Internet of Things application system, method, device, equipment, medium and program product

Abstract

The invention relates to an Internet of Things application system, method, device and equipment, a medium and a program product. The system comprises an equipment management module, a data acquisition and storage module, an interface integration module and a privacy protection module, and the equipment management module is used for equipment state monitoring and management or equipment firmware remote updating; the data acquisition and storage module is used for large-scale data storage and management, or data backup and recovery, or data encryption and secure storage; the interface integration module is used for managing interface access authority and security; and the privacy protection module is used for identity verification and authorization management or privacy compliance management. By the adoption of the system, the reliability and safety of the system can be improved, and interoperability between different devices and the system is promoted.

Description

Technical Field

[0001] The present application relates to the technical field of Internet of Things, and in particular to an Internet of Things application system, method, device, equipment, medium and program product. Background Art

[0002] Due to the rapid development of IoT technology and the need for wide application, along with the improvement of sensor technology, network technology and data processing capabilities, IoT applications have gradually moved from concept to practical application and have been widely adopted in various industries. However, since IoT involves a large number of devices, sensors and data sources, it is difficult to effectively manage and connect a large number of devices with existing technologies. Secondly, data collection, storage, analysis and application also need to be supported by an efficient, secure and reliable system platform. Summary of the invention

[0003] Based on this, it is necessary to provide an Internet of Things application system, method, device, equipment, medium and program product to address the above technical problems.

[0004] In a first aspect, the present application provides an Internet of Things application system, including a device management module, a data collection and storage module, an interface integration module, and a privacy protection module, wherein:

[0005] The device management module is used for device status monitoring and management or remote updating of device firmware;

[0006] The data acquisition and storage module is used for large-scale data storage and management, or data backup and recovery, or data encryption and secure storage;

[0007] The interface integration module is used to manage interface access rights and security;

[0008] The privacy protection module is used for identity authentication and authorization management, or privacy compliance management.

[0009] In one embodiment, the device management module includes: a device status management submodule and a device firmware management submodule, wherein:

[0010] The device status management submodule is used to obtain and monitor the operating status, performance indicators and abnormal conditions of the device in real time, and remotely manage the configuration, update and fault handling of the device;

[0011] The device firmware management submodule is used to manage, update, download, install and provide status feedback on the device firmware.

[0012] In one embodiment, the data acquisition and storage module includes: a real-time data acquisition and processing submodule, a large-scale data storage and management submodule, a data backup and recovery submodule, and a data encryption and secure storage submodule, wherein:

[0013] The real-time data acquisition and processing submodule is used to acquire data in real time, and transmit, process, monitor and feedback the acquired data in real time;

[0014] The large-scale data storage and management submodule is used to provide data access and interface management functions, collect and preprocess data through the data access and interface management functions to obtain the massive data to be stored, and use data storage technology to effectively store and manage the massive data;

[0015] The data backup and recovery submodule is used to provide data backup technology, automated backup solutions and data recovery technology, and ensure data consistency and integrity through data consistency backup and integrity verification functions;

[0016] The data encryption and secure storage submodule is used to provide data encryption technology and secure storage technology, and to ensure the security of data during transmission by establishing an HTTPS connection between the device and the cloud service.

[0017] In one embodiment, the interface integration module includes: an interface providing submodule and an interface access management submodule, wherein:

[0018] The interface provides a submodule, which implements interface design through interface design technology and combines data format and serialization technology to ensure that the data format of the provided interface is unified;

[0019] The interface provides a submodule, which is also used to handle errors in interface requests and record logs and version management;

[0020] The interface access management submodule confirms the identity of the user or device through identity authentication technology;

[0021] The interface access management submodule is further used to define the access rights of the user role according to the user role to ensure that the user can only access authorized resources;

[0022] The interface access management submodule is also used to assign a unique API key to each application or device for identity authentication and access control, and to protect the confidentiality of data transmitted and stored in the interface through data encryption technology.

[0023] In one embodiment, the privacy protection module includes: a data transmission encryption submodule, an identity authentication authorization submodule and a privacy compliance management submodule, wherein:

[0024] The data transmission encryption submodule implements the data transmission encryption function through transport layer security protocol technology, end-to-end encryption technology, data encryption library tools, message queues and data transmission protocols;

[0025] The identity authentication and authorization submodule implements the identity authentication and authorization functions through identity authentication, authorization management, multi-factor identity authentication, key management and interface access control;

[0026] The privacy compliance management submodule is based on the privacy policy and compliance framework, and combines data collection and processing management, data encryption and secure storage, and user rights management technology to achieve privacy compliance management functions.

