A data security transmission method for edge gateway of Internet of Things

Abstract

The present invention discloses a data security transmission method for an edge gateway of the Internet of Things, which specifically relates to the technical field of data transmission, and is used to solve the problem of inflexible encryption methods in existing low-power devices in data encryption transmission; collect perception data through low-power devices and perform preprocessing; analyze the multi-dimensional load state of the communication channel through network state tensor decomposition, and evaluate the risk of future load changes; analyze the time distribution of encryption and decryption links through distributed time optimization game, and evaluate the link delay balance; dynamically adjust whether to use a lightweight encryption algorithm based on the above analysis results. When a lightweight encryption algorithm is selected, the device encrypts the data to generate preliminary encrypted data and transmits it to the edge gateway; the edge gateway performs high-intensity encryption upgrades on the preliminary encrypted data to generate deep encrypted data and transmits it to the cloud server. The present invention reduces the energy consumption of low-power devices while ensuring data security, and improves the reliability of data transmission.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission, and more specifically, to a data security transmission method for an edge gateway of an Internet of Things. Background Art

[0002] With the rapid development of IoT technology, low-power devices are increasingly used in IoT sensor networks. These devices provide important support for scenarios such as smart homes, industrial automation, and smart agriculture by collecting and transmitting information such as environmental data and device status data. However, low-power devices are usually limited by their limited computing power and battery life.

[0003] In the prior art, IoT devices usually use high-strength encryption algorithms to encrypt collected data in order to ensure the security of data transmission. The encryption method is not flexible enough. Since the computational complexity of high-strength encryption algorithms is high, they often consume a lot of computing resources and energy, which will cause the battery of low-power devices to deplete faster, seriously affecting the service life of the equipment and the stability of data transmission.

[0004] In order to solve the above problems, a technical solution is now provided. Summary of the invention

[0005] In order to overcome the above-mentioned defects of the prior art, an embodiment of the present invention provides a data security transmission method of an Internet of Things edge gateway to solve the problems raised in the above-mentioned background technology.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] A data security transmission method for an Internet of Things edge gateway comprises the following steps:

[0008] The low-power IoT device collects the perception data and pre-processes the perception data;

[0009] Analyze the multi-dimensional load status of the communication channel through network state tensor decomposition to assess the risk level of future load changes in the communication channel;

[0010] The time distribution of encryption and decryption links is analyzed through distributed time optimization game to evaluate the balance of link delays;

[0011] Based on the future load change trend of the communication channel and the balance of link delay, dynamically adjust whether to use the lightweight encryption algorithm.

[0012] In a preferred embodiment, the sensing data is collected by a low-power IoT device and pre-processed, specifically:

[0013] Acquire sensor data through sensor modules of low-power IoT devices, including environmental data, device status data, and user behavior data;

[0014] De-noising the acquired perception data to remove outliers and invalid data;

[0015] Format the perception data and convert the data into a unified structured format;

[0016] Standardize the perception data and normalize the data values ​​to a preset range to ensure that perception data of different dimensions have consistent dimensions.

[0017] In a preferred embodiment, the multi-dimensional load state of the communication channel is analyzed by network state tensor decomposition to evaluate the risk of future load changes in the communication channel, specifically:

[0018] Acquire multi-dimensional data of the communication channel, where the multi-dimensional data of the communication channel includes time dimension data, device dimension data, and channel dimension data;

[0019] Among them, the time dimension data records the load changes of the communication channel in different time periods, the device dimension data records the traffic usage of each device involved in the communication, and the channel dimension data records the bandwidth usage of different communication channels;

[0020] constructing a multi-dimensional tensor model of the communication channel, and inputting the multi-dimensional data of the communication channel into the tensor model to characterize the load state of the communication channel;

[0021] Use tensor decomposition algorithm to decompose the multidimensional tensor model and extract the main feature information of each dimension;

[0022] Among them, the main characteristic information includes the load trend of the communication channel in the future time period, the impact of specific equipment on the channel load, and the dynamic usage of the channel bandwidth;

[0023] Prediction data of the communication channel load change trend is generated according to the main feature information extracted by tensor decomposition, and the risk degree of future load change of the communication channel is evaluated based on the prediction data of the communication channel load change trend.

