A blockchain-based intelligent monitoring device security protection method and system

Abstract

The application discloses a kind of based on blockchain intelligent monitoring equipment security protection method and system, it is related to the field of intelligent monitoring.The application designs the dual authentication mechanism of blockchain-intelligent monitoring equipment to prevent illegal access;Based on asymmetric encryption (RSA) and symmetric encryption (AES) hybrid encryption, a monitoring data encryption storage mechanism is designed, to protect the privacy of users on intelligent monitoring equipment from being disclosed;Through blockchain technology, the interaction data of all user devices are recorded and the use rights of users are clarified, so as to prevent the data of intelligent monitoring equipment from being tampered with, and thus to ensure data credibility.Therefore, the intelligent monitoring equipment security protection method and system can effectively prevent the login authentication risk, privacy leakage risk and data tampering risk in the data access and interaction process, and improve the security of the data access and interaction process.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of intelligent monitoring, in particular to a blockchain-based intelligent monitoring device security protection method and system. BACKGROUND

[0002] In recent years, with the wide popularity of the Internet and the rapid development of computer, network image processing and transmission technology, intelligent monitoring technology has also made great progress and has penetrated into many fields. With the help of new technologies and new applications such as intelligent chips, deep learning and cloud big data analysis, intelligent monitoring devices can realize target detection, face recognition, voice recognition and target classification, thereby reducing or replacing human intervention, greatly surpassing the video capture and transmission functions of traditional monitoring devices, and highlighting advantages in target preference analysis, intelligent security, and automatic driving, and getting more and more applications. Although these devices bring a lot of convenience to people, since intelligent monitoring devices store and analyze a large amount of data related to user privacy, such as images, geographic locations, and some even show people's behavior habits and identity characteristics, network security attacks targeting intelligent monitoring devices occur frequently.

[0003] With the development of smart home, the intelligent and networked upgrade of monitoring devices also expands the attack surface and continuously worsens the threat level, which mainly includes the following risks: (1) login authentication risk: similar to traditional monitoring devices, intelligent monitoring devices themselves have security vulnerabilities, attackers can obtain user information through transmission protocols, phishing emails or malicious software, and pretend to be real users to access intelligent monitoring devices; (2) privacy leakage risk: intelligent monitoring devices have better recognition and data analysis capabilities than traditional monitoring devices, and the recorded image information and analyzed data information are also more likely to have more serious privacy leakage risks; (3) data tampering risk: intelligent monitoring devices do not work independently, and manufacturers usually optimize and improve their technical solutions based on the data collected by intelligent monitoring devices, but users are difficult to understand which data can be shared with manufacturers and which data cannot be shared; in addition, the device monitoring data stored in the cloud by users may be tampered with by illegal users. SUMMARY

[0004] To solve the problems in the above background art, the present application provides a blockchain-based intelligent monitoring device security protection method and system to effectively prevent login authentication risk, privacy leakage risk and data tampering risk in the data access and interaction process, and improve the security of the data access and interaction process.

[0005] To achieve the above-mentioned purpose, the present application provides the following solutions:

[0006] The application discloses a blockchain-based intelligent monitoring device security protection method, which is applied to a blockchain-based intelligent monitoring device security protection system, wherein the intelligent monitoring device security protection system comprises a user device, an intelligent monitoring device and a distributed ledger; the user device comprises an authenticated device and an unauthenticated device; the authenticated device comprises an authenticated master device and an authenticated other device; and the distributed ledger comprises a plurality of blockchain nodes.

[0007] The intelligent monitoring device security protection method comprises the following steps.

[0008] The master device initiates an authentication request to the intelligent monitoring device.

[0009] The intelligent monitoring device receives the authentication request and returns an RSA public key and an admin identifier.

[0010] The authenticated master device combines the current MAC address with the admin identifier, encrypts the master device information by using the RSA public key, and sends the encrypted master device information to the intelligent monitoring device.

[0011] The authenticated master device combines the current MAC address with the admin identifier, and writes the combined master device information into the blockchain node.

[0012] The intelligent monitoring device decrypts the encrypted master device information by using an RSA private key, and stores the decrypted master device information in the local device, which is used for access verification of the authenticated master device.

[0013] Optionally, the blockchain-based intelligent monitoring device security protection method further comprises the following steps.

[0014] The authenticated master device authenticates other devices and gives the other devices the permission to interact with the intelligent monitoring device.

[0015] After the other devices are authenticated by the master device, the other devices initiate an authentication request to the intelligent monitoring device as authenticated other devices.

[0016] The intelligent monitoring device receives the authentication request of the authenticated other devices and returns an RSA public key and an other identifier.

[0017] The authenticated other devices combine the current MAC address with the other identifier, encrypt the other device information by using the RSA public key, and send the encrypted other device information to the intelligent monitoring device.

[0018] The authenticated other devices combine the current MAC address with the other identifier, and write the combined other device information into the blockchain node.

[0019] The intelligent monitoring device decrypts the encrypted other device information using the RSA private key, and stores the decrypted other device information in the local device for access verification of the authenticated other device.

[0020] Optionally, the blockchain-based intelligent monitoring device security protection method further comprises:

[0021] When an unauthenticated device requests to access the data stored in the intelligent monitoring device, the intelligent monitoring device matches the unauthenticated device information with the authenticated device information stored in the local device and the authenticated device information stored in the blockchain node; the authenticated device information includes authenticated master device information and other device information.

