Internet of Things auditing method, electronic equipment, storage medium and computer program product

Abstract

The invention provides an Internet of Things auditing method, electronic equipment, a storage medium and a computer program product, and the Internet of Things auditing method comprises the steps: obtaining a network message sent by client equipment to a video monitoring center through network equipment; analyzing the network message and judging whether the network message is a GAT1400 protocol message or not based on an analysis result; when the network message is a GAT1400 protocol message, identity authentication information is extracted from the analysis result and analyzed to obtain authentication detail information, and the authentication detail information comprises a first digest value and a first user name; whether the first abstract value and the first user name are correct or not is verified based on the verification information, and when the first abstract value and the first user name are incorrect, it is determined that the network message is illegal flow, and the network message is blocked. According to the method and the device, the network message using the GAT1400 protocol can be audited, the illegal traffic is blocked based on the audit result, and the video monitoring center is prevented from being attacked by the illegal traffic.

Description

Technical Field

[0001] The present application relates to the field of network auditing, and specifically, to an Internet of Things auditing method, electronic device, storage medium and computer program product. Background Art

[0002] At present, the prior art provides an Internet of Things gateway audit method, which is used to audit GB35114 protocol report files. However, the prior art has the following defects:

[0003] 1. IoT video surveillance devices that support the GAT1400 standard cannot be audited.

[0004] 2. The IoT gateway (GB35114 standard detection system) can only be deployed in bypass mode, but some users' usage environments do not support mirror traffic configuration. It is necessary to connect the IoT gateway (GB35114 standard detection system) in series to the network. The IoT gateway deployed in series cannot audit network messages.

[0005] 3. The Internet of Things Gateway (GB35114 standard detection system) only supports audit records that comply with the GB35114 standard. Abnormal data streams that meet the GB35114 standard will also be pushed to the video surveillance center, reducing security. Summary of the invention

[0006] The purpose of the embodiments of the present application is to provide an Internet of Things audit method, electronic device, storage medium and computer program product, so as to audit network messages using the GAT1400 protocol, and block illegal traffic based on the audit results to prevent the video surveillance center from being attacked by illegal traffic.

[0007] In a first aspect, the present invention provides an Internet of Things auditing method, which is applied to an Internet of Things gateway, and the method comprises:

[0008] Obtain network messages sent by client devices to the video surveillance center through network devices;

[0009] Parsing the network message and determining whether the network message is a GAT1400 protocol message based on the parsing result;

[0010] When the network message is the GAT1400 protocol message, extracting identity authentication information from the parsing result and parsing the identity authentication information to obtain authentication detail information, wherein the authentication detail information includes a first summary value and a first user name;

[0011] Whether the first summary value and the first user name are correct is verified based on the verification information; when the first summary value and the first user name are incorrect, the network message is determined to be illegal traffic, and the network message is blocked.

[0012] The method of the first aspect of the present application obtains the network message sent by the client device to the video surveillance center through the network device, and then can parse the network message and determine whether the network message is a GAT1400 protocol message based on the parsing result, and then can extract the identity authentication information from the parsing result and parse the identity authentication information when the network message is the GAT1400 protocol message to obtain the authentication details information, wherein the authentication details information includes a first summary value and a first user name, so that the first summary value and the first user name can be verified based on the verification information to see whether they are correct. When the first summary value and the first user name are incorrect, it is determined that the network message is illegal traffic and the network message is blocked. Compared with the prior art, the present application can audit the network message using the GAT1400 protocol, and block the illegal traffic based on the audit result, thereby preventing the video surveillance center from being attacked by illegal traffic.

[0013] In an optional implementation, the Internet of Things gateway is deployed in series between the video surveillance center and the network device, or the Internet of Things gateway is deployed in bypass between the video surveillance center and the network device.

[0014] This optional implementation mode allows the Internet of Things gateway to be deployed in series between the video surveillance center and the network device, or allows the Internet of Things gateway to be deployed in bypass between the video surveillance center and the network device, thereby being compatible with a variety of user usage environments.

[0015] In an optional implementation manner, blocking the network message includes:

[0016] When the IoT gateway is deployed in the serial deployment mode, discarding the network message or sending a rejection message to the client device;

[0017] When the Internet of Things gateway is deployed in a bypass deployment mode, the video surveillance center is simulated to send an RST message to the client device to trigger the client device connection interruption.

