Smart home wireless communication evaluation method based on communication protocol analysis

Abstract

The invention relates to a smart home wireless communication evaluation method based on communication protocol analysis. The method comprises the steps of signal scanning for dynamically and adaptively adjusting a threshold value, event-driven communication protocol data monitoring and capturing, fixed byte comparison in a communication data frame, byte distance comparison in the communication data frame, comparative calculation of a communication protocol coincidence degree, and non-fixed byte analysis in the communication data frame. The method is suitable for a third-party detection mechanism of a smart home wireless product, and can be used for performing wireless communication data integrity, data freshness, data repudiation resistance and data confidentiality on the smart home wireless product from three aspects of wireless signal dynamic capture, communication data frame fixed bytes and communication data frame non-fixed bytes. The evaluation efficiency of the evaluation personnel is greatly improved, and a foundation is laid for judging the information security level of the smart home wireless product.

Description

Technical Field

[0001] The present invention belongs to the technical field of smart home wireless communication evaluation, and in particular relates to a smart home wireless communication evaluation method based on communication protocol analysis. Background Art

[0002] As a civilian product widely used in thousands of households, smart home faces many information security threats, such as user privacy protection, network attacks and threats, physical intrusion and hijacking, etc. In the smart home system, smart home terminal products are the ones that need to be entrusted to third-party testing agencies for information security testing. This is because there are many information security protection measures available for each node of the smart home, such as switches, routers, and servers. However, due to the relationship between hardware performance and computing power resources, smart home terminal products have become the most vulnerable link to be breached and captured.

[0003] In the third-party testing business for smart home terminal products, the testing business volume of wireless communication smart home terminal products is much larger than that of wired communication smart home terminal products. This is not only because there are more types and quantities of wireless communication products, but also from the physical medium level, wireless communication products are more likely to be intercepted, analyzed and deciphered, and thus more susceptible to replay attacks, man-in-the-middle attacks, spoofing attacks, etc.

[0004] However, for third-party testing agencies, wireless communication products currently have more prominent capacity shortcomings in terms of testing equipment, testing methods, and testing personnel. In comparison, wired communication products can use network packet capture software such as Wireshark to capture communication data from switches and other channels, and then conduct information security analysis such as data confidentiality, integrity, freshness, and non-repudiation. However, third-party information security testing of wireless communication products faces the following difficulties:

[0005] First of all, the evaluators need to spend a lot of time reading documents to complete the wireless connection. According to common industry practices, smart home manufacturers submitting for inspection need to provide detailed instructions and communication protocols for their products, and third-party testing agencies are responsible for verifying the authenticity of the contents of their instructions. However, since wireless communication evaluation work needs to be carried out at multiple OSI levels, such as RF transceiver, modulation and demodulation, encoding and decoding, data framing, encryption and decryption, etc., the evaluators need to spend a lot of time reading product manuals or communication protocol documents to accurately configure the wireless scanning module to complete the monitoring of wireless communications.

[0006] Secondly, the testers need to spend a lot of time to capture effective wireless communication data. Since smart home terminal products not only correspond to many types of events (such as wireless door locks closing, opening, reporting, heartbeat and other types of events), but also have fast communication speeds (often in seconds, or even less than 1 second, to complete wireless communication and related operations), the testers not only need to capture effective data from a large number of data, but also need to capture all wireless communication data frames of various event types one by one according to the manufacturer's instructions.

[0007] Finally, the testers need to spend a lot of time to eliminate the interference of background noise. Completely different from the data captured by wired communication, the data captured by wireless monitoring will inevitably be affected by background noise, even in a completely shielded environment. In a complete string of wireless communication data frames, random bytes such as FF, 0A, 00 are randomly inserted, making the entire string of data frames inconsistent with the communication protocol description in the manufacturer's manual, which will cause great interference to the evaluation work and force the testers to repeat the data capture work.

[0008] To sum up, due to the large amount of protocol information, numerous event types, fast speed, low value density and other reasons, the current third-party testing agencies have very low testing capabilities for wireless communication smart home terminal products. Even many small and medium-sized third-party testing agencies are unable to undertake information security testing of wireless communication smart home terminal products. Summary of the invention

[0009] In order to solve the problems existing in the prior art and enhance the information security evaluation capability of third-party testing organizations for wireless communication smart home products, the present invention proposes a smart home wireless communication evaluation method based on communication protocol analysis, so as to establish efficient evaluation capability of wireless communication smart home terminal products for third-party testing organizations.

[0010] The technical solution adopted by the present invention is as follows: A smart home wireless communication evaluation method based on communication protocol analysis, the method includes six parts, namely, signal scanning with dynamic adaptive adjustment of threshold, event-driven communication protocol data monitoring and capture, fixed byte comparison in communication data frame, byte distance comparison in communication data frame, comparative calculation of communication protocol compliance and non-fixed byte analysis in communication data frame; The method comprises the following steps: (1) Perform signal scanning with dynamic and adaptive threshold adjustment; (2) Conduct event-driven communication protocol data monitoring and capture; (3) Compare fixed bytes within the communication data frame; (4) If the fixed byte comparison in the communication data frame passes, the byte distance comparison in the communication data frame is performed; if the fixed byte comparison in the communication data frame fails, return to step (1); (5) If the byte distance comparison in the communication data frame passes, the non-fixed byte analysis in the communication data frame is performed; if the byte distance comparison in the communication data frame fails, return to step (1); (6) A one-dimensional array is constructed by comparing fixed bytes in the communication data frame and byte distances in the communication data frame, and a comparative calculation of the degree of compliance with the communication protocol is performed to obtain a data integrity assessment; (7) Data confidentiality evaluation, data freshness evaluation, and data non-repudiation evaluation are obtained by analyzing the non-fixed bytes in the communication data frame.

