Data security transmission method for smart home

Abstract

The present invention discloses a data security transmission method for smart home, which relates to the technical field of data transmission, including: obtaining N data interaction nodes in the smart home intranet, and obtaining the connectivity relationship of the interaction nodes, establishing the intranet topology structure, and generating the association identifiers between the data interaction nodes; obtaining the real-time flowing intranet data set; obtaining the node features of the interaction nodes, and establishing a dynamic evaluation window mapped with the interaction nodes; establishing feature extraction results and node impact features through feature extraction; performing node anomaly identification through the feature extraction results to generate a first anomaly identification result; performing impact anomaly identification through the node impact features to generate a second anomaly identification result; performing comprehensive impact evaluation on the anomaly identification results, establishing anomaly identification, and performing data security transmission management for smart home. The present invention solves the technical problem that the prior art has insufficient security when performing data transmission in smart home, and achieves the technical effect of improving the security of data transmission.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission, and in particular to a data security transmission method for smart homes. Background Art

[0002] With the rapid development of modern smart home technology, the types and number of smart devices are increasing, and smart home systems are becoming more and more popular. However, with the increase in the number of devices and the diversification of functions, the data transmission and security management of smart home systems are also facing increasing challenges. As smart home devices are connected to the Internet, security issues in the data transmission process become more prominent, and data leakage is prone to occur. Summary of the invention

[0003] The present application provides a data security transmission method for smart homes, which is used to solve the technical problem that the prior art has insufficient security when performing data transmission in smart homes.

[0004] In view of the above problems, the present application provides a data security transmission method for smart home.

[0005] The present application provides a data security transmission method for smart home, the method comprising:

[0006] Establish intranet communication with the smart home, and obtain N data interaction nodes of the intranet of the smart home, where N is an integer greater than 1; obtain the connectivity relationship of the N data interaction nodes, establish an intranet topology based on the connectivity relationship, and generate an association identifier between the data interaction nodes based on the intranet topology, where the association identifier is a unidirectional association identifier; configure a network monitoring system, monitor the intranet of the smart home through the network monitoring system, and obtain a real-time flowing intranet data set; obtain node features of the N data interaction nodes, input the node features into a window matching network, and establish a dynamic evaluation window mapped with the N data interaction nodes; adjust the dynamic evaluation window with the dynamic evaluation window; Use historical data of the mapped data interaction node, perform feature extraction of long and short windows through the historical data, establish feature extraction results, call the feature extraction results with the association identifier, and establish node influence features of the data interaction node; perform node anomaly identification of independent data interaction nodes on the intranet data set through the feature extraction results to generate a first anomaly identification result; perform impact anomaly identification of the intranet data set through the node influence feature to generate a second anomaly identification result; perform a comprehensive impact evaluation on the first anomaly identification result and the second anomaly identification result, establish an identification anomaly, and perform data security transmission management of the smart home through the identification anomaly.

[0007] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0008] The present application establishes intranet communication with a smart home, and obtains N data interaction nodes of the intranet of the smart home, where N is an integer greater than 1; obtains connectivity relationships of the N data interaction nodes, establishes an intranet topology based on the connectivity relationships, and generates association identifiers between data interaction nodes based on the intranet topology, where the association identifiers are unidirectional association identifiers; configures a network monitoring system, monitors the intranet of the smart home through the network monitoring system, and obtains a real-time flowing intranet data set; obtains node features of the N data interaction nodes, inputs the node features into a window matching network, and establishes a dynamic evaluation window mapped to the N data interaction nodes; calls historical data of the mapped data interaction nodes with the dynamic evaluation window, extracts features of long and short windows with the historical data, establishes feature extraction results, calls feature extraction results with association identifiers, and establishes node influence features of the data interaction nodes; performs node anomaly identification of independent data interaction nodes on the intranet data set through the feature extraction results, and generates a first anomaly identification result; performs influence anomaly identification of the intranet data set through the node influence feature, and generates a second anomaly identification result; performs comprehensive impact evaluation on the first anomaly identification result and the second anomaly identification result, establishes an identification anomaly, and performs data security transmission management of the smart home through the identification anomaly. The present invention solves the technical problem of insufficient security in the prior art when transmitting data in smart homes. It achieves the technical effect of improving the security of data transmission by establishing intranet communication with the smart home, monitoring and managing data interaction nodes in real time, and dynamically adjusting and optimizing the data transmission process. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0010] Figure 1 A schematic diagram of a method for secure data transmission for smart homes provided in an embodiment of the present application;

[0011] Figure 2 A schematic diagram of a process for obtaining node characteristics of data interaction nodes in a method for secure data transmission for smart homes provided in an embodiment of the present application. DETAILED DESCRIPTION

[0012] The present application provides a data security transmission method for smart homes, which is used to solve the technical problem that the existing technology has insufficient security when transmitting data in smart homes. By establishing intranet communication with the smart home, real-time monitoring and management of data interaction nodes, and dynamically adjusting and optimizing the data transmission process, the technical effect of improving the security of data transmission is achieved.

[0013] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0014] It should be noted that any variations of the terms "include" and "have" are intended to cover non-exclusive inclusions. For example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or modules that are not explicitly listed or inherent to these processes, methods, products or devices.

