Internet-of-things secret change integrated information security protection system

Abstract

The invention discloses an Internet of Things secret change integrated information security protection system, relates to the technical field of information security, and aims to solve the problems of inflexible secret key management, insufficient encryption strength, indynamic authority management, limited attack detection capability and protection response lag in an existing Internet of Things system. The system is composed of a data encryption module, a dynamic key generation module, a key synchronization module, an access control module, an attack detection module and a protection strategy module. A dynamic key is generated based on a device identifier and a timestamp through a dynamic key generation module, so that the key is unique and updated in real time; the data encryption module adopts a dynamic mask block encryption algorithm to effectively resist data eavesdropping and tampering; the access control module dynamically adjusts the permissions between the devices through the permission matrix; the attack detection module monitors equipment abnormity in real time through behavior pattern analysis; and the protection strategy module updates the key or isolates the equipment after detecting the abnormity, so as to prevent attack diffusion.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an Internet of Things secret modification integrated information security protection system. Background Art

[0002] With the rapid development of Internet of Things (IoT) technology, IoT devices have gradually penetrated into multiple fields such as smart homes, industrial manufacturing, medical health, and smart transportation. These devices form a complex distributed network through sensors, wireless communication technology, and cloud collaboration, providing users with efficient and convenient services. However, due to the diversity, distributed deployment, and low-power design characteristics of IoT devices, their information security faces many challenges. Especially in the process of data communication, IoT devices are vulnerable to external attacks due to the lack of a complete security protection mechanism, which leads to serious problems such as data leakage, device tampering, and even system paralysis.

[0003] Although many IoT systems currently try to enhance system security by using encryption algorithms, permission control, and anomaly detection, the following key issues still exist: 1. Single key management method makes it difficult to prevent key leakage: Currently, most IoT devices rely on static keys or preset keys for data encryption. This approach has serious security risks. Once the key is stolen by an attacker, all subsequent communications may be cracked, and the device and its users are at risk of data leakage.

[0004] The use of static keys makes it difficult for IoT devices to handle man-in-the-middle and replay attacks. For example, an attacker can intercept the communication data of a legitimate device and resend it to maliciously control the device.

[0005] In a complex IoT environment, devices usually need to communicate with multiple nodes or the cloud, but existing technologies lack dynamic key generation and distribution mechanisms for multi-device scenarios. Static keys cannot adapt to real-time changes in device status and communication requirements, resulting in insufficient overall system protection capabilities.

[0006] IoT devices are mostly limited by hardware resources (such as computing power and storage space). In order to reduce resource overhead, many devices use low-complexity encryption algorithms, such as fixed masks or simple symmetric encryption. These methods are very vulnerable to modern computing power. Attackers can quickly decrypt communication data through brute force, resulting in user privacy leakage or system hijacking.

[0007] In current IoT systems, packet encryption mostly uses fixed masks or keys, which may cause data to present similar patterns in multiple communications. This encryption method is easy for attackers to identify patterns and crack through traffic analysis technology. For example, attackers can infer the key or encryption rules by capturing the similarities of multiple data packets.

[0008] Due to hardware performance limitations, some low-power IoT devices can only support simple encryption algorithms, making it difficult to balance high performance and high security, further increasing security risks.

[0009] The permissions between devices in the IoT system are usually preset when the system is deployed, and there is no dynamic adjustment mechanism afterwards. When the status of a device changes (such as when the device is attacked or behaves abnormally), the system cannot revoke or adjust its permissions in time, which can easily lead to the spread of attacks.

[0010] In the prior art, device permissions are mostly managed in a coarse-grained manner. For example, whether device A can access device B is usually determined through a binary decision of "allow" or "deny", which fails to achieve refined permission management based on device status, communication content or operation type.

[0011] Anomaly detection in traditional IoT systems mostly relies on fixed threshold monitoring or simple rule matching. For example, if the frequency of device data upload exceeds a certain threshold, it is considered abnormal. However, this approach cannot cope with complex attack scenarios such as data camouflage, covert communication, or progressive attacks.

[0012] Current anomaly detection mechanisms mainly focus on single indicators, such as communication frequency or data volume, and lack the ability to analyze the overall behavior pattern of the device. For example, an attacker can evade detection by adjusting the attack rhythm to make its behavior characteristics very close to those of a normal device.

