An Internet of Things security protection system

Abstract

The present invention relates to the technical field of Internet of Things, and specifically discloses an Internet of Things security protection system, including a router and a smart home device connected to the router, wherein the router is used to receive a device's access request to a main WIFI, determine whether the device requesting access is a new device, and if so, obtain the device information of the device, and mark the device as a smart terminal or a smart home device; if marked as a smart terminal, the router is also used to analyze the usage habits of the smart terminal, generate a user tag, and add the user tag to the display name of the smart terminal; the router is also used to receive a control instruction from the smart terminal to the smart home device, determine whether it is the first time to send a control instruction to the smart home device, and if so, send the control information to a pre-bound master control device. The technical solution of the present invention can reduce the risk of intrusion through a local area network.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and in particular to an Internet of Things security protection system. Background Art

[0002] With the development of physical network technology, more and more smart home hardware can be connected to the Internet of Things in the home. These smart home hardware are usually connected to the network through a router, and users can remotely control the smart home hardware through smart terminals such as mobile phones and tablets. For example, you can control the opening and closing of curtains through your mobile phone without getting up, and you can control the switch of the living room lights through your mobile phone in the bedroom, etc., which greatly improves the convenience of smart home hardware control.

[0003] However, when smart home hardware is connected to the network, there is a risk of being attacked illegally, especially when connected to the Internet. In order to ensure security and prevent smart home hardware from being illegally controlled, some smart home hardware can only be controlled in the same local area network to reduce the possibility of being attacked illegally.

[0004] However, illegal attackers can still access the local area network to conduct illegal attacks, and smart home devices still face security threats. Summary of the invention

[0005] The present invention provides an Internet of Things security protection system, which can reduce the risk of intrusion through a local area network.

[0006] In order to solve the above technical problems, this application provides the following technical solutions:

[0007] An Internet of Things security protection system includes a router and a smart home device connected to the router, wherein the router is used to receive a device's access request to a main WIFI, determine whether the device requesting access is a new device, and if it is a new device, obtain device information of the device, determine a display name of the device based on the device information, and mark the device as a smart terminal or a smart home device;

[0008] If the terminal is marked as a smart terminal, the router is further used to obtain the communication data of the smart terminal, analyze the usage habits of the smart terminal based on the communication data, generate a user tag based on the usage habits, and add the user tag to the display name of the smart terminal;

[0009] The router is also used to receive control instructions from the smart terminal to the smart home device, determine whether it is the first time to send a control instruction to the smart home device, and if so, send the control information to the pre-bound master control device, the control information including the control instruction and the display name of the smart terminal;

[0010] The router is also used to obtain feedback information from the main control device. If the feedback information is that the request is approved, the smart terminal is added to the control whitelist and the control command is sent to the corresponding smart home device. If the feedback information is that the request is rejected, the smart terminal is added to the control blacklist and no subsequent operations are performed.

[0011] The basic scheme principles and beneficial effects are as follows:

[0012] Usually in the Internet of Things (IoT) in the home, i.e. the local area network, the router will connect various smart home devices and smart terminals, such as mobile phones, tablets and computers. After these smart terminals are connected to the home's local area network, they have the authority to control the smart home devices in the local area network by logging into the corresponding APP or web page. In order to ensure that smart home devices will not be subject to illegal attacks, it is necessary to manage the smart terminals connected to the local area network and the control instructions issued by the smart terminals to the smart home devices.

[0013] In this solution, after the device is connected to the main WIFI for the first time, the device is classified by device information, and the smart terminal is identified for separate management. However, determining the display name of the device based solely on the device information is not conducive to the management user distinguishing the currently connected smart terminal. For example, the three smart terminals are mobile phones of the same brand and model, and the display names are the same, making it difficult to distinguish the corresponding users behind them. This solution analyzes the usage habits of the smart terminal based on communication data, generates user tags based on usage habits, and adds user tags to the display name of the smart terminal; because different people use different common APPs on their mobile phones, the generated user tags are also different, which helps the management user to quickly distinguish all the owners of the currently connected smart terminals and discover illegally connected smart terminals as soon as possible. If an illegally connected smart terminal is found, the management user can also know that the current password has been leaked. When the smart terminal controls the smart home device, this solution sets a second line of defense, and sends the control information to the main control device bound to the management user for review. If the review fails, the feedback information is a request rejection, and the control command issued by the smart terminal is not executed.

[0014] In summary, this solution can identify smart terminals before smart home devices execute control instructions, thereby preventing smart home devices from being illegally invaded.