[0027] In a second aspect, the present application further provides an Internet of Things application method, which is applied to the system described in the first aspect, and the method includes:

[0028] Get interface interaction instructions;

[0029] Determine a target function module from preset system modules according to the interface interaction instruction; the preset system modules are the device management module, the data acquisition and storage module, the interface integration module and the privacy protection module;

[0030] Respond to the interface interaction instruction based on the target function module to execute the task corresponding to the interface interaction instruction.

[0031] In a third aspect, the present application also provides an Internet of Things application device, including:

[0032] An acquisition module is used to obtain interface interaction instructions;

[0033] A determination module, used to determine a target function module from preset system modules according to the interface interaction instruction; the preset system modules are the device management module, the data acquisition and storage module, the interface integration module and the privacy protection module;

[0034] A response module is used to respond to the interface interaction instruction based on the target function module to execute the task corresponding to the interface interaction instruction.

[0035] In a fourth aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0036] Get interface interaction instructions;

[0037] Determine a target function module from preset system modules according to the interface interaction instruction; the preset system modules are the device management module, the data acquisition and storage module, the interface integration module and the privacy protection module;

[0038] Respond to the interface interaction instruction based on the target function module to execute the task corresponding to the interface interaction instruction.

[0039] In a fifth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0040] Get interface interaction instructions;

[0041] Determine a target function module from preset system modules according to the interface interaction instruction; the preset system modules are the device management module, the data acquisition and storage module, the interface integration module and the privacy protection module;

[0042] Respond to the interface interaction instruction based on the target function module to execute the task corresponding to the interface interaction instruction.

[0043] In a sixth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0044] Get interface interaction instructions;

[0045] Determine a target function module from preset system modules according to the interface interaction instruction; the preset system modules are the device management module, the data acquisition and storage module, the interface integration module and the privacy protection module;

[0046] Respond to the interface interaction instruction based on the target function module to execute the task corresponding to the interface interaction instruction.

[0047] The above-mentioned Internet of Things application system, method, device, equipment, medium and program product, the system includes a device management module, a data acquisition and storage module, an interface integration module and a privacy protection module, wherein: the device management module is used for device status monitoring and management or remote update of device firmware; the data acquisition and storage module is used for large-scale data storage and management, or data backup and recovery, or data encryption and secure storage; the interface integration module is used to manage interface access rights and security; the privacy protection module is used for identity authentication and authorization management, or privacy compliance management. Therefore, by monitoring and managing the device status or remotely updating the device firmware through the device management module, the management efficiency of the device can be improved, and the data acquisition and storage module can realize the effective storage and management of large-scale data, and the data backup and recovery as well as data encryption and secure storage can effectively improve the security of data acquisition and storage. Combining the functions of the interface integration module and the privacy protection module can also further improve the system availability while ensuring the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0049] Figure 1 An application environment diagram of an Internet of Things application method in an embodiment;

[0050] Figure 2 A schematic diagram of a flow chart of an Internet of Things application method in one embodiment;

[0051] Figure 3 A structural block diagram of an Internet of Things application device in one embodiment;

[0052] Figure 4 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0054] The Internet of Things application system provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The Internet of Things application system can be integrated on the server 104, and the Internet of Things application system includes a device management module, a data acquisition and storage module, an interface integration module, and a privacy protection module, wherein: the device management module is used for device status monitoring and management or remote update of device firmware; the data acquisition and storage module is used for large-scale data storage and management, or data backup and recovery, or data encryption and secure storage; the interface integration module is used to manage interface access rights and security; the privacy protection module is used for identity authentication and authorization management, or privacy compliance management. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablets, Internet of Things devices and portable wearable devices, and the Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, projection devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The head mounted device may be a virtual reality (VR) device, an augmented reality (AR) device, smart glasses, etc. The server 104 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0055] In an exemplary embodiment, the Internet of Things application system is integrated into Figure 1 The server 104 in the system includes a device management module, a data acquisition and storage module, an interface integration module and a privacy protection module, wherein: the device management module is used for device status monitoring and management or remote update of device firmware; the data acquisition and storage module is used for large-scale data storage and management, or data backup and recovery, or data encryption and secure storage; the interface integration module is used to manage interface access rights and security; the privacy protection module is used for identity authentication and authorization management, or privacy compliance management.