[0024] In a preferred embodiment, a tensor decomposition algorithm is used to decompose the multidimensional tensor model to extract the main feature information of each dimension, specifically:

[0025] Tensor decomposition uses a high-order singular value decomposition algorithm, and its decomposition formula is: ;in, is the core tensor, is the feature matrix of the time dimension, is the feature matrix of the device dimension, is the feature matrix of channel dimension, , and are the feature numbers of time dimension, device dimension and channel dimension respectively. is the main feature number of the time dimension, is the main feature number of the device dimension, is the main feature number of the channel dimension;

[0026] According to the decomposition results, the main features of the time dimension, the main features of the device dimension and the main features of the channel dimension are extracted.

[0027] In a preferred embodiment, prediction data of the communication channel load change trend is generated according to the main feature information extracted by tensor decomposition, and the risk degree of future load change of the communication channel is evaluated based on the prediction data of the communication channel load change trend, specifically:

[0028] Extract the eigenvector of each time point from the time dimension feature matrix obtained by tensor decomposition, extract the eigenvalue of the device from the device dimension feature matrix, and extract the eigenvalue of the channel from the channel dimension feature matrix;

[0029] The kernel method is used to construct a nonlinear prediction model, and the formula is as follows: ;in, Indicates the next time point Channel The load forecast value, Represents the time point in the time dimension feature matrix and time characteristics The characteristic value of Represents the device in the device dimension feature matrix and device characteristics The characteristic value of Represents the channel in the channel dimension feature matrix and channel characteristics The characteristic value of represents the kernel function, is the regression weight, is the time point index, is the length of the time window;

[0030] Calculate the future load change risk index, the expression is: ;in, is the future load change risk index, Indicates the predicted time point Communication Channel The load value, Indicates the communication channel The maximum permissible load capacity, represents the current time step index, Indicates the total length of the prediction time window.

[0031] In a preferred embodiment, the time distribution of the encryption and decryption links is analyzed through a distributed time optimization game to evaluate the balance of link delays, specifically:

[0032] Obtain the time distribution data of the encryption and decryption link, including encryption processing time, decryption processing time and data transmission time. The encryption processing time records the encryption operation duration of each node on the link, the decryption processing time records the decryption operation duration, and the data transmission time records the transmission delay of each segment of the data in the link;

[0033] A time distribution game model of the link is constructed. Each node in the link is set as a game participant. The strategy of each participant is to adjust its encryption and decryption time to optimize the total delay of the link. The loss function of each participant is defined as a coupling function of the node's own time distribution and the total delay of the link.

[0034] The game equilibrium is calculated iteratively through a distributed optimization algorithm. The optimization process includes:

[0035] a. Initialize the encryption time, decryption time and data transmission time of each node;

[0036] b. In each iteration, the node updates its encryption and decryption times based on its local time distribution and the policies of other nodes;

[0037] c. When the game process converges, determine the equilibrium state of link time distribution;

[0038] Extract the optimized link time distribution balance results, including the encryption time, decryption time and data transmission time of each node;

[0039] The delay balance index of the link is calculated based on the time distribution balance result. The delay balance index is used to quantify the degree of balance of the time distribution of each node in the link.

[0040] In a preferred embodiment, based on the future load change trend of the communication channel and the balance of link delay, whether to use the lightweight encryption algorithm is dynamically adjusted, specifically:

[0041] Set future load change risk threshold and delay balance threshold;

[0042] When the future load change risk index is less than or equal to the future load change risk threshold, and the delay balance index is greater than the delay balance threshold, it is determined to use the lightweight encryption algorithm; otherwise, it is determined not to use the lightweight encryption algorithm.

[0043] In a preferred embodiment, a data security transmission method for an Internet of Things edge gateway further includes:

[0044] When a lightweight encryption algorithm is used, the sensed data is encrypted based on the lightweight encryption algorithm to generate preliminary encrypted data, and the preliminary encrypted data is transmitted from the low-power device to the edge gateway;

[0045] The edge gateway performs high-intensity encryption upgrades on the initially encrypted data, generates deeply encrypted data and transmits it to the cloud server.

[0046] Technical effects and advantages of a data security transmission method for an Internet of Things edge gateway of the present invention:

[0047] 1. The present invention proposes a data security transmission method for an edge gateway of the Internet of Things. By combining the load change risk of the communication channel and the balance of link delay, it dynamically adjusts whether to use a lightweight encryption algorithm, thereby achieving a balance between data security transmission and energy consumption optimization of low-power devices. By analyzing the multi-dimensional load state of the communication channel through network state tensor decomposition and predicting future load change trends, it is possible to dynamically perceive the pressure changes of the communication network and avoid using complex encryption algorithms under high network load conditions, which leads to a decrease in transmission efficiency. At the same time, the time distribution of the encryption and decryption link is analyzed through distributed time optimization games, the link delay balance is effectively evaluated, and the encryption strategy is optimized based on the link delay balance, thereby improving the overall performance of the link and ensuring the stability and security of data transmission.

