Internet of Things gateway data isolation acquisition method and system

Abstract

The invention provides an internet of things gateway data isolation acquisition method and system in the technical field of internet of things, and the method comprises the steps: S1, connecting an intranet communication module and an extranet communication module of an internet of things gateway through a first TTL port and a second TTL port, setting a communication protocol of the first TTL port, and setting a data receiving format of the second TTL port; s2, a configuration setting instruction is obtained through the external network communication module and analyzed to obtain configuration content, and after format conversion is conducted on the configuration content based on the data receiving format, the configuration content is sent to the internal network communication module through a second TTL port; s3, after the intranet communication module executes configuration operation based on the configuration content, Internet of Things data collected by the connected Internet of Things equipment is obtained; s4, the intranet communication module sends the Internet of Things data to an extranet communication module through a first TTL port based on a communication protocol; and S5, the external network communication module encrypts the Internet of Things data into encrypted acquisition data and reports the encrypted acquisition data. The method has the advantage that the security of data acquisition of the Internet of Things is greatly improved.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and in particular to an Internet of Things access data isolation and collection method and system. Background Art

[0002] In the wave of digital transformation, IoT technology has been widely used. With the continuous development of IoT, the collection of IoT data through IoT devices has become one of the key links. However, the IoT data collection process faces many security challenges, which not only affects the privacy and property security of enterprises and individuals, but also has an important impact on the stability and development of the entire society.

[0003] On the one hand, digital transformation has promoted the intelligent upgrade of various industries, and the number of IoT devices has exploded. These IoT devices are distributed in different environments and collect a large amount of sensitive data, such as personal health information, business secrets, etc. On the other hand, the means of network attacks are also constantly evolving, and hackers are increasingly targeting IoT devices, trying to obtain valuable information by attacking the IoT data collection process. Therefore, ensuring the security of IoT data collection has become an important issue that needs to be solved in the process of digital transformation.

[0004] After IoT devices collect IoT data, they need to upload the IoT data through an IoT gateway. However, for traditional IoT gateways, the external network and internal network that report IoT data are directly connected together within the operating system of the IoT gateway, which is equivalent to exposing the entire IoT gateway to the Internet. Although some security measures have been taken, the relevant data is only encrypted through a single encryption algorithm, which still poses a great security risk.

[0005] Therefore, how to provide a method and system for isolating and collecting IoT data to improve the security of IoT data collection has become a technical problem that needs to be solved urgently. Summary of the invention

[0006] The technical problem to be solved by the present invention is to provide a method and system for isolating and collecting data of the Internet of Things, so as to improve the security of data collection of the Internet of Things.

[0007] In a first aspect, the present invention provides a method for isolating and collecting data of an Internet of Things gateway, comprising the following steps:

[0008] Step S1, the intranet communication module and the extranet communication module of the Internet of Things gateway are connected through the first TTL port and the second TTL port respectively, the communication protocol of the first TTL port is set, and the data receiving format of the second TTL port is set;

[0009] Step S2, the IoT gateway obtains the configuration setting instruction through the external network communication module, verifies the configuration setting instruction, parses to obtain the configuration content, converts the configuration content based on the data receiving format, and sends the configuration content to the internal network communication module through the second TTL port;

[0010] Step S3: After the intranet communication module performs configuration operations based on the configuration content, it obtains the IoT data collected by the connected IoT devices;

[0011] Step S4, the intranet communication module sends the IoT data to the external network communication module through the first TTL port based on the communication protocol;

[0012] Step S5: The external network communication module encrypts the received IoT data into encrypted collected data, and reports the encrypted collected data through the TLS protocol.

[0013] Further, in step S1, the first TTL port is used to transmit IoT data, and the IoT data can only be transmitted based on a set communication protocol, and the communication protocol is Modbus RTU protocol;

[0014] The second TTL port is used to transmit configuration content including at least an acquisition register address and a driver type, and the configuration content can only be transmitted based on a set data receiving format.

[0015] Furthermore, the step S2 is specifically as follows:

[0016] The IoT gateway obtains the configuration setting instruction through the external network communication module, parses the configuration setting instruction to obtain ciphertext data, a timestamp and a hash value, wherein the hash value is obtained by performing a hash calculation on the ciphertext data and the timestamp; the ciphertext data is obtained by encrypting the configuration content through the 3DES algorithm and the RC6 algorithm;

[0017] After the integrity of the ciphertext data and the timestamp is checked by the hash value, the timeliness is checked by the timestamp, and then the ciphertext data is decrypted by the 3DES algorithm and the RC6 algorithm to obtain the configuration content;

[0018] After the external network communication module performs format conversion on the configuration content based on the data receiving format, the configuration content is sent to the internal network communication module in real time through the second TTL port.

