based on a secure channel; a second main module for implementing step 2, whereby the client establishes a connection with the server based on a secure channel and performs data interaction; a third main module for implementing step 3, whereby the client requests a token from the server based on a secure channel; a fourth main module for implementing step 4, whereby the client obtains the token and stores it in memory; and a fifth main module for implementing step 5, whereby the client establishes a connection with the server based on a normal channel and performs data interaction.

[0101] The network security protection device based on the Internet of Things communication protocol provided in this embodiment of the invention adopts... Figure 2 Several modules within the system establish two TCP channels between the MQTT client and the MQTT server to process secure data and ordinary data respectively, use TLS for encrypted transmission, and introduce token management functionality. The platform verifies the token carried by the device, and the designed IoT communication protocol can identify whether the requested connection is secure at the protocol control layer, increasing the difficulty for attackers to crack it and improving the level of network security protection.

[0102] It should be noted that the apparatus in the device embodiments provided by the present invention can be used not only to implement the methods in the above method embodiments, but also to implement the methods in other method embodiments provided by the present invention. The difference lies only in the setting of corresponding functional modules. Its principle is basically the same as that of the above device embodiments provided by the present invention. As long as those skilled in the art, based on the above device embodiments and referring to the specific technical solutions in other method embodiments, obtain corresponding technical means and technical solutions composed of these technical means by combining technical features, and improve the apparatus in the above device embodiments while ensuring the practicality of the technical solutions, they can obtain corresponding device-type embodiments for implementing the methods in other method-type embodiments. For example:

[0103] Based on the above device embodiments, as an optional embodiment, the network security protection device based on the Internet of Things communication protocol provided in this embodiment of the invention further includes: a first submodule, used to implement step 2, specifically including: step 2.1, the client requests to connect to the server; step 2.2, the server returns connection feedback information; step 2.3, the client sends a PING message to the server; step 2.4, the server returns PING feedback information; step 2.5, the client sends a message to the server; step 2.6, the server confirms the message; step 2.7, disconnect.

[0104] Based on the above device embodiments, as an optional embodiment, the network security protection device based on the Internet of Things communication protocol provided in this embodiment of the invention further includes: a second submodule, used to implement step 5, specifically including: step 5.1, the client and the server establish a normal connection channel; step 5.2, the server returns connection feedback information; step 5.3, the client sends a PING message to the server; step 5.4, the server returns PING feedback information; step 5.5, the client sends a message to the server; step 5.6, the server confirms the message; step 5.7, disconnect.

[0105] Based on the above device embodiments, as an optional embodiment, the network security protection device based on the Internet of Things communication protocol provided in this embodiment of the invention further includes: a third sub-module, used to implement step 5.2, which specifically includes: in the fixed header of the CONNACK control message of the MQTT protocol, the control message type flag bit confirms whether the connection is a secure channel or a normal channel, with 0 for the first secure channel and 1 for the first normal channel.

[0106] Based on the above device embodiments, as an optional embodiment, the network security protection device based on the Internet of Things communication protocol provided in this embodiment of the invention further includes: a fourth sub-module, used to implement step 5.4, which specifically includes: in the fixed header of the PINGRESP control message of the MQTT protocol, the control message type flag bit of the connection confirmation keep-alive request is a secure channel or a normal channel, 0 for the second secure channel and 1 for the second normal channel.

[0107] Based on the above device embodiments, as an optional embodiment, the network security protection device based on the Internet of Things communication protocol provided in this embodiment of the invention further includes: a fifth sub-module, used to implement step 2.1, specifically including: requesting the fixed header flag bit of the CONNECTREQ control message to confirm whether the created channel is a secure channel or a normal channel, where 0 is the third secure channel and 1 is the third normal channel.

[0108] Based on the above device embodiments, as an optional embodiment, the network security protection device based on the Internet of Things communication protocol provided in this embodiment of the invention further includes: a sixth sub-module, used to implement step 2, specifically including: adding a control message with a value of 0 to the MQTT protocol for requesting CONNECTREQ; the CONNECTREQ control message includes a fixed header, a variable header, and a payload.

[0109] The method in this embodiment of the invention is implemented using an electronic device; therefore, it is necessary to introduce the relevant electronic device. For this purpose, this embodiment of the invention provides an electronic device, such as... Figure 3 As shown, the electronic device includes at least one processor, a communications interface, at least one memory, and a communications bus, wherein the at least one processor, the communications interface, and the at least one memory communicate with each other via the communications bus. The at least one processor can invoke logical instructions stored in the at least one memory to execute all or part of the steps of the methods provided in the foregoing method embodiments.