[0015] like Figure 1 As shown, the present application provides a data security transmission method for smart home, the method comprising:

[0016] Step S100: Establish intranet communication with the smart home, and obtain N data interaction nodes of the intranet of the smart home, where N is an integer greater than 1.

[0017] In the embodiment of the present application, the intranet communication of the smart home is first established through the router and the gateway. All devices in the smart home system are connected to the same central router or gateway. When connecting, the devices are connected to the network by using wireless communication protocols (such as Wi-Fi, Zigbee, Z-Wave, Bluetooth, etc.) or wired connections (such as Ethernet). The router assigns a unique LAN IP address to each device through DHCP to ensure that the devices can recognize and communicate with each other.

[0018] Next, use network scanning tools and device discovery protocols to obtain N data interaction nodes in the smart home intranet. Use network scanning tools such as Nmap to scan the intranet, identify and list all active devices and their IP addresses. For example, use Nmap to scan a specific IP range and list the IP addresses and open ports of all responding devices. Similarly, smart home devices use mDNS (multicast DNS) or UPnP (Universal Plug and Play) protocols to automatically broadcast their existence and allow other devices to discover and connect. By enabling mDNS or UPnP, listen to broadcast messages in the network to obtain device information. Through this process, N data interaction nodes in the intranet of the smart home are obtained. N is an integer greater than 1, indicating that there are multiple devices in the intranet participating in data interaction. These devices include smart light bulbs, smart sockets, smart door locks, security cameras, etc.

[0019] Step S200: Acquire the connectivity relationship of N data interaction nodes, establish an intranet topology structure based on the connectivity relationship, and generate association identifiers between data interaction nodes based on the intranet topology structure, wherein the association identifiers are unidirectional association identifiers.

[0020] In an embodiment of the present application, the connectivity relationship of N data interaction nodes is first obtained by a network traffic monitoring method. A network monitoring system, such as Wireshark, is used to monitor the flow of data packets in the intranet and analyze the captured network traffic data. Specifically, the traffic data of all devices in the intranet is recorded through the capture function of Wireshark, and the captured data contains the source IP and target IP of each device. Then, the source IP and target IP information of all data packets are extracted through the analysis function of Wireshark. This information is used to determine which nodes, i.e., there is a communication relationship between the devices corresponding to the IP addresses. The connectivity relationship of N data interaction nodes is obtained through the above process. Next, an intranet topology is established based on the connectivity relationship, and the extracted source IP and target IP information is organized into a node list and an edge list. The node list contains all devices involved in the communication, i.e., data interaction nodes, and the edge list contains all communication paths, i.e., connectivity relationships. After that, a graphics algorithm library, such as NetworkX, is used to add the node list and the edge list to the graph structure, draw an intranet topology diagram, and complete the establishment of the intranet topology.

[0021] After building the intranet topology, the graph algorithm library is used to convert the undirected graph into a directed graph and add a directional identifier to indicate a one-way communication path between nodes. For example, if there is a communication path between nodes A and B and the data flow flows from node A to node B, a directed edge from node A to node B is added to the directed graph. This process generates association identifiers between data interaction nodes.

[0022] Step S300: configure a network monitoring system, monitor the intranet of the smart home through the network monitoring system, and obtain a real-time and flowing intranet data set.

[0023] In an embodiment of the present application, first configure the network monitoring system, select and install a suitable network monitoring tool, such as Wireshark. Next, in the main interface of Wireshark, select the network interface for monitoring, which is the interface of the router or switch connected to the smart home device. After selection, start capturing all network data packets passing through the interface. The captured data packets include information such as the source IP address, destination IP address, transport protocol, and the size and content of the data packet. In order to focus on the traffic of smart home devices, set capture filters to exclude irrelevant data packets. Filters are set based on conditions such as IP address, port number, and protocol type. For example, create a filter to capture only data packets that match the IP address range of smart home devices.

[0024] Through the above process, the network monitoring system completes the intranet monitoring of the smart home and obtains real-time and flowing intranet data sets.

[0025] Step S400: Obtain node features of N data interaction nodes, input the node features into a window matching network, and establish a dynamic evaluation window mapped to the N data interaction nodes.

[0026] Further, such as Figure 2 As shown, in the method provided in the embodiment of the application, the node characteristics of N data interaction nodes are obtained, and further include:

[0027] Acquire data traffic of data interaction nodes, wherein the data traffic includes the traffic size of data generation nodes and single generation nodes; establish a timing attenuation coefficient through the data generation nodes in the data traffic; perform frequency acquisition of data traffic through the timing attenuation coefficient to establish a timing frequency feature; extract the traffic size of data traffic based on the timing attenuation coefficient to establish a timing traffic feature; establish node features based on the timing frequency feature and the timing traffic feature.

[0028] In an embodiment of the present application, a network monitoring tool such as Wireshark is first used to monitor the smart home network to obtain real-time traffic data of N data interaction nodes. Then, the captured data is parsed and processed to extract the characteristic information of each node. The captured data is parsed using a data processing tool to extract characteristic information such as the communication frequency, data transmission volume, and average data packet size of each node. Next, a timing decay coefficient is established based on the extracted node characteristic data. The timing decay coefficient is used to describe the law of data flow changing over time. Specifically, by analyzing the data flow changes of each node in different time periods, the timing decay coefficient of each node is calculated to reflect the change trend of its data flow. After establishing the timing decay coefficient, the coefficient is used to collect the frequency of data flow and establish a timing frequency feature. The timing frequency feature of the node is obtained by monitoring and counting the number of data packets in each time window. At the same time, the flow size of the data flow is extracted based on the timing decay coefficient to establish a timing flow feature. This step reflects the change in the data transmission volume of each node in a specific time period by calculating the total data transmission volume in each time window.

