An information security protection method, system, terminal and medium based on the Internet of Things

Abstract

A method and system for information security protection based on the Internet of Things (IoT) is characterized by the following steps: Step 1, the data sending end obtains the public key of the sensing device based on a smart contract and encrypts the data information collected from the sensing device; Step 2, the data sending end segments the encrypted data information into encrypted data blocks, generates a segment header and footer table, and forwards the encrypted data blocks sequentially to the data receiving end through multiple neighbor nodes and base station devices of the data sending end; Step 3, the data receiving end verifies the encrypted data blocks based on the encrypted header and footer table and decrypts the encrypted data blocks based on the private key of the sensing device. This invention reduces the risk of privacy exposure, increases system stability, and prevents the spread of sensitive information leakage scenarios, effectively preventing the leakage and spread of sensitive information and fully ensuring data security.

Description

Technical Field

[0001] This invention relates to the field of the Internet of Things (IoT), and more specifically, to an information security protection method, system, terminal, and medium based on the IoT. Background Technology

[0002] The Internet of Things (IoT) technology can use various information sensors, radio frequency identification (RFID) technology, global positioning systems (GPS), infrared sensors, laser scanners, and other devices to collect real-time data on any object or process that needs to be monitored, connected, or interacted with. This data includes information on sound, light, heat, electricity, mechanics, chemistry, biology, location, and other relevant parameters. Through various possible network access methods, it enables ubiquitous connectivity between things and between things and people, achieving intelligent perception, identification, and management of objects and processes.

[0003] Currently, the research and application deployment of blockchain + IoT can support the large-scale expansion of massive IoT devices while ensuring the trustworthiness, reliability, and transparency of ownership, transaction records, etc., effectively solving pain points encountered in the current development of IoT, such as device security, privacy leaks, low efficiency, and high trust costs. On the other hand, the integration of blockchain + IoT technology leverages the decentralized advantages of blockchain, enabling the technology to effectively implement distributed Internet technologies such as P2P (peer-to-peer), NAS (Network Attached Storage), and CDN (Content Distribution Network) based on IoT terminal devices.

[0004] Background technical document: CN109889522B discloses a blockchain-based method for protecting IoT information security. This method utilizes a distributed storage system to store massive amounts of IoT data, combining blockchain technology with encryption techniques to protect the security of IoT data. Data collected by IoT devices is recorded and stored in IPFS (InterPlanetary File System). Asymmetric encryption technology is used to encrypt the hash value of the original IoT information, creating a block. Then, blocks are linked to the previous block in chronological order using their hash values, ensuring the immutability of the data.

[0005] However, existing blockchain + IoT information security protection methods still suffer from risks of privacy exposure due to centralized management, poor system stability, and insufficiently refined processing and screening of sensitive information flows. Because current technologies lack effective defenses against these issues, sensitive information leakage and dissemination are highly likely to occur in blockchain + IoT communication networks.

[0006] To address the aforementioned issues, there is an urgent need for a new information security protection method, system, terminal, and medium based on the Internet of Things. Summary of the Invention

[0007] To address the shortcomings of existing technologies, this invention provides an information security protection method, system, terminal, and medium based on the Internet of Things. By judging the dynamic sensitivity level of data information, it selects and encrypts data information collected by sensing devices, and achieves secure data transmission through information segmentation and distributed forwarding.

[0008] The present invention adopts the following technical solution.

[0009] The first aspect of this invention relates to an information security protection method based on the Internet of Things (IoT), the method comprising the following steps: Step 1, the data sending end obtains the public key of the sensing device based on a smart contract and encrypts the data information collected from the sensing device; Step 2, the data sending end segments the encrypted data information into encrypted data blocks, generates a segment header and footer table, and forwards the encrypted data blocks sequentially to the data receiving end through multiple neighbor nodes and base station equipment of the data sending end; Step 3, the data receiving end verifies the encrypted data blocks based on the encrypted header and footer table and decrypts the encrypted data blocks based on the private key of the sensing device.