[0018] This optional implementation can discard the network message or send a rejection message to the client device when the IoT gateway is deployed in the serial deployment mode. On the other hand, when the IoT gateway is deployed in the bypass deployment mode, it can simulate the video surveillance center sending an RST message to the client device to trigger the client device connection interruption.

[0019] In an optional implementation manner, the authentication details information further includes encryption algorithm information, wherein the encryption algorithm information represents the encryption algorithm used by the client device to encrypt the network message;

[0020] And, the method further comprises:

[0021] Based on the encryption algorithm information, it is determined whether the encryption algorithm used by the network message is a national secret signature algorithm that meets the requirements of the GAT1400 standard. If not, it is determined that the network message is illegal traffic and the network message is blocked.

[0022] This optional implementation can determine whether the encryption algorithm used by the network message is a national secret signature algorithm that meets the requirements of the GAT1400 standard based on the encryption algorithm information. If not, the network message can be determined to be illegal traffic and blocked.

[0023] In an optional implementation manner, after acquiring the network message sent by the client device to the video surveillance center through the network device and before parsing the network message, the method further includes:

[0024] Filter out http messages from the network messages.

[0025] This optional implementation method can filter out http messages from the network messages.

[0026] In an optional embodiment, the method further comprises:

[0027] Generate a web configuration page so that the user can configure the verification information based on the web configuration page, wherein the verification information at least includes a target password and a second user name, the second user name is used to verify whether the first user name is correct, and the target password is used to calculate a second digest value for verifying the first digest value.

[0028] This optional implementation can generate a web configuration page so that the user can configure the verification information based on the web configuration page, wherein the verification information includes at least a target password and a second user name, the second user name is used to verify whether the first user name is correct, and the target password is used to calculate a second digest value for verifying the first digest value.

[0029] In an optional implementation, the authentication details information further includes a device ID of the client device, and the verification information further includes a device ID audit range;

[0030] Furthermore, after extracting the identity authentication information from the parsing result and parsing the identity authentication information, and before verifying whether the first digest value and the first user name are correct based on the verification information, the method further includes:

[0031] Based on the device ID of the client device and the device ID audit range, network messages whose device ID falls within the device ID audit range are screened out from the network messages.

[0032] This optional implementation manner may screen out network messages whose device IDs fall within the device ID audit range from the network messages based on the device ID of the client device and the device ID audit range.

[0033] In a second aspect, the present application provides an Internet of Things auditing device, which is applied to an Internet of Things gateway, and the device includes:

[0034] An acquisition module, used to acquire network messages sent by a client device to a video surveillance center via a network device;

[0035] A parsing module, used for parsing the network message and judging whether the network message is a GAT1400 protocol message based on the parsing result;

[0036] An extraction module, configured to extract identity authentication information from the parsing result and parse the identity authentication information to obtain authentication detail information when the network message is the GAT1400 protocol message, wherein the authentication detail information includes a first summary value and a first user name;

[0037] A determination module is used to verify whether the first summary value and the first user name are correct based on verification information. When the first summary value and the first user name are incorrect, the network message is determined to be illegal traffic and the network message is blocked.

[0038] The device of the second aspect of the present application can obtain the network message sent by the client device to the video surveillance center through the network device by executing the method of the present application, and then can parse the network message and determine whether the network message is a GAT1400 protocol message based on the parsing result, and then can extract the identity authentication information from the parsing result and parse the identity authentication information when the network message is the GAT1400 protocol message, and obtain the authentication details information, wherein the authentication details information includes a first summary value and a first user name, so that the first summary value and the first user name can be verified based on the verification information to see whether they are correct. When the first summary value and the first user name are incorrect, the network message is determined to be illegal traffic and the network message is blocked. Compared with the prior art, the present application can audit the network message using the GAT1400 protocol, and block the illegal traffic based on the audit result, thereby preventing the video surveillance center from being attacked by illegal traffic.

[0039] In a third aspect, the present invention provides an electronic device, comprising:

[0040] Processor; and

[0041] A memory configured to store machine-readable instructions, which, when executed by the processor, execute the method described in any one of the aforementioned embodiments.