[0029] The node characteristics are established by combining the time series frequency characteristics and the time series traffic characteristics. The node characteristics include the communication frequency and data transmission volume of each node in different time periods.

[0030] Then, the extracted node feature data is input into the window matching network. The window matching network is a network model used to dynamically analyze and match data features. By setting a fixed-size time window, such as 5 minutes, the feature changes of each node in different time periods are captured and analyzed. The window matching network is pre-built. When training, the recurrent neural network or long short-term memory network model in machine learning technology is used to model and train the time series data. The training data set consists of time series data of node features, with the feature data in each time window as the input sequence and the behavior changes of the node as the output. The input sequence is processed by multiple layers of RNN or LSTM units to capture the dynamic patterns in the time series, and then the prediction results are output through the fully connected layer. During the training process, a loss function, such as the mean square error, is used to measure the difference between the model's prediction and the actual data, and the model parameters are optimized by the back propagation algorithm to gradually improve the prediction accuracy of the model. The window matching network is obtained through this process.

[0031] Then, the node feature data acquired in real time is input into the trained window matching network. The window matching network generates dynamic evaluation results of node behavior based on the input real-time feature data. The dynamic evaluation results reflect the characteristic performance of the node in different time periods and help capture the dynamic changes of node features. Finally, according to the output results of the model, a dynamic evaluation window mapped to N data interaction nodes is established.

[0032] Step S500: calling historical data of the mapped data interaction node with the dynamic evaluation window, extracting features of long and short windows through the historical data, establishing feature extraction results, calling the feature extraction results with the association identifier, and establishing node influence features of the data interaction node.

[0033] In an embodiment of the present application, the historical data of the data interaction node is first stored and managed through a time series database. The historical data of each data interaction node is stored in the time series database, including features such as timestamp, number of data packets, and size of data packets. The dynamic evaluation window queries the historical data in the corresponding time period from the time series database according to the set time window size. Next, the feature extraction of long and short windows is performed by sliding window technology. Sliding window is a method commonly used in time series data analysis, which can dynamically capture data features in different time periods. The size of long window and short window is defined, for example, the long window is 1 hour and the short window is 5 minutes, and the long window and short window are applied to the historical data of each data interaction node for feature extraction. Specific features include the average number of data packets, the total data transmission volume, the maximum and minimum data packet size, and the frequency of data packet transmission. The sliding window moves step by step according to the time series, and each time it moves a unit of time, such as 1 minute, the feature value in the window is calculated. The feature extraction result is established by sliding window technology and time series analysis. Then, the extracted long and short window features are processed and combined by feature engineering technology to form a feature extraction result.

[0034] Next, a graph database is used to store and manage the association identifiers between data interaction nodes. The association identifiers of each data interaction node are stored in the graph database, and these association identifiers represent the one-way communication paths between the nodes. By querying the graph database, the relevant nodes and their features are found according to the association identifiers between the nodes, and the feature extraction results are called to further analyze the relationship and influence between the nodes. Finally, the graph neural network is used to model the nodes and their associations, and the influence features of the nodes are calculated. When building a graph neural network model, the structure of the GNN model is first defined, including the input layer, hidden layer, and output layer. The input layer receives the node features and the information of the neighboring nodes, the hidden layer updates the embedded representation of the node through the message passing mechanism, and the output layer generates the final representation of each node. During the training process, the node features and association information are used as training data, and the model parameters are optimized and the loss function is minimized through the forward propagation and back propagation algorithms. Through training, the model learns the influence relationship between nodes. After the model training is completed, the node feature data obtained in real time is input into the trained GNN model to generate the node influence features.

[0035] Step S600: performing node anomaly identification of independent data interaction nodes on the intranet data set using the feature extraction result to generate a first anomaly identification result.

[0036] In an embodiment of the present application, when node anomalies of independent data interaction nodes are identified for an intranet data set through feature extraction results, anomaly identification is performed through anomaly detection rules. The anomaly detection rules are pre-set, including the upper and lower limits of the average number of data packets, the threshold of the total data transmission volume, the range of data packet size, and the limit of data packet transmission frequency. Then, these predefined rules are applied to the feature extraction results of each node, each rule is checked one by one, and the nodes that violate the rules are recorded. For the average number of data packets, its normal range is set. If the average number of data packets of a node exceeds this range, the node is marked as abnormal. Similarly, for the total data transmission volume, if the transmission volume of a node suddenly increases or decreases by more than the set threshold, it is marked as an abnormal node. For the rules of data packet size and transmission frequency, each node is checked for violations. Through these rule detections, all nodes that violate the rules are summarized to generate a first anomaly identification result.

[0037] Step S700: Identify the impact anomaly of the intranet data set using the node impact feature to generate a second anomaly identification result.

