Internet of Things application security partitioning method and Internet of Things gateway

Abstract

The embodiment of the invention provides an Internet of Things application security partitioning method and an Internet of Things gateway using the method. The Internet of Things application security partitioning method is suitable for an Internet of Things gateway and comprises the following steps. A plurality of regions corresponding to a plurality of subnets are established by dividing the plurality of subnets. An application installed in the Internet of Things gateway is deployed to one of the plurality of regions. A transmission channel policy associated with at least one of the plurality of regions is configured. And managing packet transmission of the plurality of areas according to the transmission channel strategy. Therefore, the flexibility and efficiency of security management of the Internet of Things gateway can be improved.

Description

Technical Field

[0001] The present invention relates to a network security technology, and in particular to an Internet of Things application security partitioning method and an Internet of Things gateway using the method. Background Art

[0002] The Internet of Things (IoT) gateway is a solution to facilitate IoT communication. The IoT gateway mainly acts as a transmission bridge between IoT devices and cloud servers. Many IoT data can be transmitted to cloud servers via IoT gateways for real-time monitoring and analysis. Furthermore, IoT gateways play a key role in various operational scenarios of IoT systems, and IoT gateways can also help enterprises manage data transmission. IoT gateways can forward collected sensor data to cloud servers via untrusted networks, or forward control commands from untrusted networks to IoT devices or control devices. Therefore, in the IoT environment, since IoT devices and control devices can directly connect to untrusted networks through IoT gateways, it is necessary to establish a firewall to protect these IoT devices, control devices, and IoT gateways themselves in the IoT system from cyber attacks.

[0003] However, as the functionality of IoT gateways continues to develop, IoT gateways will be responsible for managing more complex and numerous applications, such as data collection and edge computing. In addition, IoT gateways are also involved in data transmission and automated control of devices with different security levels. Therefore, for the needs and security considerations of various operating scenarios, the firewall protection provided by traditional IoT gateways or other network devices no longer meets current needs. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides an Internet of Things application security partitioning method and an Internet of Things gateway using the method, which can solve the above technical problems.

[0005] The IoT application security partitioning method of the embodiment of the present invention is applicable to the IoT gateway and includes (but is not limited to) the following steps. Multiple areas corresponding to the multiple subnets are established by dividing the multiple subnets. An application installed in the IoT gateway is deployed to one of the multiple areas. A transmission channel policy (conduit policy) associated with at least one of the multiple areas is configured. Packet transmission of the multiple areas is managed according to the transmission channel policy.

[0006] The IoT gateway of the embodiment of the present invention includes a transceiver, a storage device, and a processor. The processor is connected to the transceiver and the storage device and configured to perform the following operations. Multiple areas corresponding to the multiple subnets are established by dividing the multiple subnets. An application installed in the IoT gateway is deployed to one of the multiple areas. A transmission channel strategy associated with at least one of the multiple areas is configured. Packet transmission of the multiple areas is managed according to the transmission channel strategy.

[0007] Based on the above, in an embodiment of the present invention, after establishing multiple areas corresponding to multiple subnets, transmission channel strategies for managing packet transmission can be configured for these areas respectively. In addition, multiple applications installed on the IoT gateway can be divided into different areas. Therefore, the packet transmission of each application can be controlled based on the transmission channel strategy of the area where it is located. In this way, not only can the network security defense capability of the IoT gateway be greatly improved, but also the flexibility and efficiency of the security management of the IoT gateway can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 is a schematic diagram of an Internet of Things system according to an embodiment of the present invention;

[0009] Figure 2 is a block diagram of an Internet of Things gateway according to an embodiment of the present invention;

[0010] Figure 3 is a flow chart of a method for secure partitioning of Internet of Things applications according to an embodiment of the present invention;

[0011] Figure 4 is a schematic diagram of a partition model according to an embodiment of the present invention;

[0012] Figure 5 FIG. 4 is a schematic diagram of deploying applications to regions according to an embodiment of the present invention.

[0013] Figure 6 is a schematic diagram of establishing a region according to an embodiment of the present invention;

[0014] Figures 7A to 7D is a schematic diagram of a transmission channel strategy for a region according to an embodiment of the present invention;

[0015] Figure 8 FIG. 4 is a schematic diagram of deploying applications to regions according to partition labels according to an embodiment of the present invention.