[0048] 2. The initial encrypted data of low-power devices is upgraded to high-intensity encryption through the edge gateway, and deep encrypted data is generated and transmitted to the cloud server, further enhancing the security of data during the entire transmission process. This solution combines the advantages of lightweight encryption algorithms and high-intensity encryption algorithms, fully utilizes the computing resources of low-power devices, and relies on the powerful processing capabilities of edge gateways to complete more complex encryption operations, thereby achieving optimal resource allocation. The entire method can extend the battery life of the device while ensuring data security, reduce premature failure of the device due to frequent encryption, and significantly improve the reliability and sustainability of low-power devices in IoT sensor networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 This is a schematic diagram of a data security transmission method for an Internet of Things edge gateway of the present invention. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] Embodiment 1: Figure 1 A data security transmission method for an edge gateway of the Internet of Things is provided, which comprises the following steps:

[0052] The perception data is collected by low-power IoT devices and pre-processed.

[0053] The multi-dimensional load status of the communication channel is analyzed by network state tensor decomposition to evaluate the risk level of future load changes in the communication channel.

[0054] The time distribution of encryption and decryption links is analyzed through distributed time optimization game to evaluate the balance of link delay.

[0055] Based on the future load change trend of the communication channel and the balance of link delay, dynamically adjust whether to use the lightweight encryption algorithm.

[0056] When a lightweight encryption algorithm is used, the perception data is encrypted based on the lightweight encryption algorithm to generate preliminary encrypted data, and the preliminary encrypted data is transmitted from the low-power device to the edge gateway.

[0057] The edge gateway performs high-intensity encryption upgrades on the initially encrypted data, generates deeply encrypted data and transmits it to the cloud server.

[0058] The low-power IoT device collects the perception data and pre-processes the perception data, specifically:

[0059] The sensor modules of low-power IoT devices are used to obtain sensor data, including environmental data, device status data, and user behavior data:

[0060] Among them, sensor modules include but are not limited to temperature and humidity sensors, optical sensors, vibration sensors, acceleration sensors and sound sensors. Perception data mainly covers the following three categories:

[0061] Environmental data: including temperature, humidity, light intensity, air quality and other data.

[0062] Device status data: including device power status, operating status, internal temperature and other information.

[0063] User behavior data: including the user's action mode and keystroke behavior when operating the device.

[0064] De-noise the acquired perception data to remove outliers and invalid data:

[0065] The sliding window algorithm is used to calculate the short-term mean and standard deviation of the collected data, and outliers that exceed the range of ±3 times the standard deviation of the mean are marked; null values ​​and extreme values ​​caused by too long collection time or sensor failure during collection are eliminated; the Kalman filter algorithm is used to smooth the time series data to reduce the high-frequency noise interference in the perception data.

[0066] Format the perception data and convert it into a unified structured format:

[0067] Multi-source perception data are organized in the form of "key-value pairs". For example, data such as temperature, humidity, and light intensity are respectively mapped to timestamps and device IDs to form standardized data record entries. Different categories of data (environmental data, device status data, user behavior data) are divided into independent data groups and sorted in chronological order. When multiple sensor modules collect data at different time intervals, their timestamps are aligned to ensure that all data are arranged according to a unified time dimension.

[0068] Standardize the perception data and normalize the data values ​​to a preset range to ensure that perception data of different dimensions have consistent dimensions:

[0069] Different types of sensory data may have different dimensions and value ranges. For example, temperature may be from 0 to 50 degrees Celsius, and humidity may be from 0% to 100%. In order to eliminate dimensional differences and ensure the consistency of subsequent data transmission and analysis, sensory data needs to be standardized.

[0070] All data values ​​are mapped to the range of [0,1] through the minimum-maximum normalization formula; for some unevenly distributed data, the z-score normalization formula can be used for processing.

[0071] The multi-dimensional load state of the communication channel is analyzed by network state tensor decomposition to assess the risk level of future load changes in the communication channel. Specifically:

[0072] The multi-dimensional data of the communication channel is obtained, where the multi-dimensional data of the communication channel includes time dimension data, device dimension data, and channel dimension data.

[0073] Among them, the time dimension data records the load changes of the communication channel in different time periods, the device dimension data records the traffic occupancy of each device involved in the communication, and the channel dimension data records the bandwidth usage of different communication channels.