[0013] The IoT network environment is complex, and the communication patterns and behavioral characteristics between devices may change at any time. However, existing detection technologies lack adaptive capabilities and it is difficult to adjust detection strategies based on network dynamics, resulting in high false alarm rates and serious underreporting.

[0014] Existing security protection technologies mainly focus on post-attack repairs, such as updating firmware or replacing keys after an attack occurs. This method is time-consuming and difficult to contain the spread and damage of attacks in a timely manner.

[0015] When the system detects device anomalies, existing protection strategies usually only stop communication or send warnings, lacking targeted and flexible response strategies. For example, it is impossible to dynamically adjust permissions or update keys based on device abnormal behavior, making it difficult to effectively control the impact of attacks.

[0016] When IoT devices generate and update dynamic keys, they need to rely on timestamps to ensure key synchronization. However, due to the wide distribution of IoT devices, the timestamps of the sender and receiver may be inconsistent due to clock drift or network delay, resulting in the inability to correctly match the keys, thus causing decryption failure.

[0017] In scenarios where multiple devices communicate simultaneously, existing technologies make it difficult to quickly distribute and synchronize keys, resulting in poor coordination and consistency in communications between devices, further reducing the security of the system.

[0018] Existing IoT security technologies have significant deficiencies in key management, data encryption, permission control, attack detection, and protection response, which are mainly reflected in the lack of dynamic key management, low encryption algorithm strength, inflexible permission management, limited attack detection capabilities, and lagging protection measures. These technical shortcomings make it difficult for IoT systems to cope with complex security threats and also restrict the further development of IoT technology. Therefore, there is an urgent need for a technical solution that can comprehensively improve the communication security of IoT devices, with dynamic key management, intelligent behavior analysis, real-time response and protection as the core, to solve these pain points in existing technologies and provide an effective solution for the secure communication of IoT devices.

[0019] Therefore, we urgently need to design an IoT encryption integrated information security protection system to solve the above problems. Summary of the invention

[0020] The purpose of the present invention is to provide an Internet of Things encryption integrated information security protection system to address the deficiencies in the prior art and to solve the problems raised in the background technology.

[0021] To achieve the above object, the present invention provides the following technical solution: an Internet of Things encryption and integrated information security protection system, the system comprising: a data encryption module for encrypting data transmitted between Internet of Things devices, using a symmetric encryption algorithm, the formula is: in is the plaintext data to be encrypted, is a dynamic key, is the encrypted ciphertext; The data encryption module adapts to the packet encryption method and converts the plaintext data Divide into , the block encryption formula is: ; in , is the group number, It is a one-way hash function used to generate dynamic mask for grouping; Dynamic key generation module based on device unique identifier and the current timestamp , dynamically generate keys ; in Indicates timestamp Hash function The processed value provides randomness in the time dimension; When generating a key, The functions include: first calculate the timestamp Hash value , introducing the randomness of the time dimension; and Through XOR Operation combination, mixing device identification and time information; finally, the mixed value is passed through Generate the final dynamic key ; The key synchronization module makes the dynamic keys of the sender and the receiver consistent during the communication process, using the key update rule: in is the current key, The timestamp for the next moment; Provides the update result after combining time and key, so as to ensure key synchronization and security; during the key synchronization process, The function is to perform hash calculation on the input timestamp and the current key, so that the updated key cannot be predicted; Access Control Matrix Manage the authority relationship between devices. The matrix is ​​defined as: ; The attack detection module is used to detect abnormal device behavior based on the behavior distance Determine the current behavior of the device Whether it is abnormal, the formula is: in Indicates the current behavior of the device. For normal behavior set, is the judgment threshold; The protection policy module triggers protection when abnormal behavior is detected, including dynamic key updates: in It is a random number used to increase the randomness in abnormal situations; Used to make the new key random; Dynamically adjust the access control matrix to remove abnormal device permission items , preventing it from continuing to access other devices.

[0022] As a preferred technical solution of the present invention, the mask generation function of the data encryption module It can be optimized to adapt to low-power devices in the following ways: , in It is the mask length parameter, which is used to reduce the computational complexity.

[0023] As a preferred technical solution of the present invention, the dynamic key generation module uses the device unique identifier and timestamp The key is generated by combining the following formula: in Indicates timestamp Hash function The processed value provides randomness in the time dimension; It is a one-way hash function that makes the input data irreversible and the output unique.