[0010] Preferably, the sensing device obtains the dynamic sensitivity level of the data type collected by the sensing device from the smart contract stored in the data sending end; and, based on the dynamic sensitivity level, the sensing device marks the corresponding sensitivity level of the data information when uploading the data information to the data sending end.

[0011] Preferably, both the public and private keys of the sensing device are obtained based on the bilinear mapping algorithm; the public key includes three random elements from the multiplicative cyclic group G1 and the multiplicative cyclic group G. T One of the elements.

[0012] Preferably, in the bilinear mapping algorithm, the mapping of the dynamic sensitivity level of the sensing device is used as the integer set Z. p The elements in.

[0013] Preferably, based on the segmentation at the data sending end, the data sending end generates a segmented header and tail table for the data information; in the segmented header and tail table, each encrypted data block corresponds to a front segment data, a middle segment data, and a rear segment data; and the front segment data, the middle segment data, and the rear segment data are all calculated and obtained based on the original data located in the front segment, the middle segment, and the rear segment of the encrypted data block.

[0014] Preferably, the data sender directly sends the segmented header and footer table to the data receiver based on the data request from the data receiver.

[0015] Preferably, the data receiving end performs authorization determination based on a smart contract. When the authorization determination is successful, the data receiving end can receive data information from the data sending end.

[0016] Preferably, the data receiving end verifies the encrypted data block based on the front segment data, middle segment data, and back segment data recorded in the segment header and tail table.

[0017] Preferably, the encryption operation includes using a homomorphic encryption algorithm to calculate an index value for the data information in an IoT information file, and recording the index value in a smart contract for authorization determination; an IoT information file is generated based on data information collected by a sensing device within a preset time period.

[0018] Preferably, attack defense components are deployed on both the data sending end and the data receiving end; when it is detected that the attack defense component on the data receiving end has failed or the dynamic sensitivity level on the data receiving end exceeds the corresponding sensitivity level of the data information in its data request, the data information is intercepted.

[0019] Preferably, the method for intercepting data information is as follows: based on the corresponding sensitivity level of the data information in the data request, sensitive information is separated from all the data information in the data request, and security information and sensitive information are obtained separately; the attack defense component in the data sending end is used to upgrade and encrypt the sensitive information, and the key is allocated to the data receiving end; the security information is encrypted using encryption operations, and then sent to the data receiving end together with the upgraded and encrypted sensitive information.

[0020] A second aspect of this invention relates to an information security protection system based on the Internet of Things (IoT). The system employs the steps of an IoT-based information security protection method as described in the first aspect of this invention. The system includes a base station, a control terminal device, and sensing devices. The control terminal device is connected to multiple sensing devices to control and collect data from them. The base station is connected to multiple control terminal devices to enable communication between them. Each control terminal device includes a data transmitter and a data receiver. The data transmitter obtains the public key of the sensing devices based on a smart contract and encrypts the collected data from the sensing devices. The data transmitter segments the encrypted data into encrypted data blocks, generates a segment header and footer table, and forwards the encrypted data blocks sequentially through multiple neighboring nodes and the base station device to the data receiver. The data receiver verifies the encrypted data blocks based on the encrypted header and footer table and decrypts them based on the private key of the sensing devices.

[0021] A third aspect of the present invention relates to a terminal, including a processor and a storage medium; the storage medium is used to store instructions; the processor is used to operate according to the instructions to execute the execution steps of the data sending end or data receiving end in the method according to the first aspect of the present invention.

[0022] A fourth aspect of the present invention relates to a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the data sending end or data receiving end in the method of the first aspect of the present invention.

[0023] The beneficial effects of this invention are that, compared with the prior art, the information security protection method, system, terminal, and medium based on the Internet of Things (IoT) of this invention can selectively encrypt data information collected by sensing devices by judging the dynamic sensitivity level of the data information, and achieve secure data transmission through information segmentation and distributed forwarding. This invention has advantages such as reducing the risk of privacy exposure, increasing system stability, and preventing the spread of sensitive information leakage scenarios. It solves the problems of poor system stability and insufficiently detailed processing and screening of sensitive information streams in centralized management models, effectively preventing the leakage and spread of sensitive information and fully ensuring data security.