[0074] The time dimension data records the load changes of the communication channel at different times, including the traffic occupancy rate, number of data packets transmitted, and communication delay of the channel in different time intervals. The time interval can be set to a fixed length according to actual needs, such as 1 minute, 10 minutes, or 1 hour, to ensure the continuity of load state changes.

[0075] Device dimension data records the traffic usage of each device involved in the communication, including the amount of data sent and received by each device in the communication channel, the device's communication frequency, and the device's connection duration. These data can reflect the contribution of a single device to the communication channel load.

[0076] Channel dimension data records the bandwidth usage of different communication channels, including the total bandwidth, used bandwidth, and remaining bandwidth of the channel, as well as the congestion probability of different channels in a specific time period.

[0077] All collected data are organized into tabular form and stored in groups according to the three-dimensional structure of time, equipment, and channel, providing input for subsequent multidimensional tensor modeling.

[0078] Construct a multidimensional tensor model of the communication channel, and input the multidimensional data of the communication channel into the tensor model to characterize the load state of the communication channel:

[0079] The multidimensional tensor model is represented by a third-order tensor in the form of ,in, Represents a multidimensional tensor model; Represents the time dimension, and its value range is the sampling time interval sequence (for example, 1 to N time points); Indicates the device dimension, and its value range is the device number involved in the communication channel; Indicates the channel dimension, and its value range is the communication channel number.

[0080] Fill the data of the time dimension, device dimension, and channel dimension into the corresponding positions of the tensor model. For example, at the time point , Equipment No. , Channel number The data value filled in is the bandwidth occupied by the device through the channel at that point in time.

[0081] After the tensor model is built, a consistency check is required to ensure the data integrity of the time dimension, device dimension, and channel dimension, such as checking whether there are unfilled data points or abnormal data.

[0082] The multidimensional tensor model is decomposed using the tensor decomposition algorithm to extract the main feature information of each dimension.

[0083] The main characteristic information includes the load trend of the communication channel in the future time period, the impact of specific equipment on the channel load, and the dynamic usage of the channel bandwidth.

[0084] The goal of tensor decomposition is to decompose the multidimensional tensor model into the main feature matrix of each dimension so as to extract the key features of time, device and channel dimensions.

[0085] Tensor decomposition can be performed using the High-Order Singular Value Decomposition (HOSVD) algorithm, and its decomposition formula is: ;in, It is the core tensor, which contains the coupling information between the time dimension, device dimension and channel dimension; is the feature matrix of the time dimension; is the feature matrix of the device dimension; is the feature matrix of channel dimension; , and They are the feature numbers of time dimension, device dimension and channel dimension respectively; is the main feature number of the time dimension, is the main feature number of the device dimension, is the main feature number of the channel dimension.

[0086] According to the decomposition results, the following main feature information is extracted: the main feature of the time dimension, which reflects the load trend of the communication channel in the future time period; the main feature of the device dimension, which reflects the impact of specific equipment on the communication channel load; the main feature of the channel dimension, which reflects the dynamic usage of the channel bandwidth.

[0087] The prediction data of the communication channel load change trend is generated based on the main feature information extracted by tensor decomposition, and the risk level of the future load change of the communication channel is evaluated based on the prediction data of the communication channel load change trend:

[0088] The eigenvector of each time point is extracted from the time dimension feature matrix obtained by tensor decomposition, the eigenvalue of the device is extracted from the device dimension feature matrix, and the eigenvalue of the channel is extracted from the channel dimension feature matrix.

[0089] A nonlinear coupling prediction model is constructed using the main feature information to reflect the comprehensive impact of time, equipment and channel characteristics on future loads. Kernel methods are used to construct the nonlinear prediction model, and the formula is as follows: ;in, Indicates the next time point Channel The load forecast value; Represents the time point in the time dimension feature matrix and time characteristics The characteristic value of Represents the device in the device dimension feature matrix and device characteristics The characteristic value of Represents the channel in the channel dimension feature matrix and channel characteristics The characteristic value of represents the kernel function, which is used to measure the similarity between current features and historical features; is the regression weight, learned by Kernel Ridge Regression; Is a time point index, ranging from 1 to ; It is the length of the time window, which indicates the total number of historical data points used for prediction.

[0090] based on (Prediction data of communication channel load change trend), calculate the future load change risk index, the expression is: ;in, is the future load change risk index, indicating that the communication channel The degree of risk of future load changes; Indicates the predicted time point Communication Channel The load value; Indicates the communication channel Maximum permissible load capacity; Indicates the current time step index, ranging from 1 to ; Represents the total length of the prediction time window (i.e. the total number of time steps that need to be predicted in the future).