[0024] As a preferred technical solution of the present invention, the key synchronization module corrects the timestamp deviation between the sending end and the receiving end through a distributed time synchronization protocol, so that the key update consistency of both parties is achieved.

[0025] As a preferred technical solution of the present invention, the normal behavior set of the attack detection module is Generated through cluster analysis, represented as multiple behavioral cluster centers , the current behavior of the device The exception judgment rules are: in Represents the behavior data of the current device, usually including parameters such as its network traffic, command execution times, and communication mode; Represents the normal behavior set, which is a normal device behavior model generated by a clustering algorithm; Indicates the center point of the behavior cluster, representing the characteristic value of the normal behavior cluster; Indicates the current behavior and the center of the behavior cluster The distance can be calculated by using Euclidean distance, cosine similarity or other suitable measurement methods; Represents the preset abnormality judgment threshold. If the behavior distance Exceed For all , then the current behavior is judged to be abnormal; Represents the number of behavior clusters, which is the number of normal behavior categories determined by cluster analysis.

[0026] As a preferred technical solution of the present invention, the access control module is based on the device operation status Dynamically adjust permissions, the status calculation formula is: Where D is the real-time operating parameter set of the device; is the state calculation function; the access control matrix is ​​updated as: in Equipment and status, The specific logic can be designed according to actual needs, including: judging the device and Whether it is in a compatible state; determine whether the device Whether the status of a device is allowed to be accessed by other devices; dynamically adjust access permissions based on device priority or trust level.

[0027] As a preferred technical solution of the present invention, when the protection strategy module triggers the key update, it records the behavior log and key update record of the abnormal device and sends the information to the system administrator.

[0028] As a preferred technical solution of the present invention, the key update record is stored through blockchain technology, and the block record format is: in Digitally sign the device to ensure the integrity and non-tamperability of key records.

[0029] As a preferred technical solution of the present invention, when the attack detection module detects abnormal behavior, it limits the communication rights of the abnormal device through the protection strategy module, including suspending its key synchronization and isolating its network access rights.

[0030] As a preferred technical solution of the present invention, the system supports collaborative work between edge devices and the cloud, wherein: The cloud is responsible for complex encryption calculations, key management, and behavior log storage; Edge devices complete real-time encryption and decryption and behavior detection tasks.

[0031] Compared with the prior art, the present invention has the following beneficial effects: The present invention uses a dynamic key generation mechanism to generate a unique and real-time changing key based on the device identifier and timestamp, effectively preventing the security risks caused by static key leakage. At the same time, the dynamic mask block encryption technology is adopted to make the data encryption of each communication unique, significantly improving the data anti-eavesdropping and anti-tampering capabilities, and meeting the high-intensity encryption requirements in complex IoT environments.

[0032] By dynamically adjusting the communication permissions between devices through the permission matrix, the system can flexibly limit or authorize device access according to the device status, enhancing the flexibility and refinement of permission management. In addition, the attack detection module monitors the abnormal behavior of devices in real time through multi-dimensional behavior pattern analysis, and can accurately identify potential threats, making up for the shortcomings of traditional detection methods in complex attack scenarios.

[0033] The protection strategy module can quickly respond when abnormal behavior is detected, such as updating keys, isolating devices, or adjusting the permission matrix, thereby effectively preventing the spread of attacks. The modules of the entire system work together, which not only improves the security of IoT communications, but also enhances the system's adaptability to dynamic network environments and improves the system's reliability and stability. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 This is a system block diagram of an Internet of Things secret modification integrated information security protection system proposed by the present invention. DETAILED DESCRIPTION

[0035] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0036] The following is combined with Figure 1 With reference to the accompanying drawings and a number of embodiments, specific embodiments of the present invention are described in detail.

[0037] Embodiment 1: See also Figure 1 As shown, the Internet of Things key modification integrated information security protection system of the present invention includes the following modules: data encryption module, dynamic key generation module, key synchronization module, access control module, attack detection module, and protection strategy module.

[0038] Data encryption module function: used to encrypt communication data between IoT devices to prevent eavesdropping or tampering.

[0039] Implementation method: Raw data Grouped into , each data packet is encrypted by a dynamic mask: ; in , is a dynamic key, It is a one-way hash function.