[0022] If the matching fails, the intelligent monitoring device sends an alarm information to the authenticated device to confirm whether the authenticated device agrees to the access of the unauthenticated device.

[0023] If the authenticated device agrees to the access, the unauthenticated device can temporarily access the intelligent monitoring device.

[0024] During the temporary access, if the unauthenticated device has malicious access, the authenticated device can blacklist the unauthenticated device.

[0025] If the authenticated device refuses the access, the unauthenticated device cannot access the intelligent monitoring device.

[0026] Optionally, the blockchain-based intelligent monitoring device security protection method further comprises:

[0027] The authenticated device initiates a request for uploading a file to the intelligent monitoring device, and the request information for uploading the file contains the self-authenticated device information of the authenticated device encrypted using the RSA public key.

[0028] The authenticated device matches the self-authenticated device information with the authenticated device information stored in the blockchain node.

[0029] The intelligent monitoring device decrypts the authenticated device information using the RSA private key, queries whether the authenticated device information currently stored contains the authenticated device information currently initiated, and queries whether the blockchain node contains the authenticated device information.

[0030] If the intelligent monitoring device and the blockchain node both contain the authenticated device information, the intelligent monitoring device responds to allow the uploading of the file, and returns a folder list that can be uploaded.

[0031] The authenticated device selects a target folder in the folder list, encodes the number of the selected target folder as an AES key of the AES encrypted data, saves the AES key in the current authenticated device, and encrypts the to-be-uploaded file using the AES key.

[0032] The authenticated device uploads the AES-encrypted file to the intelligent monitoring device.

[0033] Optionally, the blockchain-based intelligent monitoring device security protection method further comprises:

[0034] The authenticated device initiates a request for downloading a file to the intelligent monitoring device, and the request information for downloading the file contains the to-be-authenticated device information of the authenticated device encrypted by the RSA public key of the authenticated device;

[0035] The authenticated device matches the to-be-authenticated device information with the authenticated device information stored in the blockchain node at the same time;

[0036] The intelligent monitoring device decrypts the to-be-authenticated device information by using the RSA private key, queries whether the to-be-authenticated device information currently initiating the request is contained in the currently stored authenticated device information, and queries whether the to-be-authenticated device information is contained in the blockchain node at the same time;

[0037] If the to-be-authenticated device information is contained in both the intelligent monitoring device and the blockchain node, the intelligent monitoring device responds to allow the file to be downloaded, and returns a folder list that can be downloaded at the same time;

[0038] After the authenticated device selects a target file to be downloaded from the folder list, the intelligent monitoring device returns the AES-encrypted target file and a target folder number where the target file is located;

[0039] The authenticated device finds the corresponding AES key according to the target folder number, decrypts the target file by using the AES key, and saves the target file.

[0040] Optionally, the blockchain-based intelligent monitoring device security protection method further comprises:

[0041] The authenticated device initiates a request for deleting a file to the intelligent monitoring device, and the request information for deleting the file contains the to-be-authenticated device information of the authenticated device encrypted by the RSA public key of the authenticated device;

[0042] The authenticated device matches the to-be-authenticated device information with the authenticated device information stored in the blockchain node at the same time;

[0043] The intelligent monitoring device decrypts the to-be-authenticated device information by using the RSA private key, queries whether the to-be-authenticated device information currently initiating the request is contained in the currently stored authenticated device information, and queries whether the to-be-authenticated device information is contained in the blockchain node at the same time;

[0044] If the to-be-authenticated device information is contained in both the intelligent monitoring device and the blockchain node, the intelligent monitoring device responds to allow the file to be deleted, and returns a folder list that can be deleted at the same time;

[0045] After the authenticated device selects the target file to be deleted from the folder list, the intelligent monitoring device deletes the target file;

[0046] If the authenticated device selects to delete the entire target folder, the corresponding AES key in the local authenticated device also needs to be deleted.

[0047] Optionally, the blockchain-based intelligent monitoring device security protection method further comprises:

[0048] When the user device accesses the intelligent monitoring device, record the user device access information and write it into the blockchain node; the user device access information includes the device name, MAC address and current timestamp;

[0049] When the user device interacts with the data on the intelligent monitoring device, record the user device behavior information on the data and write it into the blockchain node.

[0050] Optionally, the blockchain-based intelligent monitoring device security protection method further comprises:

[0051] When the intelligent monitoring device manufacturer directly accesses the intelligent monitoring device through the reserved technical vulnerability, match the information of the current visitor with the authenticated device information stored in the blockchain node, and then return the matching result;

[0052] If the matching result is not matched, refuse access and record the access behavior of the current visitor and write it into the blockchain node.

[0053] According to the specific embodiments provided by the present application, the following technical effects are disclosed:

[0054] The present application provides a blockchain-based intelligent monitoring device security protection method and system, which designs a double authentication mechanism of blockchain-intelligent monitoring device to prevent illegal access; based on asymmetric encryption (RSA) and symmetric encryption (AES) hybrid encryption, a monitoring data encryption storage mechanism is designed to protect the privacy of users on the intelligent monitoring device from being leaked; through the blockchain technology, all user device interaction data are recorded and the user usage right is clarified, so as to prevent the data of the intelligent monitoring device from being tampered with, and further to protect the data credibility. Therefore, the intelligent monitoring device security protection method and system can effectively prevent the login authentication risk, privacy leakage risk and data tampering risk in the data access and interaction process, and improve the security of the data access and interaction process. BRIEF DESCRIPTION OF DRAWINGS

[0055] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed in the embodiments. Obviously, the drawings described below only constitute some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.

