Internet of Things equipment security access method based on mobile communication network

Abstract

The invention relates to the technical field of Internet of Things terminals, and discloses an Internet of Things equipment security access method based on a mobile communication network, which specifically comprises the steps of Internet of Things equipment identity authentication, Internet of Things equipment permission setting, encryption of data transmitted by Internet of Things equipment, and encryption of the process of data transmission of the Internet of Things equipment. A data backup and recovery system is established through a safety auditing system and auditing log management of the system, and the operation state, network communication quality and the like of the Internet of Things equipment are monitored and analyzed in real time through a performance monitoring system and then optimized. The method can enhance the security of equipment identity authentication, improve the confidentiality and integrity of data transmission, reduce the security risk and vulnerability utilization, improve the flexibility and expandability of the system, enhance the defense capability and emergency response speed of the system, and improve the user experience and data reliability. And the security and the reliability of the Internet of Things equipment when the Internet of Things equipment accesses the mobile communication network are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things terminals, and in particular to a method for securely accessing Internet of Things devices based on a mobile communication network. Background Art

[0002] With the rapid development of Internet of Things (IoT) technology, more and more IoT devices are connected to mobile communication networks, realizing the interconnection and intelligent management of devices. These IoT devices are widely used in smart homes, smart cities, industrial automation, telemedicine and other fields, greatly improving social production efficiency and people's quality of life.

[0003] In the process of IoT devices accessing mobile communication networks, secure access becomes a crucial issue. Since IoT devices are large in number and variety, and are often deployed in unattended environments, they are vulnerable to various network attacks and threats. Therefore, how to ensure the security of IoT devices when accessing mobile communication networks and prevent security incidents such as data leakage, illegal access and malicious control has become a key issue that needs to be solved in the development and application of IoT technology. Summary of the invention

[0004] In order to solve the above problems, the present invention ensures the security and reliability of IoT devices when accessing mobile communication networks from multiple levels, including device identity authentication, data protection, authority management, encrypted communication, security protection, audit logs, data backup and recovery, and performance monitoring. The present invention provides a method for secure access of IoT devices based on mobile communication networks, which specifically includes the following steps:

[0005] S1. IoT device identity authentication, matching the corresponding identity authentication identifier for each IoT device, including assigning a unique identifier to each IoT device, performing key management, and establishing an encrypted communication connection through the identity authentication protocol;

[0006] S2. IoT device permission setting: matching corresponding access rights for each IoT device, assigning different access rights and operation scopes to each IoT device through fine-grained permission management and role definition, and dynamically adjusting device permissions;

[0007] S3. Encrypt the data transmitted by IoT devices. Encrypt the data stored in IoT devices or the cloud through encryption algorithms, and change the keys regularly.

[0008] S4. Encrypt the data transmission process of IoT devices, use secure communication protocols to encrypt the communication between IoT devices, and perform end-to-end encryption on sensitive data;

[0009] S5, anomaly detection based on communication traffic and historical data through deep learning models;

[0010] S6. Record all security-related operations, including device access, permission changes, data access, etc., through the built-in audit log record management system, and regularly analyze and review the audit logs to identify abnormal behavior patterns;

[0011] S7. Establish a data backup and recovery system, and use the performance monitoring system to monitor the operating status of IoT devices, network communication quality, etc. in real time, and optimize after analysis.

[0012] Furthermore, the S1 specifically includes: assigning a unique identifier including a MAC address, serial number, etc. to each IoT device for device identification, presetting a unique device key for each device when it leaves the factory for secure communication with the platform or server, generating a pair of dynamic keys through a key exchange protocol when the device accesses the network, which are used to encrypt and decrypt communication data, and using the transport layer security protocol TLS or the secure socket layer protocol SSL to establish an encrypted communication connection to ensure the identity authentication and data transmission security of the device when it accesses the network.

[0013] Furthermore, the key management in S1 specifically includes the following steps:

[0014] S11. Generate a key in a trusted secure environment;

[0015] S12. Use distributed key distribution to distribute keys through encrypted communication channels TLS / SSL, register the public key of the IoT device to the IoT platform or key management center, and perform identity authentication and permission control;

[0016] S13. Use a secure chip or hardware security module HSM to store critical keys. Use a strong encryption algorithm to encrypt and store keys stored in non-secure hardware.