[0011] Preferably, the signal scanning part of the threshold dynamic adaptive adjustment includes setting the working mode of the SDR module, monitoring multiple groups of wireless signals, adjusting the wireless signal receiving threshold, executing an external request for adjusting the signal threshold, and continuously monitoring the wireless signal, which specifically includes the following steps: (a) SDR module working mode settings: The SDR module is turned on and the parameters of the SDR module are set, including scanning center frequency, bandwidth, sampling rate, offset tolerance, gain mode, modulation mode, and encoding mode; (b) Monitoring multiple wireless signals: Turn on scanning monitoring and prepare to adjust the receiving signal threshold; (c) Wireless signal reception threshold adjustment: Capture multiple groups of valid signals and analyze their lower limits of signal strength; (d) Execute an external request to adjust the signal threshold: Raise the signal threshold to the lower limit of effective signal strength; (e) Continuous monitoring of wireless signals: When the effective signal capture rate is less than 90%, the process returns to step (c); when the effective signal capture rate is greater than 90%, if no command to readjust the threshold is received, the process continues to scan and monitor the signal and analyze the signal. If a command to readjust the threshold is received, the process returns to step (c); Among them, in the step of monitoring multiple groups of wireless signals, 10 to 30 groups of smart home product wireless signals are continuously monitored; in the step of adjusting the wireless signal reception threshold, the signal field strength of each group of wireless signals needs to be analyzed, and the wireless signal reception threshold is adjusted to the lowest signal field strength of all groups of wireless signals, while fully receiving effective wireless signals, eliminating background noise interference to the greatest extent; in the step of executing the external request to adjust the signal threshold, after the SDR module receives the command to readjust the threshold, it will repeat the step of monitoring multiple groups of wireless signals and the step of adjusting the wireless signal reception threshold.

[0012] Preferably, the event-driven communication protocol data monitoring and capturing part constructs three sets of smart home wireless products with signals isolated from each other, and relies on the three sets of systems with signals isolated from each other to evaluate three identical smart home wireless products, wherein one smart home wireless product is set as the main tested product, and the other two smart home wireless products are set as 1# auxiliary tested product and 2# auxiliary tested product, wherein the ID number of 1# auxiliary tested product is the same as that of the main tested product, and the ID number of 2# auxiliary tested product is different from that of the main tested product; at the same time, the communication protocols of the three smart home wireless products monitored are stored in different categories according to event type or operation type for subsequent analysis.

[0013] Preferably, the fixed byte comparison part in the communication data frame, for several communication protocol fixed bytes recorded in the smart home wireless product description document provided by the manufacturer, first uses the KMP algorithm to quickly analyze whether each group of monitored communication protocol data frames has the same bytes. If all fixed bytes can be found in the group of communication protocol data frames, the group of communication protocol data frames is marked as passed in the comparison, otherwise it is marked as failed in the comparison; then the comparison pass rate of the monitored communication protocol data frames is continuously calculated. If the comparison pass rate is lower than 90%, the signal scanning part of the dynamic adaptive adjustment of the threshold is restarted.

[0014] Preferably, the byte distance comparison part within the communication data frame calculates the byte lengths between different fixed bytes for each group of monitored communication protocol data frames in turn. If the byte length between any two fixed bytes is different from the byte length defined in the manufacturer's product description document, the group of communication protocol data frames is marked as failed comparison, otherwise it is marked as passed comparison; then the comparison pass rate of the monitored communication protocol data frames is continuously calculated. If the comparison pass rate is lower than 90%, the signal scanning part with dynamic adaptive adjustment of the threshold is restarted.

[0015] Preferably, the comparison and calculation part of the communication protocol compliance degree first constructs a one-dimensional array as shown below: [Length of the preceding interval] [Fixed byte 1#] [Fixed byte 2#] […] [Fixed byte n#] [Length of the following interval] In the above one-dimensional array, the fixed byte n# represents the nth byte in the fixed byte string, the leading interval length represents the number of bytes between the fixed byte string and the previous fixed byte string, and the trailing interval length represents the number of bytes between the fixed byte string and the next fixed byte string; thus, each group of communication protocol frames has a number of one-dimensional arrays conforming to the above format; Then, all the one-dimensional arrays in each group of monitored communication protocol data frames are compared with the one-dimensional arrays in the communication protocol data frames provided in the product description document one by one, and the compliance ratio of the one-dimensional arrays is calculated as the compliance degree of the group of communication protocol data frames, with a maximum of 100% and a minimum of 0%, for evaluation personnel to use as a reference for further evaluation and analysis; Finally, if the compliance level of each group of monitored communication protocol data frames can reach 100%, it can be determined that the communication data integrity of the smart home wireless product is established.

[0016] Preferably, the non-fixed byte analysis part in the communication data frame includes data confidentiality evaluation, data freshness evaluation, and data non-repudiation evaluation steps; The data confidentiality evaluation is as follows: first, the main tested product and the 1# auxiliary tested product execute the same event at the same time, and analyze whether the communication protocol data frames of the two tested products are the same. If they are not the same, it is suggested to the evaluation personnel that the smart home wireless product uses a true random number encryption method, and the evaluation personnel are asked to make a further final judgment based on their experience. If they are not the same, the subsequent evaluation is continued; then, the main tested product and the 2# auxiliary tested product execute the same operation event at the same time, and analyze whether the communication protocols of the two tested products are the same. If they are different, it is suggested to the evaluation personnel that the encryption method of the smart home wireless product is related to its product ID number. If they are the same, the subsequent evaluation is continued; again, the main tested product executes the same operation event multiple times at different times, and analyzes whether the multiple communication protocols of the main tested product are the same. If they are different, it is suggested to the evaluation personnel that the encryption method of the smart home wireless product is related to the event time. If they are the same, the evaluation personnel are asked to make a further final judgment on the data confidentiality of the smart home wireless product based on their experience; The data freshness evaluation is firstly performed by the main tested product and the 2# auxiliary tested product executing the same operation event at the same time, and analyzing whether there are differences in the bytes representing the serial number in the communication protocol frames of the two tested products, thereby completing the serial number evaluation; secondly, the main tested product executes the same operation event multiple times at different times, and analyzing whether there are differences in the bytes representing the timestamp in the multiple communication protocol frames of the main tested product, thereby completing the timestamp evaluation; finally, if there are differences in both the serial number and the timestamp, it is suggested to the evaluation personnel that the data freshness of the communication protocol of the smart home wireless product is established, and the evaluation personnel are asked to make further final judgments based on their experience; The data non-repudiation evaluation is first performed by the main tested product and the 2# auxiliary tested product executing the same operation event at the same time, and analyzing whether there are differences in the bytes representing the check code in the communication protocol frame of the two tested products; then the main tested product and the 1# auxiliary tested product execute different events at the same time, and analyzing whether there are differences in the bytes representing the check code in the communication protocol frame of the two tested products; finally, the main tested product executes the same operation event multiple times at different times, and analyzes whether there are differences in the bytes representing the check code in the communication protocol frame of the main tested product multiple times; finally, if the check codes are different each time in the above three steps, it is recommended to the evaluator that the data non-repudiation of the communication protocol of the smart home wireless product is established, and the evaluator is asked to make further final judgment based on his experience.