[0056] Figure 1 Figure 1 is a schematic diagram of the overall architecture of a blockchain-based intelligent monitoring device security protection system of the present application.

[0057] Figure 2 Figure 2 is a schematic diagram of the main device authentication process.

[0058] Figure 3 Figure 3 is a schematic diagram of the authentication process of other devices.

[0059] Figure 4 Figure 4 is a schematic diagram of the authentication process of unauthenticated devices.

[0060] Figure 5 Figure 5 is a schematic diagram of the file upload process of authenticated devices.

[0061] Figure 6 Figure 6 is a schematic diagram of the file download (browsing) process of authenticated devices.

[0062] Figure 7 Figure 7 is a schematic diagram of the user device behavior recording process.

[0063] Figure 8 Figure 8 is a schematic diagram of the access right confirmation process. DETAILED DESCRIPTION

[0064] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments only constitute some embodiments of the present application, and all other embodiments obtained by those skilled in the art without creative labor based on the embodiments in the present application also belong to the scope of protection of the present application.

[0065] In view of the key threats to current intelligent monitoring devices, the present application provides a blockchain-based intelligent monitoring device security protection method and system to effectively prevent login authentication risks, privacy leakage risks and data tampering risks in the data access and interaction process, and improve the security of the data access and interaction process.

[0066] In order to make the above-mentioned purposes, features and advantages of the present application more apparent and easy to understand, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0067] Figure 1It is a whole architecture diagram of the intelligent monitoring device security protection system based on the blockchain. Referring to Figure 1 , the intelligent monitoring device security protection system comprises a user device, an intelligent monitoring device and a distributed ledger. The user device comprises an authenticated device and an unauthenticated device; the authenticated device comprises an authenticated master device and an authenticated other device; and the distributed ledger comprises a plurality of blockchain nodes.

[0068] The authenticated device is a data provider and a data access party, and comprises a master device (super administrator) and other devices, holds an RSA public key, has AES encryption and decryption functions, and can interact with the intelligent monitoring device through a user device such as a mobile phone, a tablet computer or a computer.

[0069] The unauthenticated device is a data access party, and the intelligent monitoring device does not record the relevant device information. After authentication, the unauthenticated device can interact with the intelligent monitoring device.

[0070] The intelligent monitoring device is a data owner, and can store the encrypted data of the master device and other authenticated devices. The intelligent monitoring device has RSA encryption and decryption functions and AES encryption and decryption functions, and lacks a screen lock password, traditional face, fingerprint and other biometric authentication capabilities.

[0071] The distributed ledger is a data recording party, and stores user device information (MAC address, operating system, version number and device type information) and user behavior information (user login, upload, download and delete file data behavior information). The user device information is written into the blockchain node, and the corresponding Json string is generated according to the user behavior and written into the blockchain node.

[0072] Based on the whole architecture of the intelligent monitoring device security protection system, the present application proposes a technical solution for illegal user login authentication risk, which comprises a user access control function, a data encryption storage function and a user behavior recording function. The user access control function comprises a master device authentication, an other device authentication and an unauthenticated device access; the data encryption storage function comprises a file upload, a file download (browsing) and a file deletion; and the user behavior recording function comprises a behavior recording and an access right confirmation.

[0073] 1) User access control function

[0074] The user access control function comprises a master device authentication, an other device authentication and an unauthenticated device access, and realizes the control of the safe access of the intelligent monitoring device, thereby effectively protecting the data security of the intelligent monitoring device.

[0075] 1.1) Master device authentication

[0076] The master device authentication is to make the master device exist as a super administrator role, and realize the management of other devices. The master device is the user device accessing the smart monitoring device for the first time, and can grant authentication permission to other devices. The master device saves the RSA public key and an admin identifier sent by the smart monitoring device, which are used for verification when interacting with the smart monitoring device. The mac address and the admin identifier of the master device are saved on the smart monitoring device and the blockchain, which are used for verification when interacting with the smart monitoring device.

[0077] Figure 2 The master device authentication process is shown in FIG. 1. The master device authentication process includes the following steps. Figure 2

[0078] 1.1.1) The master device initiates an authentication operation to the smart monitoring device (the master device initiating the authentication operation for the first time is the super administrator);

[0079] 1.1.2) The smart monitoring device receives the authentication request and returns an RSA public key + admin identifier;

[0080] 1.1.3.1) The master device combines the current mac address + admin identifier, encrypts the combined master device information using the RSA public key returned by the smart monitoring device, and sends the encrypted master device information {RSA(mac+admin)} to the smart monitoring device; 1.1.3.2) At the same time, the master device combines the current mac address + admin identifier, and writes the combined master device information (mac+admin) into the blockchain;

[0081] 1.1.4) The smart monitoring device decrypts {RSA(mac+admin)} using the RSA private key, and stores the combined information (mac+admin) into the local device for user access verification.

[0082] 1.2) Other device authentication

[0083] The other device authentication is to be authenticated as a part of the authenticated devices and bear the corresponding management role. The other device authenticated by the master device can be authenticated with the smart monitoring device. The other device saves the RSA public key and an other identifier sent by the smart monitoring device, which are used for verification when interacting with the smart monitoring device. The mac address and the other identifier of the other device are saved on the smart monitoring device and the blockchain, which are used for verification when interacting with the smart monitoring device.