[0024] The beneficial effects of the present invention also include:

[0025] 1. The IoT information security protection method in this invention modifies the traditional centralized management model of IoT to a decentralized model. By combining blockchain technology, it reduces the risk of privacy exposure and increases the stability of the system.

[0026] 2. This invention effectively prevents attacks by malicious actors. By deploying a sensitive information protection module, it identifies the flow of sensitive information in the perception layer and marks its attributes. It establishes a correlation rule between the dynamic changes of attributes and information leakage to detect sensitive information leakage scenarios. It uses an identity-based encryption method to encrypt sensitive information in real time to resist external attacks. It also notifies the system's middle layer and application layer through message feedback so that if the encryption scheme fails, it can deploy upper-layer patches to control the flow of sensitive information and prevent the spread of sensitive information leakage scenarios. Attached Figure Description

[0027] Figure 1 This is a schematic diagram illustrating the steps of an information security protection method based on the Internet of Things in this invention;

[0028] Figure 2 This is a schematic diagram of the network structure of an information security protection system based on the Internet of Things in this invention. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this invention. The embodiments described in this application are merely some embodiments of this invention, and not all embodiments. Based on the spirit of this invention, other embodiments obtained by those skilled in the art without creative effort are all within the protection scope of this invention.

[0030] Figure 1 This is a schematic diagram illustrating the steps of an information security protection method based on the Internet of Things (IoT) in this invention. Figure 1 As shown, the first aspect of the present invention relates to an information security protection method based on the Internet of Things, the method comprising steps 1 to 3.

[0031] It is understood that, in order to achieve data collection and forwarding, the data transmitter in this invention, as a control device, can be directly or indirectly connected to multiple sensing devices. In this invention, the sensing devices can be various IoT devices, which can collect relevant attribute data of the environment in a certain environment, and then aggregate, forward, analyze, process, and utilize this data through the data transmitter device.

[0032] Therefore, in this invention, a large number of sensing devices are typically connected to a single data transmitter. The data transmitter connects to the upper-layer network via a base station device or directly as a base station device. The upper-layer network in this invention can be constructed using a blockchain approach. Both the data transmitter and receiver in this invention are communication network devices participating in smart contracts within the blockchain, possessing data forwarding and processing capabilities, and achieving remote forwarding of local data through participation in smart contracts.

[0033] However, under this network infrastructure, due to the wide variety of sensing devices and the different security levels of the collected data, it is not only difficult to achieve effective data aggregation, but also various security problems may arise during data forwarding.

[0034] Therefore, this invention improves the data transmission and reception business logic of the existing blockchain + IoT networking mode.

[0035] Step 1: The data sending end obtains the public key of the sensing device based on the smart contract and encrypts the data information collected from the sensing device.

[0036] It is understood that the data transmitting end in this invention can encrypt the data information from the sensing device. The data transmitting end can read the model, serial number, data information, and corresponding time information of the sensing device.

[0037] Preferably, the sensing device obtains the dynamic sensitivity level of the data type collected by the sensing device from the smart contract stored in the data sending end; and, based on the dynamic sensitivity level, the sensing device marks the corresponding sensitivity level of the data information when uploading the data information to the data sending end.

[0038] Through this method, the present invention can prioritize the definition of sensitivity levels, or security levels, of data information generated by various sensing devices. Generally speaking, a higher sensitivity level indicates that the data needs to be encrypted using more stringent or secure encryption methods to prevent information leakage in the event of malicious attacks. Since the sensitivity levels of different data types can be modified and redefined through attack defense components on the data sending end, smart contracts in the blockchain, or other means, this is referred to as dynamic sensitivity levels.

[0039] Typically, dynamic sensitivity levels can be defined within smart contracts on the blockchain network, or they can be dynamically determined based on the defense capabilities of the local data sender. Once defined, the data sender will have at least one corresponding data table, which includes the data types collected by various sensing devices and the corresponding sensitivity levels for each data type. Therefore, when sensing devices send data to the data sender, the data sender can label different data information with different sensitivity levels.