[0017] As a preferred embodiment, the KMP algorithm is: Let the monitored wireless communication data frame be the main string T, the pointer of its internal element in the array be i, and the byte length of the main string T be n; the fixed bytes to be compared be the pattern string P, the pointer of its internal element in the value be q, and the length of the pattern string P be m; Step 1: Initialize, set the pointer q of the pattern string P and the pointer i of the main string T to 0 respectively, and calculate the prefix function array π; Step 2: Enter the loop traversal, the loop condition is i<n, in the loop body, check whether P[q] is equal to T[i]: if they are equal, let q and i increase by 1 and continue the loop; if they are not equal, then determine whether q is greater than 0, if q is greater than 0, set the pointer q value to π[q-1], if q is not greater than 0, let the main string pointer i increase by 1; Step 3: Complete the matching check. In the above loop body, if q can be looped to m, the matching position of the byte string is output as im, and the value of pointer q is set to π[q-1], and the loop in step 2 is continued; if q is not equal to m, the loop is continued until the loop condition i<n is triggered, thereby completing the matching check, that is, completing the KMP algorithm.

[0018] The beneficial effects of the present invention are: 1. The present invention can completely receive all effective communication data of smart home wireless products through dynamic adjustment of the wireless signal reception threshold, while filtering out background noise to the greatest extent; thereby, from the perspective of wireless signal signal-to-noise ratio, the work efficiency of the evaluator is greatly improved.

[0019] 2. The present invention automatically analyzes the fixed bytes in the communication protocol data frame and the distance value between any fixed bytes, and analyzes the degree of compliance between the communication protocol of the smart home wireless product and its product document description through the construction of a one-dimensional array, so that the evaluator can quickly analyze the integrity of the product data communication, thereby greatly improving the work efficiency of the evaluator.

[0020] 3. The present invention constructs three sets of smart home wireless products with signals isolated from each other, and cooperates with each other in three dimensions: product ID number, operation time, and operation event, so that the evaluation efficiency of the evaluators in the three tasks of data freshness, data non-repudiation, and data confidentiality is greatly improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is the main flow chart of the smart home wireless communication evaluation method of the present invention; Figure 2 is a flow chart of the dynamic adaptive adjustment of the wireless signal scanning threshold of the present invention; Figure 3 It is a schematic diagram of three sets of smart home wireless products in the present invention whose signals are isolated from each other. DETAILED DESCRIPTION

[0022] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments, but the protection scope of the present invention is not limited thereto.

[0023] Example 1 Reference Figure 1 A smart home wireless communication evaluation method based on communication protocol analysis is composed of six parts: signal scanning with dynamic adaptive threshold adjustment, event-driven communication protocol data monitoring and capture, fixed byte comparison in communication data frame, byte distance comparison in communication data frame, comparative calculation of communication protocol compliance, and non-fixed byte analysis in communication data frame. The method comprises the following steps: (1) Perform signal scanning with dynamic and adaptive threshold adjustment; (2) Conduct event-driven communication protocol data monitoring and capture; (3) Compare fixed bytes within the communication data frame; (4) If the fixed byte comparison in the communication data frame passes, the byte distance comparison in the communication data frame is performed; if the fixed byte comparison in the communication data frame fails, return to step (1); (5) If the byte distance comparison in the communication data frame passes, the non-fixed byte analysis in the communication data frame is performed; if the byte distance comparison in the communication data frame fails, return to step (1); (6) A one-dimensional array is constructed by comparing fixed bytes in the communication data frame and byte distances in the communication data frame, and a comparative calculation of the degree of compliance with the communication protocol is performed to obtain a data integrity assessment; (7) Data confidentiality evaluation, data freshness evaluation, and data non-repudiation evaluation are obtained by analyzing the non-fixed bytes in the communication data frame.

[0024] The following is a detailed description of the workflow of each part.

[0025] First, for the signal scanning part of the threshold dynamic adaptive adjustment, the process is as follows Figure 2 As shown, it consists of five steps: setting the working mode of the SDR module, monitoring multiple groups of wireless signals, adjusting the wireless signal receiving threshold, executing an external request to adjust the signal threshold, and continuously monitoring the wireless signal. Specifically, it includes the following steps:

[0026] (a) SDR module working mode settings: The SDR module is turned on and the parameters of the SDR module are set, including scanning center frequency, bandwidth, sampling rate, offset tolerance, gain mode, modulation mode, and encoding mode; (b) Monitoring multiple wireless signals: Turn on scanning monitoring and prepare to adjust the receiving signal threshold; (c) Wireless signal reception threshold adjustment: Capture multiple groups of valid signals and analyze their lower limits of signal strength; (d) Execute an external request to adjust the signal threshold: Raise the signal threshold to the lower limit of effective signal strength; (e) Continuous monitoring of wireless signals: When the effective signal capture rate is less than 90%, the process returns to step (c); when the effective signal capture rate is greater than 90%, if no command to readjust the threshold is received, the process continues to scan and monitor the signal and analyze the signal; if a command to readjust the threshold is received, the process returns to step (c).