[0056] In some embodiments, the device management module includes: a device status management submodule and a device firmware management submodule, wherein: the device status management submodule is used to acquire and monitor the operating status, performance indicators and abnormal conditions of the device in real time, and remotely manage the configuration, update and troubleshooting of the device; the device firmware management submodule is used to manage, update, download, install and provide status feedback on the device firmware.

[0057] In some embodiments, the devices managed by the device status management submodule are all target devices obtained from the device database that have passed device registration, device authentication, and device authorization. Among them, the registration process of the target device is the process of connecting the new device to the Internet of Things platform and assigning it a unique identity. Each device requires a unique identifier (such as UUID or IMEI) when registering to ensure that each device can be uniquely identified in the system. Each device also needs to provide a RESTful API interface when registering, which allows the device to send a registration request to the cloud platform, and the request contains device information (such as type, manufacturer, version, UID, etc.). After the device registers the identification and interface, the registration information of the device is stored in the device database (relational MySQL or non-relational MongoDB database) for subsequent management and query.

[0058] In some embodiments, the authentication mechanism for device authentication can be key-based authentication: each device is preset with a security key (such as a symmetric key) when it leaves the factory, and this security key is used for signing and encryption when communicating with the cloud platform. Specifically, the public key infrastructure (PKI) can use digital certificates and public-private key pairs for authentication, and the device authenticates its identity by holding a private key and the public key of the cloud platform. In some embodiments, the authentication protocol can be combined with protocols such as OAuth 2.0 and MQTT username / password authentication to ensure that the device is authenticated with valid credentials when connected. Short-term tokens can also be used. After successful authentication, the cloud platform can issue a short-term valid token (such as JWT) to the device so that the device can use it in subsequent requests to reduce security risks.

[0059] In some embodiments, device authorization may be achieved by using technologies such as access control lists (ACLs), role-based access control (RBAC), policy engines, or token verification, but is not limited thereto. Among them, access control lists (ACLs) refer to defining the access rights of devices, controlling their read and write rights to specific resources, and managing them based on device types and roles. Role-based access control (RBAC) divides devices into different roles (such as sensors, actuators, etc.), assigns different permissions based on roles, and simplifies permission management. A policy engine uses a policy engine (such as Open Policy Agent) to dynamically evaluate device requests and decide whether to allow access to specific resources. Token verification is to verify whether the access token used by a device is legal each time it requests access to cloud resources, and to check the authorization policy of the device.

[0060] In some embodiments, the device status management submodule can collect status data in real time through the device's built-in sensors (such as temperature, humidity, power, etc.), obtain feedback information from the actuator, monitor the execution status, and then use communication protocols such as MQTT, CoAP, HTTP, etc. to ensure that the device status data can be transmitted to the cloud platform in a timely and reliable manner. Real-time data streams can also be used to process the transmitted data streams in real time through stream processing technologies (such as Apache Kafka, Apache Flink) to ensure the timeliness of the data. In terms of updating the device status, a heartbeat mechanism or event-driven can be used to implement it, where the heartbeat mechanism is that the device regularly sends a "heartbeat" signal to the cloud platform to confirm its online status; if the heartbeat signal is not received, it can be determined that the device is offline or faulty. Event-driven is to set a trigger mechanism for specific events (such as overtemperature, device failure) to report abnormal status in real time.

[0061] In some embodiments, the device status management submodule can implement functions such as remote management interface, firmware and software updates, and fault detection and recovery in terms of device management. Among them, a RESTful API interface can be provided in the remote management interface function, allowing users to remotely configure device parameters, execute commands (such as restarting, upgrading firmware), etc., and protocols such as MQTT can be used to support real-time control of device behavior. The firmware and software update function can be updated through OTA (Over-The-Air) to achieve remote firmware upgrades, ensure that the device always runs the latest security and functional versions, and manage device firmware and software versions, and track update history. The fault detection and recovery function can automatically detect faults and generate reports through device log and status data analysis, and implement automatic recovery strategies, such as automatically restarting faulty devices, or performing specific recovery operations based on the type of fault.

[0062] In some embodiments, the device firmware management submodule is used to manage, update, download, install and provide status feedback on the device firmware, thereby realizing remote updating of the device firmware. Among them, the firmware management process can use the version number to identify different versions of the firmware to achieve version control, and support the rollback function to deal with update failures or incompatibility issues, and then store the firmware file in a cloud storage service or a dedicated firmware server to ensure efficient access and download. The firmware update mechanism can be that the device checks for updates at startup or regularly, and downloads and installs the updated firmware from the cloud by requesting firmware version information and download links. It should be noted that after the firmware download is completed, the integrity of the firmware is verified by a checksum (such as SHA256) to ensure that there is no damage or tampering. And back up the current firmware during the installation process so that it can be restored to the last stable version when the update fails. Finally, after the update is completed, the device sends a status report to the cloud platform to confirm the success or failure of the update, and attaches the necessary log information, and the cloud platform monitors the update status of the device, automatically generates an alarm, and notifies the operation and maintenance team to handle the update exception.