[0040] Preferably, both the public and private keys of the sensing device are obtained based on the bilinear mapping algorithm; the public key includes three random elements from the multiplicative cyclic group G1 and the multiplicative cyclic group G. T One of the elements.

[0041] In this invention, after the data sending end collects data information from various sensing devices, it first encrypts the data information accordingly, and then sends the encrypted data information out through the blockchain network.

[0042] It is understood that regardless of the encryption method used in this invention, it is necessary to generate a public key and a private key for the sensing device. The data receiving end can only successfully decrypt the encrypted data after obtaining the corresponding private key from the sensing device.

[0043] Furthermore, specifically, the public key in this invention can be obtained using a bilinear mapping algorithm. Specifically, in the bilinear mapping, there exists G1×G2→G T The public key in this invention can be obtained from the corresponding elements of the aforementioned multiplicative cyclic group. For example, the public key includes three random elements from the multiplicative cyclic group G1 and the multiplicative cyclic group G. T One of the elements.

[0044] In addition, the private key in this invention can also be composed of some elements in a multiplicative cyclic group.

[0045] Preferably, in the bilinear mapping algorithm, the mapping of the dynamic sensitivity level of the sensing device is used as the integer set Z. p The elements in.

[0046] It is understood that in the bilinear mapping algorithm of this invention, the multiplicative cyclic group can be obtained by using the mapping of the dynamic sensitivity level as the elements of the integer set.

[0047] Step 2: The data sending end cuts the encrypted data information into encrypted data blocks, generates a segment header and footer table, and forwards the encrypted data blocks to the data receiving end through multiple neighbor nodes and base station equipment of the data sending end in sequence.

[0048] In this invention, considering that if the data sender transmits all data to the data receiver via a single path, an attacker could easily obtain and decrypt all the data in the event of a network attack, this invention avoids this situation by rationally segmenting all data into multiple data blocks of equal or approximately equal size, and then transmitting these data blocks separately. Different data blocks can be transmitted via different network paths and are ultimately received uniformly by the data receiver.

[0049] The specific implementation involves randomly distributing the segmented encrypted data blocks to multiple different neighboring nodes. Each neighboring node can then concatenate or combine all the encrypted data blocks it receives, uploading the result to its local base station or directly uploading the data to the blockchain. Furthermore, the local base station can again concatenate or combine the encrypted data blocks from all its neighboring nodes and share the result with the remote base station within the blockchain.

[0050] Preferably, based on the segmentation at the data sending end, the data sending end generates a segmented header and tail table for the data information; in the segmented header and tail table, each encrypted data block corresponds to a front segment data, a middle segment data, and a rear segment data; and the front segment data, the middle segment data, and the rear segment data are all calculated and obtained based on the original data located in the front segment, the middle segment, and the rear segment of the encrypted data block.

[0051] It should be noted that, since the data is segmented, the local data sending device that performs the segmentation needs to record the data segmentation method. In this invention, the header, tail, and middle segments of each segmented data information can be recorded and processed to generate a segmented header-tail table. In this segmented header-tail table, each cell corresponds to an encrypted data block, and the information stored in the cell can be used to query whether the header, tail, and middle segments of the encrypted data block are accurate.

[0052] In this way, the data receiving end can verify the content of the received encrypted data block and retransmit the data if appropriate.

[0053] Preferably, the data sender directly sends the segmented header and footer table to the data receiver based on the data request from the data receiver.

[0054] To implement the above verification process, the segment header and footer table can be directly sent to the data receiving end in this invention. Typically, the data receiving end first receives the segment header and footer table, then acquires each encrypted data block, and verifies the data content within each encrypted data block upon receipt.

[0055] Step 3: The data receiving end verifies the encrypted data block based on the encrypted header and footer table, and decrypts the encrypted data block based on the private key of the sensing device.

[0056] It is understood that in this invention, both the data receiving end and the data sending end can be network devices in the blockchain, and data transmission between them can be achieved through smart contracts.

[0057] Preferably, the data receiving end performs authorization determination based on a smart contract. When the authorization determination is successful, the data receiving end can receive data information from the data sending end.