[0027] In the step of setting the working mode of the SDR module, the SDR module refers to the "Software Defined Radio" module. You can choose open source modules such as HackRF One, or you can choose a large number of domestic SDR modules. This module is driven by software and can receive or send radio signals in a specified frequency band. In this step, the evaluator needs to set a series of working parameters of the SDR module, including scanning center frequency, bandwidth, sampling rate, offset tolerance, gain mode, modulation mode (modulation and demodulation mode), encoding mode (encoding and decoding mode), etc. These parameters are often provided by the instruction documentation of smart home wireless products.

[0028] In the step of monitoring multiple groups of wireless signals, the evaluator will continuously monitor 10 to 30 groups of smart home product wireless signals according to the initial settings of the SDR module based on the product documentation. The number of groups monitored is determined by the evaluator based on experience. Usually, when the communication protocol data frame is shorter, more groups should be monitored.

[0029] In the wireless signal receiving threshold adjustment step, the signal field strength of each group of wireless signals needs to be analyzed, and the wireless signal receiving threshold needs to be adjusted to the lowest signal field strength of all groups of wireless signals, so that the effective wireless signals are fully received while eliminating the background noise interference to the greatest extent. The reason for setting this step is that when the SDR module monitors the wireless signal, it is very susceptible to the background noise, resulting in many interference bytes in the bytes output by the SDR module, which will greatly interfere with the analysis work of the evaluator, as described in the background technology.

[0030] During the external request step for adjusting the signal threshold, after the SDR module receives the command to readjust the threshold, it mainly refers to the subsequent commands generated by the "fixed byte comparison in the communication data frame" and the "byte distance comparison in the communication data frame" that require the SDR to readjust the wireless signal receiving threshold. The steps of monitoring multiple groups of wireless signals and adjusting the wireless signal receiving threshold will be repeated. Therefore, when the measured wireless signal strength and the background environmental noise change, the receiving threshold can be dynamically adjusted to adapt to the latest wireless signal strength ratio, thereby maintaining the ability to eliminate noise background interference as much as possible.

[0031] For the event-driven communication protocol data monitoring and capture part.

[0032] The implementation of the evaluation method of the present invention has certain requirements on the evaluation hardware environment, specifically, it is necessary to build three systems with signals isolated from each other, and the three sets of smart home wireless products with signals isolated from each other are as follows: Figure 3As shown, each system has independent smart home wireless products, wireless routers, and SDR modules under test, and the input port of each smart home wireless product (which can be a wireless input port or a wired input port) is connected to the evaluation server, so that the evaluation server software can drive the smart home wireless product to perform corresponding event operations (such as commanding the LED light Bluetooth driver to turn on, off, dim, etc.) according to demand. At the same time, the output port (usually a wired output port) of each wireless router and SDR module is connected to the evaluation server, so that the results received by the wireless router are transmitted to the evaluation server, so that the evaluation server can confirm whether the corresponding operation event is successfully executed. In order to conveniently perform a combined and arranged evaluation of the communication protocol of the smart home wireless product from multiple dimensions such as different time, different events, and different IDs, the present invention sets one of the smart home wireless products in the above three systems as the main tested product, and the other two smart home wireless products are set as 1# auxiliary tested product and 2# auxiliary tested product, wherein the ID number of 1# auxiliary tested product is the same as that of the main tested product, and the ID number of 2# auxiliary tested product is different from that of the main tested product. At the same time, the communication protocols of the three smart home wireless products monitored are stored in different categories according to event type or operation type for subsequent analysis.

[0033] For the fixed byte comparison part in the communication data frame.

[0034] For the fixed bytes of the communication protocols recorded in the manufacturer's smart home wireless product description document, the KMP method is first used to quickly analyze whether each group of monitored communication protocol data frames has the same bytes. If all the fixed bytes can be found in the group of communication protocol data frames, the group of communication protocol data frames is marked as passed, otherwise it is marked as failed. Then the comparison pass rate of the monitored communication protocol data frames is continuously calculated. If the comparison pass rate is lower than 90%, the signal scanning part of the dynamic adaptive adjustment of the threshold is restarted.

[0035] The KMP (Knuth-Morris-Pratt) algorithm is an efficient string matching algorithm. Its efficiency lies in skipping characters that have been checked and matched by constructing a π array, which greatly reduces unnecessary comparisons. The specific principle of the KMP algorithm is:

[0036] Assume that the monitored wireless communication data frame is the main string T, the pointer of its internal element in the array is i, and the byte length of the main string T is n; the fixed byte to be compared is the pattern string P, the pointer of its internal element in the value is q, and the length of the pattern string P is m. This means that the KMP algorithm needs to be used to find whether the pattern string P exists in the main string T. Then, construct a prefix function array π, and each element s in the array π satisfies the following conditions: 1) π[s] is the length of the longest substring in the pattern string P that is both a prefix and a suffix; 2) If there is no such substring, the value of π[s] is zero.

[0037] The KMP algorithm search process is: Step 1: Initialize and set the pattern string pointer q and the main string pointer to 0 respectively, and calculate the prefix function array π at the same time. For example, for the pattern string P = "ABABAC", because P[0] = "A", π[0] = 0, because P[0...1] = "AB", π[1] = 0, because P[0...2] = "ABA", π[2] = 1, and so on.

[0038] Step 2: Enter the loop traversal, the loop condition is i<n. In the loop body, check whether P[q] is equal to T[i]: if they are equal, add 1 to both q and i and continue the loop; if they are not equal, check whether q is greater than 0. If q is greater than 0, set the pointer q to π[q-1]. If q is not greater than 0, add 1 to the main string pointer i.

[0039] Step 3: Complete the match check. In the above loop, if q is equal to m, the matching position of the byte string is output as im, and the value of pointer q is set to π[q-1], and the loop in step 2 is continued. If q is not equal to m, the loop continues until the loop condition i<n is triggered, thus completing the match check, that is, completing the KMP algorithm.