[0016] Description of Reference Numerals

[0017] 10: Internet of Things system;

[0018] 120: local network;

[0019] 130: external network;

[0020] 110,410,510,610,710,810:IoT gateway;

[0021] 113: transceiver;

[0022] 112: memory;

[0023] 111: processor;

[0024] Z1, Z2, Z3, Z6: area;

[0025] 41,51,71,81: untrusted network;

[0026] 42,52,72:IACS area;

[0027] CP1_1,CP1_2,CP2,CP3,CP4,CP5,CP71,CP72,CP73,CP74: transmission channel strategy;

[0028] 501,502,503,504,505,A1,A2: application;

[0029] 61: Subnetting tool;

[0030] 62: Packet management tool;

[0031] 63: Internet area;

[0032] 64: Private area;

[0033] U1: Manager;

[0034] L1: partition label;

[0035] H1: IoT Center;

[0036] M1: partition module;

[0037] M2: Install module;

[0038] B1: attacker;

[0039] SS1: Service provision server;

[0040] SS2: Enterprise server;

[0041] S302~S308, S81~S87: steps. DETAILED DESCRIPTION

[0042] Reference will now be made in detail to exemplary embodiments of the present invention, examples of which are illustrated in the accompanying drawings. Whenever possible, the same reference numerals are used in the drawings and the description to refer to the same or like parts.

[0043] The present disclosure relates to a method for secure partitioning of an IoT application and an IoT gateway using the method. In order to enhance the security of the IoT, the present disclosure provides a partitioning model for partitioning IoT applications into a plurality of regions. The partitioning model can be used to manage core services and application services installed on an IoT gateway, thereby enhancing the security of an existing IoT application framework. The IoT gateway can establish a plurality of regions to isolate various IoT applications into these regions. Communication between regions can be performed via a transmission conduit. In the present disclosure, by establishing transmission conduit policies for these regions, packet transmission of IoT applications can be managed.

[0044] From another perspective, the present disclosure provides an IoT gateway that has the ability to isolate data, applications, and services within the IoT gateway based on a partition model. By separating multiple applications into multiple zones, access to some important system configuration files deployed in the IoT gateway can be prohibited. In some embodiments, the partition model provided by the present disclosure can be seamlessly built on the information technology (IT) framework of existing IoT applications without modifying the existing IT framework, thereby making the security management of the operational technology (OT) field in an industrial environment more robust and efficient.

[0045] Figure 1 is a schematic diagram of an Internet of Things system according to an embodiment of the present invention. Figure 1 , the IoT system 10 includes an IoT gateway 110, a local network 120, and an external network 130. The IoT system 10 may be an Industrial Internet of Things (IIoT) system. IIoT is the expansion and use of the Internet of Things in the industrial field.

[0046] The local network 120 may include multiple IoT devices, one or more control devices, and one or more network devices. IoT devices may be sensors, cameras, industrial equipment, measuring devices, etc. Control devices may be computers, programmable logic controllers (PLCs), etc. Devices in the local network 120 may be directly or indirectly connected to the IoT gateway 110. For example, the control device may communicate with the IoT gateway 110 via a suitable communication protocol (e.g., Ethernet protocol, IP or other datagram protocols, etc.). IoT devices may be connected to control devices, network devices, or IoT gateways 110 via wired or wireless communication links, and the wired or wireless communication links may support communication protocols such as Wi-Fi, Bluetooth, WirelessHART, HART-IP, etc.

[0047] The IoT gateway 110 is connected between the local network 120 and the external network 130. In some embodiments, multiple applications can be deployed and installed in the IoT gateway 110. Based on the multiple applications deployed in the IoT gateway 110, the IoT gateway 110 can provide various IoT functions, such as data collection, edge computing, security authentication, etc. These applications can be system services, Docker containers, etc. From another perspective, these applications can be provided by cloud computing platforms, such as the Azure platform, the Amazon Web Services (AWS) platform, etc. These applications allow users to run cloud intelligence on the IoT gateway 110.

[0048] The external network 130 may include a private server or a public server provided by a cloud computing platform. It is worth noting that the IoT gateway 110 may be connected to the devices of the external network 130 through an untrusted network. In other words, the external network 130 may include an untrusted network.

[0049] Figure 2 is a block diagram of an IoT gateway according to an embodiment of the present invention. Figure 2 , the IoT gateway 110 includes a transceiver 113 , a memory 112 and a processor 111 .