[0040] Dynamic Mask pass and group number Generate a unique encryption key for each packet.

[0041] The ciphertext generated after encryption is transmitted to the receiving end, which uses the same key And dynamic mask decryption to restore the original data .

[0042] Dynamic key generation module: Function: Dynamically generate keys for data encryption .

[0043] Implementation method: Dynamic key is generated by formula: ; in is a unique identifier for the device, is the timestamp, Is a one-way hash function. Timestamp The randomness of the time dimension is introduced to ensure that the key is dynamically updated over time.

[0044] Device identifier The key generated by each device is unique. When the system is initialized, the device is assigned a unique and synchronize timestamp T with the time server in the system.

[0045] Key synchronization module: Function: Enables consistency in key updates between devices.

[0046] Implementation method: Current key With the next moment timestamp Combine to generate the updated key: ; All devices correct timestamps through a time synchronization protocol (such as the NTP protocol), which can make the time of the sender and the receiver consistent, thereby achieving key synchronization.

[0047] Access control module: manages access rights between devices through the access control matrix.

[0048] Permissions matrix Indicates that Indicates the device About equipment Have access rights, Indicates no permission.

[0049] When the device status Dynamically adjust the permission matrix when changes occur .state The calculation formula is: ; in Indicates the real-time operating parameters of the device. is the state evaluation function.

[0050] Attack detection module: detects abnormal devices in real time through behavioral analysis.

[0051] Generate normal behavior set using clustering algorithm is the center point of the behavior cluster.

[0052] Current device behavior and Distance Exceeding the preset threshold When the following is considered abnormal behavior: ; After detecting abnormal behavior, the protection policy module restricts device permissions or updates keys.

[0053] Implementation method: Trigger key update and generate new key: ; in It is a random number used to introduce protection randomness.

[0054] Dynamically adjust the permission matrix and set the permissions of abnormal devices to , isolating its network access.

[0055] Embodiment 2: Smart home environments include smart door locks, cameras, smart light bulbs, thermostats, voice assistants, etc. These devices work with the central server through the home router, and users can remotely control them through mobile phone apps, such as checking the door lock status and turning on camera monitoring.

[0056] Data encryption module: its function is to encrypt the communication data between the smart door lock and the camera to prevent the leakage of user privacy information.

[0057] Implementation process: Smart door lock sends unlock request "UnlockRequest", group it and encrypt it: ; in is the data grouping, is a dynamic key, It is the group dynamic mask.

[0058] Example: Input plain text data: "UnlockRequest"; Grouping: "Unlock", "Request" uses a dynamic key , calculate the mask , get the ciphertext: ; Sending encrypted data to the camera.

[0059] Dynamic key generation module: Generates a unique and dynamically changing key for each device.

[0060] Implementation process: Smart door lock key generation formula: ; in "Lock001" is the device identifier, Is the timestamp.

[0061] Example: Timestamp "2024-11-1910:00".

[0062] Generate a key: "Lock$001" H("20$24-11-1910:00") .

[0063] Key synchronization module: ensures that keys between devices are synchronized and consistent.

[0064] Using the formula Update the key.

[0065] Example: Current Key , timestamp "2024-11-1910:01"; Calculate the new key: (“2024-11-1910:01”) .

[0066] Access control module: dynamically manages the communication permissions between door locks and cameras.

[0067] Implementation process: Through the authority matrix , set the door lock's access rights to the camera: .

[0068] If abnormal behavior is detected, permissions are dynamically adjusted to: .

[0069] Attack detection module: monitors the door lock in real time for abnormal behavior.

[0070] Implementation process: If the door lock sends more than 50 unlocking requests in a row within 1 minute, the system will determine it as abnormal: ; is the current behavior data, is the center of the normal behavior cluster.

[0071] Protection strategy module: Isolate abnormal devices and update keys.

[0072] Implementation process: Generate a new key , the permission matrix is ​​updated to .

[0073] Abnormal devices are isolated and cannot access other devices.

[0074] Embodiment 3: Scenario description: In an industrial environment, there are multiple temperature sensors and pressure sensors that monitor the status of factory equipment in real time. These devices are connected to the central controller via industrial Ethernet. The sensors are responsible for collecting data and uploading it to the server in encrypted form.

[0075] Data encryption module: Encrypts data collected by sensors to prevent industrial data leakage.