[0015] Furthermore, when the router determines that the accessed device is not a new device and is a smart terminal, it again determines whether the smart terminal is in the control blacklist. If it is in the control blacklist, it determines whether the guest WIFI has been configured. If it has been configured, the access of the smart terminal is rejected, and the guest WIFI is turned on. The configuration information of the guest WIFI is sent to the main control device, and the configuration information includes the WIFI name and WIFI password.

[0016] If the smart terminal that is accessed for the second time is in the control blacklist, it means that although the management user has denied the smart terminal the permission to control the smart home device, it has not kicked it out of the main WIFI, indicating that the smart terminal is not an intruding device, but may be a friend of the management user. If the smart terminal does not need to control smart home devices, connecting to the guest WIFI can further improve the security of the main WIFI. If the guest WIFI is currently configured, it means that the management user has the intention to use the guest WIFI. At this time, the smart terminal is denied access to the main WIFI and the guest WIFI is turned on. After the user of the smart terminal finds that he cannot connect to the main WIFI, the management user can guide him to connect to the guest WIFI. At the same time, it also avoids the situation where some management users are embarrassed to directly refuse others to connect to the main WIFI due to face. Send the configuration information of the guest WIFI to the main control device, even if the management user forgets the password of the guest WIFI, he does not have to spend time to query.

[0017] Furthermore, the router is also used to shut down the guest WIFI after no smart terminal accesses the guest WIFI within a first preset time.

[0018] It can reduce the probability of illegal intruders accessing the guest WIFI.

[0019] Further, after the router obtains feedback information from the main control device, if the feedback information is behavior monitoring, the smart terminal is added to the monitoring list and the control instruction is sent to the corresponding smart home device;

[0020] The router is also used to determine the list where the smart terminal is located when it is determined that this is not the first time that the smart terminal sends a control instruction to the smart home device. If the smart terminal is in the monitoring list, the router sends the control instruction to the corresponding smart home device and sends the control information to the main control device at the same time;

[0021] If it is in the control whitelist, the control command will be sent directly to the corresponding smart home device.

[0022] By adding certain smart terminals to the monitoring list, such as smart terminals used by children at home, the control instructions sent by the smart terminal can be continuously monitored.

[0023] Furthermore, the router is also used to determine whether the control instruction is a preset first-category control instruction when it is determined that the smart terminal sends a control instruction to the smart home device for the first time. If it is a preset first-category control instruction, it is also used to determine whether the main control device is currently connected to the router. If it is connected, the control instruction is sent to the corresponding smart home device, and at the same time, the control information is sent to the main control device.

[0024] The first type of control instructions are those that do not affect security, and illegal intrusion is a low-probability event. If such control instructions are reviewed first and then released, the user experience is poor. For example, to control the switch of a smart light, it is necessary to review it first and then release it, which has a high delay and is easy to cause user disgust. In this preferred solution, for control instructions that do not affect security, if the management user is at home (i.e., the main control device is connected to the router), the management user is allowed to make judgments first, which ensures security while improving the user experience.

[0025] Furthermore, after the router determines that the main control device is currently connected to the router, it is also used to determine whether the number of currently connected smart terminals is greater than a threshold value. If it is not greater than the threshold value, the control instruction is sent to the corresponding smart home device, and at the same time, the control information is sent to the main control device;

[0026] If it is greater than the threshold, it is also determined whether the display name of the smart terminal contains a user tag. If it contains a user tag, the control instruction is sent to the corresponding smart home device, and the control information is sent to the main control device; if it does not contain a user tag, the control information is sent to the main control device.

[0027] If the current number of connected smart terminals is greater than the threshold, the management user may be unable to distinguish the user of the smart terminal when making a subsequent judgment. Therefore, the release-first-then-judgment operation mode is enabled only when the smart terminal enables the management user to effectively distinguish the user (that is, the display name of the smart terminal contains a user tag).

[0028] Furthermore, the router is also used to obtain and record the status information of all smart home devices when the number of connected smart terminals is greater than a threshold, where the status information includes an on state or an off state;

[0029] The router is also used to turn on the guest WIFI when the current status information of all smart home devices is consistent with the recorded status information.

[0030] The scenario where the number of connected smart terminals is greater than the threshold may be a party. The status information of all smart home devices is obtained and recorded. When the status information of the smart home devices is consistent with the recorded status information next time, it is likely that a family party is held. At this time, the guest WIFI is turned on to facilitate the participants of the party to directly connect to the guest WIFI.