[0038] In an embodiment of the present application, the node influence feature reflects the importance and influence of each node in the network. The node influence feature includes information such as the centrality of the node, the strength of the connection, and the relationship with the neighboring nodes. The node influence feature is used to identify the impact anomaly of the intranet data set according to the preset rules for identifying anomalies of impact. The rules for identifying anomalies of impact include abnormal increase or decrease of node influence, change of centrality, and change of connection. For abnormal increase or decrease of node influence, the normal fluctuation range of node influence is set. If the influence of a node changes dramatically in a short period of time and exceeds the preset normal fluctuation range, it is marked as an abnormal node. For changes in centrality, if the centrality of a node in the network suddenly increases or decreases significantly, exceeding the preset range of centrality changes, it indicates that the node has abnormal behavior and is marked as an abnormal node. For changes in connection, it is set that if the number of connections or the strength of connections of a node changes significantly and exceeds the preset normal range, it is marked as an abnormal node.

[0039] Apply these predefined anomaly detection rules to the influence characteristics of each node, check each rule one by one, and record the nodes that violate the rule. For example, set a normal range of node influence, and if the influence of a node exceeds this range, mark the node as abnormal. Similarly, for the rules of centrality and connection change, check whether each node has violated it. Through these rule detections, summarize all nodes that violate the rules and generate the second anomaly identification result.

[0040] Step S800: Perform a comprehensive impact evaluation on the first abnormality recognition result and the second abnormality recognition result, establish recognition anomalies, and perform data security transmission management of the smart home through the recognition anomalies.

[0041] In an embodiment of the present application, when a comprehensive impact evaluation is performed on the first anomaly identification result and the second anomaly identification result, the first anomaly identification result and the second anomaly identification result are first scored respectively. When scoring the first anomaly identification result, a certain score is given according to the severity of the rule. For example, if the average number of data packets exceeds the normal range once, an abnormal score of 10 points is given; if the total data transmission volume exceeds the threshold once, an abnormal score of 15 points is given. The abnormal scores of each node under different rules are accumulated to obtain the first anomaly identification result score of the node. When scoring the second anomaly identification result, a certain score is given according to the severity of the rule. For example, if the node influence exceeds the normal range once, an abnormal score of 20 points is given; if the centrality change exceeds the threshold once, an abnormal score of 25 points is given. The abnormal scores of each node under different rules are accumulated to obtain the second anomaly identification result score of the node.

[0042] Next, the two scores are weighted averaged to calculate the comprehensive anomaly score of each node, where the weights of the first anomaly identification result score and the second anomaly identification result score are pre-set. The comprehensive anomaly score is obtained by calculation, and a list of identification anomalies is established, and nodes with scores exceeding the preset threshold are marked as identification anomalies. Based on the identification anomaly results, data security transmission management of smart homes is carried out, including data transmission restrictions, security policy adjustments, and alarms and notifications. Among them, data transmission restrictions are to limit or suspend data transmission of abnormal nodes through network access control technology, such as access control lists; security policy adjustments are to strengthen monitoring and auditing of abnormal nodes according to the situation of identification anomalies, and use intrusion detection systems and intrusion prevention systems to monitor and defend abnormal activities in real time; alarms and notifications are to send alarms and notifications to network administrators through network management and monitoring systems.

[0043] Furthermore, the method provided in the application embodiment also includes:

[0044] A preset strength threshold is set, and real-time environment monitoring of the smart home is performed through the preset strength threshold to establish a real-time environment signal set; a group authentication network is configured, and the group authentication network is a floor-based signal authentication network; environmental signal authentication is performed on the real-time environment signal set through the signal authentication network to establish an environmental signal authentication result; an abnormality recognition penalty factor is established based on the environmental signal authentication result; a penalty is calculated for recognition abnormalities through the abnormality recognition penalty factor, and data security transmission management of the smart home is performed according to the penalty calculation result.

[0045] In an embodiment of the present application, various signals in the smart home environment are first collected through environmental sensors, such as temperature sensors, humidity sensors, light sensors, etc. The environmental sensors are used to detect parameters such as temperature, humidity, and light intensity in the environment in real time. The preset intensity threshold is determined by collecting a large amount of sensor data under normal conditions and calculating the mean and standard deviation of each environmental parameter. The threshold range is set according to these mean values ​​and standard deviations, for example, the range is set to "mean value ± 3 times the standard deviation" as the threshold for normal signals. During the monitoring process, any signal that exceeds this range will be marked as an abnormal signal. Real-time environmental monitoring of smart homes is performed through environmental sensors, environmental parameter data is collected in real time, and a real-time environmental signal set is established.

[0046] When configuring a group authentication network, a signal collection node is set up on each floor. This node is responsible for collecting environmental signals from all devices on that floor. These signals include various environmental parameters such as temperature, humidity, and light intensity. The signal collection node sends the collected signals to the central processing unit of the group authentication network through a wireless network. The central processing unit of the group authentication network receives environmental signals from each floor and processes them centrally.

[0047] Next, the real-time environmental signal set is authenticated through the group authentication network. The group authentication network analyzes the received environmental signals according to preset rules to authenticate their legitimacy and normality. The preset rules are set based on the normal range of environmental parameters, such as temperature between 18-26 degrees, humidity between 40%-60%, and light intensity between 300-800 lux. Each signal in the real-time environmental signal set is analyzed to check whether the signal meets the preset rules. Signals that exceed the preset rule range are marked as abnormal signals. The authentication status of each signal is recorded, including normal or abnormal. Through the above process, the environmental signal authentication result is established, and the environmental signal authentication result includes the authentication status of each signal, that is, normal or abnormal.