[0076] Implementation process: Data collected by sensors “Temperature C", encryption formula: .

[0077] Dynamic key generation module: dynamically generates the key for each sensor.

[0078] Key formula: ; in “TempSensor .

[0079] The attack detection module functions to identify abnormal sensor behavior.

[0080] Implementation process: If the frequency of data upload by a sensor increases sharply from 1 time per second to 50 times per second, the system will determine it as abnormal behavior and trigger isolation.

[0081] Protection strategy module: Isolate abnormal sensors and update permissions.

[0082] Implementation process: Permission matrix update , and notify the administrator.

[0083] Embodiment 4: Scenario description: In a hospital environment, a monitor transmits a patient's vital signs data (such as heart rate and blood pressure) to a central server via a wireless network for real-time monitoring.

[0084] Data encryption module: Encrypt heart rate data to protect patient privacy.

[0085] Implementation process: heart rate data “HeartRate Block Cipher: Function of dynamic key generation module: dynamically generate the key of the monitor.

[0086] Implementation process: Use formula ,in "Monitor .

[0087] Attack detection module: detects abnormal behavior of the monitor.

[0088] Implementation process: If the upload frequency of the monitor is abnormal (for example, it increases from 1 time per second to 100 times per second), the system will determine it as abnormal.

[0089] Protection strategy module: Isolate abnormal monitors and update keys.

[0090] Implementation process: Update the permission matrix , generate a new key and notify the server.

[0091] Ciphertext calculation formula: In the present invention, ciphertext It is through plaintext grouping and dynamically generated masks XOR operation results in: in The plain text The data to be encrypted Divide into multiple fixed-size groups The size of each packet is determined according to the device performance and requirements (such as 128 bytes or 256 bytes).

[0092] Dynamic mask for grouping, with dynamic key and group number Generate, the calculation formula is: ; in It is a dynamic key generated by the device identifier and timestamp (such as , Number the current group (from 1 to , It is a one-way hash function that converts input data into a pseudo-random value of fixed length to ensure the uniqueness and security of the mask.

[0093] For XOR operation, group the plaintext bit by bit and dynamic mask Performs logical operations.

[0094] Embodiment 5: Scenario description: Assume plaintext data "unlockRequest", dynamic key , group number Starting from 1, the hash function The output is a 128-bit (16-byte) value. This embodiment details the entire process of block encryption, dynamic mask generation, and ciphertext calculation.

[0095] 1. Group the plaintext Grouped into: ; Convert packet data to binary representation (in ASCII encoding): (ASCII code for "Unlock") (ASCII encoding of "Request").

[0096] 2. Dynamic mask generation, the mask is generated by the formula Generate, the specific calculation is as follows: For the group ,Right now: ; count ; Will Input hash function , assuming the hash output is: ; For grouping ,Right now: ; count ; Will Input hash function , assuming the hash output is: ; 3. Ciphertext calculation, grouping plaintext byte by byte and dynamic mask XOR operation is performed on the corresponding bytes to calculate the ciphertext , for grouping , mask The first 6 bytes are , XOR calculation: ; ; For grouping , mask The first 7 bytes are , XOR calculation: ; ; The complete ciphertext is composed of the group ciphertext and Stitched together: ; The calculation results are: .

[0097] 5. Decryption process, using the same dynamic key at the receiving end And the mask generation formula , restore the plaintext through XOR operation.

[0098] For ciphertext , mask The first 6 bytes are ; The decryption result is "Unlock".

[0099] ; For ciphertext , mask The first 7 bytes are , ; , the decrypted result is "Request".

[0100] The final restored plaintext is: .

