Safety management method of Internet of Things equipment, electronic equipment, medium and product

Abstract

The invention relates to the technical field of safety management, in particular to a safety management method of Internet of Things equipment, electronic equipment, a medium and a product, and the method comprises the steps: obtaining real-time operation data of each piece of Internet of Things equipment in an Internet of Things system; based on preset hidden danger features, whether abnormal operation data exists in all the real-time operation data is judged, and the abnormal operation data is the real-time operation data containing the preset hidden danger features; if yes, determining a hidden danger type corresponding to each piece of abnormal operation data based on a preset hidden danger feature corresponding to each piece of abnormal operation data; and based on each abnormal operation data and the corresponding hidden danger type, triggering an early warning mechanism of the abnormal Internet of Things equipment corresponding to each abnormal operation data. According to the application, the Internet of Things equipment with potential safety hazards can be found in time, and the Internet of Things equipment can be overhauled or maintained in time, so that the influence on other Internet of Things equipment is reduced.

Description

Technical Field

[0001] The present application relates to the field of security management technology, and in particular to a security management method, electronic equipment, medium and product for an Internet of Things device. Background Art

[0002] With the rapid development of IoT technology, IoT devices have been widely used in smart homes, smart cities, industrial automation and other fields, greatly improving the level of intelligence in production and life. However, due to the large number and variety of IoT devices, which are often deployed in complex and changing environments, the widespread use of IoT devices has also brought unprecedented security challenges.

[0003] In related technologies, IoT devices are generally managed securely through regular manual inspections and troubleshooting. However, this manual inspection method is not only inefficient, but also difficult to achieve comprehensive coverage. Once an IoT device in the IoT system fails or is maliciously attacked, it is often difficult to be discovered in time, which may trigger a chain reaction and may affect the stable operation of the entire IoT system. Summary of the invention

[0004] In order to facilitate the timely discovery of IoT devices with potential safety hazards and to promptly inspect or maintain them to reduce the impact on other IoT devices, the present application provides a security management method, electronic device, medium and product for IoT devices.

[0005] In the first aspect, the present application provides a security management method for an IoT device, which adopts the following technical solution: A security management method for an Internet of Things device, comprising: Get real-time operating data of each IoT device in the IoT system; Based on the preset hidden danger features, determine whether there is abnormal operation data in all real-time operation data, where the abnormal operation data is real-time operation data containing the preset hidden danger features; If so, determining the hidden danger type corresponding to each abnormal operation data based on the preset hidden danger feature corresponding to each abnormal operation data; Based on each abnormal operation data and the corresponding hidden danger type, an early warning mechanism for the abnormal IoT device corresponding to each abnormal operation data is triggered.

[0006] By adopting the above technical solution, the operating data of each IoT device is monitored in real time, so as to ensure the timeliness and accuracy of the operating data. In addition, by presetting hidden danger characteristics, it is convenient to automatically identify and judge whether there are hidden dangers in the real-time operating data. This automated identification method can improve the efficiency and accuracy of discovering hidden dangers. Finally, the corresponding early warning mechanism is triggered by abnormal operating data and corresponding hidden danger types, so that relevant management personnel can receive early warning information in time and take corresponding inspection or maintenance measures, so as to avoid the long-term existence of hidden dangers, and then reduce the negative impact of hidden dangers on other IoT devices in the IoT system.

[0007] In a possible implementation, after the abnormal IoT device corresponding to the abnormal operation data is determined, the method further includes: If the maintenance completion instruction is not detected within the preset time period, the abnormal position of the abnormal IoT device is determined from the IoT system, and the affected IoT device corresponding to the abnormal IoT device is determined based on the abnormal position and the preset hidden danger characteristics corresponding to the abnormal operation data; Determine a predicted impact value corresponding to the abnormal IoT device based on the historical operation data and the abnormal operation data; Determine a predicted abnormal impact value of each influencing IoT device based on the association value between each influencing IoT device and the abnormal IoT device and the predicted impact spread value; Based on each predicted abnormal impact value, the corresponding security defense mechanism affecting the IoT device is triggered.

[0008] By adopting the above technical solution, when it is detected that a hidden danger has not been repaired or eliminated in time, by comparing the historical operation data and the abnormal operation data, it is convenient to calculate the predicted impact spread value corresponding to the abnormal IoT device, so as to facilitate the evaluation of the potential impact that the hidden danger may have on the entire IoT system. Combined with the association value and the preset impact spread value between each affected IoT device and the abnormal IoT device, it is convenient to accurately calculate the impact that each affected IoT device may be affected, and then trigger the corresponding defense mechanism based on the predicted degree of impact, so as to effectively reduce the losses caused to the affected IoT devices after the hidden danger breaks out before the hidden danger of the abnormal IoT device breaks out, and to prevent the hidden danger from further spreading.