[0063] In some embodiments, the data acquisition and storage module includes: a real-time data acquisition and processing submodule, a large-scale data storage and management submodule, a data backup and recovery submodule, and a data encryption and secure storage submodule, wherein: the real-time data acquisition and processing submodule is used to acquire data in real time, and transmit, process, monitor and feedback the acquired data in real time; the large-scale data storage and management submodule is used to provide data access and interface management functions, perform data acquisition and preprocessing through data access and interface management functions, obtain massive data to be stored, and use data storage technology to effectively store and manage massive data; the data backup and recovery submodule is used to provide data backup technology, automated backup solutions and data recovery technology, and ensure data consistency and integrity through data consistency backup and integrity verification functions; the data encryption and secure storage submodule is used to provide data encryption technology and secure storage technology, and establish an HTTPS connection between the device and the cloud service to ensure the security of data during transmission.

[0064] In some embodiments, the real-time data acquisition and processing submodule can obtain real-time data from IoT devices through sensors and actuators. Specifically, the sensor can use various sensors (temperature, humidity, pressure, light, etc.) to collect environmental data, and can monitor the status and feedback information of the actuator to achieve closed-loop control. The acquired real-time data can be combined with a specific communication protocol to achieve a specific effect. For example, CoAP can be used. CoAP is a protocol designed for resource-constrained devices, suitable for UDP connections, and supports efficient data transmission. MQTT can also be used. MQTT is a lightweight message transmission protocol suitable for low-bandwidth and high-latency environments. Devices can publish status updates through MQTT agents.

[0065] In some embodiments, the real-time collected data is transmitted to a cloud platform or edge computing device, and the data is processed closer to the device (such as a gateway or edge device) through real-time data streams to reduce the transmission volume and latency. Different stream processing frameworks can be used for real-time analysis and processing of collected data, for example, Apache Kafka: used for high-throughput transmission and distribution of data streams, supporting multi-consumer mode; Apache Flink: a powerful stream processing framework that supports complex event processing and real-time analysis; Apache Spark Streaming: processes real-time data streams and can be used in conjunction with a batch processing framework. Data in real-time data streams can be filtered (such as discarding irrelevant data) and aggregated (such as calculating averages, maximum values, etc.) by defining rules.

[0066] In some embodiments, the processing results are monitored and fed back so that the system can be adjusted in a timely manner. Specifically, dashboards and visualization tools (Grafana, Kibana) can be used to display real-time data and processing results, providing a user-friendly monitoring interface. Thresholds and rules can also be set, and once the data exceeds the preset range, an alarm is automatically triggered to notify relevant personnel (such as sending SMS, email or push notification).

[0067] In some embodiments, the large-scale data storage and management submodule provides efficient data access and management interfaces (RESTful or GraphQL API) through data access and interface management functions, so that applications and users can easily access and operate stored data, and use SQL (for relational databases) or NoSQL query languages ​​to support complex data query and analysis. Data visualization tools (such as Tableau and Grafana) can also be integrated for data analysis and display, thereby combining various types of databases (relational databases, non-relational databases, time series databases, and data lakes) to achieve effective storage and management of massive data.

[0068] In some embodiments, the data backup and recovery submodule is used to provide data backup technology, automated backup solutions and data recovery technology. Among them, the backup type provided by the data backup technology can be a full backup: a full backup of all data is performed regularly, which is suitable for the backup of small-scale data and important data. It can also be an incremental backup: only the data that has changed since the last backup is backed up, saving storage space and backup time. It can also be a differential backup: backing up the data that has changed since the last full backup, which is faster than incremental backup when restoring, but occupies more storage.

[0069] In some embodiments, the backup storage technology may adopt cloud storage: using cloud storage services to provide high availability and persistence. Alternatively, local storage may be adopted: configuring redundant storage (such as NAS, SAN) in a local data center to ensure fast backup and recovery.