[0050] The memory 112 may be used to store instructions, program codes, software modules and other data, and may be, for example, any type of fixed or removable random access memory (RAM), read-only memory (ROM), flash memory or other similar devices, integrated circuits and combinations thereof.

[0051] The processor 111 may be a central processing unit (CPU), a general-purpose processor, or other programmable general-purpose or special-purpose microprocessor, a digital signal processor (DSP), a programmable controller, a field programmable gate array (FPGA), an application-specific integrated circuit (ASIC), or other similar components or a combination of the above components.

[0052] In different embodiments, the memory 112 may be a separate device from the processor 111 , or may be integrated into the processor 111 .

[0053] The processor 111 can access and execute the software modules recorded in the memory 112 to implement the IoT application security partitioning method in the embodiment of the present invention. The above-mentioned software modules can be broadly interpreted as meaning instructions, instruction sets, codes, program codes, programs, applications, software suites, threads, programs, functions, etc., regardless of whether they are called software, firmware, middleware, microcode, hardware description language or others.

[0054] The transceiver 113 has a transmitter (e.g., a transmission circuit) and a receiver (e.g., a receiving circuit). In some embodiments, the transceiver 113 can be used to transmit and receive time-frequency segmentation information. The transceiver 113 can perform low noise amplification (LNA), impedance matching, analog-to-digital conversion (ADC), digital-to-analog conversion (DAC), frequency mixing, up and down frequency conversion, filtering, amplification, and / or similar operations. For example, the transceiver 113 may be a WiFi or Bluetooth transceiver that complies with the 802.xx standard. For example, the transceiver 113 may be included in a USB port or an interface for establishing a wired link.

[0055] Figure 3 This is a flow chart of a method for secure partitioning of IoT applications according to an embodiment of the present invention. Figure 3 , the method of this embodiment can be performed by Figure 1 The IoT gateway 110 is executed as follows: Figure 1 and Figure 2 Description of components shown Figure 3 Details of each step.

[0056] In step S302, the processor 111 establishes multiple regions corresponding to the multiple subnets by dividing the multiple subnets. The present disclosure does not limit the number of regions, which can be configured according to actual needs. In some embodiments, the processor 111 divides the multiple subnets by establishing a virtual network interface, and each subnet corresponds to an IP address range. In other words, these regions can be created by generating virtual bridges or virtual networks, and each region can be associated with the IP address range of the corresponding subnet.

[0057] In step S304, the processor 111 deploys an application installed in the IoT gateway 110 to one of the multiple zones. Further, each zone can be regarded as a logical grouping of applications with similar security requirements. The applications installed in the IoT gateway 110 may be containers, services, or daemons. In addition, in some embodiments, each application deployed in the IoT gateway 110 may be assigned to a corresponding zone according to the partition label of each application. The partition label of the application can be set according to predefined rules or user operations.

[0058] For example, some applications related to information technology (IT) services can be deployed in the first area, and some applications related to operational technology (OT) services can be deployed in the second area. In addition, some applications related to core services can be deployed in the third area.

[0059] In some embodiments, the processor 111 may assign a specific IP address within the IP address range of a certain subnet (i.e., one of the multiple subnets) to an application to deploy the application to one of the multiple regions corresponding to one of the multiple subnets. More specifically, when the processor 111 decides to deploy an application to a first region, the processor 111 may assign an IP address within the IP address range of the subnet corresponding to the first region to the application. In the case where the application is assigned this specific IP address, the application may be considered to be divided into the corresponding region.

[0060] In step S306, the processor 111 configures a transmission channel policy associated with at least one of the multiple areas. In step S308, the processor 111 manages packet transmission in the multiple areas according to the transmission channel policy. The transmission channel policy may include access rules for at least one of the multiple areas. In the present disclosure, a transmission channel (conduit) may represent a controlled communication path or communication channel between different areas. Correspondingly, the transmission channel policy can be used to manage packet transmission between areas. For example, the transmission channel policy can prevent packet transmission from a first area to a second area. In addition, the transmission channel policy can be used to manage packet transmission between areas including some applications in the IoT gateway 110 and an untrusted network (i.e., an external network).

[0061] In some embodiments, the multiple areas established by the processor 111 may include an IT service area and an OT service area. The IT service area includes at least one IT service application, and the OT service area includes at least one OT service application. In addition, the multiple areas established by the processor 111 may also include a management area, and the management area includes at least one secure service application.