[0058] Therefore, when the data receiving end determines that it has the right to obtain data based on the smart contract, it can receive data from the data sending end.

[0059] Preferably, the encryption operation includes using a homomorphic encryption algorithm to calculate an index value for the data information in an IoT information file, and recording the index value in a smart contract for authorization determination; an IoT information file is generated based on data information collected by a sensing device within a preset time period.

[0060] It is understood that the method in this invention can use homomorphic encryption algorithms to calculate index values ​​for data information, and use these index values ​​as the standard for authorization determination.

[0061] This index value can be generated based on a single IoT information file. Understandably, the sensing device mentioned earlier can send a complete IoT information file to the data sender, and the data sender can generate this index value while encrypting the IoT information file, facilitating the data receiver's parsing of the data.

[0062] Preferably, the data receiving end verifies the encrypted data block based on the front segment data, middle segment data, and back segment data recorded in the segment header and tail table.

[0063] In this invention, based on the segmented header and footer table directly sent to the data receiving end as described above, the encrypted data block can also be verified, and the verification result determines whether to receive, store, and process the encrypted data block. If the verification fails, the data block can be discarded and the corresponding data block or all data blocks can be requested from the data sending end again.

[0064] Preferably, attack defense components are deployed on both the data sending end and the data receiving end; when it is detected that the attack defense component on the data receiving end has failed or the dynamic sensitivity level on the data receiving end exceeds the corresponding sensitivity level of the data information in its data request, the data information is intercepted.

[0065] It is understood that all data sending and receiving devices in this invention can be deployed with attack defense components. These components can monitor the data request status on the data receiving end in real time. When too many data requests are detected, or other pre-set conditions are met, the dynamic sensitivity level is deemed to have exceeded the limit. Furthermore, if an error occurs in the monitoring status, or if there are verification anomalies with other monitoring statuses, the attack defense component deployment on the data receiving end can also be considered to have failed.

[0066] In both of the above scenarios, the data can be intercepted. This interception can be of all data, or it can be of the more sensitive portion of the data that is intercepted, re-encrypted, and then resent.

[0067] Preferably, the method for intercepting data information is as follows: based on the corresponding sensitivity level of the data information in the data request, sensitive information is separated from all the data information in the data request, and security information and sensitive information are obtained separately; the attack defense component in the data sending end is used to upgrade and encrypt the sensitive information, and the key is allocated to the data receiving end; the security information is encrypted using encryption operations, and then sent to the data receiving end together with the upgraded and encrypted sensitive information.

[0068] It is understood that in one method of this invention, after authorization is obtained, the original IoT information file is queried from IPFS based on the index value of the obtained IoT data information. if(LayoutOfADCom()

[0069] When the attack defense component fails or the dynamic sensitivity level of sensitive information reaches a threshold, the statement `{when SI.dl = mll, HookAuthForSI(mll), ReInputPS(ull)}` is executed. This statement intercepts the authentication of sensitive information in the middle layer of the communication network, requiring the user to re-enter the sensitive information password. Simultaneously, the statement `when SI.dl = all, HookSerForSI(all), ReInputPS(ull)` is executed. This statement intercepts the sensitive information service at the application layer and requires the user to re-enter the sensitive information password `ReGenSI(SI, SI.SL)`. Furthermore, this invention can also encrypt data and allocate a key `ReplaceSI(mll)` through its own attack defense component. Additionally, the original sensitive information is replaced with newly generated and encrypted sensitive information at the middle layer.

[0070] Figure 2 This is a schematic diagram of the network structure of an information security protection system based on the Internet of Things (IoT) according to the present invention. Figure 2 As shown, in a second aspect, the present invention relates to an information security protection system based on the Internet of Things (IoT). The system employs the steps of an information security protection method based on the IoT as described in the first aspect of the present invention. The system includes a base station, a control terminal device, and sensing devices. The control terminal device is connected to multiple sensing devices to control and collect data from them. The base station is connected to multiple control terminal devices to enable communication between the control terminal devices. The control terminal device includes a data sender and a data receiver. The data sender obtains the public key of the sensing devices based on a smart contract and encrypts the collected data from the sensing devices. The data sender segments the encrypted data into encrypted data blocks, generates a segment header and footer table, and forwards the encrypted data blocks sequentially through multiple neighboring nodes and the base station device to the data receiver. The data receiver verifies the encrypted data blocks based on the encrypted header and footer table and decrypts the encrypted data blocks based on the private key of the sensing devices.