[0091] According to the above formula, the greater the future load change risk index, the higher the risk level of future load changes in the communication channel, indicating that the uncertainty and volatility of the load of the communication channel in the future time period is greater, which may lead to problems such as difficulty in allocating communication resources, bandwidth overload or data transmission delay, and therefore the higher the risk level.

[0092] The time distribution of the encryption and decryption links is analyzed through distributed time optimization game to evaluate the balance of link delays. Specifically:

[0093] Obtain the time distribution data of the encryption and decryption link, including encryption processing time, decryption processing time and data transmission time. The encryption processing time records the encryption operation duration of each node on the link, the decryption processing time records the decryption operation duration, and the data transmission time records the transmission delay of each segment of the data in the link.

[0094] Among them, the time distribution data is the time data of each node in the link (including encryption nodes, decryption nodes and relay nodes) recording its operation in real time.

[0095] A time distribution game model of the link is constructed. Each node in the link is set as a game participant. The strategy of each participant is to adjust its encryption and decryption time to optimize the total link delay. The loss function of each participant is defined as the coupling function of the node's own time distribution and the total link delay:

[0096] Each node in the link is regarded as a participant in the game, and the participant's goal is to optimize its local time distribution strategy while taking into account the delay balance of the entire link.

[0097] Each node can adjust its encryption or decryption time within a certain range. For example, a node can optimize its local time cost by changing the complexity of the encryption algorithm or the allocation strategy of the decryption task.

[0098] The loss function of each node consists of two parts:

[0099] Local time distribution deviation: the difference between the actual time distribution of a node and the ideal time distribution;

[0100] Impact of full link delay: the impact of node time distribution on the total link delay.

[0101] By defining the loss function, we ensure that each node optimizes its own strategy while considering the overall time distribution balance of the link.

[0102] The game equilibrium is calculated iteratively through a distributed optimization algorithm. The optimization process includes:

[0103] a. Initialize the encryption time, decryption time, and data transmission time of each node.

[0104] The initial value can be determined based on the average value of historical time data or preset parameters.

[0105] b. In each iteration, a node updates its encryption and decryption times based on its local time distribution and the policies of other nodes.

[0106] Each node updates its encryption time and decryption time according to its current time distribution and the strategies of other nodes. The update strategy includes adjusting the complexity of the encryption algorithm, changing the execution order of decryption tasks, and dynamically adjusting the local resource allocation ratio.

[0107] After updating the local strategy, each node obtains feedback information about the change in its time distribution on the delay of the entire link through the link monitoring module. The feedback information includes the positive and negative impact of the node time distribution adjustment on the link delay balance and the change value of the current link total delay.

[0108] c. When the game process converges, determine the equilibrium state of the link time distribution.

[0109] Through multiple rounds of iterations, when the total link delay change caused by the strategy adjustment of all nodes is less than the preset threshold, it is determined that the game process has reached an equilibrium state.

[0110] Extract the optimized link time distribution balance results, including the encryption time, decryption time and data transmission time of each node:

[0111] Under the equilibrium state, the distribution data of encryption time, decryption time and data transmission time in the link are extracted;

[0112] The data structure includes: node identification, time type, and balanced time value.

[0113] The equalization results are stored in a standardized format to facilitate subsequent evaluation of link delay equalization indicators.

[0114] The delay balance index of the link is calculated based on the time distribution balance result. The delay balance index is used to quantify the degree of balance of the time distribution of each node in the link:

[0115] The delay balance index is used to quantify the degree of balance of the time distribution of each node in the link. The specific calculation method is as follows: First, obtain the encryption processing time, decryption processing time and data transmission time of each node in the link, and calculate the time proportion of each node, that is, the proportion of the total time of the node to the entire link time. Secondly, calculate the mean of the time proportion of all nodes, and the mean is used to characterize the balance of the time distribution of each node under an ideal state. Then, calculate the difference between the time proportion of each node and the mean, and take the absolute value to represent the degree of deviation of each node. Then, by summing the deviation of all nodes and normalizing it to a total value, the degree of imbalance of the overall time distribution of the link is represented. Finally, the total value is reversed into a balance index. The closer the delay balance index is to 1, the higher the degree of balance of the time distribution of each node in the link; the closer the delay balance index is to 0, the lower the degree of balance of the time distribution of each node in the link, and the more imbalanced the time distribution. This index is used to evaluate the coordination of the time distribution of each node in the link and provide a quantitative basis for optimizing the link delay balance.