[0040] For the byte distance comparison part in the communication data frame.

[0041] For each group of monitored communication protocol data frames, the byte lengths between different fixed bytes are calculated in turn. If the byte length between any two fixed bytes is different from the byte length defined in the manufacturer's product description document, the group of communication protocol data frames is marked as failed to match, otherwise it is marked as passed. Then the matching pass rate of the monitored communication protocol data frames is continuously calculated. If the matching pass rate is lower than 90%, the signal scanning part of the dynamic adaptive adjustment of the threshold is restarted.

[0042] The bytes between any two fixed bytes are actually non-fixed bytes (variable bytes), and their length is calculated from the end of the previous fixed byte to the beginning of the next fixed byte. The length of non-fixed bytes can be calculated using the len() function of the Python language. Other languages ​​such as Java and C# also have similar functions.

[0043] Through the above two parts of "fixed byte comparison within the communication data frame" and "byte distance comparison within the communication data frame", the integrity of the monitored wireless communication data frame can actually be ensured, that is, whether the entire string of communication data frames specified in the product description document is obtained, and whether the data frame is not disturbed by any noise bytes in the middle, thus ensuring that the subsequent evaluation personnel's evaluation of the communication protocol is accurate and effective. Therefore, if the pass rate of any part of "fixed byte comparison within the communication data frame" and "byte distance comparison within the communication data frame" is low, it means that the previously set dynamic threshold of the received signal is no longer suitable for the latest wireless signal noise ratio and needs to be readjusted.

[0044] Comparative calculation part for the degree of compliance with the communication protocol.

[0045] First build a one-dimensional array like this: [Length of the preceding interval] [Fixed byte 1#] [Fixed byte 2#] …] [Fixed byte n#] [Length of the following interval] In the above one-dimensional array, the fixed byte n# represents the nth byte in the string of fixed bytes, the length of the leading interval represents the number of bytes between the string of fixed bytes and the previous string of fixed bytes, and the length of the trailing interval represents the number of bytes between the string of fixed bytes and the next string of fixed bytes. Thus, in each group of communication protocol frames, there are several one-dimensional arrays that conform to the above format. It should be noted that through the creation of this type of one-dimensional array, AI algorithms such as neural networks can also be introduced to automatically, efficiently and intelligently complete the comparison calculation of the degree of compliance of the communication protocol.

[0046] Then, all one-dimensional arrays in each group of monitored communication protocol data frames are compared one by one with the one-dimensional arrays in the communication protocol data frames provided in the product description document, and the compliance ratio of the one-dimensional arrays is calculated as the compliance degree of the group of communication protocol data frames (maximum 100%, minimum 0%), which is used as a reference for further evaluation and analysis by evaluators.

[0047] Finally, if the compliance degree of each group of monitored communication protocol data frames can reach 100%, it can be determined that the communication data integrity of the smart home wireless product is established. At the same time, as mentioned above, a wireless communication protocol data frame with a compliance degree of 100% means that all fixed bytes of the string of data frames have been verified correctly, and the composition format of the entire string of data frames has also complied with the provisions of the product description document. In this way, the evaluator can focus on the subsequent analysis of the non-fixed bytes, especially the analysis of the change rules of the non-fixed bytes with the product ID, operation time, operation events, etc.

[0048] The non-fixed byte analysis part in the communication data frame includes data confidentiality evaluation, data freshness evaluation, and data non-repudiation evaluation steps.

[0049] According to multiple standards such as "GB / T 41387-2022 Information Security Technology - General Security Specification for Smart Home", "GB / T 28448-2019 Information Security Technology - Network Security Level Protection Evaluation Requirements", and "GB / T 36951-2018 Information Security Technology - Internet of Things Perception Terminal Application Security Technical Requirements": Data integrity means that communication data should have integrity evidence, such as checksums, message digests, etc.; data freshness means that it should contain relevant information to protect the freshness of transmitted data, such as timestamps, serial numbers, etc.; data non-repudiation means that the data sent should be digitally signed; data confidentiality means that when transmitting sensitive information such as identification information, privacy data and important business data, encryption protection should be carried out, and the encryption algorithm should comply with relevant national cryptographic regulations.

[0050] The data confidentiality evaluation is as follows: first, the main tested product and the 1# auxiliary tested product execute the same event at the same time, and analyze whether the communication protocol data frames of the two tested products are the same. If they are not the same, it is suggested to the evaluation personnel that the smart home wireless product uses a true random number encryption method, and the evaluation personnel are asked to make a further final judgment based on their experience. If they are not the same, the subsequent evaluation will continue; then, the main tested product and the 2# auxiliary tested product execute the same operation event at the same time, and analyze whether the communication protocols of the two tested products are the same. If they are different, it is suggested to the evaluation personnel that the encryption method of the smart home wireless product is related to its product ID number. If they are the same, the subsequent evaluation will continue; again, the main tested product executes the same operation event multiple times at different times, and analyzes whether the multiple communication protocols of the main tested product are the same. If they are different, it is suggested to the evaluation personnel that the encryption method of the smart home wireless product is related to the event time. If they are the same, the evaluation personnel are asked to make a further final judgment on the data confidentiality of the smart home wireless product based on their experience.

[0051] The data freshness evaluation is first performed by having the main tested product and the 2# auxiliary tested product execute the same operation event at the same time, and analyzing whether there are differences in the bytes representing the serial numbers in the communication protocol frames of the two tested products, thereby completing the serial number evaluation; secondly, the main tested product executes the same operation event multiple times at different times, and analyzing whether there are differences in the bytes representing the timestamps in the multiple communication protocol frames of the main tested product, thereby completing the timestamp evaluation; finally, if there are differences in both the serial number and the timestamp, it is recommended to the evaluator that the data freshness of the communication protocol of the smart home wireless product is established, and the evaluator is asked to make further final judgment based on his experience.