[0031] Furthermore, the router is also used to change the password of the guest WIFI when the cumulative number of smart terminals accessing the guest WIFI is greater than a set value, and send the changed password to the main control device;

[0032] The router is also used to recalculate the number of access smart terminals after the password is changed.

[0033] Change the guest WIFI password regularly to reduce the risk of the guest WIFI password being leaked.

[0034] Furthermore, the router is also used to determine whether the change of the status information of the preset smart home device within the second preset time is consistent with the set conditions, and if consistent, turn on the visitor WIFI.

[0035] For example, within 3 seconds, the kitchen smart light is turned on and off 3 times continuously to turn on the guest WIFI. During a party, the management user may be busy with reception or food preparation, and it is inconvenient to use the main control device. By adopting this preferred solution, the management user can conveniently control the guest WIFI.

[0036] Furthermore, the device information includes an IP address and a MAC address. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is a schematic diagram of an Internet of Things security protection system according to Example 1. DETAILED DESCRIPTION

[0038] The following is further described in detail through specific implementation methods:

[0039] Embodiment 1

[0040] like Figure 1 As shown, an IoT security protection system of this embodiment includes a router, smart home devices and a main control device. Both the smart home devices and the main control device are connected to the local area network established by the router. Smart home devices include smart TVs, smart lights, smart electric meters, smart gas meters, smart refrigerators, sweeping robots, smart water heaters, smart speakers and other devices that can be controlled online. The main control device manages the smart terminal currently bound by the user. This smart terminal has the highest management authority. The smart terminal is such as a mobile phone.

[0041] The router is used to receive the access request of the device, determine whether the device requesting access is a new device, and if it is a new device, obtain the device information of the device, determine the display name of the device based on the device information, and mark the device as a smart terminal or smart home device; the device information includes an IP address and a MAC address. In this embodiment, the access is to the main WIFI of the router, and the access request is sent after the WIFI password is correctly entered. At present, the MAC address of the networked device needs to be filed. Based on the MAC address, the filing information can be queried online to obtain the name of the device as the display name. When the name of the device is not queried, the MAC address is used as the display name. For example, if the name of the device obtained by querying the MAC address is a fruit phone, the display name of the device is determined to be: fruit phone, and the device is marked as a smart terminal. If the name of the device obtained by querying the MAC address is xx smart speaker, the display name of the device is determined to be: xx smart speaker, and the device is marked as a smart home device. In this embodiment, the types of smart terminals include mobile phones, tablets, and computers.

[0042] If it is marked as a smart terminal, the router is also used to obtain the communication data of the smart terminal, analyze the usage habits of the smart terminal based on the communication data, generate a user tag based on the usage habits, and add the user tag to the display name of the smart terminal. In this embodiment, through the communication data, one or two applications or games that generate the most traffic are analyzed, and the names of the games or applications are used as user tags. The user tag is added to the display name of the smart terminal, for example, a fruit mobile phone uses xxx video applications, and an xx brand mobile phone uses xxx game applications.

[0043] The router is also used to receive control instructions from the smart terminal to the smart home device, determine whether it is the first time to send a control instruction to the smart home device, and if so, send the control information to the pre-bound master control device, the control information including the control instruction and the display name of the smart terminal;

[0044] The router is also used to obtain feedback information from the master device, including request approval, request rejection, or behavior monitoring.

[0045] If the feedback information indicates that the request is approved, the smart terminal is added to the control whitelist, and the control command is sent to the corresponding smart home device;

[0046] If the feedback information is request rejection, the smart terminal is added to the control blacklist and no subsequent operations are performed.

[0047] If the feedback information is behavior monitoring, the smart terminal is added to the monitoring list and the control command is sent to the corresponding smart home device;

[0048] The router is also used to determine again the list of the smart terminal when it determines that this is not the first time that the smart terminal sends a control instruction to the smart home device. If it is in the monitoring list, the control instruction is sent to the corresponding smart home device and the control information is sent to the main control device; if it is in the control whitelist, the control instruction is sent directly to the corresponding smart home device.

[0049] When the router determines that the connected device is not a new device and is a smart terminal, it will again determine whether the smart terminal is in the control blacklist. If it is in the control blacklist, it will determine whether the guest WIFI has been configured. If it has been configured, the access of the smart terminal will be rejected, and the guest WIFI will be turned on. The configuration information of the guest WIFI will be sent to the main control device, and the configuration information includes the WIFI name and WIFI password.

[0050] The router is also used to shut down the guest WIFI after no smart terminal accesses the guest WIFI within a first preset time.