[0116] Based on the future load change trend of the communication channel and the balance of link delay, dynamically adjust whether to use the lightweight encryption algorithm, specifically:

[0117] Set a future load change risk threshold, which is used to limit the acceptable range of future load changes in the communication channel. If the future load change risk index is less than or equal to the threshold, the load fluctuation of the communication channel is considered to be stable, and there is a low risk of affecting the encryption policy adjustment.

[0118] Set the delay balance threshold, which is used to limit the minimum balance degree of the time distribution of each node in the link. If the delay balance index is greater than the threshold, it is considered that the link time distribution is sufficiently balanced to ensure that the delay impact of the encryption and decryption process is maintained within a reasonable range.

[0119] If the future load change risk index is less than or equal to the future load change risk threshold, it means that the load fluctuation of the communication channel is small, which is suitable for the lightweight encryption requirements of low-power devices; if the delay balance index is greater than the delay balance threshold, it means that the encryption and decryption time distribution of the link is balanced, the delay will not become a bottleneck, and it can support the normal operation of the lightweight encryption algorithm.

[0120] When the future load change risk index is less than or equal to the future load change risk threshold, and the delay balance index is greater than the delay balance threshold, it is determined to use the lightweight encryption algorithm; otherwise, it is determined not to use the lightweight encryption algorithm.

[0121] When a lightweight encryption algorithm is used, the sensed data is encrypted based on the lightweight encryption algorithm to generate preliminary encrypted data, and the preliminary encrypted data is transmitted from the low-power device to the edge gateway, specifically:

[0122] Selection of lightweight encryption algorithm: Dynamically select appropriate lightweight encryption algorithm based on the resource status of low-power devices (such as CPU performance, battery power) and data security requirements. Common algorithms include:

[0123] Symmetric key encryption algorithm (such as TinyAES): By using the same key for encryption and decryption, encryption efficiency and resource consumption are balanced;

[0124] Stream encryption algorithm (such as Salsa20): encrypts data streams bit by bit or byte by byte, suitable for encryption needs of real-time data;

[0125] Block encryption algorithm (such as LEA encryption): divides data into blocks for processing to reduce device memory usage.

[0126] Encryption process:

[0127] The lightweight encryption algorithm dynamically generates a symmetric key through the device's random number generator, and the key length is selected according to the algorithm (such as 128 bits or 256 bits);

[0128] The preprocessed sensing data is input into the lightweight encryption algorithm block by block, and the encryption operation is performed to generate preliminary encrypted data;

[0129] Generate a checksum for each piece of encrypted data to verify data integrity during transmission.

[0130] After encryption is completed, the preliminary encrypted data is temporarily stored by the device cache module, waiting to be transmitted to the edge gateway.

[0131] Transmit preliminary encrypted data from low power device to edge gateway:

[0132] According to the network environment and device characteristics, select low-power, high-security wireless transmission protocols, including but not limited to:

[0133] Message Queuing Telemetry Transport Protocol (MQTT): suitable for low-bandwidth networks;

[0134] Bluetooth Low Energy (BLE): suitable for short-distance low-power transmission;

[0135] Ultra-wideband communication protocol (UWB): suitable for scenarios with high real-time requirements.

[0136] During data transmission, the low-power device monitors the following in real time:

[0137] Data packet integrity: Verify the integrity of received data through checksums;

[0138] Transmission order: attach a sequence number to each data packet to ensure the correct transmission order;

[0139] Packet loss rate detection: If packet loss is detected, the retransmission mechanism is triggered to ensure the integrity of data arrival.

[0140] Security measures for data encryption transmission: To improve the security of the transmission process, low-power devices take further security measures at the transmission layer, such as:

[0141] Packet header encryption: Encrypt the metadata of the packet to hide the source and destination addresses of the data;

[0142] Session key negotiation: Generate temporary session keys through secure key exchange protocols (such as Diffie-Hellman) to enhance transmission security.

[0143] After receiving the preliminary encrypted data, the edge gateway first stores the data in a temporary cache;

[0144] The received data packets are checked to verify the integrity and order of each data packet. If the check passes, the data is marked as "completed"; if the check fails, the low-power device is requested to retransmit the corresponding data packet.

[0145] The edge gateway performs high-intensity encryption upgrade on the initial encrypted data, generates deep encrypted data and transmits it to the cloud server, specifically:

[0146] The edge gateway receives preliminary encrypted data from the low-power device through the communication module.

[0147] The received data contains data content, checksum and meta-information (such as timestamp, device identification); after the data is received, the edge gateway temporarily stores the data in the local cache module to ensure that the data will not be lost due to processing delays.