[0084] Figure 3 The other device authentication process is shown in FIG. 2. The other device authentication process includes the following steps. Figure 3

[0085] ​​1.2.1) The master device can authenticate other devices and grant them corresponding permissions to interact with the smart monitoring device;

[0086] 1.2.2) The other devices respond to the authentication;

[0087] 1.2.3) The authenticated other devices initiate an authentication request to the smart monitoring device;

[0088] 1.2.4) The smart monitoring device receives the authentication request and returns an RSA public key + other identifier;

[0089] 1.2.5.1) The other device combines the current mac address + other identifier, encrypts it using the RSA public key returned by the smart monitoring device, and sends the encrypted other device information {RSA(mac+other)} to the smart monitoring device; 1.2.5.2) At the same time, the authenticated other device combines the current mac address + other identifier, and writes the combined other device information (mac+other) into the blockchain;

[0090] 1.2.6) Decrypt the user device information (mac+other) using the RSA private key, and store the combined information (mac+other) locally for user access verification.

[0091] 1.3) Unauthenticated device access

[0092] When an unauthenticated device accesses, it will match the authenticated device information stored on the smart monitoring device and the authenticated device information stored on the blockchain (since it is an unauthenticated device, the matching result is failure). Then the smart monitoring device will initiate a request to the authenticated device to ask if it is allowed to access, which is used to send an "alarm" information. If the request is passed, the unauthenticated device can interact with the smart monitoring device, otherwise, it is directly denied access; Since the smart monitoring device does not record the relevant information of the unauthenticated device, only after the master device authentication can it access the smart monitoring device, if the unauthenticated device frequently accesses, it can be put into the blacklist; The unauthenticated device does not have the RSA key sent by the smart monitoring device and does not contain the corresponding device record in the blockchain, even if it imitates the mac information of the authenticated device, it cannot access the data.

[0093] Figure 4 The authentication process for unauthenticated devices is shown in Figure 4 , the unauthenticated device access process includes:

[0094] 1.3.1) The unauthenticated device starts accessing data;

[0095] 1.3.2.1) the unauthenticated device matches the device information stored locally by the intelligent monitoring device; 1.3.2.2) matches the device information stored in the blockchain at the same time;

[0096] 1.3.3) if the matching fails, an alarm information is sent to the authenticated user to verify the current device;

[0097] 1.3.4.1) if the authenticated device agrees to access, the unauthenticated device can temporarily access the intelligent monitoring device; 1.3.4.2) the authenticated device can directly refuse access; if there is a malicious access, similar to a ddos attack, the unauthenticated user can be blacklisted.

[0098] 2) Data encryption storage function

[0099] The data encryption storage function is divided into three parts, including file upload, file download (browsing) and file deletion, which realizes the basic operation of the data in the intelligent monitoring device, strictly checks the device operating the intelligent monitoring device, and ensures the data security of the intelligent monitoring device.

[0100] 2.1) File upload

[0101] The file upload realizes the function that the encrypted data can be uploaded to the specified location of the intelligent monitoring device. The authenticated device generates a request information according to the authenticated device information encrypted by the RSA public key {RSA(mac+admin / other)} to access the intelligent monitoring device, and the intelligent monitoring device queries the "mac address+identification" in the device information storage (which can be understood as a small database) for verification, and sends the request information "mac address+identification" to match the device record in the blockchain for verification. After the double verification, data interaction with the intelligent monitoring device can be carried out. Assuming that the folder in the intelligent monitoring device has an id (number), the authenticated device encodes according to the folder id to be uploaded, and the encoded id is used as the key of the AES encrypted data. The AES key is stored in the local device, and the AES encrypted data is uploaded to the intelligent monitoring device, ensuring that the transmission process is in the form of ciphertext data transmission.

[0102] Figure 5 The file upload process diagram for the authenticated device is shown in Figure 5 , which includes:

[0103] 2.1.1.1) the authenticated device initiates a request to upload files to the intelligent monitoring device, and the request information contains the information encrypted by the RSA public key of the current device {RSA(mac+admin / other)}; 2.1.1.2) the authenticated device matches the request information {mac+admin / other} with the device information stored in the blockchain at the same time;

[0104] 2.1.2.1) The intelligent monitoring device decrypts the relevant device information using the RSA private key and queries whether the current device information initiating the request is included in the currently stored authenticated device information; 2.1.2.2) Query whether the current device information is included in the blockchain;

[0105] 2.1.3) After both steps 2.1.2) are successfully matched, the intelligent monitoring device responds to the uploadable data and returns the list of uploadable folders (for example, numbers 001, 002);

[0106] 2.1.4.1) Encode the selected folder number as the key for AES encrypted data, and perform AES encryption on the data to be uploaded; 2.1.4.2) Save the AES encrypted key in the current device;

[0107] 2.1.5) The authenticated device starts uploading the encrypted data.

[0108] 2.2) File download (browsing)

[0109] The file download (browsing) realizes the function of downloading the encrypted data in the specified location of the intelligent monitoring device. After the authenticated device is verified by the intelligent monitoring device and the blockchain, the corresponding file is selected for download, and the memory of the intelligent monitoring device returns the previous ciphertext data and the folder number (id) of the folder where the target file to be downloaded is located. The authenticated device finds the corresponding AES key in the local storage of multiple keys according to the folder id, decrypts the received data, and stores the data locally. If the data is viewed, the decrypted data can be loaded into the memory or stored locally, and the data can be cleared after viewing.