[0009] In one possible implementation, the method further includes: When it is detected that the IoT system includes a target IoT device, a device model and an original firmware version corresponding to the target IoT device are identified, and the real-time operation data corresponding to the target IoT device includes a preset high-risk vulnerability; Based on the device model and the original firmware version, determine the upgrade firmware version corresponding to the target IoT device, and generate an online upgrade instruction based on the upgrade firmware version; When the original firmware version is upgraded online based on the online upgrade instruction, real-time upgrade data corresponding to the target IoT device is obtained, and the upgrade progress is determined based on the real-time upgrade data; When the upgrade progress is abnormal, the firmware version being upgraded corresponding to the target IoT device is rolled back to the original firmware version.

[0010] By adopting the above technical solution, when a preset high-risk vulnerability is detected, the latest firmware version is automatically downloaded and sent to the affected IoT device to complete a seamless online upgrade without human intervention. Based on the device model and original firmware version of the target IoT device, the accuracy of determining the upgraded firmware version can be improved. During the upgrade process, the real-time upgrade data of the target IoT device is obtained and the upgrade progress is determined, so that the status of the upgrade process can be monitored in real time, so that abnormal situations in the upgrade process can be discovered in time and corresponding measures can be taken to deal with them. If the upgrade progress is abnormal, rolling back to the original firmware version can maximize the protection of the data in the IoT device, thereby reducing the impact of the upgrade abnormality on the device operation.

[0011] In a possible implementation, after determining the upgrade firmware version corresponding to the target IoT device, the method further includes: Obtain incompatible data features of the upgraded firmware version; Based on the incompatible data feature, determining whether the target IoT device contains abnormal software running data, wherein the abnormal software running data contains the incompatible data feature; If yes, the image operation environment configuration is determined based on the abnormal software operation data, and an online upgrade instruction is generated based on the image operation environment configuration and the upgrade firmware.

[0012] By adopting the above technical solution, by analyzing the incompatible data characteristics of the upgraded firmware version, it is easy to clarify which data or software features are no longer supported or conflicting in the new firmware version. By identifying potential conflicts or problems before upgrading, it is helpful to avoid equipment failure, data loss or functional abnormality caused by incompatibility during the firmware upgrade process, thereby reducing the risk in the firmware upgrade process. In addition, after detecting abnormal software running data, the corresponding image running environment configuration is promptly determined, and the firmware is upgraded based on the image running environment configuration, which facilitates the optimization or adjustment of the upgrade process, thereby ensuring that the device can operate normally after the firmware upgrade.

[0013] In a possible implementation, when the preset hidden danger feature is load pressure, the method further includes: Based on a preset load pressure threshold, determining a target load area from the Internet of Things system, wherein a total value of operating load pressures corresponding to each Internet of Things device in the target load area is higher than the preset load pressure threshold; Determine an edge service node from the target load area, and determine a predicted total operating load pressure value and a predicted high pressure period of the target load area based on historical operating data; An additional load value of the edge service node is determined based on the predicted total operating load pressure value, and an additional service instruction is generated based on the additional load value and the predicted high-pressure time period.

[0014] By adopting the above technical solution, the target load area with higher operating load pressure can be accurately identified by presetting the load pressure threshold, and by reasonably adding edge service nodes, the pressure of the target load area can be effectively alleviated, thereby facilitating the improvement of the carrying capacity of the entire Internet of Things system.

[0015] In a possible implementation, the determining of the target load area from the Internet of Things system based on a preset load pressure threshold includes: Based on a preset load pressure threshold, the Internet of Things system is divided into regions to obtain a plurality of divided regions; Identify the number of upper device nodes and the number of lower device nodes of each IoT device in each divided load area, and determine the device type of each IoT device based on the number of upper device nodes and the number of lower device nodes of each IoT device; Based on the device type of each IoT device in each divided load area and the number of preset target device types included, a target load area is determined from all divided load areas.

[0016] By adopting the above technical solution, based on the device type of each IoT device in each divided load area and the number of preset target device types, not only can the influence of IoT devices of different device types in the IoT system be fully considered, but also the importance of IoT devices of preset target device types in load pressure management can be considered. Therefore, based on the device type and the number of preset target device types, when the target load area is accurately determined from multiple divided load areas, the accuracy of the determined target load area is higher.

[0017] In a second aspect, the present application provides an electronic device, which adopts the following technical solution: An electronic device, comprising: at least one processor; Memory; At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute the security management method of the above-mentioned Internet of Things device.

[0018] In a third aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution: A computer-readable storage medium includes: a computer program that can be loaded by a processor and execute the security management method of the Internet of Things device.

[0019] In a fourth aspect, the present application provides a computer program product, which adopts the following technical solution: A computer program product includes a computer program, and when the computer program is executed by a processor, the security management method of the Internet of Things device is implemented.