[0062] Figure 4 is a schematic diagram of a partition model according to an embodiment of the present invention. Figure 4 , the IoT gateway 410 can deploy applications to three areas Z1-Z3. In this embodiment, area Z1 is an OT service area, and area Z2 is an IT service area. Area Z3 is a management area.

[0063] OT service applications related to OT services, such as data collection applications, can be deployed in zone Z1. IT service applications related to IT services, such as edge computing applications and data transmission applications, can be deployed in zone Z2. Applications related to core services, such as security service applications, device management service applications, and credential service applications, can be deployed in zone Z3.

[0064] Applications in zone Z1 and applications in zone Z3 can communicate with devices in the industrial automation and control system (IACS) zone 42 via a local area network (LAN) to perform functions related to devices in the IACS zone 42, such as collecting data from IoT devices or controlling industrial equipment. Applications in zone Z2 and applications in zone Z3 can communicate with the untrusted network 41 via a wide area network (WAN) to perform functions related to devices in the untrusted network 41, such as transmitting data to a cloud server or receiving control commands from an external server to control devices in the IACS zone 42. It is worth noting that communication between zone Z1 and zone Z2 is prohibited. By dividing multiple applications of the IoT gateway 410 into zones Z1 to Z3, the packet transmission of the internal services of the IoT gateway 410 can be effectively managed, thereby improving the security of the Internet of Things.

[0065] Figure 5 is a schematic diagram of deploying applications to regions according to an embodiment of the present invention. Figure 5 ,After the zones Z1 to Z3 are created, the transmission channels between these zones Z1 to Z3 can be designed to manage access, prevent unauthorized activities, block the spread of threats or malware, and maintain the integrity and confidentiality of network transmissions.

[0066] In some embodiments, the IoT gateway 510 may be configured with a transmission channel policy associated with at least one of the areas Z1 to Z3. Specifically, the IoT gateway 510 may configure a transmission channel policy for one or more transmission channels, so that the packet transmission of the application can be managed according to the transmission channel policy of the transmission channel. The IoT gateway 510 may configure a transmission channel policy CP1_1 for the transmission channel between the area Z1 and the IACS area 52, and the IoT gateway 510 may configure another transmission channel policy CP1_2 for the transmission channel between the area Z3 and the IACS area 52, so as to manage and monitor the packet transmission between the application in the area Z1 and the IACS area 52 and the packet transmission between the application in the area Z3 and the IACS area 52. The transmission channel policies CP1_1 and CP1_2 may be the same or different, and the present disclosure is not limited to this.

[0067] The IoT gateway 510 can configure a transmission channel policy CP2 for the transmission channel between the area Z1 and the area Z2, so that the packet transmission between the application in the area Z1 and the application in the area Z2 can be managed and monitored. In some embodiments, based on the transmission channel policy CP2, the application in the area Z1 and the application in the area Z2 will not be able to communicate with each other. In some embodiments, the IoT gateway 510 can omit the configuration of the transmission channel policy for the transmission channel between the area Z2 and the area Z1. Of course, if packet transmission is required in some cases, the transmission channel policy CP2 between the area Z2 and the area Z1 can be set accordingly.

[0068] In addition, the IoT gateway 510 can configure the transmission channel policy CP3 for the transmission channel between the area Z1 and the area Z3 and the transmission channel between the area Z2 and the area Z3. Therefore, the packet transmission between the application in the area Z2 and the application in the area Z3 can be managed and monitored, and the packet transmission between the application in the area Z1 and the application in the area Z3 can be managed and monitored.

[0069] The IoT gateway 510 can configure the transmission channel policy CP4 for the transmission channel between the area Z2 and the untrusted network 51, so that the packet transmission between the application in the area Z2 and the untrusted network 51 can be managed and monitored. The IoT gateway 510 can also configure the transmission channel policy CP5 for the transmission channel between the area Z3 and the untrusted network 51, so that the packet transmission between the application in the area Z3 and the untrusted network 51 can be managed and monitored.

[0070] It is worth noting that the applications in different zones Z1 to Z3 may belong to a single service module provided by the cloud platform. For example, applications of the service module “IoTedge” may be assigned to different zones Z1 to Z3. Figure 5As shown, applications 501 to 503 of the "IoTedge" service module may be assigned to zone Z3. Application 504 of the service module "IoTedge" may be assigned to zone Z1, and application 505 of the service module "IoTedge" may be assigned to zone Z2. In other words, the method disclosed in the present invention can be implemented on an existing IoT application framework.