[0148] Dynamically select high-strength encryption algorithms based on the processing power and security requirements of the edge gateway. Algorithms include but are not limited to asymmetric key encryption algorithms (such as RSA encryption), block encryption algorithms (such as AES-256 encryption), and hash algorithms combined with encryption (such as SHA-256 + AES).

[0149] The edge gateway generates a highly encrypted key pair, where the public key is used for encryption and the private key is used for decryption;

[0150] The key is generated using a random number generator to ensure the unpredictability of the key.

[0151] The public key is transmitted to the cloud server through a secure channel for use in the decryption process.

[0152] The preliminary encrypted data is divided into blocks of fixed block size, and the size of each block is dynamically adjusted according to the requirements of the encryption algorithm (such as the packet length of the AES algorithm is 128 bits); if the last block of data is less than the specified length, a padding strategy (such as PKCS#7 padding) is used to complete the data block.

[0153] For each block of data, high-intensity encryption operations are performed to generate deeply encrypted data blocks; after each encryption operation, the data checksum is updated and the timestamp of the encryption operation is recorded.

[0154] Reassemble all deep encrypted data blocks to generate a complete deep encrypted data packet; append meta information to the header of the deep encrypted data packet, including: encryption algorithm identifier, encryption timestamp, data length and checksum.

[0155] Select a highly secure transmission protocol based on the network environment and data security requirements. Common protocols include:

[0156] Transport Layer Security (TLS): used to establish a secure transmission channel; Hypertext Transfer Protocol Secure (HTTPS): ensures that data is encrypted during transmission; Advanced Message Queuing Protocol (AMQP): suitable for batch data transmission scenarios.

[0157] Monitor in real time the packet loss, delay and network interruption that may occur during the transmission process; if the transmission is interrupted, the edge gateway records the incomplete data packets and retransmits them after the network is restored.

[0158] After receiving the deeply encrypted data, the cloud server verifies the integrity of the data through the encrypted metadata; after successful verification, the data is marked as "arrived safely".

[0159] The cloud server uses a pre-shared public key or private key to decrypt the received deeply encrypted data; if the decryption fails, it requests the edge gateway to resend the original deeply encrypted data packet.

[0160] The decrypted data is stored in the cloud database according to its category; the decrypted data is distributed to the corresponding application module or data processing service according to demand.

[0161] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters and thresholds in the formula are set by technicians in this field according to actual conditions.

[0162] The above embodiments may be implemented in whole or in part by software, hardware, firmware or any other combination thereof. When implemented by software, the above embodiments may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or may be transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium may be a solid-state hard disk.

[0163] Those of ordinary skill in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0164] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and modules described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0165] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0166] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, and may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0167] In addition, each functional module in each embodiment of the present application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0168] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0169] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0170] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A data security transmission method for an Internet of Things edge gateway, characterized in that: The steps include: The low-power IoT device collects the perception data and pre-processes the perception data; The multi-dimensional load state of the communication channel is analyzed by network state tensor decomposition to evaluate the risk level of future load changes of the communication channel; wherein, multi-dimensional data of the communication channel is obtained, and the multi-dimensional data of the communication channel includes time dimension data, device dimension data and channel dimension data; Extract the eigenvector of each time point from the time dimension feature matrix obtained by tensor decomposition, extract the eigenvalue of the device from the device dimension feature matrix, and extract the eigenvalue of the channel from the channel dimension feature matrix; The kernel method is used to construct a nonlinear prediction model, and the formula is as follows: Where L(i+1, k) represents the load prediction value of channel k at the next time point i+1, and A i，u represents the eigenvalue of time point i and time feature u in the time dimension feature matrix, B j，v represents the eigenvalues ​​of device j and device feature v in the device dimension feature matrix, C k，w represents the eigenvalues ​​of channel k and channel feature w in the channel dimension feature matrix, K represents the kernel function, α m is the regression weight, m ​​is the time point index, and M is the length of the time window; Calculate the future load change risk index, the expression is: Among them, R(k) is the future load change risk index, L(i+h, k) represents the load value of communication channel k at the predicted time point h, and L max (k) represents the maximum permissible load capacity of communication channel k, h represents the current time step index, and H represents the total length of the prediction time window; The time distribution of encryption and decryption links is analyzed through distributed time optimization game to evaluate the balance of link delays; Based on the future load change trend of the communication channel and the balance of link delay, dynamically adjust whether to use the lightweight encryption algorithm.