[0051] Embodiment 2

[0052] The difference between this embodiment and the first embodiment is that in this embodiment, the router is further used to determine whether the control instruction is a preset first-class control instruction when determining that the smart terminal sends a control instruction to the smart home device for the first time. If it is a preset first-class control instruction, it is also used to determine whether the main control device is currently connected to the router. If it is connected, it is determined whether the current number of connected smart terminals is greater than a threshold. If it is not greater than the threshold, the control instruction is sent to the corresponding smart home device, and at the same time, the control information is sent to the main control device.

[0053] If it is greater than the threshold, it is also determined whether the display name of the smart terminal contains a user tag. If it contains a user tag, the control instruction is sent to the corresponding smart home device, and the control information is sent to the main control device; if it does not contain a user tag, the control information is sent to the main control device, and the next step is performed according to the feedback information of the main control device. The threshold is 3-5, and in this embodiment, it is 5.

[0054] In this embodiment, control instructions are divided into first category control instructions, second category control instructions and third category control instructions according to the degree of impact on security; first category control instructions include turning on and off smart lights, turning on and off smart TVs, etc.; second category control instructions include turning on and off smart air conditioners, turning on and off smart curtains, etc.; third category control instructions include turning on and off smart water heaters, turning on and off surveillance cameras, turning on and off smoke alarms, etc.

[0055] Embodiment 3

[0056] The difference between this embodiment and the second embodiment is that in this embodiment, the router is also used to obtain and record the status information of all smart home devices when the number of connected devices is greater than the threshold, and the status information includes the on state or off state, and also includes the usage data of the smart home devices within a set time, and the set time is 2 hours. For example, the power consumption of a smart refrigerator within 2 hours, and the water consumption of a smart water meter within 2 hours.

[0057] The router is also used to turn on the guest WIFI when the current status information of all smart home devices is consistent with the recorded status information and the similarity of the usage data is greater than 80%.

[0058] The scenario where the number of connected smart terminals is greater than the threshold may be a party. The status information of all smart home devices is obtained and recorded. When the status information of the smart home devices is consistent with the recorded status information next time, it is likely that a family party is also held. At this time, the guest WIFI is turned on to facilitate the participants of the party to directly connect to the guest WIFI. In this embodiment, in order to improve the accuracy of scene recognition, the usage data of smart home devices is also judged. For example, the similarity of power consumption of smart refrigerators within 2 hours is greater than 80%, indicating that the amount of food stored in the refrigerator is similar, for example, drinks are frozen for the party, which can further improve the accuracy of recognition.

[0059] Embodiment 4

[0060] The difference between this embodiment and the third embodiment is that in this embodiment, the router is also used to determine whether the change of the status information of the preset smart home device within the second preset time is consistent with the set condition, and if it is consistent, turn on the guest WIFI. For example, within 3 seconds, the smart light in the kitchen is turned on and off 3 times continuously.

[0061] The router is also used to filter out smart terminals in the non-control whitelist and monitoring list from the smart terminals currently connected to the main WIFI after turning on the guest WIFI, disconnect the smart terminals in the non-control whitelist and monitoring list from the main WIFI, and then send the configuration information of the guest WIFI to the main control device, the configuration information includes the WIFI name and WIFI password.

[0062] The router is also used to change the password of the guest WIFI when the cumulative number of smart terminals accessing the guest WIFI is greater than the set value, and send the changed password to the main control device; the router is also used to recalculate the number of smart terminals accessing after the password is changed. The set value is 10-20, and it is 15 in this embodiment. In this embodiment, when the password of the guest WIFI is changed, the composition rule of the new password is consistent with the composition rule of the initially configured guest WIFI password. For example, if the initially configured guest WIFI password is pure numbers, then the changed guest WIFI password is pure numbers, and if the initially configured guest WIFI password is letters plus symbols, then the changed guest WIFI password is letters plus symbols.

[0063] During a party, the management user may be busy with reception or food preparation, and it is not convenient to use the main control device. The solution of this embodiment can facilitate the management user to control the guest WIFI. Disconnect the connection between the smart terminals in the non-control white list and the monitoring list and the main WIFI, and then send the configuration information of the guest WIFI to the main control device, so that the management user can guide such users to access the guest WIFI. After long-term use, the main WIFI is usually only accessible to those permitted by the management user, and other users can only access the guest WIFI.