[0042] The electronic device of the present application can obtain the network message sent by the client device to the video surveillance center through the network device by executing the method of the present application, and then can parse the network message and determine whether the network message is a GAT1400 protocol message based on the parsing result, and then can extract the identity authentication information from the parsing result and parse the identity authentication information when the network message is the GAT1400 protocol message, and obtain the authentication details information, wherein the authentication details information includes a first summary value and a first user name, so that the first summary value and the first user name can be verified based on the verification information to see whether they are correct. When the first summary value and the first user name are incorrect, it is determined that the network message is illegal traffic and the network message is blocked. Compared with the prior art, the present application can audit the network message using the GAT1400 protocol, and block the illegal traffic based on the audit result, thereby preventing the video surveillance center from being attacked by illegal traffic.

[0043] In a fourth aspect, the present invention provides a storage medium storing a computer program, wherein the computer program is executed by a processor as described in any one of the aforementioned embodiments.

[0044] The storage medium of the present application can obtain the network message sent by the client device to the video surveillance center through the network device by executing the method of the present application, and then can parse the network message and determine whether the network message is a GAT1400 protocol message based on the parsing result, and then can extract the identity authentication information from the parsing result and parse the identity authentication information when the network message is the GAT1400 protocol message, and obtain the authentication details information, wherein the authentication details information includes a first summary value and a first user name, so that the first summary value and the first user name can be verified based on the verification information to see whether they are correct. When the first summary value and the first user name are incorrect, it is determined that the network message is illegal traffic and the network message is blocked. Compared with the prior art, the present application can audit the network message using the GAT1400 protocol, and block the illegal traffic based on the audit result, so as to prevent the video surveillance center from being attacked by illegal traffic.

[0045] In a fifth aspect, the present invention provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the method described in any one of the aforementioned embodiments.

[0046] The computer program product of the fifth aspect of the present application can obtain the network message sent by the client device to the video surveillance center through the network device by executing the method of the present application, and then can parse the network message and determine whether the network message is a GAT1400 protocol message based on the parsing result, and then can extract the identity authentication information from the parsing result and parse the identity authentication information when the network message is the GAT1400 protocol message, and obtain the authentication details information, wherein the authentication details information includes a first summary value and a first user name, so that the first summary value and the first user name can be verified based on the verification information to see whether they are correct. When the first summary value and the first user name are incorrect, it is determined that the network message is illegal traffic and the network message is blocked. Compared with the prior art, the present application can audit the network message using the GAT1400 protocol, and block the illegal traffic based on the audit result, so as to prevent the video surveillance center from being attacked by illegal traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0048] Figure 1It is a flowchart of an Internet of Things audit method disclosed in an embodiment of the present application;

[0049] Figure 2 It is a schematic diagram of a serial deployment of IoT gateways disclosed in an embodiment of the present application;

[0050] Figure 3 It is a schematic diagram of an IoT gateway bypass deployment disclosed in an embodiment of the present application;

[0051] Figure 4 It is a schematic diagram of an Internet of Things gateway device disclosed in an embodiment of the present application;

[0052] Figure 5 It is a structural schematic diagram of an electronic device disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0053] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0054] Embodiment 1

[0055] See also Figure 1 , Figure 1 It is a flowchart of an Internet of Things audit method disclosed in the embodiment of the present application, such as Figure 1 As shown, the method of the embodiment of the present application includes the following steps:

[0056] 101. Obtaining a network message sent by a client device to a video surveillance center via a network device;

[0057] 102. parse the network message and determine whether the network message is a GAT1400 protocol message based on the parsing result;

[0058] 103. When the network message is a GAT1400 protocol message, extract the identity authentication information from the parsing result and parse the identity authentication information to obtain authentication detail information, wherein the authentication detail information includes the first summary value and the first user name;

[0059] 104. Verify whether the first digest value and the first user name are correct based on the verification information. When the first digest value and the first user name are incorrect, determine that the network message is illegal traffic, and block the network message.