[0019] Furthermore, the step S3 is specifically as follows:

[0020] After the intranet communication module performs configuration operations based on the configuration content, it acquires the IoT data collected by the connected IoT devices in real time through the Ethernet interface, RS485 interface or RS232 interface.

[0021] Furthermore, the step S5 is specifically as follows:

[0022] The external network communication module creates a pair of public keys and private keys based on the ECDH algorithm, performs HMAC calculation on the received IoT data to obtain a MAC value, encrypts the IoT data and the MAC value by using the private key to obtain primary encrypted data, converts the primary encrypted data into binary, swaps 3 consecutive 1s with 2 consecutive 1s to obtain secondary encrypted data, encrypts the secondary encrypted data by using the AES256 algorithm to obtain tertiary encrypted data; encrypts the public key by using the XTEA algorithm to obtain a primary key, shifts each character of the primary key to the left by 7 bits to obtain a secondary key, encrypts the secondary key by using the IDEA algorithm to obtain a third key, encapsulates the third-level encrypted data and the third-level key into encrypted collection data by using the AES-KW algorithm, and reports the encrypted collection data in real time by using the TLS protocol.

[0023] In a second aspect, the present invention provides an IoT gateway data isolation and collection system, comprising the following modules:

[0024] A TTL port setting module, used for connecting the intranet communication module and the extranet communication module of the IoT gateway through the first TTL port and the second TTL port respectively, setting the communication protocol of the first TTL port, and setting the data receiving format of the second TTL port;

[0025] A configuration setting instruction verification module, used for the IoT gateway to obtain the configuration setting instruction through the external network communication module, to verify the configuration setting instruction, to parse and obtain the configuration content, to convert the format of the configuration content based on the data receiving format, and to send the configuration content to the internal network communication module through the second TTL port;

[0026] An IoT data acquisition module, used to acquire IoT data collected by connected IoT devices after the intranet communication module performs configuration operations based on configuration content;

[0027] An Internet of Things data sending module, used for the intranet communication module to send the Internet of Things data to the external network communication module through the first TTL port based on the communication protocol;

[0028] The Internet of Things data encryption reporting module is used for the external network communication module to encrypt the received Internet of Things data into encrypted collection data, and report the encrypted collection data through the TLS protocol.

[0029] Further, in the TTL port setting module, the first TTL port is used to transmit IoT data, and the IoT data can only be transmitted based on a set communication protocol, and the communication protocol is the Modbus RTU protocol;

[0030] The second TTL port is used to transmit configuration content including at least an acquisition register address and a driver type, and the configuration content can only be transmitted based on a set data receiving format.

[0031] Furthermore, the configuration setting instruction verification module is specifically used to:

[0032] The IoT gateway obtains the configuration setting instruction through the external network communication module, parses the configuration setting instruction to obtain ciphertext data, a timestamp and a hash value, wherein the hash value is obtained by performing a hash calculation on the ciphertext data and the timestamp; the ciphertext data is obtained by encrypting the configuration content through the 3DES algorithm and the RC6 algorithm;

[0033] After the integrity of the ciphertext data and the timestamp is checked by the hash value, the timeliness is checked by the timestamp, and then the ciphertext data is decrypted by the 3DES algorithm and the RC6 algorithm to obtain the configuration content;

[0034] After the external network communication module performs format conversion on the configuration content based on the data receiving format, the configuration content is sent to the internal network communication module in real time through the second TTL port.

[0035] Furthermore, the IoT data acquisition module is specifically used for:

[0036] After the intranet communication module performs configuration operations based on the configuration content, it acquires the IoT data collected by the connected IoT devices in real time through the Ethernet interface, RS485 interface or RS232 interface.

[0037] Furthermore, the IoT data encryption reporting module is specifically used for:

[0038] The external network communication module creates a pair of public keys and private keys based on the ECDH algorithm, performs HMAC calculation on the received IoT data to obtain a MAC value, encrypts the IoT data and the MAC value by using the private key to obtain primary encrypted data, converts the primary encrypted data into binary, swaps 3 consecutive 1s with 2 consecutive 1s to obtain secondary encrypted data, encrypts the secondary encrypted data by using the AES256 algorithm to obtain tertiary encrypted data; encrypts the public key by using the XTEA algorithm to obtain a primary key, shifts each character of the primary key to the left by 7 bits to obtain a secondary key, encrypts the secondary key by using the IDEA algorithm to obtain a third key, encapsulates the third-level encrypted data and the third-level key into encrypted collection data by using the AES-KW algorithm, and reports the encrypted collection data in real time by using the TLS protocol.