[0020] In summary, the present application includes at least one of the following beneficial technical effects: By monitoring the operating data of each IoT device in real time, it is easy to ensure the timeliness and accuracy of the operating data. In addition, by pre-setting hidden danger characteristics, it is easy to automatically identify and judge whether there are hidden dangers in the real-time operating data. This automated identification method can improve the efficiency and accuracy of discovering hidden dangers. Finally, the corresponding early warning mechanism is triggered by abnormal operating data and corresponding hidden danger types, so that relevant management personnel can receive early warning information in time and take corresponding inspection or maintenance measures, so as to avoid the long-term existence of hidden dangers, and then reduce the negative impact of hidden dangers on other IoT devices in the IoT system.

[0021] By presetting the load pressure threshold, the target load area with higher operating load pressure can be accurately identified, and by reasonably adding edge service nodes, the pressure in the target load area can be effectively alleviated, thereby improving the carrying capacity of the entire IoT system. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a flowchart of a security management method for an Internet of Things device in an embodiment of the present application; Figure 2 It is a flowchart of determining an additional service instruction in an embodiment of the present application; Figure 3 It is a structural schematic diagram of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0023] The following is combined with Figures 1 to 3 This application is described in further detail.

[0024] After reading this specification, those skilled in the art may make non-creative modifications to this embodiment as needed, but such modifications are protected by patent law as long as they are within the scope of the claims of this application.

[0025] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0026] It should be noted that in the optional embodiments of the present application, the object information and other related data involved, when the embodiments in the present application are applied to specific products or technologies, need to obtain the permission or consent of the object, and the collection, use and processing of the relevant data need to comply with the relevant laws, regulations and standards of the relevant countries and regions. In other words, if the embodiments of the present application involve data related to the object, it needs to be obtained with the authorization and consent of the object, the authorization and consent of the relevant departments, and in compliance with the relevant laws, regulations and standards of the country and region. If personal information is involved in the embodiments, the acquisition of all personal information needs to obtain the consent of the individual. If sensitive information is involved, the separate consent of the information subject needs to be obtained. The embodiments also need to be implemented with the authorization and consent of the object.

[0027] Specifically, the embodiment of the present application provides a security management method for an IoT device, which is executed by an electronic device, which can be a server or a terminal device, wherein the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services. The terminal device can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., but is not limited thereto. The terminal device and the server can be directly or indirectly connected via wired or wireless communication, which is not limited in the embodiment of the present application.

[0028] refer to Figure 1 , Figure 1 : is a flow chart of a security management method for an IoT device in an embodiment of the present application, the method comprising steps S110 to S140, wherein: Step S110: Acquire real-time operation data of each IoT device in the IoT system.

[0029] Specifically, the IoT system includes multiple IoT devices, each of which can communicate with the central cloud. The real-time operation data of the IoT devices include but are not limited to the CPU usage, memory occupancy and network traffic usage of the IoT devices during operation. Among them, by analyzing the CPU usage, it is convenient to understand the processor workload of the IoT device. When the CPU usage is high, it may mean that the IoT device is performing heavier computing tasks, or that some processes are occupying more processor resources; by analyzing the memory usage, it is convenient to understand the performance and response speed of the IoT device. Memory is a key resource for IoT devices to run various applications and services. When the memory usage is high, it may mean that the IoT device runs slowly and may even face the consequence of device crash; by analyzing the network traffic usage, it is convenient to understand the transmission status of the IoT device when transmitting data to other devices.

[0030] The real-time operation data of each IoT device can be obtained from the operation log of the corresponding IoT device, and can also be collected by sensors built into the IoT device and uploaded to the electronic device. The specific acquisition method is not specifically limited in the embodiments of this application.

[0031] Step S120: Based on the preset hidden danger characteristics, determine whether there is abnormal operation data in all the real-time operation data, and the abnormal operation data is the real-time operation data containing the preset hidden danger characteristics.

[0032] Specifically, the preset hidden danger features can be CPU usage hidden dangers, memory occupancy hidden dangers, and network traffic hidden dangers, wherein the CPU usage hidden danger is a CPU usage rate higher than the preset CPU usage rate standard, the memory occupancy hidden danger is a memory occupancy rate higher than the preset memory occupancy rate standard, and the network traffic hidden danger is a network traffic usage higher than the preset traffic standard. The preset CPU usage rate standard, the preset memory occupancy rate standard, and the preset traffic standard can be determined by relevant staff according to historical experimental data and uploaded to the electronic device. The specific standard content is not specifically limited in the embodiment of this application. Based on the preset hidden danger features, the real-time operation data corresponding to each IoT device in the IoT system is monitored for hidden dangers. When any preset hidden danger feature is included in the real-time operation data, the corresponding real-time operation data is determined as abnormal operation data. The abnormal operation data contains at least one preset hidden danger feature, that is, the real-time operation data may contain two or more preset hidden danger features at the same time, that is, a certain IoT device may have high CPU usage and high network traffic usage during operation, two hidden danger problems. Different preset hidden danger features have different data identifiers in the real-time operation data. Therefore, a feature recognition algorithm can be used to determine whether the real-time operation data corresponding to each IoT device contains a preset hidden danger feature. The specific feature recognition algorithm is not specifically limited in the embodiment of this application.