[0071] In some embodiments, the IoT gateway 510 may obtain a service module provided by a cloud service platform, wherein the service module includes one or more applications. When the application of the service module belongs to a high data security level, the IoT gateway 510 deploys the application to the management area. When the application of the service module belongs to a low data security level, the IoT gateway 510 deploys the application to the IT service area or the OT service area. More specifically, the service module provided by the cloud service platform may include multiple applications, and these applications may be divided into different areas according to the data security level they handle. The multiple applications of a single service module provided by the cloud platform may include applications corresponding to a high data security level and applications corresponding to a low data security level. Figure 5 In the implementation example, when the service module provided by the cloud service platform is installed on the IoT gateway 510, applications corresponding to the highest data security level (such as applications 501 to 503) can be deployed to area Z3, and other applications corresponding to the lowest data security level belonging to the same service module (such as application 504 or 505) can be deployed to area Z1 or Z2 according to scenario requirements.

[0072] In some embodiments, a partition label can be assigned to an application deployed in the IoT gateway 510. Therefore, the application can be deployed to the corresponding area according to the partition label. The partition label of the application can be assigned according to user operations or predefined rules. For example, one or more applications in zone Z1 can be assigned the same partition label so as to be grouped in the same zone Z1. For example, for a Docker container, the partition label can be assigned by setting the parameter "--network". For the Azure IoT Edge module, the partition label can be assigned by setting the parameter "NetworkMode". For Linux system services, the partition label can be assigned by setting the parameter "RestrictNetworkInterfaces".

[0073] Figure 6 is a schematic diagram of establishing a region according to an embodiment of the present invention. Figure 6, the IoT gateway 610 can use the subnetting tool 61 to create multiple areas (e.g., area Z6). The above-mentioned subnetting tool 61 can establish a virtual network interface (virtual net interface) to generate a subnet corresponding to an IP address range. The IoT gateway 610 can create multiple areas by dividing the IP address range or using a network namespace. For example, the IoT gateway 610 can create multiple areas corresponding to different IP address ranges by establishing a Docker bridge or a virtual network (Vnets). The IoT gateway 610 can assign an IP address within a subnet to a specific application deployed in the IoT gateway 610, thereby allocating the specific application to the area corresponding to the subnet. For example, the IP addresses of all applications in area Z6 are within the IP address range of the subnet corresponding to area Z6 (e.g., 192.168.*).

[0074] In addition, by using a packet management tool 62, such as iptables, nftables, or a firewall, the communication of the transmission channel between the Internet zone 63 and the zone Z6 and the transmission channel between the private zone 64 and the zone Z6 can be managed. That is, the transmission channel policy of each transmission channel can be configured by using iptables, nftables, or a firewall. Therefore, based on the transmission channel policy configured using iptables, nftables, or a firewall, the network security of the IoT system can be enhanced by controlling and managing network traffic according to predefined rules and policies.

[0075] In some embodiments, the areas may include a first area and a second area. The transmission channel policy of the first area includes a plurality of rules, including allowing packets to be transmitted from the first area to an untrusted network, denying packets from the first area to be transmitted to a work area via a local area network, denying packets from an untrusted network to be transmitted to the first area, or conditionally allowing packets from an untrusted network to be transmitted to the first area.

[0076] For example, Fig. 7A is a schematic diagram of a transmission channel strategy for a region according to an embodiment of the present invention. Fig. 7A , the IoT gateway 710 may configure a transmission channel policy CP71 between the zone Z2 and the untrusted network zone. The zone Z2 may be an IT service zone. The transmission channel policy CP71 of the zone Z2 may include at least one of rule a, rule b, rule c and rule d.

[0077] Rule a: Allow packets to be transmitted from zone Z2 to untrusted network 71. Rule b: Deny packets to be transmitted from zone Z2 to work area 72 via local area network LAN. Rule c: Deny packets to be transmitted from untrusted network 71 to zone Z2. Rule d: Conditionally allow packets from untrusted network 71 to reach zone Z2. Based on this, the transmission channel between the IT service area and the untrusted network area 71 can be monitored and managed to prevent network attacks (such as distributed denial of service (DDoS)) from the untrusted network 71.