[0039] The advantages of the present invention are:

[0040] 1. The intranet communication module and the extranet communication module of the IoT gateway are connected through the first TTL port and the second TTL port respectively, the communication protocol of the first TTL port is set, and the data receiving format of the second TTL port is set; the IoT gateway obtains the configuration setting instruction through the extranet communication module and verifies it, parses it to obtain the configuration content, converts the format of the configuration content based on the data receiving format, and sends the configuration content to the intranet communication module through the second TTL port; after the intranet communication module performs the configuration operation based on the configuration content, it obtains the IoT data collected by the connected IoT device; then the intranet communication module obtains the IoT data collected by the connected IoT device through the first TTL port based on the communication protocol It is proposed to send the IoT data to the external network communication module, the external network communication module encrypts the received IoT data into encrypted collection data, and reports the encrypted collection data through the TLS protocol; that is, the internal network communication module and the external network communication module of the IoT gateway are independent of each other, physically isolated, connected through the first TTL port and the second TTL port, and the first TTL port can only communicate based on the set communication protocol, and the second TTL port only transmits data based on the set data receiving format, and the IoT data reported by the external network communication module is encrypted at multiple levels, and the TLS protocol is a secure transmission protocol, thereby greatly improving the security of IoT data collection.

[0041] 2. The first TTL port is set to transmit IoT data, and IoT data can only be transmitted based on the set communication protocol. The second TTL port is set to transmit configuration content, and the configuration content can only be transmitted based on the set data receiving format. That is, the intranet communication module and the extranet communication module of the IoT gateway can communicate based on the first TTL port of the limited communication protocol, and remote maintenance can be performed through the second TTL port, thereby greatly improving the security and convenience of IoT gateway operation and maintenance.

[0042] 3. By setting the configuration setting instruction to carry ciphertext data, timestamp and hash value, the hash value is obtained by hashing the ciphertext data and timestamp. The ciphertext data is obtained by encrypting the configuration content through the 3DES algorithm and the RC6 algorithm. It not only prevents the configuration content from being stolen in plain text, but also can perform integrity verification based on the hash value and timeliness verification based on the timestamp, thereby greatly improving the security of the configuration content transmission configuration.

[0043] 4. Create a pair of public and private keys through the ECDH algorithm, perform HMAC calculation on the IoT data to obtain the MAC value, encrypt the IoT data and the MAC value through the private key to obtain the first-level encrypted data, convert the first-level encrypted data into binary, swap 3 consecutive 1s with 2 consecutive 1s to obtain the second-level encrypted data, encrypt the second-level encrypted data through the AES256 algorithm to obtain the third-level encrypted data; encrypt the public key through the XTEA algorithm to obtain the first-level key, shift each character of the first-level key to the left by 7 bits to obtain the second-level key, encrypt the second-level key through the IDEA algorithm to obtain the third-level key, and encrypt the second-level key through the AES-KW algorithm. The three-level encrypted data and the three-level key are encapsulated as encrypted collection data, and the encrypted collection data is reported in real time through the TLS protocol; since the data encrypted by the private key can only be decrypted by the public key, and the IoT data is encrypted at multiple levels, the public key is also encrypted at multiple levels, and the TLS protocol is a secure transmission protocol, and the integrity can also be checked through the MAC value. At least 11 security measures are taken before and after (ECDH algorithm, public and private keys, HMAC calculation, data swap, AES256 algorithm, XTEA algorithm, character displacement direction, character displacement amount, IDEA algorithm, AES-KW algorithm, TLS protocol), which greatly improves the security of IoT data reporting. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The present invention will be further described below in conjunction with embodiments with reference to the accompanying drawings.

[0045] Figure 1 It is a flow chart of a method for isolating and collecting data of an Internet of Things gateway of the present invention.

[0046] Figure 2 It is a structural schematic diagram of an Internet of Things gateway data isolation and acquisition system of the present invention. DETAILED DESCRIPTION

[0047] The technical solution in the embodiment of the present application has the following overall idea: the intranet communication module and the extranet communication module of the IoT gateway are independent of each other and physically isolated, connected through the first TTL port and the second TTL port, and the first TTL port can only communicate based on the set communication protocol, and the second TTL port only transmits data based on the set data receiving format, and the IoT data reported by the extranet communication module is encrypted at multiple levels, and the TLS protocol is a secure transmission protocol to improve the security of IoT data collection.