[0070] In some embodiments, the backup task can be triggered regularly by using a scheduling tool (such as a cron job) to ensure that the backup is carried out according to a predetermined plan. Automated backup solutions can also be written (such as Shell, Python) to perform backup operations, including data export, compression, and transmission to backup storage for automated backup solutions to reduce manual intervention and errors.

[0071] In some embodiments, if user data is damaged, data recovery needs to be achieved through various recovery strategies and recovery tools. Among them, the recovery strategy can be fast recovery: ensuring that important data (such as configuration files, user data) can be quickly recovered to reduce business interruption time. It can also be full recovery and partial recovery: support recovery from full backup, and also allow selective recovery of specific data. In terms of the choice of recovery tools, you can use the recovery tools that come with the database (such as MySQL's mysqlpump, PostgreSQL's pg_restore) to recover database data. For file system backups, it is more suitable to use backup software (such as Bacula, Veeam) for recovery operations.

[0072] In some embodiments, for relational databases, transaction logs or snapshot technology can be used for backup to ensure data consistency during backup. After the backup is completed, a checksum (such as SHA256) is calculated to ensure that the backup data has not been tampered with or damaged.

[0073] In some embodiments, the data encryption and secure storage submodule is used to provide data encryption technology and secure storage technology, and to ensure the security of data during transmission by establishing an HTTPS connection between the device and the cloud service. Among them, the data encryption technology can use the AES encryption algorithm to encrypt sensor data, device status information, etc., and store them in a database or file system. When the device communicates with the cloud, AES is used to encrypt the data in real time. The RSA algorithm can also be used to exchange symmetric encryption keys between the device and the cloud to ensure the secure transmission of the keys. And important data (such as user passwords) are hashed, and hash values ​​are stored instead of original data to enhance security.

[0074] In some embodiments, the secure storage technology may be to encrypt and store user identity information, sensor data, etc., to ensure the security of the data on the physical storage medium.

[0075] In some embodiments, the interface integration module includes: an interface providing submodule and an interface access management submodule, wherein: the interface providing submodule implements interface design through interface design technology, and combines data format and serialization technology to ensure that the data format of the provided interface is unified; the interface providing submodule is also used to handle errors in interface requests and record logs and version management; the interface access management submodule confirms the identity of the user or device through identity authentication technology; the interface access management submodule is also used to define the access rights of user roles according to user roles to ensure that users can only access authorized resources; the interface access management submodule is also used to assign a unique API key to each application or device for identity authentication and access control, and use data encryption technology to protect the confidentiality of data transmitted and stored in the interface.

[0076] In some embodiments, the interface provided in the interface providing submodule allows different systems to interact through the HTTP protocol, supporting data acquisition, creation, update and deletion (CRUD operations). Each request contains sufficient information and does not depend on the state of the server. All operations are targeted at resources, and resources are identified by URIs.

[0077] In some embodiments, the technology stack used for interface design may include the development framework: Spring Boot (Java): provides rich functions and is suitable for building enterprise-level applications. Database: SQL (such as MySQL, PostgreSQL): suitable for storing structured data and supporting complex queries. NoSQL (such as MongoDB, Cassandra): suitable for storing unstructured data and rapid expansion. Document generation tool: Swagger / OpenAPI: used to automatically generate API documents and provide an interactive API test interface.

[0078] In some embodiments, the structure and specifications of the RESTful API interface are designed based on the technology stack related technologies, the resources in the API, such as devices, users, data records, etc., are determined, their attributes and relationships are defined, and precise interface design is implemented through URI design and HTTP methods. Specifically, standard HTTP methods can be used to represent operations: GET: get resources, POST: create new resources, PUT / PATCH: update existing resources, DELETE: delete resources, and appropriate HTTP status codes can also be used to represent the results of the request: 200 OK: successful request, 201 Created: successful resource creation, 404 Not Found: the requested resource does not exist, 500 Internal Server Error: server error.

[0079] In some embodiments, the interface providing submodule may use a library (such as Jackson, Gson, Marshmallow) to convert data objects into JSON format, or parse JSON into data objects to ensure that the data format of the API is unified and easy to parse.

[0080] In some embodiments, the interface providing submodule defines a unified error response format for errors in some interface requests, returns detailed error information, and uses a log framework (Log4j) to record API access logs and error information for subsequent debugging and monitoring.

[0081] In some embodiments, the interface providing submodule uses a version number (such as / v1 / devices) in the URI to ensure that different versions of the API can coexist to manage the version of the API for functional iteration and compatibility maintenance.