[0017] S14. Implement strict access control policies to limit access to keys;

[0018] S15. Set the key update cycle to realize automatic key update, revoke the relevant keys when the device is lost, stolen or the keys are leaked, and properly manage the revoked or expired keys;

[0019] S16. When establishing encrypted communication between IoT devices or between IoT devices and a server, use a key for encryption and decryption;

[0020] S17. Record key operations such as key generation, distribution, storage, use and destruction through audit logs, and review and analyze audit logs regularly.

[0021] Furthermore, S2 specifically includes: the fine-grained permission management is to assign different access rights and operation scopes to the device according to the type, purpose and user of the device. The roles and permissions specifically define different roles, including administrators, ordinary users, etc., and assign corresponding permissions to each role. The access rights and operation scope of the device are dynamically adjusted according to changes in business needs and security policies.

[0022] Furthermore, the S3 specifically includes: the encryption algorithm is a national secret algorithm, specifically the SM4 national secret algorithm.

[0023] Furthermore, the S4 specifically includes: the secure communication protocol specifically: using security protocols such as TLS / SSL to encrypt communications between IoT devices, implementing encryption and authentication through the IPSec protocol at the IP layer, and for devices that require remote access, using VPDN+SDP single packet authorization to transmit data through an end-to-end dedicated encrypted tunnel.

[0024] Furthermore, the S5 specifically includes the following steps:

[0025] S51, collecting communication traffic data and related historical data, including network traffic records in different time periods, user behavior data, network configuration parameters, etc.;

[0026] S52, cleaning the collected data to remove outliers, missing values ​​and duplicate data;

[0027] S53, perform data normalization to convert data of different scales into a unified scale to facilitate model training;

[0028] S54, extracting features related to traffic prediction and anomaly detection, such as historical traffic, timestamp, user activity, etc.;

[0029] S55. Using a convolutional neural network model, the convolutional layer, pooling layer and fully connected layer are designed to extract and classify the features in the traffic data and mark them. The marked data forms a database.

[0030] S56, using the labeled database to train the convolutional neural network model to obtain a prediction error and a probability value of the convolutional neural network model;

[0031] S57. The trained deep learning model predicts and analyzes new communication traffic data. If the prediction error of a certain data exceeds the set threshold or its probability value is low, it is considered an anomaly.

[0032] Furthermore, the S7 specifically includes: through the performance monitoring system, real-time monitoring of the operating status of the Internet of Things devices, network communication quality, etc., analysis and optimization to improve the data transmission speed and processing efficiency, and regular performance evaluation and optimization adjustment of the Internet of Things devices.

[0033] The beneficial effects of the present invention are:

[0034] 1. Enhance the security of device authentication

[0035] Uniqueness guarantee: By assigning a unique identity (such as serial number, MAC address, etc.) to each IoT device, the authenticity and uniqueness of the device's identity are ensured to prevent illegal devices from accessing the network.

[0036] Key management: Use key exchange protocols to generate dynamic keys to achieve secure communication between devices and platforms or servers, preventing keys from being stolen or cracked.

[0037] 2. Improve the confidentiality and integrity of data transmission

[0038] Encrypted transmission: Use transport layer security protocols (such as TLS / SSL) to encrypt communications between IoT devices to ensure confidentiality during data transmission and prevent data from being eavesdropped or leaked.

[0039] 3. Reduce security risks and vulnerability exploits

[0040] Permission control: Through fine-grained permission management, different access rights and operation scopes are assigned to different devices or users to implement the principle of least privilege and reduce security risks. Establish a complete device software update mechanism to install the latest security patches and updates for IoT devices in a timely manner, fix known vulnerabilities, and reduce the risk of being attacked.

[0041] 4. Improve system flexibility and scalability

[0042] Dynamic management: Supports dynamic adjustment of device access rights and operating scope, and flexible configuration based on changes in business needs and security policies.

[0043] Strong compatibility: supports various types of IoT devices and different communication protocols, with good compatibility and scalability.

[0044] 5. Improve user experience and data reliability

[0045] Seamless access: Provides a simple and convenient access method, allowing users to easily connect IoT devices to the network and enjoy smart services.

[0046] Data backup and recovery: Establish a data backup and recovery system to ensure rapid recovery when data is lost or damaged, and improve data reliability and availability.

[0047] The present invention ensures the security and reliability of IoT devices when accessing mobile communication networks from multiple levels, including device identity authentication, data protection, authority management, encrypted communication, security protection, audit logs, data backup and recovery, and performance monitoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 The present invention is a flow chart of a method for secure access of IoT devices based on a mobile communication network. DETAILED DESCRIPTION

[0049] The following is combined with Figure 1 The preferred embodiments of the present invention are described in detail so that the advantages and features of the present invention can be more easily understood by those skilled in the art, thereby making a clearer and more definite definition of the protection scope of the present invention.