[0048] Please refer to Figure 1 to Figure 2 As shown, a preferred embodiment of a method for isolating and collecting data of an Internet of Things gateway of the present invention comprises the following steps:

[0049] Step S1, the intranet communication module and the extranet communication module of the Internet of Things gateway are connected through the first TTL port and the second TTL port respectively, the communication protocol of the first TTL port is set, and the data receiving format of the second TTL port is set;

[0050] Step S2, the IoT gateway obtains the configuration setting instruction through the external network communication module, verifies the configuration setting instruction, parses to obtain the configuration content, converts the configuration content based on the data receiving format, and sends the configuration content to the internal network communication module through the second TTL port;

[0051] Step S3: After the intranet communication module performs configuration operations based on the configuration content, it obtains the IoT data collected by the connected IoT devices;

[0052] Step S4, the intranet communication module sends the IoT data to the external network communication module through the first TTL port based on the communication protocol;

[0053] Step S5: The external network communication module encrypts the received IoT data into encrypted collected data, and reports the encrypted collected data through the TLS protocol.

[0054] In the step S1, the first TTL port is used to transmit IoT data, and the IoT data can only be transmitted based on a set communication protocol, and the communication protocol is the Modbus RTU protocol;

[0055] The second TTL port is used to transmit configuration content including at least an acquisition register address and a driver type, and the configuration content can only be transmitted based on a set data receiving format.

[0056] The first TTL port is set to transmit IoT data, and the IoT data can only be transmitted based on the set communication protocol. The second TTL port is set to transmit configuration content, and the configuration content can only be transmitted based on the set data receiving format. That is, the intranet communication module and the extranet communication module of the IoT gateway can communicate based on the first TTL port of the limited communication protocol, and remote maintenance can be performed through the second TTL port, thereby greatly improving the security and convenience of IoT gateway operation and maintenance.

[0057] The step S2 is specifically as follows:

[0058] The IoT gateway obtains the configuration setting instruction through the external network communication module, parses the configuration setting instruction to obtain ciphertext data, a timestamp and a hash value, wherein the hash value is obtained by performing a hash calculation on the ciphertext data and the timestamp; the ciphertext data is obtained by encrypting the configuration content through the 3DES algorithm and the RC6 algorithm;

[0059] By setting the configuration setting instruction to carry ciphertext data, timestamp and hash value, the hash value is obtained by hashing the ciphertext data and timestamp, and the ciphertext data is obtained by encrypting the configuration content through the 3DES algorithm and the RC6 algorithm. It not only prevents the configuration content from being stolen in plain text, but also can perform integrity verification based on the hash value and timeliness verification based on the timestamp, thereby greatly improving the security of the configuration content transmission configuration.

[0060] After the integrity of the ciphertext data and the timestamp is checked by the hash value, the timeliness is checked by the timestamp, and then the ciphertext data is decrypted by the 3DES algorithm and the RC6 algorithm to obtain the configuration content;

[0061] After the external network communication module performs format conversion on the configuration content based on the data receiving format, the configuration content is sent to the internal network communication module in real time through the second TTL port.

[0062] The step S3 is specifically as follows:

[0063] After the intranet communication module performs configuration operations based on the configuration content, it acquires the IoT data collected by the connected IoT devices in real time through the Ethernet interface, RS485 interface or RS232 interface.

[0064] The step S5 is specifically as follows:

[0065] The external network communication module creates a pair of public keys and private keys based on the ECDH algorithm, performs HMAC calculation on the received IoT data to obtain a MAC value, encrypts the IoT data and the MAC value by using the private key to obtain primary encrypted data, converts the primary encrypted data into binary, swaps 3 consecutive 1s with 2 consecutive 1s to obtain secondary encrypted data, encrypts the secondary encrypted data by using the AES256 algorithm to obtain tertiary encrypted data; encrypts the public key by using the XTEA algorithm to obtain a primary key, shifts each character of the primary key to the left by 7 bits to obtain a secondary key, encrypts the secondary key by using the IDEA algorithm to obtain a third key, encapsulates the third-level encrypted data and the third-level key into encrypted collection data by using the AES-KW algorithm, and reports the encrypted collection data in real time by using the TLS protocol.

[0066] A pair of public and private keys are created through the ECDH algorithm, and the HMAC calculation is performed on the IoT data to obtain the MAC value. The IoT data and the MAC value are encrypted with the private key to obtain the first-level encrypted data. After the first-level encrypted data is converted to binary, the three consecutive 1s and the two consecutive 1s are swapped to obtain the second-level encrypted data. The second-level encrypted data is encrypted with the AES256 algorithm to obtain the third-level encrypted data. The public key is encrypted with the XTEA algorithm to obtain the first-level key, and each character of the first-level key is shifted to the left by 7 bits to obtain the second-level key. The second-level key is encrypted with the IDEA algorithm to obtain the third-level key, and the AES-KW algorithm is used to convert the first-level encrypted data into binary. The three-level encrypted data and the three-level key encapsulation are encrypted collection data, and the encrypted collection data is reported in real time through the TLS protocol; since the data encrypted by the private key can only be decrypted by the public key, and the IoT data is encrypted at multiple levels, the public key is also encrypted at multiple levels, and the TLS protocol is a secure transmission protocol, and the integrity can also be checked through the MAC value. At least 11 security measures are taken before and after (ECDH algorithm, public and private keys, HMAC calculation, data swap, AES256 algorithm, XTEA algorithm, character displacement direction, character displacement amount, IDEA algorithm, AES-KW algorithm, TLS protocol), which greatly improves the security of IoT data reporting.