[0033] Step S130: If yes, then determine the hidden danger type corresponding to each abnormal operation data based on the preset hidden danger feature corresponding to each abnormal operation data.

[0034] Specifically, the hidden danger types include malicious damage types and normal damage types, wherein malicious damage can indicate that the IoT device has been subjected to malicious attacks or illegal intrusions during operation, resulting in the appearance of preset hidden danger features in the real-time operation data, while normal damage can indicate that as the IoT device ages or wears out over the service life, the IoT device will appear in the real-time operation data after the preset hidden danger features appear. For any abnormal operation data, when determining the hidden danger type corresponding to the abnormal operation data, it can be determined whether there is a preset malicious damage feature in the abnormal operation data. When the abnormal operation data contains the preset malicious damage feature, the hidden danger type corresponding to the abnormal operation data is the malicious damage type, wherein the preset malicious damage feature can be that the CPU usage rate continues to be high-loaded and has no obvious business logic support, the memory occupancy rate is abnormally high and cannot be released, the network traffic usage surges and is not required by the business, etc.; when the abnormal operation data contains the preset normal damage feature, the hidden danger type corresponding to the abnormal operation data is the normal damage type, wherein the preset normal damage feature can be that the CPU usage rate gradually increases but is accompanied by the aging or load increase of the IoT device, the memory occupancy rate gradually increases with the business growth, and the network traffic usage increases due to business needs, etc. The above method can be used to determine the hidden danger type corresponding to each abnormal operation data.

[0035] Step S140: Based on each abnormal operation data and the corresponding hidden danger type, trigger the early warning mechanism of the abnormal IoT device corresponding to each abnormal operation data.

[0036] Specifically, it is convenient to determine the hidden danger impact level of the corresponding IoT device based on the abnormal operation data, and then trigger the corresponding early warning mechanism based on the hidden danger impact level and hidden danger type. For example, for abnormal operation data with hidden danger type of malicious damage type and high hidden danger impact level, it may be necessary to immediately trigger a high-level early warning. Different hidden danger impact levels and hidden danger types correspond to different early warning mechanisms. The early warning mechanism corresponding to different abnormal operation data can be determined based on the preset mechanism mapping relationship. The preset mechanism mapping relationship is the correspondence between the combination of hidden danger impact level and hidden danger type and the early warning mechanism. The specific content of the preset mechanism mapping relationship is not specifically limited in the embodiments of this application.

[0037] For the embodiments of the present application, by real-time monitoring of the operating data of each IoT device, it is convenient to ensure the timeliness and accuracy of the operating data. In addition, by pre-setting hidden danger characteristics, it is convenient to automatically identify and judge whether there are hidden dangers in the real-time operating data. This automated identification method is convenient to improve the efficiency and accuracy of discovering hidden dangers. Finally, the corresponding early warning mechanism is triggered by abnormal operating data and corresponding hidden danger types, so that relevant management personnel can receive early warning information in time and take corresponding inspection or maintenance measures, thereby facilitating the avoidance of long-term existence of hidden dangers, and further facilitating the reduction of the negative impact of hidden dangers on other IoT devices in the IoT system.

[0038] Furthermore, in order to effectively reduce the losses caused to the IoT devices after the outbreak of hidden dangers, after determining the abnormal IoT devices corresponding to the abnormal operation data, the method provided in the embodiment of the present application also includes: If the maintenance completion instruction is not detected within the preset time period, the abnormal position of the abnormal IoT device is determined from the IoT system, and the affected IoT device corresponding to the abnormal IoT device is determined based on the preset hidden danger characteristics corresponding to the abnormal position and the abnormal operation data; based on the historical operation data and the abnormal operation data, the predicted impact spread value corresponding to the abnormal IoT device is determined.

[0039] Specifically, for any abnormal operation data, the preset time period is a period of time after the corresponding early warning mechanism is triggered based on the abnormal operation data. The duration corresponding to the preset time period can be 3 minutes or 5 minutes. The specific duration is not specifically limited in the embodiment of the present application. If the maintenance completion instruction is not received within the preset time period, the abnormal IoT device corresponding to the abnormal operation data is still in a hidden danger state. At this time, the actual abnormality may not have occurred. However, if the hidden danger is not promptly repaired and eliminated, it is very likely that the hidden danger will cause abnormal operation or even collapse. At this time, it will not only affect the abnormal IoT device, but also may affect other IoT devices in the IoT system. In order to reduce the impact on other IoT devices caused by the actual abnormality of the abnormal IoT device, when it is detected that the abnormal IoT device has not been repaired in time, the affected IoT devices that may be affected can be located from the IoT system. The affected IoT devices are IoT devices that have physical connections, communication protocols or business logic with the abnormal IoT devices. The number of affected IoT devices is not specifically limited in the embodiment of the present application.