[0110] Figure 6 The file download (browsing) process for the authenticated device is shown in FIG. 2, which includes the following steps: Figure 6

[0111] 2.2.1.1) The authenticated device initiates a request to the intelligent monitoring device to download the file, and the request information includes the information encrypted by the RSA public key of the current device {RSA(mac+admin / other)}; 2.2.1.2) The authenticated device simultaneously matches the request information {mac+admin / other} with the device information stored in the blockchain;

[0112] ​2.2.2.1) The intelligent monitoring device decrypts the relevant device information {RSA(mac+admin / other)} using the RSA private key and queries whether the currently initiated device information is included in the currently stored authenticated device information; 2.2.2.2) Query the blockchain for device information;

[0113] 2.2.3) After the double authentication of step 2.2.2) is successfully matched, the intelligent monitoring device responds to the download data;

[0114] 2.2.4) The authenticated device selects the required download file;

[0115] 2.2.5) The intelligent monitoring device returns the encrypted file data and the folder number where the file is located (assuming the current selection is id "001" folder);

[0116] 2.2.6) The authenticated device finds the corresponding AES key according to the folder number;

[0117] 2.2.7) The authenticated device decrypts the original data and saves it in the current device.

[0118] 2.3) File deletion

[0119] After the authenticated device is verified by the intelligent monitoring device and the blockchain, it initiates a deletion request and sends the file information to be deleted to the intelligent monitoring device, which deletes the corresponding encrypted file. If the entire folder is deleted, the AES key on the authenticated device needs to be deleted.

[0120] 3) User behavior recording function

[0121] The user behavior recording function is divided into two parts, including behavior recording and access right confirmation, which realizes the monitoring of all behaviors on the intelligent monitoring device and the confirmation of access rights, retains all behavior records, and ensures that the data of the intelligent monitoring device cannot be tampered with.

[0122] 3.1) Behavior recording

[0123] The behavior record realizes the record of all interactions of the intelligent monitoring device, including access record and data interaction record. When any user device accesses the intelligent monitoring device, the current device related information (including device name, MAC address, current timestamp) is recorded, and the corresponding device information is written into the blockchain in the form of a Json string "{name, mac, time}". Similarly, when any user device interacts with the data on the intelligent monitoring device, the corresponding operation behavior (including device name, MAC address, user behavior, current timestamp) is written into the blockchain in the format "{name, mac, operation, time}".

[0124] Figure 7 A schematic diagram of the user device behavior record process is shown in Figure 7 The behavior record process includes:

[0125] 3.1.1.1) any user device accesses the intelligent monitoring device; 3.1.1.2) records the access information of any user device {name, mac, time} and writes it into the blockchain;

[0126] 3.1.2.1) any user device interacts with the data on the intelligent monitoring device; 3.1.2.2) records the behavior information of any user device on the data {name, mac, operation, time} and writes it into the blockchain.

[0127] 3.2) Access right confirmation

[0128] The access right confirmation realizes the guarantee of the data access right of the intelligent monitoring device. Whether it is the manufacturer of the intelligent monitoring device or the unauthenticated device, it needs to be authenticated by the intelligent monitoring device and the blockchain. Even if the merchant bypasses the authentication of the intelligent monitoring device, it cannot pass the access authentication on the blockchain, and this behavior will also be recorded on the blockchain.

[0129] Figure 8 A schematic diagram of the access right confirmation process is shown in Figure 8 The access right confirmation process includes:

[0130] 3.2.1) the merchant obtains the access right of the data;

[0131] 3.2.2) the merchant can directly pass the verification of the intelligent monitoring device through the reserved technical vulnerability;

[0132] 3.2.3) even if it passes the verification of the intelligent monitoring device, it still needs to be verified on the blockchain;

[0133] 3.2.4) According to the information of the current visitor, the device information stored on the blockchain is matched, and then the matching result is returned (the confirmation of access right needs to pass double authentication);

[0134] 3.2.5) Record the access behavior of the current merchant.

[0135] It can be seen that the intelligent monitoring device security protection system designs double authentication of blockchain-intelligent monitoring device to ensure the security of data access, designs a hybrid encryption data privacy protection mechanism to avoid data leakage after the device is lost. In addition, the intelligent monitoring device security protection system of the application collects the behavior record of the user and writes it into the blockchain, so that the data of the user is not tampered with.

[0136] Based on the intelligent monitoring device security protection system, the application further provides a blockchain-based intelligent monitoring device security protection method, comprising:

[0137] The main device initiates an authentication request to the intelligent monitoring device;

[0138] The intelligent monitoring device receives the authentication request and returns an RSA public key and an admin identifier;

[0139] The authenticated main device combines the current mac address with the admin identifier, and uses the RSA public key for encryption, and sends the encrypted main device information to the intelligent monitoring device;

[0140] The authenticated main device combines the current mac address with the admin identifier, and writes the combined main device information into the blockchain node;

[0141] The intelligent monitoring device uses the RSA private key to decrypt the encrypted main device information, and stores the decrypted main device information in the local for access verification of the authenticated main device.