[0082] In some embodiments, the interface access management submodule can use the OAuth 2.0 protocol for identity authentication and support multiple authorization methods (such as authorization code, client credentials). Specifically, the user obtains an access token after logging in, and subsequent API requests must carry the token to prove the identity. JWT (JSON Web Tokens) is used as the authentication mechanism. The token contains user identity information and permissions. JWT can be generated after the user successfully logs in, the validity period can be set, and verification can be performed in subsequent requests.

[0083] In some embodiments, the interface access management submodule can define specific permissions for each role, check user roles and permissions in API requests, and assign a unique API key to each application or device for authentication and access control, wherein the API keys need to be rotated regularly to prevent abuse, and a key expiration and invalidation mechanism is implemented to ensure that old keys become invalid after a certain period of time.

[0084] In some embodiments, the interface access management submodule uses TLS to encrypt API communications to protect the security of data during transmission, encrypts all API requests and responses using HTTPS, and uses symmetric encryption algorithms such as AES to encrypt stored data and encrypt stored sensitive data to ensure the security of data in the database.

[0085] In some embodiments, the privacy protection module includes: a data transmission encryption sub-module, an identity authentication authorization sub-module and a privacy compliance management sub-module, wherein: the data transmission encryption sub-module implements the data transmission encryption function through transport layer security protocol technology, end-to-end encryption technology, data encryption library tools, message queues and data transmission protocols; the identity authentication authorization sub-module implements the identity authentication authorization function through identity authentication, authorization management, multi-factor authentication, key management and interface access control; the privacy compliance management sub-module is based on the privacy policy and compliance framework, and combines data collection and processing management, data encryption and secure storage and user rights management technology to implement the privacy compliance management function.

[0086] In some embodiments, the data transmission encryption submodule uses the transport layer security protocol technology to enforce the use of the HTTPS protocol in all APIs and data transmission interfaces to ensure that data is encrypted during transmission, configure server and client certificates, and ensure the verification of the identities of both parties.

[0087] In some embodiments, the data transmission encryption submodule generates a pair of public and private keys for the device through end-to-end encryption technology. The public key is used to encrypt data, and the private key is securely stored locally on the device for decryption. A symmetric key is shared between the device and the cloud for encryption and decryption of transmitted data. The key can be securely exchanged through public key encryption.

[0088] In some embodiments, the data transmission encryption submodule implements data encryption and decryption by using mature encryption library tools (such as OpenSSL, Bouncy Castle, libsodium), and uses these libraries to encrypt data on the device and server sides to ensure the security and efficiency of the encryption algorithm.

[0089] In some embodiments, when the data transmission encryption submodule uses the MQTT protocol for inter-device communication, TLS is enabled for data encryption to ensure the security of messages during transmission. When CoAP is used for data transmission, DTLS is used to protect the security of data transmission.

[0090] In some embodiments, the identity authentication and authorization submodule obtains an access token through the OAuth authorization server when the user logs in, and subsequent API requests must carry the token for identity authentication. JWT can also be generated after the user successfully logs in, and the validity period is set, and the validity and integrity of the JWT are verified for each request. The identity authentication and authorization submodule assigns a unique identifier (such as a device ID) to each IoT device, and authenticates it through a certificate or key, and uses an X.509 certificate or API key to authenticate the device to ensure the legitimacy of the device.

[0091] In some embodiments, the identity authentication and authorization submodule sets a permission list for different roles in the system, verifies in the API request whether the user role has the right to access specific resources, and defines access rights based on the user's role (such as administrator, user, visitor).

[0092] In some embodiments, the identity authentication authorization submodule combines the username / password with other factors (such as mobile phone verification code, fingerprint recognition) to authenticate the user, requiring the user to enter a verification code received on the mobile phone or a one-time password (OTP) generated by the authenticator when logging in.

[0093] In some embodiments, the authentication authorization submodule uses a key management system (KMS) service to generate, store, and manage encryption keys, stores sensitive keys and certificates in the KMS, and dynamically calls them during the authentication process.

[0094] In some embodiments, the authentication and authorization submodule uses an API gateway (such as Kong, Spring-cloudGateway) to centrally manage authentication and authorization, configure the API gateway for authentication, support OAuth and JWT, and automatically handle user access rights.

[0095] In some embodiments, the privacy compliance management submodule is based on writing a privacy policy in accordance with legal requirements and providing clear instructions during user registration and data collection to ensure compliance with various laws and regulations (such as GDPR and CCPA).