[0060] The method of the embodiment of the present application obtains the network message sent by the client device to the video surveillance center through the network device, and then can parse the network message and determine whether the network message is a GAT1400 protocol message based on the parsing result, and then can extract the identity authentication information from the parsing result and parse the identity authentication information when the network message is a GAT1400 protocol message, and obtain the authentication details information, wherein the authentication details information includes a first summary value and a first user name, so that it can verify whether the first summary value and the first user name are correct based on the verification information, and when the first summary value and the first user name are incorrect, it is determined that the network message is illegal traffic, and the network message is blocked. Compared with the prior art, the present application can audit the network message using the GAT1400 protocol, and block the illegal traffic based on the audit result, so as to prevent the video surveillance center from being attacked by illegal traffic.

[0061] In comparison, after identifying network messages as illegal traffic, the prior art will still send the illegal traffic to the video surveillance center, thereby making the video surveillance center vulnerable to attacks, thereby reducing the security of the video surveillance center.

[0062] In the embodiment of the present application, the client device is a terminal device that generates video data, and the terminal device may be an IoT camera. Further, after the client device generates the video data, it generates a network message based on the video data.

[0063] In an embodiment of the present application, the client device is connected to the network device for communication, and then the network message is sent to the video surveillance center through the network device.

[0064] In the embodiment of the present application, with respect to step 102, the protocol information of the network message can be extracted by parsing the message header of the network message, and then it can be determined whether the network message is a GAT1400 protocol message based on the protocol information.

[0065] In the embodiment of the present application, parsing the network message will obtain a parsing result, wherein the parsing result includes a field of dialectical message protocol information, through which it can be determined whether the network message is a GAT1400 protocol message.

[0066] In the embodiment of the present application, GAT1400 is a transmission protocol of a video image information application system.

[0067] In the embodiment of the present application, the network message carries the identity authentication information, for example, the network message carries the identity authentication information through the author izat ion field. Further, the identity authentication information may include data associated with multiple subfields, and the data associated with the subfields is authentication details information.

[0068] In an embodiment of the present application, the first summary value is calculated by the client device based on a preset rule, wherein the preset rule refers to a rule based on the GAT1400 standard, and the first user name refers to the device ID of the logged-in client device.

[0069] In the embodiment of the present application, for step 104, if the first summary value and the first user name are incorrect, it means that the network message sent by the client device does not meet the GAT1400 protocol requirements, and thus the network message is illegal traffic in the network using the GAT1400 protocol to communicate, and needs to be blocked to prevent the illegal traffic from attacking the video surveillance center.

[0070] In an embodiment of the present application, as an optional implementation, the Internet of Things gateway is deployed in series between the video surveillance center and the network device, or the Internet of Things gateway is deployed in bypass between the video surveillance center and the network device.

[0071] This optional implementation method allows the Internet of Things gateway to be deployed in series between the video surveillance center and the network device, or the Internet of Things gateway to be deployed in bypass between the video surveillance center and the network device, thereby being compatible with a variety of user usage environments.

[0072] For the above optional implementation methods, the IoT gateway can be deployed in series or in bypass in the network environment to block traffic, thereby improving the usability of the IoT gateway, that is, it is compatible with a variety of user environments. For example, in some scenarios, the IoT gateway needs to be deployed in series, and when it is impossible to obtain network messages by mirroring network traffic, it can still ensure that the IoT gateway can obtain network messages and audit them.

[0073] In the embodiment of the present application, as an optional implementation mode, blocking network messages includes the following sub-steps:

[0074] When the IoT gateway is deployed in tandem, it discards network messages or sends a rejection message to the client device;

[0075] When the IoT gateway is deployed in bypass deployment mode, the simulated video surveillance center sends RST messages to the client device to trigger the client device connection interruption.

[0076] This optional implementation can discard network messages or send rejection messages to client devices when the IoT gateway is deployed in series, so that network messages cannot be sent to the video surveillance center. On the other hand, when the IoT gateway is deployed in bypass deployment, it can simulate the video surveillance center sending RST messages to the client device to trigger the client device connection interruption.

[0077] With respect to the above optional implementation manner, the RST message refers to a special type of message used in a computer network, particularly in the Transmission Control Protocol (TCP).