[0048] Based on the environmental signal authentication results, an abnormal identification penalty factor is established. In order to reflect the severity of abnormal conditions in environmental signals, the authentication results are analyzed using statistical analysis techniques, and the penalty factor is set by calculating the frequency, strength, and duration of abnormal signals. For example, the abnormal frequency indicates the number of abnormal signals that appear at a certain node within a certain period of time, the abnormal strength indicates the amplitude of the abnormal signal, and the duration indicates the length of time the abnormal signal persists. Different penalty factors are set based on these statistical analysis results. The specific calculation process is to multiply the abnormal frequency, abnormal strength, and duration to obtain the abnormal identification penalty factor.

[0049] Next, the anomaly recognition penalty factor is used to calculate the penalty for the recognized anomaly. The anomaly recognition result is combined with the penalty factor to quantitatively evaluate each anomaly and calculate its comprehensive impact. First, an initial score is assigned to each anomaly, which is based on the previous anomaly recognition result. For example, if a node is marked as an anomaly, a basic score is assigned to the node. Then, the anomaly recognition result score is multiplied by the penalty factor to obtain a comprehensive penalty value, which is used as the penalty calculation result.

[0050] Finally, the smart home data security transmission management is carried out according to the penalty calculation results. For example, if the comprehensive penalty value is lower than the preset value, data transmission restriction is imposed. If it is higher than the preset value, security policy adjustment, alarm and notification are carried out.

[0051] Furthermore, in the method provided in the embodiment of the application, the abnormal identification penalty factor is established based on the environmental signal authentication result, and further includes:

[0052] Obtain the unauthenticated environmental signal in the environmental signal authentication result, and read the historical interaction record between the environmental signal and the intranet; call the log data through the historical interaction record, and extract the access features, interaction features, and home status features of the smart home based on the log data; perform timing-sensitive identification through the access features, interaction features, and home status features, and establish an abnormal identification penalty factor according to the timing-sensitive identification result.

[0053] In an embodiment of the present application, first, unauthenticated environmental signals in the environmental signal authentication result are obtained. These unauthenticated signals refer to signals that are marked as abnormal or unauthenticated during the environmental signal authentication process. Then, the historical interaction records between these unauthenticated environmental signals and the intranet are read. The historical interaction records between these signals and the intranet devices are obtained by querying the log database of the smart home system. The log data includes detailed information such as access time, access events, and number of login attempts. Based on the historical interaction records, the log data is called to extract access features, interaction features, and home status features. Specifically, when performing access feature extraction, access features are extracted from the log data, including information such as access time, access events, and number of login failures. When performing interaction feature extraction, the interaction mode between the environmental signal and the intranet device is analyzed. For example, the communication frequency, data transmission volume, number of successful or failed interactions, etc. between the statistical signal and a specific device are counted. When performing home status feature extraction, the status information of the smart home device is obtained, such as the on or off status of the device, the running time, and abnormal alarms.

[0054] When performing time-sensitive identification, time series analysis is performed on access features, interaction features, and home status features to identify abnormal fluctuations in feature data. For example, the sliding window technology is used to calculate the changes in feature data in different time windows to identify abnormal events that significantly deviate from the normal range. Based on the results of the time series analysis, possible abnormal patterns are identified. For example, frequent login failures, sudden increases in data transmission volume, abnormal changes in device status, etc. Next, based on the results of time-sensitive identification, an abnormal identification penalty factor is established. Specifically, according to the identified abnormal patterns, corresponding penalty rules are set. For example, for frequent login failures, a higher penalty factor is set; for a sudden increase in data transmission volume, a medium penalty factor is set; for abnormal changes in device status, a lower penalty factor is set. According to the set penalty rules, the penalty factor for each abnormal situation is calculated. The final penalty factor is obtained by comprehensively considering the abnormal frequency, intensity, and duration. The calculation process is to multiply the abnormal frequency, abnormal intensity, and duration to obtain the penalty factor.

[0055] Through the above steps, based on the unauthenticated environmental signals in the environmental signal authentication results, combined with historical interaction records and log data, access features, interaction features and home status features are extracted to perform timing-sensitive recognition, and an abnormal recognition penalty factor is established based on the recognition results.

[0056] Furthermore, the method provided in the application embodiment also includes:

[0057] The timing-sensitive recognition result is subjected to sensitive screening without reporting anomalies, and an implicit feature set is established, wherein the implicit feature set carries a modification identifier, and the modification identifier includes a time modification identifier and a request modification identifier; the implicit feature set is used to identify and authenticate the intranet data set, and the modification is distinguished by the modification identifier; if the recognition and authentication result is abnormal and / or the feature in the implicit feature set is triggered as an explicit feature, an authentication anomaly is reported; and data security transmission management of the smart home is performed based on the authentication anomaly.

[0058] In an embodiment of the present application, the timing-sensitive recognition results are first subjected to a sensitive screening of unreported anomalies, and by comparing historical data with existing recognition results, those anomalies with low frequency but high potential risk are identified. These unreported anomalies are extracted and recorded as a basis for further analysis. Next, a latent feature set is established. The latent feature set contains all sensitive features that have not reported anomalies, and each feature has a modification identifier. The modification identifier includes a time modification identifier and a request modification identifier. The time modification identifier records the changes in the feature at different time points, while the request modification identifier records the changes in the feature under different request types. For example, if a feature changes frequently within a specific time period or behaves abnormally under a specific request type, a corresponding modification identifier needs to be added to it.