[0050] The present invention provides a method for secure access of an Internet of Things device based on a mobile communication network, which specifically comprises the following steps:

[0051] S1. IoT device identity authentication, matching the corresponding identity authentication identifier for each IoT device, including assigning a unique identifier to each IoT device, and performing key management, establishing an encrypted communication connection through an identity authentication protocol; ensuring that only authorized IoT devices can access the system to prevent unauthorized access.

[0052] Each IoT device is assigned a unique identifier including MAC address, serial number, etc., for device identification. Each device is preset with a unique device key when it leaves the factory for secure communication with the platform or server to ensure the confidentiality of data transmission. When the device accesses the network, a pair of dynamic keys is generated through the key exchange protocol to encrypt and decrypt communication data. The transport layer security protocol TLS or the secure socket layer protocol SSL is used to establish an encrypted communication connection to ensure the identity authentication and data transmission security of the device when it accesses the network, and to ensure the authenticity of the device's identity and the security of communication when it accesses the network.

[0053] The key management in S1 specifically includes the following steps:

[0054] S11. Generate a key in a trusted secure environment;

[0055] S12. Use distributed key distribution to distribute keys through encrypted communication channels TLS / SSL, register the public key of the IoT device to the IoT platform or key management center, and perform identity authentication and permission control;

[0056] S13. Use a secure chip or hardware security module HSM to store critical keys. Use a strong encryption algorithm to encrypt and store keys stored in non-secure hardware.

[0057] S14. Implement strict access control policies to limit access to keys;

[0058] S15. Set the key update cycle to realize automatic key update, revoke the relevant keys when the device is lost, stolen or the keys are leaked, and properly manage the revoked or expired keys;

[0059] S16. When establishing encrypted communication between IoT devices or between IoT devices and a server, use a key for encryption and decryption;

[0060] S17. Record key operations such as key generation, distribution, storage, use and destruction through audit logs, and review and analyze audit logs regularly.

[0061] Pre-set device keys and dynamic key exchange protocols such as TLS / SSL ensure the communication security of devices when accessing the network. TLS / SSL not only provides data encryption, but also verifies the identity of both parties to prevent man-in-the-middle attacks.

[0062] Specific: Algorithm selection for key generation: According to the security requirements and performance limitations of IoT devices, select a suitable encryption algorithm to generate keys. According to encryption requirements, select a suitable national secret algorithm. Commonly used national secret algorithms include: SM2: Asymmetric encryption algorithm, based on elliptic curve cryptography (ECC), suitable for digital signatures, key exchange and other scenarios. SM3: Cryptographic hash algorithm, used to generate data summaries to ensure data integrity and authenticity. SM4: Symmetric encryption algorithm, similar to AES, suitable for encryption and decryption of large amounts of data. Generate the corresponding key according to the selected national secret algorithm.

[0063] Key distribution uses secure channels: distribute keys through encrypted communication channels (such as TLS / SSL) to ensure the security of keys during transmission. Registration and verification: register the public key of the device to the IoT platform or key management center, and perform identity authentication and permission control. Only authorized devices can obtain the corresponding keys. Distributed distribution: For large-scale IoT systems, a distributed key distribution solution is adopted to improve distribution efficiency and security.

[0064] Then the key storage is carried out. The first is hardware-level protection: for critical keys, a secure chip or hardware security module (HSM) should be used for storage to provide physical-level protection. It also includes encrypted storage: for keys stored in non-secure hardware, a strong encryption algorithm should be used for encrypted storage to ensure that even if the device is compromised, the key will not be easily leaked. Access control: Implement strict access control policies to limit access rights to keys and ensure that only authorized personnel or systems can access the keys.

[0065] Key update and revocation: Specific keys need to be updated regularly: According to security policies and business needs, set the key update cycle and implement an automated key update mechanism. This helps prevent long-term keys from being cracked or leaked. Key revocation: When a device is lost, stolen, or a key is leaked, the relevant keys can be quickly revoked. At the same time, an effective notification mechanism is established to promptly notify all relevant parties of key revocation information. Historical key management: Properly manage revoked or expired keys to ensure that they are not misused or leaked.