[0096] In some embodiments, the privacy compliance management submodule adopts a compliance framework (such as NIST, ISO / IEC27001) to guide privacy protection measures, evaluates existing privacy management measures, ensures compliance with the framework requirements, and conducts compliance audits regularly.

[0097] In some embodiments, the privacy compliance management submodule adopts the principle of data minimization, collects only necessary user data, avoids excessive collection, strictly follows the principle of data minimization when designing the data collection process, and regularly reviews the data type. Use pop-up windows or registration forms to require users to explicitly choose to agree to collect data and provide the option to withdraw consent.

[0098] In some embodiments, the privacy compliance management submodule encrypts all stored user data and data in transit, and uses role-based access control (RBAC) or attribute-based access control (ABAC) to manage data access rights to ensure that only authorized personnel can access.

[0099] In some embodiments, the privacy compliance management submodule implements a user interface that allows users to view and download their data, supports data export functionality, and adds relevant options in the user account settings to simplify the process for users to exercise their rights, thereby providing an interface for users to exercise rights such as correction, deletion, and withdrawal of consent.

[0100] In an exemplary embodiment, Figure 2 As shown, an Internet of Things application method is provided, and the application of the method to an Internet of Things application system is used as an example for explanation. The Internet of Things application system is integrated in Figure 1 The server 104 in the method includes the following steps S202 to S206. Wherein:

[0101] Step S202, obtaining interface interaction instructions.

[0102] The interface interaction instruction refers to the interface interaction instruction received in the interface of the current IoT application system, which is used to indicate the task requirements to be implemented by the specific interaction. The task requirements may be data access requests, identity authentication requests, etc., but are not limited thereto.

[0103] In some embodiments, the user can obtain interface interaction instructions by clicking or double-clicking on the interface of the Internet of Things application system, and promptly issuing interface interaction instructions corresponding to specific tasks, but is not limited to this.

[0104] Step S204, determining a target functional module from preset system modules according to the interface interaction instruction; the preset system modules are a device management module, a data collection and storage module, an interface integration module, and a privacy protection module.

[0105] The interface interaction instruction includes an interface interaction type, and the interface interaction type is used to indicate the task type corresponding to the interface interaction instruction.

[0106] In some embodiments, determining the target functional module from the preset system modules according to the interface interaction type of the interface interaction instruction can accurately and quickly allocate the interface interaction instruction to improve the instruction processing efficiency of the system. For example, when the interface interaction instruction is a data access instruction type, the privacy protection module is directly used as the target functional module, thereby achieving a rapid response to the interface interaction instruction.

[0107] Step S206, responding to the interface interaction instruction based on the target functional module to execute the task corresponding to the interface interaction instruction.

[0108] Among them, the task corresponding to the execution interface interaction instruction is a task process set according to the data carried by the interface interaction instruction.

[0109] In some embodiments, when the interface interaction instruction is an identity authentication instruction, because the identity information carried in the identity authentication instruction needs to be verified, the target function module is a privacy protection module to verify the identity information. While verifying whether it is correct, it will also determine whether the current identity information has the right to access the corresponding task data, thereby ensuring the security of the system.

[0110] In the above-mentioned Internet of Things application method, an interface interaction instruction is obtained; a target function module is determined from a preset system module according to the interface interaction instruction; the preset system modules are a device management module, a data acquisition and storage module, an interface integration module, and a privacy protection module; and the interface interaction instruction is responded to based on the target function module to execute the task corresponding to the interface interaction instruction. Therefore, by obtaining the interface interaction instruction in real time, and determining the target function module from the preset system module according to the interface interaction instruction, and responding to the interface interaction instruction based on the target function module to execute the task corresponding to the interface interaction instruction, the various functions of the Internet of Things application system are efficiently realized, so that timely interface interaction with the user can be achieved, and the system availability can be further improved while ensuring the security of the system.

[0111] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0112] Based on the same inventive concept, the embodiment of the present application also provides an Internet of Things application device for implementing the Internet of Things application method involved above. The implementation solution provided by the device to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in one or more Internet of Things application device embodiments provided below can refer to the limitations of the Internet of Things application method above, and will not be repeated here.

[0113] In an exemplary embodiment, Figure 3 As shown, an Internet of Things application device 300 is provided, including: an acquisition module 301, a determination module 302 and a response module 303, wherein:

[0114] The acquisition module 301 is used to acquire the interface interaction instruction;

[0115] The determination module 302 is used to determine the target function module from the preset system modules according to the interface interaction instruction; the preset system modules are the device management module, the data collection and storage module, the interface integration module and the privacy protection module;

[0116] The response module 303 is used to respond to the interface interaction instruction based on the target function module to execute the task corresponding to the interface interaction instruction.