[0071] A third aspect of the present invention relates to a terminal, including a processor and a storage medium; the storage medium is used to store instructions; the processor is used to operate according to the instructions to execute the execution steps of the data sending end or data receiving end in the method of the first aspect of the present invention.

[0072] It is understood that, in order to implement the various functions in the methods provided in the embodiments of this application, the terminal includes corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, based on the algorithm steps of the examples described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0073] This application embodiment can divide the interrupt device into functional modules according to the above method example. For example, each function can be divided into a separate functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods.

[0074] The terminal device includes at least one processor, a bus system, and at least one communication interface. The processor may be a central processing unit (CPU), or it may be replaced by a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), or other hardware. Alternatively, the FPGA or other hardware may work together with the CPU as a processor.

[0075] The memory can be read-only memory (ROM) or other types of static storage devices capable of storing static information and instructions, random access memory (RAM) or other types of dynamic storage devices capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed discs, laser discs, optical discs, universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited to these. The memory can exist independently and be connected to the processor via a bus. The memory can also be integrated with the processor.

[0076] The hard drive can be a mechanical hard drive or a solid-state drive (SSD), etc. The interface card can be a host bus adapter (HBA), a redundant array of independent disks (RID), an expander card, or a network interface controller (NIC), etc., and this embodiment of the invention is not limited to any particular type. The interface card in the hard drive module communicates with the hard drive. The storage node communicates with the interface card of the hard drive module to access the hard drive in the hard drive module.

[0077] The hard drive interface can be Serial Attached Small Computer System Interface (SAS), Serial Advanced Technology Attachment (SATA), or Peripheral Component Interconnect Express (PCIe), etc.

[0078] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software programs, implementation can be, in whole or in part, in the form of a computer program product. This computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device containing one or more servers, data centers, etc., that can be integrated with the medium. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks (SSDs)).

[0079] A fourth aspect of the present invention relates to a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the data sending end or data receiving end in the method of the first aspect of the present invention.

[0080] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0081] The beneficial effects of this invention are that, compared with the prior art, the information security protection method, system, terminal, and medium based on the Internet of Things (IoT) of this invention can selectively encrypt data information collected by sensing devices by judging the dynamic sensitivity level of the data information, and achieve secure data transmission through information segmentation and distributed forwarding. This invention has advantages such as reducing the risk of privacy exposure, increasing system stability, and preventing the spread of sensitive information leakage scenarios. It solves the problems of poor system stability and insufficiently detailed processing and screening of sensitive information streams in centralized management models, effectively preventing the leakage and spread of sensitive information and fully ensuring data security.

[0082] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the protection scope of the claims of the present invention.

Claims

1. A method for information security protection based on Internet of Things, characterized in that, The method comprises the following steps: Step 1: The sensing device marks the corresponding sensitive level of the data information when uploading the data information to the data sending end based on the dynamic sensitive level; the data sending end obtains the public key of the sensing device based on the smart contract and performs encryption operation on the collected data information from the sensing device; Step 2: The data sending end cuts the encrypted data information into encrypted data blocks and generates a segmented header and tail table, in which each encrypted data block corresponds to front segment data, middle segment data and rear segment data; and the front segment data, middle segment data and rear segment data are obtained based on the calculation of the original data in the front segment, middle segment and rear segment of the encrypted data block; and the encrypted data blocks are forwarded to the data receiving end through a plurality of neighbor nodes and base station devices of the data sending end in turn; Wherein, the encrypted data blocks obtained after cutting are randomly distributed to a plurality of different neighbor nodes; the neighbor nodes splice or combine all the encrypted data blocks received by themselves and upload the spliced result to the local base station or directly realize data chaining; the local base station splices or combines the encrypted data blocks of all neighbor nodes again and shares the data result in the blockchain to the remote base station; Step 3: The data receiving end performs authorization judgment based on the smart contract, and when the authorization judgment is passed, the data receiving end can receive the data information from the data sending end; the data receiving end verifies the encrypted data block based on the encrypted header and tail table and decrypts the encrypted data block based on the private key of the sensing device.