[0059] Then, the implicit feature set is used to identify and authenticate the intranet data set. Specifically, the features in the implicit feature set are applied to the intranet data set for comprehensive feature matching and identification. The time modification flag and request modification flag are used to detect whether the features have changed in a specific time period or under a specific request type. This step identifies potential anomalies by comparing the current data with the data in the implicit feature set.

[0060] During the identification and authentication process, if the identification and authentication result is abnormal, or a feature in the implicit feature set is triggered as an explicit feature, the authentication abnormality will be reported immediately. Explicit triggering means that the implicit feature shows clear abnormal behavior in actual application, such as frequent login failures, sudden increase in data transmission volume, abnormal changes in device status, etc.

[0061] Finally, according to the abnormal authentication results, the data security transmission management of the smart home is carried out. Specific measures include limiting or suspending the data transmission of the nodes reporting the abnormal authentication to prevent potential malicious behaviors from affecting the network security. Network access control technology, such as access control lists, is used to achieve this goal. At the same time, according to the identified abnormal situations, the network security strategy is adjusted to strengthen the monitoring and auditing of abnormal nodes. In addition, alarms and notifications are sent to network administrators through the network management and monitoring system.

[0062] Furthermore, the method provided in the application embodiment also includes:

[0063] Obtain storage information of M data storage devices of the smart home, where M is an integer greater than 2; perform storage authentication at the same time node through the storage information, make consensus changes according to the storage authentication results, and record intranet data based on the consensus change results.

[0064] In the embodiment of the present application, the storage information of M data storage devices of the smart home is first obtained through the network request and response method. A request is sent to each data storage device through HTTP, REST API or other network protocols to obtain its storage status information, such as storage capacity, remaining space, etc. Each device responds to these requests and returns the required data, including the hash value of the current stored data, storage timestamp and other metadata.

[0065] Next, the storage authentication at the same time node is performed through the hash verification method. First, the network time protocol is used to ensure the time synchronization of all data storage devices so that the clock of each device is consistent. At a common time node, the key data of each data storage device is calculated using a hash function, and the calculation result is compared with the previously stored hash value. If the two do not match, it is considered that the data has been tampered with between the two checks.

[0066] Consensus changes are made based on the storage authentication results. Distributed consensus algorithms such as Raft are used to determine which data storage devices are trustworthy. During the authentication process, if the data of a device is found to be inconsistent, the device is excluded from the consensus group or marked as faulty through the Raft algorithm. The consensus algorithm determines which data is trustworthy and uses it as the final consensus result, i.e., the consensus change result.

[0067] Finally, based on the consensus change results, the intranet data is recorded, and the consensus change results, key operation logs, and any related device information are recorded on a secure log server using a logging tool. These log records include detailed information on each consensus change, such as the devices participating in the consensus, the consensus results, and faulty devices.

[0068] Furthermore, the method provided in the application embodiment also includes:

[0069] Configure a homomorphic encryption library, which contains multiple groups of homomorphic encryption configurations; establish a pre-use plan for the intranet, and configure a first trigger condition according to the pre-use plan; obtain the current date node, and configure a second trigger condition according to the date node; match the encryption strategy of the homomorphic encryption library through the first trigger condition and the second trigger condition to generate a matching result; and perform data encryption processing on the intranet based on the matching result.

[0070] In the embodiment of the present application, the homomorphic encryption library is first configured. The homomorphic encryption library is an encryption technology that allows computing operations to be performed directly on ciphertext. Select a homomorphic encryption algorithm, such as Paillier encryption, BGV encryption, CKKS encryption, etc., and set the corresponding encryption configuration for each algorithm. Including generating public keys and private keys, setting encryption parameters, etc. After the configuration is completed, the homomorphic encryption library will contain multiple sets of different homomorphic encryption configurations, ready for data encryption.

[0071] Next, establish a pre-use plan for the intranet. The pre-use plan is developed and deployed by writing a plan document or using configuration management tools such as Ansible and Puppet, which describes in detail the policies and rules for triggering encryption operations under specific conditions. The pre-use plan ensures that when and how to use homomorphic encryption for data protection can be effectively planned in the intranet. Then, configure the first trigger condition according to the pre-use plan. The first trigger condition is set by monitoring network activity using a network monitoring tool such as Wireshark. These conditions include the time of data transmission, the size of data transmission, the frequency of transmission, etc. When specific conditions are met, the encryption operation is triggered.

[0072] Next, the current date node is obtained, and the second trigger condition is configured according to the date node. The second trigger condition is a time-based trigger condition. The current date and time are obtained through the system clock or time server, and a specific date, time period or periodic time point is set to trigger the encryption operation.