[0067] The decryption process of the encrypted collected data is as follows: the encrypted collected data is decapsulated by the AES-KW algorithm to obtain the third-level encrypted data and the third-level key, the third-level encrypted data is decrypted by the AES256 algorithm to obtain the second-level encrypted data, 3 consecutive 1s and 2 consecutive 1s in the second-level encrypted data are swapped, and binary inverse conversion is performed to obtain the first-level encrypted data, the third-level key is decrypted by the IDEA algorithm to obtain the second-level key, each character of the second-level key is shifted right by 7 bits to obtain the first-level key, the first-level key is decrypted by the XTEA algorithm to obtain the public key, the first-level encrypted data is decrypted by the public key to obtain the Internet of Things data and the MAC value, and the Internet of Things data is integrity checked by the MAC value.

[0068] A preferred embodiment of an Internet of Things gateway data isolation and collection system of the present invention includes the following modules:

[0069] A TTL port setting module, used for connecting the intranet communication module and the extranet communication module of the IoT gateway through the first TTL port and the second TTL port respectively, setting the communication protocol of the first TTL port, and setting the data receiving format of the second TTL port;

[0070] A configuration setting instruction verification module, used for the IoT gateway to obtain the configuration setting instruction through the external network communication module, to verify the configuration setting instruction, to parse and obtain the configuration content, to convert the format of the configuration content based on the data receiving format, and to send the configuration content to the internal network communication module through the second TTL port;

[0071] An IoT data acquisition module, used to acquire IoT data collected by connected IoT devices after the intranet communication module performs configuration operations based on configuration content;

[0072] An Internet of Things data sending module, used for the intranet communication module to send the Internet of Things data to the external network communication module through the first TTL port based on the communication protocol;

[0073] The Internet of Things data encryption reporting module is used for the external network communication module to encrypt the received Internet of Things data into encrypted collection data, and report the encrypted collection data through the TLS protocol.

[0074] In the TTL port setting module, the first TTL port is used to transmit IoT data, and the IoT data can only be transmitted based on a set communication protocol, and the communication protocol is the Modbus RTU protocol;

[0075] The second TTL port is used to transmit configuration content including at least an acquisition register address and a driver type, and the configuration content can only be transmitted based on a set data receiving format.

[0076] The first TTL port is set to transmit IoT data, and the IoT data can only be transmitted based on the set communication protocol. The second TTL port is set to transmit configuration content, and the configuration content can only be transmitted based on the set data receiving format. That is, the intranet communication module and the extranet communication module of the IoT gateway can communicate based on the first TTL port of the limited communication protocol, and remote maintenance can be performed through the second TTL port, thereby greatly improving the security and convenience of IoT gateway operation and maintenance.

[0077] The configuration setting instruction verification module is specifically used for:

[0078] The IoT gateway obtains the configuration setting instruction through the external network communication module, parses the configuration setting instruction to obtain ciphertext data, a timestamp and a hash value, wherein the hash value is obtained by performing a hash calculation on the ciphertext data and the timestamp; the ciphertext data is obtained by encrypting the configuration content through the 3DES algorithm and the RC6 algorithm;

[0079] By setting the configuration setting instruction to carry ciphertext data, timestamp and hash value, the hash value is obtained by hashing the ciphertext data and timestamp, and the ciphertext data is obtained by encrypting the configuration content through the 3DES algorithm and the RC6 algorithm. It not only prevents the configuration content from being stolen in plain text, but also can perform integrity verification based on the hash value and timeliness verification based on the timestamp, thereby greatly improving the security of the configuration content transmission configuration.

[0080] After the integrity of the ciphertext data and the timestamp is checked by the hash value, the timeliness is checked by the timestamp, and then the ciphertext data is decrypted by the 3DES algorithm and the RC6 algorithm to obtain the configuration content;

[0081] After the external network communication module performs format conversion on the configuration content based on the data receiving format, the configuration content is sent to the internal network communication module in real time through the second TTL port.

[0082] The Internet of Things data acquisition module is specifically used for:

[0083] After the intranet communication module performs configuration operations based on the configuration content, it acquires the IoT data collected by the connected IoT devices in real time through the Ethernet interface, RS485 interface or RS232 interface.