[0078] In some embodiments, the areas include a first area, a second area, and a third area. The transmission channel policy associated with the third area includes a plurality of rules. The plurality of rules include denying packet transmission between a first application in the first area or the second area and a second application in the third area, or allowing packet transmission between a first application in the first area or the second area and a third application in the third area. The plurality of rules further include denying packets from being transmitted from an untrusted network to the third area.

[0079] For example, Figure 7B is a schematic diagram of a transmission channel strategy for a region according to an embodiment of the present invention. Figure 7B , the IoT gateway 710 may configure a transmission channel policy CP72 for the transmission channel between the area Z2 and the area Z3 and the transmission channel between the area Z1 and the area Z3. Area Z1 may be an OT service area. Area Z2 may be an IT service area. Area Z3 may be a management area. The transmission channel policy CP72 associated with area Z3 may include at least one of rule e and rule f.

[0080] Rule e: Deny packet transmission between the first application in zone Z1 or zone Z2 and the second application in zone Z3. Rule f: Allow packet transmission between the first application in zone Z1 or zone Z2 and the third application in zone Z3. The second application and the third application are different applications in zone Z3. In other words, the first application in zone Z1 or zone Z2 can access zone Z3 through permission control, that is, the transmission channel policy CP72 can only allow authorized packet flows between zone Z1 and zone Z3 and authorized packet flows between zone Z2 and zone Z3. For example, by utilizing container security profiles, applications in zone Z1 and zone Z2 can access the management zone Z3. In addition, the transmission channel policy CP72 can allow applications of a service module provided by the cloud platform to access applications of the same service module in the management zone Z3. For example, the transmission channel policy CP72 can allow applications in zones Z1 and Z2 to access applications with specific ports in the management zone Z3. In addition, it should be noted that the transmission channel policy CP72 can deny some applications in the management zone Z3 from being accessed by applications in zones Z1 and Z2. In other words, some applications in zone Z3 can be isolated, thereby improving the security of management services and security services.

[0081] For example, Figure 7C is a schematic diagram of a transmission channel strategy for a region according to an embodiment of the present invention. Figure 7C , the IoT gateway 710 may configure a transmission channel policy CP73 for the transmission channel between the untrusted network 71 and the zone Z3. The zone Z1 may be an OT service zone. The zone Z2 may be an IT service zone. The zone Z3 may be a management zone. The transmission channel policy CP73 associated with the zone Z3 may include at least one of the rule g and the rule h.

[0082] Rule g: Allow datagrams from zone Z3 to communicate with trusted services in untrusted network 71. Rule h: Deny packets from untrusted network 71 to reach zone Z3. In this way, the transmission channel between zone Z3 and untrusted network 71 can be monitored to prevent network attacks (such as distributed denial of service (DDoS)) from untrusted network 71.

[0083] In some embodiments, the areas include a first area, a second area, and a third area. The transmission channel policy of the second area includes a plurality of rules. The plurality of rules include denying packets from the second area to be transmitted to an untrusted network, or allowing packets from the second area to be transmitted to a local area network.

[0084] For example, Fig.7D is a schematic diagram of a transmission channel strategy for a region according to an embodiment of the present invention. Fig.7D, the IoT gateway 710 may configure a transmission channel policy CP74 for the transmission channel between the area Z1 and the work field 72. Area Z1 may be an OT service area. Area Z2 may be an IT service area. Area Z3 may be a management area. The transmission channel policy CP74 associated with area Z1 may include at least one of rule i and rule j. Rule i: Deny packets from area Z1 to be transmitted to the untrusted network 71. Rule j: Allow packets from area Z1 to be transmitted to the work field 72 via the local area network.

[0085] In some embodiments of the IoT gateway using the Linux kernel, the zones Z1-Z3 and the transmission channel strategy are implemented at the application layer. Accordingly, the netfilter in the Linux kernel can filter packets according to the transmission channel strategy.

[0086] In some embodiments, the IoT gateway may obtain a partition label of the application, wherein the partition label corresponds to one of the multiple regions. When installing the application to the IoT gateway, the IoT gateway may deploy the application to one of the multiple regions according to the partition label of the application.