[0073] Through the above-mentioned first trigger condition and second trigger condition, the encryption policy of the homomorphic encryption library is matched to generate a matching result. The matching process is implemented through scripts or automation tools, such as Cron jobs and task schedulers, to ensure that the correct encryption configuration is automatically selected and applied when the trigger condition is met. Specifically, the network activity and time nodes are monitored in real time to check whether the first trigger condition and the second trigger condition are met. If the trigger condition is met, the corresponding encryption configuration is selected from the homomorphic encryption library. The selection process is based on factors such as priority, data type, and data importance defined in the pre-use plan. Finally, the encryption policy matching result is generated to determine which homomorphic encryption configuration to use for data encryption.

[0074] Finally, the intranet data is encrypted based on the matching results. Specifically, first obtain the data that needs to be encrypted from the intranet, including sensitive information such as user information, sensor data, and log records. Obtain this data through database queries or data crawling tools, such as SQL queries and API calls. Next, encrypt the data using the selected homomorphic encryption configuration. Relying on the selected homomorphic encryption algorithm, ensure that the data remains encrypted during transmission and storage. Use existing encryption libraries and tools, such as Microsoft SEAL, HElib, etc. to implement homomorphic encryption operations. Finally, store the encrypted data in a secure storage device or transmit it to the target device via a secure transmission protocol.

[0075] Furthermore, the method provided in the application embodiment also includes:

[0076] Execute the cumulative record of identified anomalies and establish an anomaly database; extract an anomaly feature set from the anomaly database, perform big data matching based on the anomaly feature set, and establish a bias protection mechanism; and perform security management of the intranet through the bias protection mechanism.

[0077] In the embodiment of the present application, first, a log record and management tool is used to perform cumulative recording of identified anomalies. During the operation of the smart home system, all identified abnormal events, including data transmission anomalies, device anomalies, user behavior anomalies, etc., will be recorded. These records include information such as the type of anomaly, time of occurrence, associated devices, and event description. Next, an abnormality database is established to aggregate the accumulated recorded abnormal events into a special abnormality database. A relational database such as MySQL or PostgreSQL is used to store and manage all historical abnormal event data.

[0078] Next, the abnormal feature set is extracted from the abnormal database. The data in the abnormal database is analyzed through data mining and statistical analysis tools to extract the abnormal feature set. The abnormal feature set includes the frequency of abnormal occurrence, the type of abnormal event, the scope of impact, related equipment, etc. Then, big data matching is performed based on the abnormal feature set, and the extracted abnormal feature set is processed using the big data analysis platform. By comparing with large-scale data sets, similar abnormal patterns and potential threats are identified. Then, based on the big data matching results, a biased protection mechanism is established. The biased protection mechanism takes corresponding protection measures according to different abnormal features and threat levels. For example, for frequently occurring low-threat abnormal events, set up automated response measures, such as automatically restarting the device, restricting access, etc.; for high-threat abnormal events, set up more stringent protection measures, such as isolating the device, notifying the administrator, etc.

[0079] Finally, the intranet is managed securely through the bias protection mechanism. Specifically, it uses network monitoring tools to monitor various activities in the intranet in real time to detect abnormal behavior. Once abnormal behavior is detected, the bias protection mechanism automatically executes preset response measures, such as limiting data transmission, restarting devices, modifying access rights, etc., and uses automated operation and maintenance tools such as SaltStack to implement these operations.

[0080] In the embodiments of the present application, in summary, the embodiments of the present application have at least the following technical effects:

[0081] The present application establishes intranet communication with a smart home, and obtains N data interaction nodes of the intranet of the smart home, where N is an integer greater than 1; obtains connectivity relationships of the N data interaction nodes, establishes an intranet topology based on the connectivity relationships, and generates association identifiers between data interaction nodes based on the intranet topology, where the association identifiers are unidirectional association identifiers; configures a network monitoring system, monitors the intranet of the smart home through the network monitoring system, and obtains a real-time flowing intranet data set; obtains node features of the N data interaction nodes, inputs the node features into a window matching network, and establishes a dynamic evaluation window mapped to the N data interaction nodes; calls historical data of the mapped data interaction nodes with the dynamic evaluation window, extracts features of long and short windows with the historical data, establishes feature extraction results, calls feature extraction results with association identifiers, and establishes node influence features of the data interaction nodes; performs node anomaly identification of independent data interaction nodes on the intranet data set through the feature extraction results, and generates a first anomaly identification result; performs influence anomaly identification of the intranet data set through the node influence feature, and generates a second anomaly identification result; performs comprehensive impact evaluation on the first anomaly identification result and the second anomaly identification result, establishes an identification anomaly, and performs data security transmission management of the smart home through the identification anomaly. The present invention solves the technical problem of insufficient security in the prior art when transmitting data in smart homes. It achieves the technical effect of improving the security of data transmission by establishing intranet communication with the smart home, monitoring and managing data interaction nodes in real time, and dynamically adjusting and optimizing the data transmission process.

[0082] It should be noted that the above-mentioned sequence of the embodiments of the present application is only for description and does not represent the advantages and disadvantages of the embodiments. And the above-mentioned specific embodiments of this specification are described. The processes depicted in the accompanying drawings do not necessarily require the specific order and continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0083] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

[0084] This specification and drawings are merely exemplary illustrations of the present application and are deemed to cover any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, a person skilled in the art may make various modifications and variations to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the present application and its equivalents, the present application intends to include these modifications and variations.