[0142] Further, the intelligent monitoring device security protection method further comprises:

[0143] The authenticated main device authenticates other devices and gives other devices the right to interact with the intelligent monitoring device;

[0144] After responding to the main device authentication, the other device initiates an authentication request to the intelligent monitoring device as an authenticated other device;

[0145] The intelligent monitoring device receives the authentication request of the authenticated other device and returns an RSA public key and an other identifier;

[0146] The authenticated other device combines the current mac address with the other identifier, and uses the RSA public key for encryption, and sends the encrypted other device information to the intelligent monitoring device;

[0147] The other device that has been authenticated combines the current MAC address with the other identifier, and writes the combined other device information into the blockchain node;

[0148] The smart monitoring device decrypts the encrypted other device information using the RSA private key, and stores the decrypted other device information locally for access verification of the authenticated other device.

[0149] The smart monitoring device security protection method further comprises:

[0150] When an unauthenticated device requests to access the data stored in the smart monitoring device, the smart monitoring device matches the unauthenticated device information with the authenticated device information stored locally and the authenticated device information stored in the blockchain node; the authenticated device information includes authenticated master device information and other device information;

[0151] If the matching fails, the smart monitoring device sends an alarm information to the authenticated device to confirm whether the authenticated device agrees to the access of the unauthenticated device;

[0152] If the authenticated device agrees to the access, the unauthenticated device can temporarily access the smart monitoring device;

[0153] During the temporary access, if the unauthenticated device has malicious access, the authenticated device can blacklist the unauthenticated device;

[0154] If the authenticated device refuses the access, the unauthenticated device cannot access the smart monitoring device.

[0155] The smart monitoring device security protection method further comprises:

[0156] The authenticated device initiates a request to upload a file to the smart monitoring device, and the upload file request information contains the self-to-be-authenticated device information of the authenticated device encrypted using the RSA public key;

[0157] The authenticated device matches the self-to-be-authenticated device information with the authenticated device information stored in the blockchain node;

[0158] The smart monitoring device decrypts the to-be-authenticated device information using the RSA private key, queries whether the to-be-authenticated device information currently initiating the request is included in the authenticated device information currently stored, and queries whether the to-be-authenticated device information is included in the blockchain node;

[0159] If the smart monitoring device and the blockchain node both include the to-be-authenticated device information, the smart monitoring device responds to allow the upload of the file, and returns a list of folders that can be uploaded;

[0160] The authenticated device selects a target folder in the folder list, encodes the number of the selected target folder as an AES key of the AES encrypted data, stores the AES key in the current authenticated device, and encrypts the file to be uploaded by using the AES key;

[0161] The authenticated device uploads the AES encrypted file to the intelligent monitoring device.

[0162] The intelligent monitoring device security protection method further comprises:

[0163] The authenticated device initiates a file downloading request to the intelligent monitoring device, and the file downloading request information contains the authenticated device information of the authenticated device encrypted by using the RSA public key;

[0164] The authenticated device matches the authenticated device information of the authenticated device stored in the blockchain node with the authenticated device information of the authenticated device;

[0165] The intelligent monitoring device decrypts the authenticated device information by using the RSA private key, queries whether the authenticated device information of the current authenticated device information contains the authenticated device information of the current request, and queries whether the current authenticated device information is contained in the blockchain node;

[0166] If the current authenticated device information is contained in the intelligent monitoring device and the blockchain node, the intelligent monitoring device responds to allow the file to be downloaded, and returns a folder list that can be downloaded;

[0167] After the authenticated device selects a target file to be downloaded from the folder list, the intelligent monitoring device returns the AES encrypted target file and the target folder number of the target file;

[0168] The authenticated device finds the corresponding AES key according to the target folder number, decrypts the target file by using the AES key, and saves the target file.

[0169] The intelligent monitoring device security protection method further comprises:

[0170] The authenticated device initiates a file deletion request to the intelligent monitoring device, and the file deletion request information contains the authenticated device information of the authenticated device encrypted by using the RSA public key;

[0171] The authenticated device matches the authenticated device information of the authenticated device stored in the blockchain node with the authenticated device information of the authenticated device;

[0172] The intelligent monitoring device decrypts the authenticated device information by using the RSA private key, queries whether the authenticated device information of the current authenticated device information contains the authenticated device information of the current request, and queries whether the current authenticated device information is contained in the blockchain node;

[0173] If the current to-be-authenticated device information is contained in both the intelligent monitoring device and the blockchain node, the intelligent monitoring device responds to allow the deletion of the file, and returns a list of folders that can be deleted at the same time;

[0174] After the authenticated device selects the target file to be deleted from the folder list, the intelligent monitoring device deletes the target file;

[0175] If the authenticated device selects to delete the entire target folder, the corresponding AES key in the authenticated device needs to be deleted.

[0176] The intelligent monitoring device security protection method further comprises:

[0177] When the user device accesses the intelligent monitoring device, record the user device access information and write it into the blockchain node; the user device access information includes the device name, MAC address and current timestamp;

[0178] When the user device interacts with the data on the intelligent monitoring device, record the user device behavior information on the data and write it into the blockchain node.

[0179] The intelligent monitoring device security protection method further comprises:

[0180] When the intelligent monitoring device manufacturer directly accesses the intelligent monitoring device through the reserved technical vulnerability, match the information of the current visitor with the authenticated device information stored in the blockchain node, and then return the matching result;

[0181] If the matching result is not matched, refuse access and record the access behavior of the current visitor and write it into the blockchain node.