[0052] The data non-repudiation evaluation is first performed by the main tested product and the 2# auxiliary tested product executing the same operation event at the same time, and analyzing whether there are differences in the bytes representing the check code in the communication protocol frame of the two tested products; then the main tested product and the 1# auxiliary tested product execute different events at the same time, and analyzing whether there are differences in the bytes representing the check code in the communication protocol frame of the two tested products; finally, the main tested product executes the same operation event multiple times at different times, and analyzes whether there are differences in the bytes representing the check code in the communication protocol frame of the main tested product multiple times; finally, if the check codes are different each time in the above three steps, it is recommended to the evaluator that the data non-repudiation of the communication protocol of the smart home wireless product is established, and the evaluator is asked to make further final judgment based on his experience.

[0053] Example 2 The following is an application example to illustrate the use process of the evaluation method of the present invention. The following is a communication protocol of a wireless LED lamp driver. Users can use a wireless transceiver such as a mobile phone to send commands to the LED lamp driver according to the following protocol, and finally realize remote switching or remote dimming control of the LED lamp. The communication protocol of the wireless LED lamp driver is as follows:

[0054] | Start character| Target device type| Controller ID| Timestamp| Serial number| Command byte| Brightness value| Checksum| End character| | 0xAA00 | 0x01 | 0xXXXX | 0xXXXXXXXXXXXX | 0xXXXX | 0xXX | 0xXX |0xXX | 0x00BB | In the above communication protocol, the three bytes of "start character, target device type, and end character" are fixed parts of the communication protocol, and their values ​​will not change; the six bytes of "controller ID number, timestamp, serial number, command byte, brightness value, and checksum" are non-fixed parts of the communication protocol, and their values ​​will change with the product ID number, operation time, operation event type, etc. The specific meanings of each byte are as follows:

[0055] Start Byte: 2 bytes, used to mark the beginning of the data frame. In this example, a fixed value of 0xAA is used.

[0056] Target Device Type: 2 bytes, used to specify the target device type of the message. In this example, 0xFF01 is used to indicate that the target device is an LED lamp driver.

[0057] Controller ID: 2 bytes, used to uniquely identify each controller. In this example, the ID of the main DUT is set to 0x01, the ID of the 1# auxiliary DUT is set to 0x01, and the ID of the 2# auxiliary DUT is set to 0x02.

[0058] Timestamp: 6 bytes, used to record the time when the message was sent. In this example, the timestamp is accurate to the second level. For example, the message sent at 08:12:35 on October 28, 2024 has a timestamp of 0x241028081235.

[0059] Sequence Number: 2 bytes, used to track the message sequence and avoid duplicate messages. For example, 0x0001 represents the first string of commands sent to the LED lamp driver.

[0060] Command Byte: 1 byte, used to indicate specific commands, such as turning on the light (0x01), turning off the light (0x02), and dimming (0x03). The dimming command is followed by a brightness value.

[0061] Brightness Value: 1 byte, valid when the command is dimming, indicating the light brightness level, ranging from 0 to 255 (i.e. from 0x00 to 0xFF).

[0062] Checksum: 1 byte, used to ensure the integrity of data transmission. Various mathematical calculation methods such as XOR check, CRC check, LRC check, etc. can be used. This example uses the sum check method, that is, all bytes before the checksum are added, and the high bit of the sum is removed, and the remaining bytes are used as the checksum.

[0063] Terminator: 2 bytes, used to mark the end of the data frame. In this example, a fixed value of 0xBB is used.

[0064] In summary, the communication protocol for sending a dimming command (adjusting to half brightness) to the main product under test (LED lamp driver) is: AA 00 FF 01 01 24 10 28 08 12 35 00 01 03 80 DA 00 BB.

[0065] The following first analyzes the evaluation of data integrity, that is, the comparison of the degree of compliance of communication protocols.

[0066] First, the KMP algorithm is used to find whether the communication protocol contains the start character "AA 00", the target device type "FF01", and the end character "00 BB". If, during the wireless communication process, due to external noise interference, an interference byte is added in the middle of the start character, causing the start character to become "AA 3C 00", the fixed byte comparison of the communication protocol will fail.

[0067] Secondly, the byte length between the start character "AA 00" and the target device type "FF 01" is calculated, and the byte length between the target device type "FF 01" and the end character "00 BB" is also calculated. If there is an extra interference byte in the middle of the timestamp due to external noise during wireless communication, the byte length between the target device type "FF 01" and the end character "00 BB" calculated by the len() function will be 13, instead of the correct 12 bytes. At this time, the byte distance comparison of this group of communication protocols fails.

[0068] Finally, in order to compare and calculate the degree of compliance with the communication protocol, the following three arrays will be constructed: Array 1:

[00] [AA]

[00]

[00] , indicating that there are 0 bytes before the fixed byte start character "AA 00", and the distance between it and the next fixed byte "FF 01" is also 0 bytes.

[0069] Array 2:

[00] [FF]

[01]

[12] , indicating that the distance between the fixed byte target device type "FF 01" and the previous fixed byte "AA 00" is 0 bytes, and the distance between it and the next fixed byte "00 BB" is 12 bytes.

[0070] Array 3:

[12]

[00] [BB]

[00] , indicating that the distance between the fixed byte terminator "00 BB" and the previous fixed byte "FF 01" is 12 bytes, followed by 0 bytes.

[0071] Through the above three arrays, we can quickly calculate and conclude that the communication protocol "AA 00 FF01 01 24 10 28 08 12 35 00 01 03 80 DA 00 BB" monitored this time meets the data integrity requirements.

[0072] The evaluation of data confidentiality is analyzed below.

[0073] From the above description, we can see that the monitored communication protocol "AA 00 FF 01 01 24 10 28 08 12 35 0001 03 80 DA 00 BB" is plain text transmission and does not meet the confidentiality requirements.

[0074] If the same command to adjust the brightness to half is sent to the main tested product and the 1# auxiliary tested product at the same time, the communication protocol of the main tested product monitored is "9d 7f 8e 9c 7c 5a 7e ab 7b 6f 6e 7f 7e 7bce 7b 8f 9e", and the communication protocol of the 1# auxiliary tested product is "5d 7f 8e 6c 7c 5a 9e 3b 7b ca 6e 7f 7eab 3e 4e 55 7e", it can be determined that the LED lamp driver uses a completely random number encryption method.