[0078] In the embodiment of the present application, as an optional implementation, the authentication details information also includes encryption algorithm information, wherein the encryption algorithm information represents the encryption algorithm used by the client device to encrypt the network message. Accordingly, the method of the embodiment of the present application also includes the following steps:

[0079] Based on the encryption algorithm information, determine whether the encryption algorithm used by the network message is a national secret signature algorithm that meets the requirements of the GAT1400 standard. If not, determine that the network message is illegal traffic and block the network message.

[0080] This optional implementation method can determine whether the encryption algorithm used by the network message is a national secret signature algorithm that meets the requirements of the GAT1400 standard based on the encryption algorithm information. If not, the network message can be determined to be illegal traffic and the network message can be blocked.

[0081] In the embodiment of the present application, as an optional implementation, after obtaining the network message sent by the client device to the video surveillance center through the network device and before parsing the network message, the method of the embodiment of the present application further includes the following steps:

[0082] Filter out http messages from network messages.

[0083] This optional implementation method can filter out http messages from network messages.

[0084] In the embodiment of the present application, as an optional implementation manner, the method of the embodiment of the present application further includes the following steps:

[0085] Generate a web configuration page so that the user can configure verification information based on the web configuration page, wherein the verification information includes at least a target password and a second user name, the second user name is used to verify whether the first user name is correct, and the target password is used to calculate a second digest value for verifying the first digest value.

[0086] This optional implementation can generate a web configuration page so that the user can configure verification information based on the web configuration page, wherein the verification information includes at least a target password and a second user name, the second user name is used to verify whether the first user name is correct, and the target password is used to calculate a second digest value for verifying the first digest value.

[0087] In the embodiment of the present application, as an optional implementation, the authentication details information further includes a device ID of the client device, the verification information further includes a device ID audit range, and, after extracting the identity authentication information from the parsing result and parsing the identity authentication information, before verifying whether the first summary value and the first user name are correct based on the verification information, the method of the embodiment of the present application further includes the following steps:

[0088] Based on the device ID of the client device and the device ID audit range, network messages whose device ID falls within the device ID audit range are filtered out from the network messages.

[0089] This optional implementation can filter out network messages whose device IDs fall within the device ID audit range from network messages based on the device ID of the client device and the device ID audit range.

[0090] For the embodiments of this application, as an example, please refer to Figure 2 and Figure 3 ,like Figure 2 and Figure 3 As shown, depending on the deployment method, network messages pass through the IoT gateway (GAT1400 standard detection system) when deployed in series, and network messages are mirrored to the IoT gateway (GAT1400 standard detection system) when deployed in bypass. Figure 2 is a schematic diagram of a serial deployment of IoT gateways disclosed in an embodiment of the present application, and Figure 3 It is a schematic diagram of an IoT gateway bypass deployment disclosed in an embodiment of the present application.

[0091] For further information, see Figure 4 , Figure 4 Schematic diagram of an Internet of Things gateway disclosed in the embodiment of the present application. Figure 4 As shown, the IoT gateway includes an IoT network message processing module, an IoT signaling parsing module, an IoT signaling verification module, a Web configuration and display module, an IoT audit information recording module, a database module, and an IoT audit exception processing module, among which:

[0092] The Internet of Things network message processing module extracts network messages that meet the audit IP range, parses the network messages and determines whether the network messages are HTTP protocol messages. If they meet the condition of being HTTP protocol messages, the network messages are sent to the Internet of Things signaling parsing module.

[0093] Furthermore, the IoT signaling parsing module further parses the network message, including parsing the camera ID associated with the User-Identity field, and parsing the authentication information details associated with the Authorization field.

[0094] Furthermore, the IoT signaling parsing module sends the message with the camera ID within the audit range to the IoT signaling verification module.

[0095] Furthermore, the IoT signaling verification module parses the author authentication information details to obtain the target field, where the target field includes response: the summary value calculated by the client according to the algorithm, username: the username to be authenticated, real: the authentication domain, which can take any identification value, ur i: the requested resource location, qop: protection quality, nonce: the server password random number, nc: a hexadecimal request authentication counter, algorithm: the default MD5 algorithm, and cnonce: the client password random number.

[0096] Furthermore, the IoT signaling verification module calculates the summary value based on the information parsed from the message and the password configured on the web page, verifies whether the summary value and the user name are correct, and enters the audit exception handling module if the verification fails, where the web page is implemented by the Web configuration and display module.