[0182] The present application designs a double authentication of blockchain-intelligent monitoring device to ensure the security of data access, based on hybrid encryption of asymmetric encryption (RSA) and symmetric encryption (AES), realizes the privacy protection of data on the intelligent monitoring device, and avoids data leakage after the loss of the device. In addition, the present application records the device interaction information through the blockchain technology, so as to protect the network user safety behavior, prevent the user data privacy leakage or tampering. The specific contribution points of the method and system of the present application are as follows:

[0183] 1. A dual authentication mechanism based on blockchain; to prevent illegal access by illegal users or improper use by legal users, to ensure that intelligent monitoring devices with limited computing and storage capabilities can be reasonably and properly utilized, the invention designs a dual authentication mechanism of blockchain-intelligent monitoring device to ensure user access control security, to prevent unauthorized users from accessing illegally and illegal users from accessing illegally; user device information will be stored on the intelligent monitoring device and the blockchain respectively, dual authentication means that when a user initiates access to the intelligent monitoring device, the stored user device information on the intelligent monitoring device and the stored user device information on the blockchain need to be matched simultaneously; only when the matching on the intelligent monitoring device and the blockchain is passed can the user interact with the intelligent monitoring device.

[0184] 2. Hybrid encryption data privacy protection mechanism; to protect the data stored on the intelligent monitoring device, the traditional data privacy protection scheme is to use common symmetric encryption algorithm to encrypt and store the data; but if the device is lost or stolen, the encrypted data and the symmetric key stored on the intelligent monitoring device will be known by the attacker, and the encrypted data stored on the intelligent monitoring device will be directly recovered, resulting in the leakage of the user's private data stored on the device; the invention is based on hybrid encryption of asymmetric encryption (RSA) and symmetric encryption (AES), and designs a data privacy protection mechanism that separates encrypted data and keys, specifically: (i) the user device encrypts its own device information using the RSA public key, and the intelligent monitoring device decrypts it using the RSA private key, which is used to verify whether the user device has access rights; (ii) when the user device needs to upload files, it uses AES encryption to ensure that the transmission process is in ciphertext form, and the decryption key is saved locally on the user device, separated from the intelligent monitoring device; this ensures the privacy of the data stored on the intelligent monitoring device.

[0185] 3. User behavior recording mechanism based on blockchain; traditional protection modes can be divided into two layers, the first layer of protection uses boundary protection to protect network data; the second layer is to set permissions or encrypt data to achieve protection, but such a mode is vulnerable to network attacks; blockchain is a mechanism for multiple parties to reach a trusted record and trusted contract, making this technology applicable to implement user behavior recording functions; therefore, the invention designs a user behavior recording process based on blockchain, specifically: (i) any user device access will trigger the recording mechanism, including user access to the intelligent monitoring device and add, delete, modify and query operations on the intelligent monitoring device; (ii) each behavior of any user device will generate a corresponding behavior record Json string, including username, MAC address, behavior and timestamp, and then write it to the blockchain, ensuring that the user's behavior record cannot be tampered with.

[0186] The various embodiments described in this specification are intended to be exemplary only, and the same or similar implementations can be used in conjunction with other embodiments to achieve the same or similar results. Accordingly, the embodiments described in this specification are not intended to be exhaustive or to be limited to the embodiments described in this specification.

[0187] The principles and implementations of the present application are described in this specification using specific examples, and the description of the above embodiments is only to help understand the method of the present application and its core idea; at the same time, for those skilled in the art, according to the idea of the present application, the specific implementation and application range will also be changed. In view of the above, the content of the specification should not be understood as a limitation of the present application.

[0188] For example, one possible alternative is an intelligent monitoring device security protection system based on artificial intelligence, which can learn and analyze the behavior patterns of monitoring devices, timely discover abnormal situations and give early warnings and defenses. At the same time, the system can also use automation technology to remotely manage and maintain the monitoring devices, ensuring the stable operation and security of the devices.

[0189] Another alternative is an intelligent monitoring device security protection system based on Internet of Things technology, which can connect monitoring devices and other smart devices to achieve information sharing and collaborative defense between devices. At the same time, the system can also use sensors and data analysis technology to monitor and analyze the environment and state of the monitoring devices in real time, timely discover abnormal situations and give early warnings and defenses.