[0084] The Internet of Things data encryption reporting module is specifically used for:

[0085] The external network communication module creates a pair of public keys and private keys based on the ECDH algorithm, performs HMAC calculation on the received IoT data to obtain a MAC value, encrypts the IoT data and the MAC value by using the private key to obtain primary encrypted data, converts the primary encrypted data into binary, swaps 3 consecutive 1s with 2 consecutive 1s to obtain secondary encrypted data, encrypts the secondary encrypted data by using the AES256 algorithm to obtain tertiary encrypted data; encrypts the public key by using the XTEA algorithm to obtain a primary key, shifts each character of the primary key to the left by 7 bits to obtain a secondary key, encrypts the secondary key by using the IDEA algorithm to obtain a third key, encapsulates the third-level encrypted data and the third-level key into encrypted collection data by using the AES-KW algorithm, and reports the encrypted collection data in real time by using the TLS protocol.

[0086] A pair of public and private keys are created through the ECDH algorithm, and the HMAC calculation is performed on the IoT data to obtain the MAC value. The IoT data and the MAC value are encrypted with the private key to obtain the first-level encrypted data. After the first-level encrypted data is converted to binary, the three consecutive 1s and the two consecutive 1s are swapped to obtain the second-level encrypted data. The second-level encrypted data is encrypted with the AES256 algorithm to obtain the third-level encrypted data. The public key is encrypted with the XTEA algorithm to obtain the first-level key, and each character of the first-level key is shifted to the left by 7 bits to obtain the second-level key. The second-level key is encrypted with the IDEA algorithm to obtain the third-level key, and the AES-KW algorithm is used to convert the first-level encrypted data into binary. The three-level encrypted data and the three-level key encapsulation are encrypted collection data, and the encrypted collection data is reported in real time through the TLS protocol; since the data encrypted by the private key can only be decrypted by the public key, and the IoT data is encrypted at multiple levels, the public key is also encrypted at multiple levels, and the TLS protocol is a secure transmission protocol, and the integrity can also be checked through the MAC value. At least 11 security measures are taken before and after (ECDH algorithm, public and private keys, HMAC calculation, data swap, AES256 algorithm, XTEA algorithm, character displacement direction, character displacement amount, IDEA algorithm, AES-KW algorithm, TLS protocol), which greatly improves the security of IoT data reporting.

[0087] The decryption process of the encrypted collected data is as follows: the encrypted collected data is decapsulated by the AES-KW algorithm to obtain the third-level encrypted data and the third-level key, the third-level encrypted data is decrypted by the AES256 algorithm to obtain the second-level encrypted data, 3 consecutive 1s and 2 consecutive 1s in the second-level encrypted data are swapped, and binary inverse conversion is performed to obtain the first-level encrypted data, the third-level key is decrypted by the IDEA algorithm to obtain the second-level key, each character of the second-level key is shifted right by 7 bits to obtain the first-level key, the first-level key is decrypted by the XTEA algorithm to obtain the public key, the first-level encrypted data is decrypted by the public key to obtain the Internet of Things data and the MAC value, and the Internet of Things data is integrity checked by the MAC value.

[0088] In summary, the advantages of the present invention are:

[0089] 1. The intranet communication module and the extranet communication module of the IoT gateway are connected through the first TTL port and the second TTL port respectively, the communication protocol of the first TTL port is set, and the data receiving format of the second TTL port is set; the IoT gateway obtains the configuration setting instruction through the extranet communication module and verifies it, parses it to obtain the configuration content, converts the format of the configuration content based on the data receiving format, and sends the configuration content to the intranet communication module through the second TTL port; after the intranet communication module performs the configuration operation based on the configuration content, it obtains the IoT data collected by the connected IoT device; then the intranet communication module obtains the IoT data collected by the connected IoT device through the first TTL port based on the communication protocol It is proposed to send the IoT data to the external network communication module, the external network communication module encrypts the received IoT data into encrypted collection data, and reports the encrypted collection data through the TLS protocol; that is, the internal network communication module and the external network communication module of the IoT gateway are independent of each other, physically isolated, connected through the first TTL port and the second TTL port, and the first TTL port can only communicate based on the set communication protocol, and the second TTL port only transmits data based on the set data receiving format, and the IoT data reported by the external network communication module is encrypted at multiple levels, and the TLS protocol is a secure transmission protocol, thereby greatly improving the security of IoT data collection.