Claims

1. A data security transmission method for smart home, characterized in that: The method comprises: Establish intranet communication with the smart home and obtain N data interaction nodes of the intranet of the smart home, where N is an integer greater than 1; Acquire the connectivity relationship of N data interaction nodes, establish an intranet topology structure based on the connectivity relationship, and generate association identifiers between data interaction nodes based on the intranet topology structure, wherein the association identifiers are unidirectional association identifiers; Configure a network monitoring system, monitor the intranet of the smart home through the network monitoring system, and obtain a real-time and flowing intranet data set; Obtain node features of N data interaction nodes, input the node features into a window matching network, and establish a dynamic evaluation window mapped to the N data interaction nodes; Using the dynamic evaluation window to call historical data of the mapped data interaction node, extracting features of long and short windows through the historical data, establishing feature extraction results, calling the feature extraction results with the association identifier, and establishing node influence features of the data interaction node; Perform node anomaly identification of independent data interaction nodes on the intranet data set using the feature extraction result to generate a first anomaly identification result; Identify the impact anomaly of the intranet data set using the node impact feature to generate a second anomaly identification result; Performing a comprehensive impact evaluation on the first abnormality recognition result and the second abnormality recognition result, establishing an identification abnormality, and performing data security transmission management of the smart home through the identification abnormality; The feature extraction result is called by using the association identifier to establish the node influence feature of the data interaction node, including: According to the association identifiers between the interactive nodes, relevant nodes and their features are found, and the feature extraction results are called to further analyze the relationship and influence between the nodes, and the nodes and their associations are modeled using a graph neural network to calculate the influence features of the nodes; Performing a comprehensive impact evaluation on the first anomaly recognition result and the second anomaly recognition result, including: Scoring the first anomaly identification result and the second anomaly identification result respectively, and assigning certain scores according to the severity of the rules; The two scores are weighted averaged to calculate the comprehensive anomaly score of each node, wherein the weights of the first anomaly recognition result score and the second anomaly recognition result score are preset.

2. The data security transmission method for smart home according to claim 1, characterized in that: The step of obtaining node features of N data interaction nodes further includes: Obtaining data traffic of data interaction nodes, wherein the data traffic includes the traffic size of data generation nodes and single generation nodes; Establishing a timing attenuation coefficient through a data generation node in the data flow; The frequency of data flow is collected by using the timing attenuation coefficient to establish a timing frequency characteristic; Extracting the flow size of data flow based on the time series attenuation coefficient and establishing time series flow characteristics; Node characteristics are established based on time series frequency characteristics and time series traffic characteristics.

3. The data security transmission method for smart home according to claim 1, characterized in that: The method further comprises: Setting a preset intensity threshold, performing real-time environment monitoring of a smart home through the preset intensity threshold, and establishing a real-time environment signal set; Configuring a group authentication network, wherein the group authentication network is a floor-based signal authentication network; Performing environmental signal authentication on the real-time environmental signal set through the signal authentication network, and establishing an environmental signal authentication result; Establishing an abnormal identification penalty factor based on the environmental signal authentication result; The abnormal identification penalty factor is used to calculate the penalty for the identification abnormality, and the data security transmission management of the smart home is performed according to the penalty calculation result.

4. The data security transmission method for smart home according to claim 3, characterized in that: The establishing of an abnormality identification penalty factor based on the environmental signal authentication result also includes: Obtaining an unauthenticated environmental signal in the environmental signal authentication result, and reading a historical interaction record between the environmental signal and the intranet; Calling log data through the historical interaction records, and extracting access features, interaction features, and home status features of the smart home based on the log data; The access features, interaction features and home status features are used to perform timing-sensitive identification, and an abnormal identification penalty factor is established according to the timing-sensitive identification result.

5. The data security transmission method for smart home according to claim 4, characterized in that: The method further comprises: Performing sensitive screening of the timing-sensitive recognition results without reporting anomalies, and establishing an implicit feature set, wherein the implicit feature set has a modification identifier, and the modification identifier includes a time modification identifier and a request modification identifier; Using the implicit feature set to identify and authenticate the intranet data set, and using the modification identifier to identify the modification; If the recognition and authentication result is abnormal and / or the feature in the implicit feature set is triggered as an explicit feature, an authentication abnormality is reported; The data security transmission management of the smart home is performed according to the authentication exception.

6. The data security transmission method for smart home according to claim 1, characterized in that: The method further comprises: Obtain storage information of M data storage devices of the smart home, where M is an integer greater than 2; The storage information is used to perform storage authentication at the same time node, consensus changes are made according to the storage authentication results, and intranet data is recorded based on the consensus change results.

7. The data security transmission method for smart home according to claim 1, characterized in that: The method further comprises: Configure a homomorphic encryption library, where the homomorphic encryption library contains multiple groups of homomorphic encryption configurations; Establishing a pre-use plan for the intranet, and configuring a first trigger condition according to the pre-use plan; Obtain the current date node, and configure the second trigger condition according to the date node; The encryption strategy of the homomorphic encryption library is matched according to the first trigger condition and the second trigger condition to generate a matching result; The intranet data is encrypted based on the matching results.

8. The data security transmission method for smart home according to claim 1, characterized in that: The method further comprises: Perform cumulative recording of identified anomalies and establish an anomaly database; Extracting an abnormal feature set from the abnormal database, performing big data matching based on the abnormal feature set, and establishing a bias protection mechanism; The intranet is securely managed through the bias protection mechanism.

Images