[0087] Figure 8 is a schematic diagram of deploying applications to regions based on partition labels according to an embodiment of the present invention. Figure 8 In step S81, the administrator U1 may determine the partition labels L1 corresponding to different applications. In step S82, the partition labels L1 set by the administrator U1 may be stored in the IoT Hub H1. In step S83, when the application is to be installed in the IoT gateway 801, the partition labels L1 corresponding to different applications may be transmitted from the IoT Hub H1 to the partition module M1 in the IoT gateway 801 to achieve the result of remotely deploying the applications in multiple areas of the IoT gateway 801. In step S84, the partition module M1 may provide the partition label L1 to the installation module M2 in the IoT gateway 801. In step S85, the installation module M2 downloads the applications A1 and A2 from the service provision server SS1 (e.g., a cloud service platform). In steps S86 and S87, during the installation process of the applications A1 and A2, the installation module M2 assigns IP addresses of different subnets to the applications A1 and A2 according to the partition label L1, so as to deploy the different applications A1 and A2 to the area Z1 and the area Z2 respectively. In addition, through the configuration of the transmission channel policy of the transmission channel as described in the above embodiment, the packet transmission between the enterprise server SS2 and the application A2 is allowed. However, the packet transmission between the attacker B1 and any area inside the IoT gateway 801 is denied.

[0088] It should be noted that any content of each embodiment of the present application, as well as any content of the same embodiment, can be freely combined. Any combination of the above content is within the scope of the present application.

[0089] In summary, the present disclosure is applicable to IoT gateways in IoT systems, and enhances the security of IoT devices by establishing regions and transmission channels. Specifically, applications deployed in IoT gateways can be partitioned into multiple regions. Each region can be associated with different transmission channel policies and permission controls to ensure that only authorized entities can access and execute specific functions. In other words, by establishing transmission channel policies for regions, communications between applications can be restricted and controlled. These transmission channel policies may manage the flow, filtering, and blocking of specific types of traffic to ensure that only authorized communications occur between different regions. Therefore, the method disclosed in the present disclosure can protect the IoT system from unauthorized access and potential threats, thereby improving the overall security and credibility of the IoT environment. In addition, since the transmission channel policy can be set based on the region, the configuration efficiency and flexibility of the packet management policy can be greatly improved, and the feasibility of remotely deployed application services can be further improved.

[0090] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for secure partitioning of Internet of Things applications, applicable to Internet of Things gateways, characterized in that: The method comprises: By dividing the plurality of subnets, a plurality of regions corresponding to the plurality of subnets are established; Deploying an application installed in the IoT gateway to one of the plurality of areas; configuring a transmission channel strategy associated with at least one of the plurality of areas; and The packet transmission of the plurality of zones is managed according to the transmission channel strategy.

2. The Internet of Things application security partitioning method according to claim 1 is characterized in that: The step of establishing the plurality of areas corresponding to the plurality of subnets by dividing the plurality of subnets comprises: The plurality of subnets are divided by establishing a virtual network interface, wherein each of the plurality of subnets corresponds to an IP address range.

3. The Internet of Things application security partitioning method according to claim 2 is characterized in that: The step of deploying the application installed in the IoT gateway to the multiple areas, wherein one of the areas comprises: A specific IP address within the IP address range of one of the plurality of subnets is assigned to the application to deploy the application to the one of the plurality of zones corresponding to the one of the plurality of subnets.

4. The Internet of Things application security partitioning method according to claim 1 is characterized in that: The multiple areas include an information technology service area and an operational technology service area, the information technology service area includes at least one information technology service application, and the operational technology service area includes at least one operational technology service application.

5. The Internet of Things application security partitioning method according to claim 4 is characterized in that: The plurality of areas further include a management area, and the management area includes at least one security service application.

6. The Internet of Things application security partitioning method according to claim 5 is characterized in that: The step of deploying the application installed in the IoT gateway to one of the multiple areas includes: Acquire a service module provided by a cloud service platform, wherein the service module includes the application; When the application belongs to a high data security level, deploying the application to the management area; and When the application belongs to a low data security level, the application is deployed to the information technology service area or the operation technology service area.

7. The method for secure partitioning of Internet of Things applications according to claim 1, characterized in that: The method further comprises: A partition label of the application is obtained, wherein the partition label corresponds to one of the plurality of areas.

8. The method for secure partitioning of Internet of Things applications according to claim 7, characterized in that: The step of deploying the application installed in the IoT gateway to the multiple areas, wherein one of the areas comprises: When the application is installed on the IoT gateway, the application is deployed to one of the multiple areas according to the partition tag of the application.