[0101] The contents not described in detail in this specification belong to the prior art known to professional and technical personnel in the field. Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments, or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. An Internet of Things secret modification integrated information security protection system, characterized in that: The system includes: The data encryption module is used to encrypt data transmitted between IoT devices, using a symmetric encryption algorithm. The formula is: ； in is the plaintext data to be encrypted, is a dynamic key, is the encrypted ciphertext; The data encryption module adapts to the packet encryption method and converts the plaintext data Divide into , the block encryption formula is: ； in , is the group number, It is a one-way hash function used to generate dynamic mask for grouping; Dynamic key generation module based on device unique identifier and the current timestamp , dynamically generate keys ; ； in Indicates timestamp Hash function The processed value provides randomness in the time dimension; When generating a key, The functions include: first calculate the timestamp Hash value , introducing the randomness of the time dimension; and Through XOR Operation combination, mixing device identification and time information; finally, the mixed value is passed through Generate the final dynamic key ; The key synchronization module makes the dynamic keys of the sender and the receiver consistent during the communication process, using the key update rule: ； in is the current key, The timestamp for the next moment; Provides the update result after combining time and key, so as to ensure key synchronization and security; during the key synchronization process, The function is to perform hash calculation on the input timestamp and the current key, so that the updated key cannot be predicted; Access Control Matrix Manage the authority relationship between devices. The matrix is ​​defined as: ； The attack detection module is used to detect abnormal device behavior based on the behavior distance Determine the current behavior of the device Whether it is abnormal, the formula is: ； in Indicates the current behavior of the device. For normal behavior set, is the judgment threshold; The protection policy module triggers protection when abnormal behavior is detected, including dynamic key updates: ； in It is a random number used to increase the randomness in abnormal situations; Used to make the new key random; Dynamically adjust the access control matrix to remove abnormal device permission items , preventing it from continuing to access other devices.

2. The Internet of Things secret modification integrated information security protection system according to claim 1 is characterized in that: The mask generation function of the data encryption module It can be optimized to adapt to low-power devices in the following ways: ； in It is the mask length parameter, which is used to reduce the computational complexity.

3. The Internet of Things secret modification integrated information security protection system according to claim 1 is characterized in that: The dynamic key generation module uses the device unique identifier and timestamp The key is generated by combining the following formula: ； in Indicates timestamp Hash function The processed value provides randomness in the time dimension; It is a one-way hash function that makes the input data irreversible and the output unique.

4. The Internet of Things secret modification integrated information security protection system according to claim 1 is characterized in that: The key synchronization module corrects the timestamp deviation between the sending end and the receiving end through a distributed time synchronization protocol, so that the key update consistency of both parties is achieved.

5. The Internet of Things secret modification integrated information security protection system according to claim 1 is characterized in that: The normal behavior set of the attack detection module Generated through cluster analysis, represented as multiple behavioral cluster centers , the current behavior of the device The exception judgment rules are: ； in Represents the behavior data of the current device, including its network traffic, command execution times, and communication mode parameters; Represents the normal behavior set, which is a normal device behavior model generated by a clustering algorithm; Indicates the center point of the behavior cluster, representing the characteristic value of the normal behavior cluster; Indicates the current behavior and the center of the behavior cluster The distance is calculated using Euclidean distance and cosine similarity measurement methods; Represents the preset abnormality judgment threshold. If the behavior distance Exceed For all , then the current behavior is judged to be abnormal; Represents the number of behavior clusters, which is the number of normal behavior categories determined by cluster analysis.

6. The Internet of Things secret modification integrated information security protection system according to claim 1 is characterized in that: The access control module is based on the device operation status Dynamically adjust permissions, the status calculation formula is: ； Where D is the real-time operating parameter set of the device; is the state calculation function; the access control matrix is ​​updated as: ； in Equipment and status, The specific logic is designed according to actual needs, including: judging the device and Whether it is in a compatible state; determine whether the device Whether the status of a device is allowed to be accessed by other devices; dynamically adjust access permissions based on device priority or trust level.

7. The Internet of Things secret modification integrated information security protection system according to claim 1 is characterized in that: When the key update is triggered, the protection strategy module records the behavior log and key update record of the abnormal device and sends the information to the system administrator.

8. The Internet of Things secret modification integrated information security protection system according to claim 1 is characterized in that: Key update records are stored through blockchain technology, and the block record format is: ； in Digitally sign the device to ensure the integrity and non-tamperability of key records.

9. The Internet of Things secret modification integrated information security protection system according to claim 1 is characterized in that: When the attack detection module detects abnormal behavior, it limits the communication rights of the abnormal device through the protection strategy module, including suspending its key synchronization and isolating its network access rights.

10. The Internet of Things secret modification integrated information security protection system according to claim 1 is characterized in that: The system supports collaborative work between edge devices and the cloud, where the cloud is responsible for complex encryption calculations, key management, and behavior log storage; and the edge devices complete real-time encryption and decryption and behavior detection tasks.

Images