[0097] Furthermore, the IoT audit exception handling module performs exception handling according to different exception handling methods, wherein the exception handling methods can be configured and displayed through the Web module, and the exception handling methods include alarm handling methods and blocking methods. Furthermore, the alarm handling method can be to record alarm information, and the blocking methods include: directly discarding the message or sending a rejection message to achieve blocking when deployed in series; simulating the server of the video surveillance center to send an RST message to the camera when deployed in bypass mode, triggering a connection interruption. Furthermore, if there is no unconfigured blocking method, the message is sent to the server of the video surveillance center as is.

[0098] Embodiment 2

[0099] The present application embodiment provides an Internet of Things auditing device, which is applied to an Internet of Things gateway. The device includes the following functional modules:

[0100] An acquisition module, used to acquire network messages sent by a client device to a video surveillance center via a network device;

[0101] A parsing module, used for parsing network messages and judging whether the network messages are GAT1400 protocol messages based on the parsing results;

[0102] An extraction module, used for extracting identity authentication information from the parsing result and parsing the identity authentication information when the network message is a GAT1400 protocol message, to obtain authentication detail information, wherein the authentication detail information includes a first summary value and a first user name;

[0103] The determination module is used to verify whether the first summary value and the first user name are correct based on the verification information. When the first summary value and the first user name are incorrect, the network message is determined to be illegal traffic and the network message is blocked.

[0104] The device of the second aspect of the present application can obtain the network message sent by the client device to the video surveillance center through the network device by executing the method of the present application, and then can parse the network message and determine whether the network message is a GAT1400 protocol message based on the parsing result, and then can extract the identity authentication information from the parsing result and parse the identity authentication information when the network message is a GAT1400 protocol message, and obtain the authentication details information, wherein the authentication details information includes a first summary value and a first user name, so that it can verify whether the first summary value and the first user name are correct based on the verification information, and when the first summary value and the first user name are incorrect, it is determined that the network message is illegal traffic and the network message is blocked. Compared with the prior art, the present application can audit the network message using the GAT1400 protocol, and block the illegal traffic based on the audit result, so as to prevent the video surveillance center from being attacked by illegal traffic.

[0105] Embodiment 3

[0106] See also Figure 5 , Figure 5 is a schematic diagram of the structure of an electronic device disclosed in an embodiment of the present application, such as Figure 5 As shown, the electronic device of the embodiment of the present application includes: a processor 301 and a memory 302, wherein the memory 302 is configured to store machine-readable instructions, and when the instructions are executed by the processor 301, a method as described in any of the aforementioned implementations is executed.

[0107] The electronic device of the embodiment of the present application can obtain the network message sent by the client device to the video surveillance center through the network device by executing the method of the embodiment of the present application, and then can parse the network message and determine whether the network message is a GAT1400 protocol message based on the parsing result, and then can extract the identity authentication information from the parsing result and parse the identity authentication information when the network message is a GAT1400 protocol message, and obtain the authentication detail information, wherein the authentication detail information includes the first summary value and the first user name, so that it can verify whether the first summary value and the first user name are correct based on the verification information, and when the first summary value and the first user name are incorrect, it is determined that the network message is illegal traffic and the network message is blocked. Compared with the prior art, the present application can audit the network message using the GAT1400 protocol, and block the illegal traffic based on the audit result, so as to prevent the video surveillance center from being attacked by illegal traffic.

[0108] Embodiment 4

[0109] An embodiment of the present application provides a storage medium, wherein the storage medium stores a computer program, and the computer program is executed by a processor as in any of the methods described in the foregoing implementations.

[0110] The storage medium of the embodiment of the present application can obtain the network message sent by the client device to the video surveillance center through the network device by executing the method of the present application, and then can parse the network message and determine whether the network message is a GAT1400 protocol message based on the parsing result, and then can extract the identity authentication information from the parsing result and parse the identity authentication information when the network message is a GAT1400 protocol message, and obtain the authentication details information, wherein the authentication details information includes a first summary value and a first user name, so that it can verify whether the first summary value and the first user name are correct based on the verification information, and when the first summary value and the first user name are incorrect, it is determined that the network message is illegal traffic and the network message is blocked. Compared with the prior art, the present application can audit the network message using the GAT1400 protocol, and block the illegal traffic based on the audit result, so as to prevent the video surveillance center from being attacked by illegal traffic.