2. The information security protection method based on Internet of Things according to claim 1, wherein: The sensing device obtains the dynamic sensitive level stored in the smart contract that conforms to the data collection type of the sensing device based on the data sending end.

3. The information security protection method based on Internet of Things according to claim 2, wherein: The public key and the private key of the sensing device are obtained based on the bilinear mapping algorithm; The public key includes three random elements in a multiplicative cyclic group G1 and one element in a multiplicative cyclic group G T .

4. The information security protection method based on Internet of Things according to claim 3, wherein: In the bilinear mapping algorithm, the mapping of the dynamic sensitivity level of the perception device is taken as an element in the integer set Z p .

5. The information security protection method based on Internet of Things according to claim 4, wherein: Based on the cutting of the data sending end, the data sending end generates the segmented header and tail table of the data information.

6. The information security protection method based on Internet of Things according to claim 5, wherein: The data sending end sends the segmented header and tail table directly to the data receiving end based on the data request of the data receiving end.

7. The information security protection method based on Internet of Things according to claim 1, wherein: The data receiving end verifies the encrypted data block based on the front segment data, middle segment data and rear segment data recorded in the segmented header and tail table.

8. The information security protection method based on Internet of Things according to claim 1, wherein: The encryption operation includes calculating an index value of data information in an Internet of Things information file by using a homomorphic encryption algorithm, and recording the index value in the smart contract to realize authorization determination. The one Internet of Things information file is generated based on data information collected by a sensing device within a preset time period.

9. The information security protection method based on the Internet of Things according to claim 1, characterized in that: The attack defense component is deployed on the data sending end and the data receiving end; When it is identified that the attack defense component on the data receiving end is invalid or the dynamic sensitive level on the data receiving end exceeds the corresponding sensitive level of the data information in the data request, the data information is intercepted.

10. The information security protection method based on the Internet of Things according to claim 9, characterized in that: The interception of the data information is performed in the following manner: Based on the corresponding sensitive level of the data information in the data request, sensitive information is separated from all the data information in the data request, and security information and sensitive information are obtained respectively; The attack defense component in the data sending end is used to upgrade and encrypt the sensitive information, and a key is distributed to the data receiving end; After the security information is encrypted by using the encryption operation, it is sent to the data receiving end together with the upgraded and encrypted sensitive information.

11. An information security protection system based on the Internet of Things, characterized in that: The system uses the steps in the information security protection method based on the Internet of Things according to any one of claims 1-10, and the system includes a base station, a control end device, and a sensing device; wherein The control end device is connected with multiple sensing devices to control and collect data from the sensing devices; The base station is connected with multiple control end devices to realize communication among the control end devices; The control end device includes a data sending end and a data receiving end; the data sending end obtains the public key of the sensing device based on a smart contract and performs an encryption operation on the data information collected from the sensing device; the data sending end cuts the encrypted data information into encrypted data blocks, generates a segmentation header and tail table, and forwards the encrypted data blocks to the data receiving end through multiple neighbor nodes of the data sending end, the base station device, and the like; the data receiving end verifies the encrypted data blocks based on the encryption header and tail table, and decrypts the encrypted data blocks based on the private key of the sensing device.

12. A terminal including a processor and a storage medium, characterized in that: The storage medium is used to store instructions; The processor is used to operate according to the instructions to perform the execution steps of the data sending end or the data receiving end in the method according to any one of claims 1-10.

13. A computer readable storage medium having stored thereon a computer program, characterized in that The program is executed by the processor to implement the steps of the data sending end or the data receiving end in the method according to any one of claims 1-10.

Images