[0040] Different abnormal operation data and preset hidden danger characteristics have different degrees of impact on other IoT devices. The content of the early warning mechanism can be determined based on the above embodiments, and the preset impact spread value corresponding to the abnormal IoT device can be determined based on the abnormal operation data and the preset hidden danger characteristics. The predicted impact spread value can also be determined based on the historical operation data. The method of determining the predicted impact spread value is not limited in the embodiments of this application. The predicted impact spread value is the range that may be affected when the abnormal IoT device has an actual abnormality based on the current abnormal operation data. The larger the predicted impact spread value, the larger the corresponding impact range.

[0041] Based on the correlation value and predicted impact spread value between each influencing IoT device and the abnormal IoT device, the predicted abnormal impact value of each influencing IoT device is determined; based on each predicted abnormal impact value, the security defense mechanism of the corresponding influencing IoT device is triggered.

[0042] Specifically, since the influencing IoT device is an IoT device that has a physical connection, communication protocol or business logic with the abnormal IoT device, the degree of association between each influencing IoT device and the abnormal IoT device can be determined based on the physical connection, communication protocol and business logic, and then the degree of association is quantified to obtain the association value. The method of determining the association value between the influencing IoT device and the abnormal IoT device is not specifically limited in the embodiment of the present application. Different association values ​​correspond to different abnormal absorption rates. The abnormal absorption rate corresponding to any association value can be determined based on the preset absorption rate mapping relationship. The specific content of the preset absorption rate mapping relationship is not specifically limited in the embodiment of the present application. Based on the abnormal absorption rate and predicted impact spread value corresponding to each abnormal IoT device, it is convenient to determine the predicted abnormal impact value corresponding to each abnormal IoT device.

[0043] Different predicted abnormal impact values ​​correspond to different security defense mechanisms. By triggering the corresponding security defense mechanism in advance, it is convenient to effectively defend against possible abnormal situations in advance, thereby effectively reducing the losses caused to IoT devices after the outbreak of hidden dangers, and preventing the hidden dangers from further spreading. For example, the isolation area can be determined based on the predicted abnormal impact value, and the data or software in the isolation area can be protected by setting the isolation area.

[0044] Furthermore, in order to reduce the impact of abnormal upgrade on device operation, the method provided in the embodiment of the present application also includes: When it is detected that the IoT system contains a target IoT device, the device model and original firmware version corresponding to the target IoT device are identified, and the real-time operation data corresponding to the target IoT device contains preset high-risk vulnerabilities; based on the device model and the original firmware version, the upgrade firmware version corresponding to the target IoT device is determined, and an online upgrade instruction is generated based on the upgrade firmware version; when the original firmware version is upgraded online based on the online upgrade instruction, the real-time upgrade data corresponding to the target IoT device is obtained, and the upgrade progress is determined based on the real-time upgrade data; when the upgrade progress is abnormal, the firmware version corresponding to the target IoT device that is being upgraded is rolled back to the original firmware version.

[0045] Specifically, the electronic device can communicate with the cloud server, which contains the firmware versions of various IoT devices. When the IoT system is determined to contain preset high-risk vulnerabilities based on the preset security scanning tool, that is, when the IoT system is detected to contain a target IoT device, it will directly query whether there is an available firmware version from the cloud server, and quickly repair possible defects or vulnerabilities in the target IoT device by upgrading the firmware, thereby reducing attacks on the target IoT device by hackers or malicious websites. In addition, many preset high-risk vulnerabilities may also lead to data leakage or tampering. By timely upgrading the firmware version, it is easy to ensure that the security mechanism of the target IoT device is strengthened, thereby protecting the data stored on the target IoT device from unauthorized access or damage.

[0046] The preset high-risk vulnerabilities may be SQL injection vulnerabilities, remote code execution vulnerabilities, cross-site scripting attack vulnerabilities, etc., among which SQL injection vulnerabilities may lead to serious consequences such as data leakage, data tampering, and account privilege escalation; remote code execution vulnerabilities allow attackers to send malicious data or requests to the target IoT device, which may cause the target IoT device to execute unauthorized code, install malware, etc.; cross-site scripting attack vulnerabilities may lead to consequences such as user session hijacking, data leakage, and malicious advertising display using the target IoT device. The specific preset high-risk vulnerabilities are not specifically limited in the embodiments of the present application.