[0090] 2. The first TTL port is set to transmit IoT data, and IoT data can only be transmitted based on the set communication protocol. The second TTL port is set to transmit configuration content, and the configuration content can only be transmitted based on the set data receiving format. That is, the intranet communication module and the extranet communication module of the IoT gateway can communicate based on the first TTL port of the limited communication protocol, and remote maintenance can be performed through the second TTL port, thereby greatly improving the security and convenience of IoT gateway operation and maintenance.

[0091] 3. By setting the configuration setting instruction to carry ciphertext data, timestamp and hash value, the hash value is obtained by hashing the ciphertext data and timestamp. The ciphertext data is obtained by encrypting the configuration content through the 3DES algorithm and the RC6 algorithm. It not only prevents the configuration content from being stolen in plain text, but also can perform integrity verification based on the hash value and timeliness verification based on the timestamp, thereby greatly improving the security of the configuration content transmission configuration.

[0092] 4. Create a pair of public and private keys through the ECDH algorithm, perform HMAC calculation on the IoT data to obtain the MAC value, encrypt the IoT data and the MAC value through the private key to obtain the first-level encrypted data, convert the first-level encrypted data into binary, swap 3 consecutive 1s with 2 consecutive 1s to obtain the second-level encrypted data, encrypt the second-level encrypted data through the AES256 algorithm to obtain the third-level encrypted data; encrypt the public key through the XTEA algorithm to obtain the first-level key, shift each character of the first-level key to the left by 7 bits to obtain the second-level key, encrypt the second-level key through the IDEA algorithm to obtain the third-level key, and encrypt the second-level key through the AES-KW algorithm. The three-level encrypted data and the three-level key are encapsulated as encrypted collection data, and the encrypted collection data is reported in real time through the TLS protocol; since the data encrypted by the private key can only be decrypted by the public key, and the IoT data is encrypted at multiple levels, the public key is also encrypted at multiple levels, and the TLS protocol is a secure transmission protocol, and the integrity can also be checked through the MAC value. At least 11 security measures are taken before and after (ECDH algorithm, public and private keys, HMAC calculation, data swap, AES256 algorithm, XTEA algorithm, character displacement direction, character displacement amount, IDEA algorithm, AES-KW algorithm, TLS protocol), which greatly improves the security of IoT data reporting.

[0093] Although the specific implementation modes of the present invention are described above, those skilled in the art should understand that the specific implementation modes described are only illustrative and are not intended to limit the scope of the present invention. Equivalent modifications and changes made by those skilled in the art in accordance with the spirit of the present invention should be included in the scope of protection of the claims of the present invention.

Claims

1. A method for isolating and collecting data of an Internet of Things, characterized in that: The steps include: Step S1, the intranet communication module and the extranet communication module of the Internet of Things gateway are connected through the first TTL port and the second TTL port respectively, the communication protocol of the first TTL port is set, and the data receiving format of the second TTL port is set; Step S2, the IoT gateway obtains the configuration setting instruction through the external network communication module, verifies the configuration setting instruction, parses to obtain the configuration content, converts the configuration content based on the data receiving format, and sends the configuration content to the internal network communication module through the second TTL port; Step S3: After the intranet communication module performs configuration operations based on the configuration content, it obtains the IoT data collected by the connected IoT devices; Step S4, the intranet communication module sends the IoT data to the external network communication module through the first TTL port based on the communication protocol; Step S5: The external network communication module encrypts the received IoT data into encrypted collected data, and reports the encrypted collected data through the TLS protocol.

2. The method for isolating and collecting Internet of Things gateway data as claimed in claim 1, characterized in that: In the step S1, the first TTL port is used to transmit IoT data, and the IoT data can only be transmitted based on a set communication protocol, and the communication protocol is the Modbus RTU protocol; The second TTL port is used to transmit configuration content including at least an acquisition register address and a driver type, and the configuration content can only be transmitted based on a set data receiving format.

3. The method for isolating and collecting data of an Internet of Things according to claim 1, characterized in that: The step S2 is specifically as follows: The IoT gateway obtains the configuration setting instruction through the external network communication module, parses the configuration setting instruction to obtain ciphertext data, a timestamp and a hash value, wherein the hash value is obtained by performing a hash calculation on the ciphertext data and the timestamp; the ciphertext data is obtained by encrypting the configuration content through the 3DES algorithm and the RC6 algorithm; After the integrity of the ciphertext data and the timestamp is checked by the hash value, the timeliness is checked by the timestamp, and then the ciphertext data is decrypted by the 3DES algorithm and the RC6 algorithm to obtain the configuration content; After the external network communication module performs format conversion on the configuration content based on the data receiving format, the configuration content is sent to the internal network communication module in real time through the second TTL port.