[0117] Each module in the above-mentioned IoT application device can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0118] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 4 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store preset system module data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an Internet of Things application method is implemented.

[0119] Those skilled in the art will understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0120] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of the above-mentioned Internet of Things application method when executing the computer program.

[0121] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned Internet of Things application method are implemented.

[0122] In one embodiment, a computer program product is provided, including a computer program, which implements the steps of the above-mentioned Internet of Things application method when executed by a processor.

[0123] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0124] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0125] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0126] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An Internet of Things application system, characterized in that: The system includes a device management module, a data collection and storage module, an interface integration module and a privacy protection module, wherein: The device management module is used for device status monitoring and management or remote updating of device firmware; The data acquisition and storage module is used for large-scale data storage and management, or data backup and recovery, or data encryption and secure storage; The interface integration module is used to manage interface access rights and security; The privacy protection module is used for identity authentication and authorization management, or privacy compliance management.

2. The system according to claim 1, characterized in that The device management module includes: a device status management submodule and a device firmware management submodule, wherein: The device status management submodule is used to obtain and monitor the operating status, performance indicators and abnormal conditions of the device in real time, and remotely manage the configuration, update and fault handling of the device; The device firmware management submodule is used to manage, update, download, install and provide status feedback on the device firmware.

3. The system according to claim 1, characterized in that The data acquisition and storage module includes: a real-time data acquisition and processing submodule, a large-scale data storage and management submodule, a data backup and recovery submodule, and a data encryption and secure storage submodule, wherein: The real-time data acquisition and processing submodule is used to acquire data in real time, and transmit, process, monitor and feedback the acquired data in real time; The large-scale data storage and management submodule is used to provide data access and interface management functions, collect and preprocess data through the data access and interface management functions to obtain the massive data to be stored, and use data storage technology to effectively store and manage the massive data; The data backup and recovery submodule is used to provide data backup technology, automated backup solutions and data recovery technology, and ensure data consistency and integrity through data consistency backup and integrity verification functions; The data encryption and secure storage submodule is used to provide data encryption technology and secure storage technology, and to ensure the security of data during transmission by establishing an HTTPS connection between the device and the cloud service.

4. The system according to claim 1, characterized in that The interface integration module includes: an interface providing submodule and an interface access management submodule, wherein: The interface provides a submodule, which implements interface design through interface design technology and combines data format and serialization technology to ensure that the data format of the provided interface is unified; The interface provides a submodule, which is also used to handle errors in interface requests and record logs and version management; The interface access management submodule confirms the identity of the user or device through identity authentication technology; The interface access management submodule is further used to define the access rights of the user role according to the user role to ensure that the user can only access authorized resources; The interface access management submodule is also used to assign a unique API key to each application or device for identity authentication and access control, and to protect the confidentiality of data transmitted and stored in the interface through data encryption technology.

5. The system according to claim 1, characterized in that The privacy protection module includes: a data transmission encryption submodule, an identity authentication authorization submodule and a privacy compliance management submodule, wherein: The data transmission encryption submodule implements the data transmission encryption function through transport layer security protocol technology, end-to-end encryption technology, data encryption library tools, message queues and data transmission protocols; The identity authentication and authorization submodule implements the identity authentication and authorization functions through identity authentication, authorization management, multi-factor identity authentication, key management and interface access control; The privacy compliance management submodule is based on the privacy policy and compliance framework, and combines data collection and processing management, data encryption and secure storage, and user rights management technology to achieve privacy compliance management functions.

6. An Internet of Things application method, characterized in that: Applied to the system of claim 1, the method comprises: Get interface interaction instructions; Determine a target function module from preset system modules according to the interface interaction instruction; the preset system modules are the device management module, the data acquisition and storage module, the interface integration module and the privacy protection module; Respond to the interface interaction instruction based on the target function module to execute the task corresponding to the interface interaction instruction.

7. An Internet of Things application device, characterized in that: Applied to the system of claim 1, the device comprises: An acquisition module is used to obtain interface interaction instructions; A determination module, used to determine a target function module from preset system modules according to the interface interaction instruction; the preset system modules are the device management module, the data acquisition and storage module, the interface integration module and the privacy protection module; A response module is used to respond to the interface interaction instruction based on the target function module to execute the task corresponding to the interface interaction instruction.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method described in claim 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method described in claim 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method described in claim 6 are implemented.

Images