[0047] After detecting the target IoT device with a preset high-risk vulnerability, it is necessary to select the upgrade firmware version from the cloud server according to the device model and original firmware version of the target IoT device. Assuming there is a target IoT device with a device model of XYZ123 and an original firmware version of V1.0.0, the latest firmware version V2.0.0 compatible with V1.0.0 can be determined in the cloud server based on the device model, and then an online upgrade instruction is generated based on V2.0.0. The online upgrade instruction is used to upgrade the firmware of the target IoT device. During the firmware upgrade process, the real-time upgrade data of the target IoT device can be recorded and analyzed to monitor whether there are abnormalities in the upgrade process. The real-time upgrade data contains the upgrade progress of each program in the target IoT device. When the upgrade progress is abnormal, the target IoT device may be unable to run or directly crash. Therefore, when an upgrade abnormality occurs, the firmware upgrade operation can be directly stopped and rolled back to the original firmware version. Although the preset high-risk vulnerability in the target IoT device cannot be eliminated after rolling back to the original firmware version, it can ensure that the target IoT device will not deteriorate further, thereby facilitating the maximum protection of the data in the target IoT device.

[0048] Further, after determining the upgrade firmware version corresponding to the target IoT device, the method provided in the embodiment of the present application further includes: Obtain incompatible data features of the upgraded firmware version; based on the incompatible data features, determine whether the target IoT device contains abnormal software running data, and the abnormal software running data contains incompatible data features; if so, determine the image running environment configuration based on the abnormal software running data, and generate online upgrade instructions based on the image running environment configuration and the upgraded firmware.

[0049] Specifically, since the firmware version upgrade may involve the update of the underlying hardware driver, operating system kernel or middleware and other components, these changes may cause the software that was previously compatible with the old firmware version to be unable to run normally on the new firmware version. Therefore, after determining the upgraded firmware version corresponding to the target IoT device, the firmware upgrade is not directly based on the upgraded firmware version. Instead, it is necessary to first determine whether there is abnormal software running data in the target IoT device based on the incompatible data characteristics of the upgraded firmware version.

[0050] Incompatible data features can be obtained from the update instructions of the upgraded firmware version, historical firmware upgrade records or historical experimental data. Incompatible data features include but are not limited to file format changes, communication protocol upgrades, data interface adjustments, etc. For example, the communication protocol used in the original firmware version is a, and the communication protocol corresponding to the upgraded firmware version is upgraded to a+. At this time, the operation data generated by the software or components that cannot use the communication protocol a+ can be called abnormal software operation data. Abnormal software operation data can include file formats, communication protocols, data interfaces, etc. in the historical operation process. By analyzing the incompatible data features of the upgraded firmware version, it is easy to clarify which data or software features are no longer supported or conflicting in the new firmware version. By identifying potential conflicts or problems before upgrading, it is helpful to avoid equipment failures, data loss or functional abnormalities caused by incompatibility during the firmware upgrade process, thereby reducing the risks during the firmware upgrade process. The mirror operation environment is a virtual operation environment suitable for abnormal software. After detecting the abnormal software operation data, the corresponding mirror operation environment configuration is promptly determined, and the firmware is upgraded based on the mirror operation environment configuration, which is convenient for optimizing or adjusting the upgrade process, thereby ensuring that the target IoT device can operate normally after the firmware upgrade.

[0051] Further, in order to improve the carrying capacity of the entire Internet of Things system, when the preset hidden danger feature is load pressure, the method provided in the embodiment of the present application further includes steps S210 to S230, such as Figure 2 As shown, where: Step S210: Based on a preset load pressure threshold, a target load area is determined from the Internet of Things system, and the total operating load pressure corresponding to each Internet of Things device in the target load area is higher than the preset load pressure threshold.

[0052] Specifically, the target load area includes at least one IoT device. By analyzing the operating loads of each IoT device and summing the operating loads of each IoT device, the target load area can be determined from the IoT system. In addition to considering the operating loads of each IoT device, the device type of each IoT device also needs to be considered. Based on a preset load pressure threshold, determining the target load area from the IoT system can specifically include: Based on a preset load pressure threshold, the Internet of Things system is divided into regions to obtain multiple divided regions; the number of upper device nodes and the number of lower device nodes of each Internet of Things device in each divided load region are identified, and the device type of each Internet of Things device is determined based on the number of upper device nodes and the number of lower device nodes of each Internet of Things device; based on the device type of each Internet of Things device in each divided load region and the number of preset target device types, a target load region is determined from all divided load regions.

[0053] Specifically, the IoT system can be preliminarily divided into regions based on the operating load of each IoT device in the IoT system to obtain multiple initial divided regions, each of which contains at least one IoT device, and different initial divided regions may contain the same IoT device. The sum of the operating loads of each IoT device in each initial divided region is then calculated, and the initial divided region whose sum of operating loads is higher than a preset load pressure threshold is determined as the final divided region.