[0110] Furthermore, when the logical instructions in at least one of the aforementioned memories can be implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various method embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0111] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0112] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0113] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. Based on this understanding, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, or sometimes in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0114] It should be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0115] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network security protection method based on an Internet of Things communication protocol, characterized in that, The application comprises the following steps: Step 1, the client initiates identity authentication to the server based on a secure channel; Step 2, the client establishes a connection with the server based on the secure channel and carries out data interaction, the secure channel is encrypted through TLS, and the client transmits high-security-level data to the server through the secure channel; Step 3, the client applies for a Token to the server based on the secure channel; Step 4, the client disconnects the connection with the server based on the secure channel; Step 5, the client establishes a connection with the server based on a normal channel and carries out data interaction, the client transmits low-security-level data to the server through the normal channel by taking the Token returned by the server as a parameter, the security level of the high-security-level data is higher than that of the low-security-level data, and the secure channel and the normal channel both realize data transmission through the MQTT protocol; Step 2 specifically comprises the following steps: Step 2.1, the client requests to connect to the server; Step 2.2, the server returns feedback information of the connection; Step 2.3, the client sends a PING message to the server; Step 2.4, the server returns feedback information of the PING; Step 2.5, the client sends a message to the server; Step 2.6, the server carries out message confirmation, all control message types in the message contain a flag bit set as a first preset value, which is used to distinguish the secure channel; Step 3 specifically comprises the following steps: Step 3.1, the client applies for a Token to the server based on the secure channel; Step 3.2, the server responds based on the secure channel and returns the Token to the client; Step 3.3, after the client obtains the Token, the Token is stored in the memory; Step 5 specifically comprises the following steps: Step 5.1, the client obtains the Token from the local memory; Step 5.2, the client establishes a normal connection channel with the server through a request CONNECTREQ control message, the request CONNECTREQ control message contains the Token; Step 5.3, the server returns feedback information of the connection; Step 5.4, the client sends a PING message to the server; Step 5.5, the server returns feedback information of the PING; Step 5.6, the client sends a message to the server; Step 5.7, the server carries out message confirmation; Step 5.8, the connection is disconnected, all control message types in the message contain a flag bit set as a second preset value, which is used to distinguish the normal channel.

2. The network security protection method based on the Internet of Things communication protocol according to claim 1, characterized in that, Step 2.1 specifically further comprises the following steps: a control message with a value of 0 for requesting CONNECTREQ is added in the MQTT protocol; the CONNECTREQ control message comprises a fixed header, a variable header and a payload.

3. The network security protection method based on the Internet of Things communication protocol according to claim 1, characterized in that, Step 3.1 specifically further comprises the following steps: a control message with a value of 15 for requesting TOKENREQ is added in the MQTT protocol; the TOKENREQ control message comprises a fixed header.

4. The network security protection method based on the Internet of Things communication protocol according to claim 1, characterized in that, The step 3.2 specifically further includes: adding a control packet with a value of 15 for responding to the TOKENRSP in the MQTT protocol; the TOKENRSP control packet includes a fixed header and a variable header.

5. A network security device based on an Internet of Things communication protocol, characterized in that, The method comprises: The first main module is configured to implement step 1, wherein the client initiates identity authentication to the server based on a secure channel. The second main module is configured to implement step 2, wherein the client establishes a connection with the server and performs data interaction based on the secure channel, the secure channel is encrypted by means of TLS, and the client transmits data with a high security level to the server through the secure channel; the third main module is configured to implement step 3, wherein the client applies for a Token to the server based on the secure channel; the fourth main module is configured to implement step 4, wherein the client disconnects the connection with the server based on the secure channel; and the fifth main module is configured to implement step 5, wherein the client establishes a connection with the server and performs data interaction based on a normal channel, the client transmits data with a low security level to the server through the normal channel by taking the Token returned by the server as a parameter, the security level of the data with the high security level is higher than that of the data with the low security level, and the secure channel and the normal channel both realize data transmission by means of the MQTT protocol. The second main module is further configured to implement: step 2.1, wherein the client requests to connect to the server; step 2.2, wherein the server returns feedback information of the connection; step 2.3, wherein the client sends a PING message to the server; step 2.4, wherein the server returns feedback information of the PING; step 2.5, wherein the client sends a message to the server; and step 2.6, wherein the server performs message confirmation, and all control packet types in the control packet are set to a first preset value to distinguish the secure channel. The third main module is further configured to implement: step 3.1, wherein the client applies for a Token to the server based on the secure channel; step 3.2, wherein the server responds based on the secure channel and returns the Token to the client; and step 3.3, wherein the client stores the Token in the memory after obtaining the Token. The fourth main module is further configured to implement: step 5.1, wherein the client obtains the Token from the local memory; step 5.2, wherein the client establishes a normal connection channel with the server by means of a request CONNECTREQ control packet, and the request CONNECTREQ control packet contains the Token; step 5.3, wherein the server returns feedback information of the connection; step 5.4, wherein the client sends a PING message to the server; step 5.5, wherein the server returns feedback information of the PING; step 5.6, wherein the client sends a message to the server; step 5.7, wherein the server performs message confirmation; and step 5.8, wherein the connection is disconnected, and all control packet types in the control packet are set to a second preset value to distinguish the normal channel.

6. An electronic device, comprising: The method comprises: The at least one processor, the at least one memory and the communication interface are in communication with each other; The at least one processor, the at least one memory and the communication interface are in communication with each other; The memory stores program instructions executable by the processor, the processor invoking the program instructions to perform the method of any one of claims 1 to 4.

7. A non-transitory computer-readable storage medium, comprising: The non-transitory computer-readable storage medium stores computer instructions that cause the computer to perform the method of any one of claims 1 to 4.

Images