[0075] The following is an analysis of the evaluation of data freshness and data non-repudiation.

[0076] If the same command to adjust the brightness to half is sent to the main tested product and the 1# auxiliary tested product at the same time, the communication protocol of the main tested product monitored is "AA 00 FF 01 01 24 10 28 08 12 35 00 01 0380 DA 00 BB", and the communication protocol of the 2# tested product is "AA 00 FF 01 02 24 10 28 08 12 35 00 01 0380 DB 00 BB".

[0077] From the perspective of data freshness, it is found that the serial numbers in the above two communication protocols are both "00 01", which means that the serial number is only related to the number of commands sent to the corresponding LED lamp driver, but has nothing to do with the ID number of the LED lamp driver. Therefore, the LED lamp driver does not meet the data freshness requirements.

[0078] From the perspective of data non-repudiation, it is found that the check codes in the above two communication protocols have changed. The former check code is "DA" and the latter check code is "DB". After analysis, it is found that the change of the check code is caused by the change of the ID number of the LED lamp driver. Therefore, the LED lamp driver meets the data non-repudiation requirements.

[0079] The present invention discloses a smart home wireless communication evaluation method based on communication protocol analysis. The method is suitable for third-party testing organizations of smart home wireless products and can greatly improve the evaluation efficiency of evaluators in four aspects of wireless communication data integrity, data freshness, data non-repudiation and data confidentiality of smart home wireless products, thereby laying a foundation for judging the information security level of the smart home wireless products.

[0080] The above specific implementation modes are used to explain the present invention rather than to limit the present invention. Any modification and change made to the present invention within the spirit of the present invention and the protection scope of the claims shall fall within the protection scope of the present invention.

Claims

1. A smart home wireless communication evaluation method based on communication protocol analysis, characterized in that: The method comprises six parts, namely, signal scanning with dynamic adaptive threshold adjustment, event-driven communication protocol data monitoring and capture, fixed byte comparison in communication data frame, byte distance comparison in communication data frame, comparative calculation of communication protocol compliance degree and non-fixed byte analysis in communication data frame; The method comprises the following steps: (1) Perform signal scanning with dynamic and adaptive threshold adjustment; (2) Conduct event-driven communication protocol data monitoring and capture; (3) Compare fixed bytes within the communication data frame; (4) If the fixed byte comparison in the communication data frame passes, the byte distance comparison in the communication data frame is performed; if the fixed byte comparison in the communication data frame fails, return to step (1); (5) If the byte distance comparison in the communication data frame passes, the non-fixed byte analysis in the communication data frame is performed; if the byte distance comparison in the communication data frame fails, return to step (1); (6) A one-dimensional array is constructed by comparing fixed bytes in the communication data frame and byte distances in the communication data frame, and a comparative calculation of the degree of compliance with the communication protocol is performed to obtain a data integrity assessment; (7) Data confidentiality evaluation, data freshness evaluation, and data non-repudiation evaluation are obtained by analyzing the non-fixed bytes in the communication data frame.

2. The smart home wireless communication evaluation method based on communication protocol analysis according to claim 1 is characterized in that: The signal scanning part of the threshold dynamic adaptive adjustment includes SDR module working mode setting, monitoring multiple groups of wireless signals, wireless signal receiving threshold adjustment, executing external request for adjusting signal threshold, and continuous wireless signal monitoring, which specifically includes the following steps: (a) SDR module working mode settings: The SDR module is turned on and the parameters of the SDR module are set, including scanning center frequency, bandwidth, sampling rate, offset tolerance, gain mode, modulation mode, and encoding mode; (b) Monitoring multiple wireless signals: Turn on scanning monitoring and prepare to adjust the threshold of receiving signals; (c) Wireless signal reception threshold adjustment: Capture multiple groups of valid signals and analyze their lower limits of signal strength; (d) Execute an external request to adjust the signal threshold: Raise the signal threshold to the lower limit of effective signal strength; (e) Continuous monitoring of wireless signals: When the effective signal capture rate is less than 90%, the process returns to step (c); when the effective signal capture rate is greater than 90%, if no command to readjust the threshold is received, the process continues to scan and monitor the signal and analyze the signal. If a command to readjust the threshold is received, the process returns to step (c); Among them, in the step of monitoring multiple groups of wireless signals, 10 to 30 groups of smart home product wireless signals are continuously monitored; in the step of adjusting the wireless signal reception threshold, the signal field strength of each group of wireless signals needs to be analyzed, and the wireless signal reception threshold is adjusted to the lowest signal field strength of all groups of wireless signals, while fully receiving effective wireless signals, eliminating background noise interference to the greatest extent; in the step of executing the external request to adjust the signal threshold, after the SDR module receives the command to readjust the threshold, it will repeat the step of monitoring multiple groups of wireless signals and the step of adjusting the wireless signal reception threshold.

3. The smart home wireless communication evaluation method based on communication protocol analysis according to claim 1 is characterized in that: The event-driven communication protocol data monitoring and capturing part constructs three sets of smart home wireless products with signals isolated from each other, and relies on the three sets of systems with signals isolated from each other to evaluate three identical smart home wireless products, wherein one smart home wireless product is set as the main tested product, and the other two smart home wireless products are set as 1# auxiliary tested product and 2# auxiliary tested product, wherein the ID number of 1# auxiliary tested product is the same as that of the main tested product, and the ID number of 2# auxiliary tested product is different from that of the main tested product; at the same time, the communication protocols of the three smart home wireless products monitored are stored in different categories according to event type or operation type for subsequent analysis.