9. The method for secure partitioning of Internet of Things applications according to claim 1, characterized in that: The multiple areas include a first area and a second area, and the transmission channel strategy associated with the first area includes multiple rules, and the multiple rules include allowing packets to be transmitted from the first area to an untrusted network, refusing packets to be transmitted from the first area to a work area via a local area network, refusing packets to be transmitted from the untrusted network to the first area, or conditionally allowing packets to be transmitted from the untrusted network to the first area.

10. The Internet of Things application security partitioning method according to claim 1, characterized in that: The multiple areas include a first area, a second area and a third area, and the transmission channel policy associated with the third area includes multiple rules, and the multiple rules include denying packet transmission between a first application in the first area or the second area and a second application in the third area, or allowing packet transmission between the first application in the first area or the second area and a third application in the third area.

11. The method for secure partitioning of Internet of Things applications according to claim 1, characterized in that: The plurality of rules also include denying packets from an untrusted network from being passed to the third zone.

12. The Internet of Things application security partitioning method according to claim 1, characterized in that: The multiple areas include a first area, a second area and a third area, and the transmission channel strategy associated with the second area includes multiple rules, and the multiple rules include denying packets from the second area to be transmitted to an untrusted network, or allowing packets from the second area to be transmitted to a local area network.

13. An Internet of Things gateway, characterized in that: include: Transceiver; Memory; A processor is coupled to the transceiver and the memory and is configured to: By dividing the plurality of subnets, a plurality of regions corresponding to the plurality of subnets are established; Deploying an application installed in the IoT gateway to one of the plurality of areas; configuring a transmission channel strategy associated with at least one of the plurality of areas; as well as The packet transmission of the plurality of zones is managed according to the transmission channel strategy.

14. The Internet of Things gateway according to claim 13, characterized in that: The processor is further configured to: The plurality of subnets are divided by establishing a virtual network interface, wherein each of the plurality of subnets corresponds to an IP address range.

15. The Internet of Things gateway according to claim 14, characterized in that: The processor is further configured to: A specific IP address within the IP address range of one of the plurality of subnets is assigned to the application to deploy the application to the one of the plurality of zones corresponding to the one of the plurality of subnets.

16. The Internet of Things gateway according to claim 13, characterized in that: The multiple areas include an information technology service area and an operational technology service area, the information technology service area includes at least one information technology service application, and the operational technology service area includes at least one operational technology service application.

17. The Internet of Things gateway according to claim 16, characterized in that: The plurality of areas further include a management area, and the management area includes at least one security service application.

18. The Internet of Things gateway according to claim 13, characterized in that: The processor is further configured to: Acquire a service module provided by a cloud service platform, wherein the service module includes the application; When the application belongs to a high data security level, deploying the application to the management area; as well as When the application belongs to a low data security level, the application is deployed to the information technology service area or the operation technology service area.

19. The Internet of Things gateway according to claim 13, characterized in that: The processor is further configured to: A partition label of the application is obtained, wherein the partition label corresponds to one of the plurality of areas.

20. The Internet of Things gateway according to claim 19, characterized in that: The processor is further configured to: When the application is installed on the IoT gateway, the application is deployed to one of the multiple areas according to the partition tag of the application.

21. The Internet of Things gateway according to claim 13, characterized in that: The multiple areas include a first area and a second area, and the transmission channel strategy associated with the first area includes multiple rules, and the multiple rules include allowing packets to be transmitted from the first area to an untrusted network, refusing packets to be transmitted from the first area to a work area via a local area network, refusing packets to be transmitted from the untrusted network to the first area, or conditionally allowing packets to be transmitted from the untrusted network to the first area.

22. The Internet of Things gateway according to claim 13, characterized in that: The multiple areas include a first area, a second area and a third area, and the transmission channel policy associated with the third area includes multiple rules, and the multiple rules include denying packet transmission between a first application in the first area or the second area and a second application in the third area, or allowing packet transmission between the first application in the first area or the second area and a third application in the third area.

23. The Internet of Things gateway according to claim 13, characterized in that: The plurality of rules also include denying packets from an untrusted network from being passed to the third zone.

24. The Internet of Things gateway according to claim 13, characterized in that: The multiple areas include a first area, a second area and a third area, and the transmission channel strategy associated with the second area includes multiple rules, and the multiple rules include denying packets from the second area to be transmitted to an untrusted network, or allowing packets from the second area to be transmitted to a local area network.

Images