Claims

1.A blockchain-based intelligent monitoring device security protection method, characterized in that, The application is applied to a blockchain-based intelligent monitoring device security protection system, which comprises a user device, an intelligent monitoring device and a distributed ledger; the user device comprises an authenticated device and an unauthenticated device; the authenticated device comprises an authenticated master device and an authenticated other device; The distributed ledger comprises a plurality of blockchain nodes; The intelligent monitoring device security protection method comprises: The master device initiates an authentication request to the intelligent monitoring device; The intelligent monitoring device receives the authentication request and returns an RSA public key and an admin identifier; The authenticated master device combines the current MAC address with the admin identifier and encrypts the master device information using the RSA public key, and sends the encrypted master device information to the intelligent monitoring device; The authenticated master device combines the current MAC address with the admin identifier, and writes the combined master device information into the blockchain node; The intelligent monitoring device decrypts the encrypted master device information using the RSA private key, and stores the decrypted master device information locally for access verification of the authenticated master device; The authenticated master device authenticates the other device and grants the other device the right to interact with the intelligent monitoring device; The other device initiates an authentication request to the intelligent monitoring device as an authenticated other device in response to the master device authentication; The intelligent monitoring device receives the authentication request of the authenticated other device and returns an RSA public key and an other identifier; The authenticated other device combines the current MAC address with the other identifier and encrypts the other device information using the RSA public key, and sends the encrypted other device information to the intelligent monitoring device; The authenticated other device combines the current MAC address with the other identifier, and writes the combined other device information into the blockchain node; The intelligent monitoring device decrypts the encrypted other device information using the RSA private key, and stores the decrypted other device information locally for access verification of the authenticated other device. 2.The blockchain-based intelligent monitoring device security protection method of claim 1, wherein, Further comprising: When an unauthenticated device requests to access the data stored in the intelligent monitoring device, the intelligent monitoring device matches the unauthenticated device information with the authenticated device information stored locally and the authenticated device information stored in the blockchain node; the authenticated device information comprises authenticated master device information and other device information; If the matching fails, the intelligent monitoring device sends an alarm information to the authenticated device to confirm whether the authenticated device agrees to the access of the unauthenticated device; If the authenticated device agrees to the access, the unauthenticated device can temporarily access the intelligent monitoring device; During the temporary access, if the unauthenticated device has malicious access, the authenticated device can blacklist the unauthenticated device; If the authenticated device refuses the access, the unauthenticated device cannot access the intelligent monitoring device. 3.The blockchain-based intelligent monitoring device security protection method of claim 1, wherein, Further comprising: The authenticated device initiates a request to upload a file to the intelligent monitoring device, and the upload file request information contains the authenticated device information encrypted by the authenticated device using the RSA public key; The authenticated device matches the authenticated device information with the authenticated device information stored in the blockchain node; The intelligent monitoring device decrypts the to-be-authenticated device information by using the RSA private key, queries whether the to-be-authenticated device information currently initiating the request is contained in the currently stored authenticated device information, and simultaneously queries whether the to-be-authenticated device information is contained in the blockchain node; If the to-be-authenticated device information is contained in both the intelligent monitoring device and the blockchain node, the intelligent monitoring device responds to allow uploading of the file, and simultaneously returns a folder list that can be uploaded; The authenticated device selects a target folder in the folder list, encodes the selected target folder number as an AES key of the AES encrypted data and stores the AES key in the current authenticated device, and uses the AES key to perform AES encryption on the to-be-uploaded file; The authenticated device uploads the AES encrypted file to the intelligent monitoring device. 4.The blockchain-based intelligent monitoring device security protection method of claim 3, wherein, Further comprising: The authenticated device initiates a request for downloading a file to the intelligent monitoring device, and the request information for downloading the file contains to-be-authenticated device information of the authenticated device encrypted by using an RSA public key; The authenticated device simultaneously matches the to-be-authenticated device information with authenticated device information stored in the blockchain node; The intelligent monitoring device decrypts the to-be-authenticated device information by using the RSA private key, queries whether the to-be-authenticated device information currently initiating the request is contained in the currently stored authenticated device information, and simultaneously queries whether the to-be-authenticated device information is contained in the blockchain node; If the to-be-authenticated device information is contained in both the intelligent monitoring device and the blockchain node, the intelligent monitoring device responds to allow downloading of the file, and simultaneously returns a folder list that can be downloaded; After the authenticated device selects a target file to be downloaded from the folder list, the intelligent monitoring device returns the AES encrypted target file and a target folder number of the target file; The authenticated device finds a corresponding AES key according to the target folder number, and decrypts the target file by using the AES key and saves the target file. 5.The blockchain-based intelligent monitoring device security protection method of claim 3, wherein, Further comprising: The authenticated device initiates a request for deleting a file to the intelligent monitoring device, and the request information for deleting the file contains to-be-authenticated device information of the authenticated device encrypted by using an RSA public key; The authenticated device simultaneously matches the to-be-authenticated device information with authenticated device information stored in the blockchain node; The intelligent monitoring device decrypts the to-be-authenticated device information by using the RSA private key, queries whether the to-be-authenticated device information currently initiating the request is contained in the currently stored authenticated device information, and simultaneously queries whether the to-be-authenticated device information is contained in the blockchain node; If the to-be-authenticated device information is contained in both the intelligent monitoring device and the blockchain node, the intelligent monitoring device responds to allow deleting of the file, and simultaneously returns a folder list that can be deleted; After the authenticated device selects a target file to be deleted from the folder list, the intelligent monitoring device deletes the target file; If the authenticated device selects to delete an entire target folder, the corresponding AES key in the authenticated device also needs to be deleted. 6.The blockchain-based intelligent monitoring device security protection method of claim 1, wherein, Further comprising: When a user device accesses the intelligent monitoring device, user device access information is recorded and written into the blockchain node; The user device access information includes a device name, a MAC address and a current timestamp; When user equipment interacts with data on intelligent monitoring equipment, the user equipment's behavior information on the data is recorded and written to the blockchain node. 7.The blockchain-based intelligent monitoring device security protection method of claim 1, wherein, Also includes: When a smart monitoring equipment manufacturer directly passes the verification of the smart monitoring equipment through a reserved technical vulnerability, the information of the current visitor is matched with the information of the certified equipment stored on the blockchain node, and then the matching result is returned. If the matching result is that the information does not match, access is denied and the current visitor's access behavior is recorded and written to the blockchain node.

Images