[0054] After the divided areas are determined, not every divided area can be used as the target load area. Instead, the number of upper device nodes and the number of lower device nodes of each target IoT device need to be determined from the divided areas, and then the device type of each IoT device in the divided areas is determined based on the number of upper device nodes and the number of lower device nodes of each target IoT device. The upper device nodes and the lower device nodes of each IoT device can be determined based on the communication data between IoT devices. For any IoT device, when the number of upper device nodes of the IoT device is greater than the number of lower device nodes, the device type of the IoT device can be determined to be the first type; when the number of upper device nodes of the IoT device is not greater than the number of lower device nodes, the device type of the IoT device can be determined to be the second type.

[0055] The target device type can be determined as the second type, and the device type ratio is determined according to the device type of each IoT device in the divided area. The divided area where the device type ratio is lower than the preset ratio threshold and the number of IoT devices containing the target device type is higher than the preset device threshold is determined as the target load area, wherein the specific preset ratio threshold and the preset device threshold are not specifically limited in the embodiment of the present application, and can be determined by relevant staff based on historical experimental data and uploaded to the electronic device. Based on the device type of each IoT device in each divided load area and the number of preset target device types, not only can the influence of IoT devices of different device types in the IoT system be fully considered, but also the importance of IoT devices of preset target device types in load pressure management can be considered. Therefore, based on the device type and the number of preset target device types, when the target load area is accurately determined from multiple divided load areas, the accuracy of the determined target load area is high.

[0056] Step S220: determine the edge service node from the target load area, and determine the predicted total operating load pressure value and the predicted high pressure period of the target load area based on the historical operating data.

[0057] Step S230: Determine the additional load value of the edge service node based on the predicted total operating load pressure value, and generate an additional service instruction based on the additional load value and the predicted high-pressure period.

[0058] Specifically, the edge service node can be randomly determined from a certain area in the target load area, or one can be selected from multiple IoT devices in the target load area as the target edge IoT device according to the number of lower-level device nodes, and then the edge service node can be determined based on the target IoT device. For example, IoT device a in the target load area contains 3 lower-level device nodes, IoT device b contains 4 lower-level device nodes, and IoT device c contains 2 lower-level device nodes. At this time, IoT device a can be determined as the target edge IoT device, and the target edge IoT device can be directly determined as the edge service node. The edge service node can also be determined from a certain area in the surrounding area of ​​the target edge IoT device. The method of determining the edge service node from the target load area is not specifically limited in the embodiment of the present application. By adding an edge service node to process part of the data processing business in the target load area nearby, it is convenient to reduce the operating load in the target load area, thereby facilitating the improvement of the transmission delay of IoT devices in the target load area.

[0059] The historical operation data includes the historical operation load of each IoT device in the target load area during the historical time period. The load trend is obtained by curve fitting of the historical operation data. The predicted total operation load pressure and the predicted high-pressure period in a certain period of time in the future are estimated based on the fitted load trend. The total operation load pressure of all IoT devices at each moment corresponding to the predicted high-pressure period is higher than the total pressure at the preset moment. The number of predicted high-pressure periods can be 1 or more. The specific number is not specifically limited in the embodiment of the present application. The specific total pressure at the preset moment is not specifically limited in the embodiment of the present application, and can be determined by relevant staff according to historical experimental data and uploaded to the electronic device. The prediction results make it easy to accurately understand which areas or devices need higher data processing and transmission capabilities when, so as to facilitate the targeted addition of edge nodes, ensure that data processing or transmission resources can be allocated on demand, and avoid waste of resources.

[0060] An electronic device is provided in an embodiment of the present application, such as Figure 3 As shown, Figure 3 The electronic device 300 shown includes: a processor 301 and a memory 303. The processor 301 and the memory 303 are connected, such as through a bus 302. Optionally, the electronic device 300 may also include a transceiver 304. It should be noted that in actual applications, the transceiver 304 is not limited to one, and the structure of the electronic device 300 does not constitute a limitation on the embodiments of the present application.

[0061] The processor 301 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor 301 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0062] The bus 302 may include a path to transmit information between the above components. The bus 302 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 302 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 The fact that only one line is used in the diagram does not mean that there is only one bus or only one type of bus.

[0063] The memory 303 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0064] The memory 303 is used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 301. The processor 301 is used to execute the application code stored in the memory 303 to implement the contents shown in the above method embodiment.

[0065] The electronic devices include, but are not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), and fixed terminals such as digital TVs, desktop computers, etc. It can also be a server, etc. Figure 3 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0066] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer can execute the corresponding content in the aforementioned method embodiment.