[0064] The above are only embodiments of the present invention. The invention is not limited to the fields involved in this implementation case. The common sense such as the known specific structures and characteristics in the scheme is not described in detail here. The ordinary technicians in the relevant field know all the common technical knowledge in the technical field to which the invention belongs before the application date or the priority date, can obtain all the existing technologies in the field, and have the ability to apply the conventional experimental means before that date. The ordinary technicians in the relevant field can improve and implement this scheme in combination with their own abilities under the enlightenment given by this application. Some typical known structures or known methods should not become obstacles for ordinary technicians in the relevant field to implement this application. It should be pointed out that for those skilled in the art, without departing from the structure of the present invention, several deformations and improvements can be made, which should also be regarded as the protection scope of the present invention, which will not affect the effect of the implementation of the present invention and the practicality of the patent. The protection scope required by this application shall be based on the content of its claims, and the specific implementation methods and other records in the specification can be used to explain the content of the claims.

Claims

1. An Internet of Things security protection system, comprising a router and a smart home device connected to the router, characterized in that: The router is used to receive a device's access request to the main WIFI, determine whether the device requesting access is a new device, and if it is a new device, obtain the device information of the device, determine the display name of the device based on the device information, and mark the device as a smart terminal or smart home device; If the terminal is marked as a smart terminal, the router is further used to obtain the communication data of the smart terminal, analyze the usage habits of the smart terminal based on the communication data, generate a user tag based on the usage habits, and add the user tag to the display name of the smart terminal; The router is also used to receive control instructions from the smart terminal to the smart home device, determine whether it is the first time to send a control instruction to the smart home device, and if so, send the control information to the pre-bound master control device, the control information including the control instruction and the display name of the smart terminal; The router is also used to obtain feedback information from the main control device. If the feedback information is that the request is approved, the smart terminal is added to the control whitelist and the control command is sent to the corresponding smart home device. If the feedback information is that the request is rejected, the smart terminal is added to the control blacklist and no subsequent operation is performed; When the router determines that the accessed device is not a new device and is a smart terminal, it determines again whether the smart terminal is in the control blacklist. If it is in the control blacklist, it determines whether the guest WIFI has been configured. If it has been configured, the access of the smart terminal is rejected, and the guest WIFI is turned on. The configuration information of the guest WIFI is sent to the main control device, and the configuration information includes the WIFI name and the WIFI password; The router is also used to shut down the guest WIFI after no smart terminal accesses the guest WIFI within a first preset time; After the router obtains feedback information from the main control device, if the feedback information is behavior monitoring, the smart terminal is added to the monitoring list and the control command is sent to the corresponding smart home device; The router is also used to determine the list where the smart terminal is located when it is determined that this is not the first time that the smart terminal sends a control instruction to the smart home device. If the smart terminal is in the monitoring list, the router sends the control instruction to the corresponding smart home device and sends the control information to the main control device at the same time; If it is in the control whitelist, the control command is directly sent to the corresponding smart home device; The router is also used to determine whether the control instruction is a preset first-class control instruction when determining that the smart terminal sends a control instruction to the smart home device for the first time. If it is a preset first-class control instruction, it is also used to determine whether the main control device is currently connected to the router. If it is connected, the control instruction is sent to the corresponding smart home device, and at the same time, the control information is sent to the main control device; After the router determines that the main control device is currently connected to the router, it is also used to determine whether the number of currently connected smart terminals is greater than the threshold. If it is not greater than the threshold, the control instruction is sent to the corresponding smart home device, and the control information is sent to the main control device at the same time; If it is greater than the threshold, it is also determined whether the display name of the smart terminal contains a user tag. If it contains a user tag, the control instruction is sent to the corresponding smart home device, and the control information is sent to the main control device; if it does not contain a user tag, the control information is sent to the main control device; The router is also used to obtain and record the status information of all smart home devices when the number of connected smart terminals is greater than a threshold, where the status information includes an on state or an off state; The router is also used to turn on the guest WIFI when the current status information of all smart home devices is consistent with the recorded status information.

2. The Internet of Things security protection system according to claim 1, characterized in that: The router is also used to change the password of the guest WIFI when the cumulative number of smart terminals accessing the guest WIFI is greater than a set value, and send the changed password to the main control device; The router is also used to recalculate the number of access smart terminals after the password is changed.

3. The Internet of Things security protection system according to claim 2, characterized in that: The router is also used to determine whether the change of the status information of the preset smart home device within the second preset time is consistent with the set conditions, and if consistent, turn on the visitor WIFI.

4. The Internet of Things security protection system according to claim 1, characterized in that: The device information includes an IP address and a MAC address.

Images