4. The method for isolating and collecting data of an Internet of Things according to claim 1, characterized in that: The step S3 is specifically as follows: After the intranet communication module performs configuration operations based on the configuration content, it acquires the IoT data collected by the connected IoT devices in real time through the Ethernet interface, RS485 interface or RS232 interface.

5. The method for isolating and collecting Internet of Things gateway data as claimed in claim 1, characterized in that: The step S5 is specifically as follows: The external network communication module creates a pair of public keys and private keys based on the ECDH algorithm, performs HMAC calculation on the received IoT data to obtain a MAC value, encrypts the IoT data and the MAC value by using the private key to obtain primary encrypted data, converts the primary encrypted data into binary, swaps 3 consecutive 1s with 2 consecutive 1s to obtain secondary encrypted data, encrypts the secondary encrypted data by using the AES256 algorithm to obtain tertiary encrypted data; encrypts the public key by using the XTEA algorithm to obtain a primary key, shifts each character of the primary key to the left by 7 bits to obtain a secondary key, encrypts the secondary key by using the IDEA algorithm to obtain a third key, encapsulates the third-level encrypted data and the third-level key into encrypted collection data by using the AES-KW algorithm, and reports the encrypted collection data in real time by using the TLS protocol.

6. An Internet of Things gateway data isolation and collection system, characterized by: Includes the following modules: A TTL port setting module, used for connecting the intranet communication module and the extranet communication module of the IoT gateway through the first TTL port and the second TTL port respectively, setting the communication protocol of the first TTL port, and setting the data receiving format of the second TTL port; A configuration setting instruction verification module, used for the IoT gateway to obtain the configuration setting instruction through the external network communication module, to verify the configuration setting instruction, to parse and obtain the configuration content, to convert the format of the configuration content based on the data receiving format, and to send the configuration content to the internal network communication module through the second TTL port; An IoT data acquisition module, used to acquire IoT data collected by connected IoT devices after the intranet communication module performs configuration operations based on configuration content; An Internet of Things data sending module, used for the intranet communication module to send the Internet of Things data to the external network communication module through the first TTL port based on the communication protocol; The Internet of Things data encryption reporting module is used for the external network communication module to encrypt the received Internet of Things data into encrypted collection data, and report the encrypted collection data through the TLS protocol.

7. The IoT gateway data isolation and collection system as claimed in claim 6, characterized in that: In the TTL port setting module, the first TTL port is used to transmit IoT data, and the IoT data can only be transmitted based on a set communication protocol, and the communication protocol is the Modbus RTU protocol; The second TTL port is used to transmit configuration content including at least an acquisition register address and a driver type, and the configuration content can only be transmitted based on a set data receiving format.

8. The IoT gateway data isolation and collection system as claimed in claim 6, characterized in that: The configuration setting instruction verification module is specifically used for: The IoT gateway obtains the configuration setting instruction through the external network communication module, parses the configuration setting instruction to obtain ciphertext data, a timestamp and a hash value, wherein the hash value is obtained by performing a hash calculation on the ciphertext data and the timestamp; the ciphertext data is obtained by encrypting the configuration content through the 3DES algorithm and the RC6 algorithm; After the integrity of the ciphertext data and the timestamp is checked by the hash value, the timeliness is checked by the timestamp, and then the ciphertext data is decrypted by the 3DES algorithm and the RC6 algorithm to obtain the configuration content; After the external network communication module performs format conversion on the configuration content based on the data receiving format, the configuration content is sent to the internal network communication module in real time through the second TTL port.

9. The IoT gateway data isolation and collection system as claimed in claim 6, characterized in that: The Internet of Things data acquisition module is specifically used for: After the intranet communication module performs configuration operations based on the configuration content, it acquires the IoT data collected by the connected IoT devices in real time through the Ethernet interface, RS485 interface or RS232 interface.

10. The IoT gateway data isolation and collection system as claimed in claim 6, characterized in that: The Internet of Things data encryption reporting module is specifically used for: The external network communication module creates a pair of public keys and private keys based on the ECDH algorithm, performs HMAC calculation on the received IoT data to obtain a MAC value, encrypts the IoT data and the MAC value by using the private key to obtain primary encrypted data, converts the primary encrypted data into binary, swaps 3 consecutive 1s with 2 consecutive 1s to obtain secondary encrypted data, encrypts the secondary encrypted data by using the AES256 algorithm to obtain tertiary encrypted data; encrypts the public key by using the XTEA algorithm to obtain a primary key, shifts each character of the primary key to the left by 7 bits to obtain a secondary key, encrypts the secondary key by using the IDEA algorithm to obtain a third key, encapsulates the third-level encrypted data and the third-level key into encrypted collection data by using the AES-KW algorithm, and reports the encrypted collection data in real time by using the TLS protocol.

Images