[0067] The embodiment of the present application provides a computer program product, which includes a computer program, and the computer program implements the method in any of the above embodiments when executed by a processor. Compared with the related art, the embodiment of the present application monitors the operation data of each IoT device in real time, so as to ensure the timeliness and accuracy of the operation data. In addition, by presetting the hidden danger characteristics, it is convenient to automatically identify and judge whether there are hidden dangers in the real-time operation data. This automated identification method is convenient to improve the efficiency and accuracy of discovering hidden dangers. Finally, the corresponding early warning mechanism is triggered by abnormal operation data and corresponding hidden danger types, so that relevant management personnel can receive early warning information in time and take corresponding inspection or maintenance measures, so as to avoid the long-term existence of hidden dangers, and then reduce the negative impact of hidden dangers on other IoT devices in the IoT system.

[0068] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0069] The above description is only a partial implementation method of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A security management method for an Internet of Things device, characterized in that: include: Get real-time operating data of each IoT device in the IoT system; Based on the preset hidden danger features, determine whether there is abnormal operation data in all real-time operation data, where the abnormal operation data is real-time operation data containing the preset hidden danger features; If so, determining the hidden danger type corresponding to each abnormal operation data based on the preset hidden danger feature corresponding to each abnormal operation data; Based on each abnormal operation data and the corresponding hidden danger type, an early warning mechanism for the abnormal IoT device corresponding to each abnormal operation data is triggered.

2. A security management method for an Internet of Things device according to claim 1, characterized in that: After determining the abnormal IoT device corresponding to the abnormal operation data, it also includes: If the maintenance completion instruction is not detected within the preset time period, the abnormal position of the abnormal IoT device is determined from the IoT system, and the affected IoT device corresponding to the abnormal IoT device is determined based on the abnormal position and the preset hidden danger characteristics corresponding to the abnormal operation data; Determine a predicted impact value corresponding to the abnormal IoT device based on the historical operation data and the abnormal operation data; Determine a predicted abnormal impact value of each influencing IoT device based on the association value between each influencing IoT device and the abnormal IoT device and the predicted impact spread value; Based on each predicted abnormal impact value, the corresponding security defense mechanism affecting the IoT device is triggered.

3. The security management method of an Internet of Things device according to claim 1, characterized in that: Also includes: When it is detected that the IoT system includes a target IoT device, a device model and an original firmware version corresponding to the target IoT device are identified, and the real-time operation data corresponding to the target IoT device includes a preset high-risk vulnerability; Based on the device model and the original firmware version, determine the upgrade firmware version corresponding to the target IoT device, and generate an online upgrade instruction based on the upgrade firmware version; When the original firmware version is upgraded online based on the online upgrade instruction, real-time upgrade data corresponding to the target IoT device is obtained, and the upgrade progress is determined based on the real-time upgrade data; When the upgrade progress is abnormal, the firmware version being upgraded corresponding to the target IoT device is rolled back to the original firmware version.

4. A security management method for an Internet of Things device according to claim 3, characterized in that: After determining the upgrade firmware version corresponding to the target IoT device, the method further includes: Obtain incompatible data features of the upgraded firmware version; Based on the incompatible data feature, determining whether the target IoT device contains abnormal software running data, wherein the abnormal software running data contains the incompatible data feature; If yes, the image operation environment configuration is determined based on the abnormal software operation data, and an online upgrade instruction is generated based on the image operation environment configuration and the upgrade firmware.

5. The security management method of an Internet of Things device according to claim 1, characterized in that: When the preset hidden danger feature is load pressure, it also includes: Based on a preset load pressure threshold, determining a target load area from the Internet of Things system, wherein a total value of operating load pressures corresponding to each Internet of Things device in the target load area is higher than the preset load pressure threshold; Determine an edge service node from the target load area, and determine a predicted total operating load pressure value and a predicted high pressure period of the target load area based on historical operating data; An additional load value of the edge service node is determined based on the predicted total operating load pressure value, and an additional service instruction is generated based on the additional load value and the predicted high-pressure time period.

6. A security management method for an Internet of Things device according to claim 5, characterized in that: The determining of the target load area from the Internet of Things system based on the preset load pressure threshold comprises: Based on a preset load pressure threshold, the Internet of Things system is divided into regions to obtain a plurality of divided regions; Identify the number of upper device nodes and the number of lower device nodes of each IoT device in each divided load area, and determine the device type of each IoT device based on the number of upper device nodes and the number of lower device nodes of each IoT device; Based on the device type of each IoT device in each divided load area and the number of preset target device types included, a target load area is determined from all divided load areas.

7. An electronic device, characterized in that: The electronic device includes: at least one processor; Memory; At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute a security management method for an Internet of Things device according to any one of claims 1-6.

8. A computer-readable storage medium, characterized in that: include: A computer program is stored which can be loaded by a processor and executes a security management method for an Internet of Things device as described in any one of claims 1 to 6.

9. A computer program product, characterized in that It includes a computer program, which, when executed by a processor, implements the steps of a security management method for an Internet of Things device according to any one of claims 1 to 6.

Images