[0111] Embodiment 5

[0112] An embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the method of any one of the aforementioned embodiments is implemented.

[0113] The computer program product of the embodiment of the present application can obtain the network message sent by the client device to the video surveillance center through the network device by executing the method of the present application, and then can parse the network message and determine whether the network message is a GAT1400 protocol message based on the parsing result, and then can extract the identity authentication information from the parsing result and parse the identity authentication information when the network message is a GAT1400 protocol message, and obtain the authentication details information, wherein the authentication details information includes the first summary value and the first user name, so that it can verify whether the first summary value and the first user name are correct based on the verification information, and when the first summary value and the first user name are incorrect, determine that the network message is illegal traffic, and block the network message. Compared with the prior art, the present application can audit the network message using the GAT1400 protocol, and block the illegal traffic based on the audit result, so as to prevent the video surveillance center from being attacked by illegal traffic.

[0114] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0115] In addition, the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0116] Furthermore, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist independently, or two or more modules may be integrated to form an independent part.

[0117] It should be noted that if the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk.

[0118] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0119] The above are only embodiments of the present application and are not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of protection of the present application.

Claims

1. An Internet of Things audit method, characterized in that: The method is applied to an Internet of Things gateway, and the method comprises: Obtain network messages sent by client devices to the video surveillance center through network devices; Parsing the network message and determining whether the network message is a GAT1400 protocol message based on the parsing result; When the network message is the GAT1400 protocol message, extracting identity authentication information from the parsing result and parsing the identity authentication information to obtain authentication detail information, wherein the authentication detail information includes a first summary value and a first user name; Whether the first summary value and the first user name are correct is verified based on the verification information; when the first summary value and the first user name are incorrect, the network message is determined to be illegal traffic, and the network message is blocked.

2. The method according to claim 1, characterized in that The Internet of Things gateway is deployed between the video surveillance center and the network device in a serial deployment manner, or the Internet of Things gateway is deployed between the video surveillance center and the network device in a bypass deployment manner.

3. The method according to claim 2, characterized in that The blocking of the network message comprises: When the IoT gateway is deployed in the serial deployment mode, discarding the network message or sending a rejection message to the client device; When the Internet of Things gateway is deployed in a bypass deployment mode, the video surveillance center is simulated to send an RST message to the client device to trigger the client device connection interruption.

4. The method according to claim 1, characterized in that The authentication details information also includes encryption algorithm information, wherein the encryption algorithm information represents the encryption algorithm used by the client device to encrypt the network message; And, the method further comprises: Based on the encryption algorithm information, it is determined whether the encryption algorithm used by the network message is a national secret signature algorithm that meets the requirements of the GAT1400 standard. If not, it is determined that the network message is illegal traffic and the network message is blocked.

5. The method according to claim 1, characterized in that After acquiring the network message sent by the client device to the video surveillance center through the network device and before parsing the network message, the method further includes: Filter out http messages from the network messages.

6. The method according to claim 1, characterized in that The method further comprises: Generate a web configuration page so that the user can configure the verification information based on the web configuration page, wherein the verification information at least includes a target password and a second user name, the second user name is used to verify whether the first user name is correct, and the target password is used to calculate a second digest value for verifying the first digest value.

7. The method according to claim 6, characterized in that The authentication details information also includes the device ID of the client device, and the verification information also includes the device ID audit range; Furthermore, after extracting the identity authentication information from the parsing result and parsing the identity authentication information, and before verifying whether the first digest value and the first user name are correct based on the verification information, the method further includes: Based on the device ID of the client device and the device ID audit range, network messages whose device ID falls within the device ID audit range are screened out from the network messages.

8. An electronic device, characterized in that: include: processor; as well as A memory configured to store machine-readable instructions, wherein when the instructions are executed by the processor, the method according to any one of claims 1 to 7 is performed.

9. A storage medium, characterized in that: The storage medium stores a computer program, and the computer program is executed by a processor to perform the method according to any one of claims 1 to 7.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images