4. The smart home wireless communication evaluation method based on communication protocol analysis according to claim 1 is characterized in that: The fixed byte comparison part in the communication data frame is aimed at several communication protocol fixed bytes recorded in the smart home wireless product description document provided by the manufacturer. First, the KMP algorithm is used to quickly analyze whether each group of monitored communication protocol data frames has the same bytes. If all fixed bytes can be found in the group of communication protocol data frames, the group of communication protocol data frames is marked as passed in the comparison, otherwise it is marked as failed in the comparison; then the comparison pass rate of the monitored communication protocol data frames is continuously calculated. If the comparison pass rate is lower than 90%, the signal scanning part of the dynamic adaptive adjustment of the threshold is restarted.

5. The smart home wireless communication evaluation method based on communication protocol analysis according to claim 1 is characterized in that: The byte distance comparison part in the communication data frame calculates the byte lengths between different fixed bytes for each group of monitored communication protocol data frames in turn. If the byte length between any two fixed bytes is different from the byte length defined in the manufacturer's product description document, the group of communication protocol data frames is marked as failed to pass the comparison, otherwise it is marked as passed. Then, the comparison pass rate of the monitored communication protocol data frames is continuously calculated. If the comparison pass rate is lower than 90%, the signal scanning part of the dynamic adaptive adjustment of the threshold is restarted.

6. The smart home wireless communication evaluation method based on communication protocol analysis according to claim 1 is characterized in that: The comparison and calculation part of the communication protocol compliance degree first constructs a one-dimensional array as shown below: [Length of the preceding interval] [Fixed byte 1#] [Fixed byte 2#] […] [Fixed byte n#] [Length of the following interval] In the above one-dimensional array, the fixed byte n# represents the nth byte in the fixed byte string, the leading interval length represents the number of bytes between the fixed byte string and the previous fixed byte string, and the trailing interval length represents the number of bytes between the fixed byte string and the next fixed byte string; thus, each group of communication protocol frames has a number of one-dimensional arrays conforming to the above format; Then, all the one-dimensional arrays in each group of monitored communication protocol data frames are compared with the one-dimensional arrays in the communication protocol data frames provided in the product description document one by one, and the compliance ratio of the one-dimensional arrays is calculated as the compliance degree of the group of communication protocol data frames, with a maximum of 100% and a minimum of 0%, for evaluation personnel to use as a reference for further evaluation and analysis; Finally, if the compliance level of each group of monitored communication protocol data frames can reach 100%, it can be determined that the communication data integrity of the smart home wireless product is established.

7. The smart home wireless communication evaluation method based on communication protocol analysis according to claim 3 is characterized in that: The non-fixed byte analysis part in the communication data frame includes data confidentiality evaluation, data freshness evaluation, and data non-repudiation evaluation steps; The data confidentiality evaluation is as follows: first, the main tested product and the 1# auxiliary tested product execute the same event at the same time, and analyze whether the communication protocol data frames of the two tested products are the same. If they are not the same, it is suggested to the evaluation personnel that the smart home wireless product uses a true random number encryption method, and the evaluation personnel are asked to make a further final judgment based on their experience. If they are not the same, the subsequent evaluation is continued; then, the main tested product and the 2# auxiliary tested product execute the same operation event at the same time, and analyze whether the communication protocols of the two tested products are the same. If they are different, it is suggested to the evaluation personnel that the encryption method of the smart home wireless product is related to its product ID number. If they are the same, the subsequent evaluation is continued; again, the main tested product executes the same operation event multiple times at different times, and analyzes whether the multiple communication protocols of the main tested product are the same. If they are different, it is suggested to the evaluation personnel that the encryption method of the smart home wireless product is related to the event time. If they are the same, the evaluation personnel are asked to make a further final judgment on the data confidentiality of the smart home wireless product based on their experience; The data freshness evaluation is firstly performed by the main tested product and the 2# auxiliary tested product executing the same operation event at the same time, and analyzing whether there are differences in the bytes representing the serial numbers in the communication protocol frames of the two tested products, thereby completing the serial number evaluation; secondly, the main tested product executes the same operation event multiple times at different times, and analyzing whether there are differences in the bytes representing the timestamps in the multiple communication protocol frames of the main tested product, thereby completing the timestamp evaluation; Finally, if both the serial number and the timestamp are different, the data freshness of the communication protocol of the smart home wireless product is suggested to the evaluator, and the evaluator is asked to make a further final judgment based on his experience; The data non-repudiation evaluation is first performed by the main tested product and the 2# auxiliary tested product executing the same operation event at the same time, and analyzing whether there are differences in the bytes representing the check code in the communication protocol frame of the two tested products; then the main tested product and the 1# auxiliary tested product execute different events at the same time, and analyzing whether there are differences in the bytes representing the check code in the communication protocol frame of the two tested products; finally, the main tested product executes the same operation event multiple times at different times, and analyzes whether there are differences in the bytes representing the check code in the communication protocol frame of the main tested product multiple times; finally, if the check codes are different each time in the above three steps, it is recommended to the evaluator that the data non-repudiation of the communication protocol of the smart home wireless product is established, and the evaluator is asked to make further final judgment based on his experience.

8. The smart home wireless communication evaluation method based on communication protocol analysis according to claim 4 is characterized in that: The KMP algorithm is: Let the monitored wireless communication data frame be the main string T, the pointer of its internal element in the array be i, and the byte length of the main string T be n; the fixed bytes to be compared be the pattern string P, the pointer of its internal element in the value be q, and the length of the pattern string P be m; Step 1: Initialize, set the pointer q of the pattern string P and the pointer i of the main string T to 0 respectively, and calculate the prefix function array π; Step 2: Enter the loop traversal, the loop condition is i<n, in the loop body, check whether P[q] is equal to T[i]: if they are equal, let q and i increase by 1 and continue the loop; if they are not equal, then determine whether q is greater than 0, if q is greater than 0, set the pointer q value to π[q-1], if q is not greater than 0, let the main string pointer i increase by 1; Step 3: Complete the matching check. In the above loop body, if q can be looped to m, the matching position of the byte string is output as im, and the value of pointer q is set to π[q-1], and the loop in step 2 is continued; if q is not equal to m, the loop is continued until the loop condition i<n is triggered, thereby completing the matching check, that is, completing the KMP algorithm.

Images