2. The data security transmission method of an Internet of Things edge gateway according to claim 1 is characterized in that: The low-power IoT device collects the perception data and pre-processes the perception data, specifically: Acquire sensor data through sensor modules of low-power IoT devices, including environmental data, device status data, and user behavior data; De-noising the acquired perception data to remove outliers and invalid data; Format the perception data and convert the data into a unified structured format; Standardize the perception data and normalize the data values ​​to a preset range to ensure that perception data of different dimensions have consistent dimensions.

3. The data security transmission method of the edge gateway of the Internet of Things according to claim 2 is characterized in that: The multi-dimensional load state of the communication channel is analyzed by network state tensor decomposition to assess the risk of future load changes in the communication channel, specifically: Among them, the time dimension data records the load changes of the communication channel in different time periods, the device dimension data records the traffic usage of each device involved in the communication, and the channel dimension data records the bandwidth usage of different communication channels; constructing a multi-dimensional tensor model of the communication channel, and inputting the multi-dimensional data of the communication channel into the tensor model to characterize the load state of the communication channel; Use tensor decomposition algorithm to decompose the multidimensional tensor model and extract the main feature information of each dimension; Among them, the main characteristic information includes the load trend of the communication channel in the future time period, the impact of specific equipment on the channel load, and the dynamic usage of the channel bandwidth; Prediction data of the communication channel load change trend is generated according to the main feature information extracted by tensor decomposition, and the risk degree of future load change of the communication channel is evaluated based on the prediction data of the communication channel load change trend.

4. The data security transmission method of the edge gateway of the Internet of Things according to claim 3 is characterized in that: The multidimensional tensor model is decomposed using the tensor decomposition algorithm to extract the main feature information of each dimension, specifically: Tensor decomposition uses a high-order singular value decomposition algorithm, and its decomposition formula is: Among them, G(u, v, w) is the core tensor, A(i, u) is the feature matrix of the time dimension, B(j, v) is the feature matrix of the device dimension, C(k, w) is the feature matrix of the channel dimension, U, V and W are the feature numbers of the time dimension, device dimension and channel dimension respectively, u is the main feature number of the time dimension, v is the main feature number of the device dimension, w is the main feature number of the channel dimension, i represents the time dimension, j represents the device dimension, and k represents the channel dimension; According to the decomposition results, the main features of the time dimension, the main features of the device dimension and the main features of the channel dimension are extracted.

5. The data security transmission method of the edge gateway of the Internet of Things according to claim 4 is characterized in that: The time distribution of the encryption and decryption links is analyzed through distributed time optimization game to evaluate the balance of link delays. Specifically: Obtain the time distribution data of the encryption and decryption link, including encryption processing time, decryption processing time and data transmission time. The encryption processing time records the encryption operation duration of each node on the link, the decryption processing time records the decryption operation duration, and the data transmission time records the transmission delay of each segment of the data in the link; A time distribution game model of the link is constructed. Each node in the link is set as a game participant. The strategy of each participant is to adjust its encryption and decryption time to optimize the total delay of the link. The loss function of each participant is defined as a coupling function of the node's own time distribution and the total delay of the link. The game equilibrium is calculated iteratively through a distributed optimization algorithm. The optimization process includes: a. Initialize the encryption time, decryption time and data transmission time of each node; b. In each iteration, the node updates its encryption and decryption times based on its local time distribution and the policies of other nodes; c. When the game process converges, determine the equilibrium state of link time distribution; Extract the optimized link time distribution balance results, including the encryption time, decryption time and data transmission time of each node; The delay balance index of the link is calculated based on the time distribution balance result. The delay balance index is used to quantify the degree of balance of the time distribution of each node in the link.

6. The data security transmission method of the edge gateway of the Internet of Things according to claim 5 is characterized in that: Based on the future load change trend of the communication channel and the balance of link delay, dynamically adjust whether to use the lightweight encryption algorithm, specifically: Set future load change risk threshold and delay balance threshold; When the future load change risk index is less than or equal to the future load change risk threshold, and the delay balance index is greater than the delay balance threshold, it is determined to use the lightweight encryption algorithm; otherwise, it is determined not to use the lightweight encryption algorithm.

7. The data security transmission method of an Internet of Things edge gateway according to claim 1 is characterized in that: Also includes: When a lightweight encryption algorithm is used, the sensed data is encrypted based on the lightweight encryption algorithm to generate preliminary encrypted data, and the preliminary encrypted data is transmitted from the low-power device to the edge gateway; The edge gateway performs high-intensity encryption upgrades on the initially encrypted data, generates deeply encrypted data and transmits it to the cloud server.

Images