[0066] Conduct key usage and auditing, encrypted communication: When establishing encrypted communication between devices or between devices and servers, use keys for encryption and decryption to ensure the security of the communication content. Signature verification: Use private keys to digitally sign to verify the integrity of the message and the authenticity of the source. At the same time, use public keys to verify the signature to ensure the validity of the signature. Security audit: Record key operations such as key generation, distribution, storage, use and destruction to form a complete audit log. Regularly review and analyze audit logs to promptly identify potential security threats and vulnerabilities.

[0067] Distributed key management schemes are used to improve the robustness and scalability of the system: Specifically, key sharding: split the key into multiple fragments and store them in multiple nodes. Secret sharing: use secret sharing technology (such as Shamir secret sharing) to ensure that even if some nodes are compromised, the key will not be leaked. Distributed consensus: use distributed consensus algorithms (such as Paxos, Raft, etc.) to ensure the consistency and reliability of key management.

[0068] S2. IoT device permission settings: limit the scope of access and operation according to the function and role of the device to prevent unauthorized operation. Match the corresponding access rights for each IoT device, assign different access rights and operation scopes to each IoT device through fine-grained permission management and role definition, and dynamically adjust the device permissions; fine-grained permission management is to assign different access rights and operation scopes to devices according to the type, purpose and user of the device, and assign specific operation permissions to each device, such as read, write, execute, etc., to ensure the principle of minimization of permissions, that is, each device or user only obtains the minimum permissions required to complete its tasks. Roles and permissions specifically define different roles, including administrators, ordinary users, etc., and assign corresponding permissions to each role. Different roles are defined according to the function and purpose of the device, and corresponding permission sets are assigned to each role. The access rights and operation scope of the device are also dynamically adjusted according to changes in business needs and security policies.

[0069] S3. Encrypt data transmitted by IoT devices to protect data stored in IoT devices or the cloud from unauthorized access or tampering. Encrypt data stored in IoT devices or the cloud using national secret encryption algorithms and change keys regularly.

[0070] S4. Encrypt the data transmission process of IoT devices, use secure communication protocols to encrypt the communication between IoT devices, and perform end-to-end encryption on sensitive data; specific secure communication protocols: use secure protocols such as TLS / SSL to encrypt the communication between IoT devices, implement encryption and authentication through the IPSec protocol at the IP layer, and for devices that require remote access, use VPDN+SDP single packet authorization to transmit data through an end-to-end dedicated encrypted tunnel. Ensure the confidentiality and integrity of data during transmission. TLS / SSL is used at the transport layer and IPSec is used at the network layer. VPDN is a technology that allows users to establish encrypted, point-to-point virtual private network connections through public networks (such as the Internet). It is suitable for remote access scenarios, such as remote employees accessing company intranet resources. SDP is a security policy used to ensure that only authorized users or devices can access network resources. In a VPDN environment, SDP can ensure that only authenticated and authorized remote devices can establish connections and securely transmit data through encrypted tunnels. Combining VPDN and SDP can create a highly secure remote access solution that transmits data through an end-to-end dedicated encrypted tunnel, effectively preventing data leakage and unauthorized access. Multi-level encryption and authentication are implemented to ensure the security of data during end-to-end transmission.

[0071] S5. Use deep learning models to automatically learn and identify abnormal behavior patterns in network traffic and extract useful features from them to improve the accuracy and efficiency of threat detection.

[0072] S5 specifically further includes the following steps:

[0073] S51, collecting communication traffic data and related historical data, including network traffic records in different time periods, user behavior data, network configuration parameters, etc.;

[0074] S52, cleaning the collected data to remove outliers, missing values ​​and duplicate data;

[0075] S53, perform data normalization to convert data of different scales into a unified scale to facilitate model training;

[0076] S54, extracting features related to traffic prediction and anomaly detection, such as historical traffic, timestamp, user activity, etc.;

[0077] S55. Using a convolutional neural network model, the convolutional layer, pooling layer and fully connected layer are designed to extract and classify the features in the traffic data and mark them. The marked data forms a database.

[0078] S56, using the labeled database to train the convolutional neural network model to obtain a prediction error and a probability value of the convolutional neural network model;

[0079] S57. The trained deep learning model predicts and analyzes new communication traffic data. If the prediction error of a certain data exceeds the set threshold or its probability value is low, it is considered an anomaly.

[0080] Through deep learning algorithms, it is possible to automatically learn and identify abnormal patterns in network traffic, which are often associated with malicious attack behaviors. Deep learning models can process large-scale data sets and extract useful features from them to improve the accuracy and efficiency of threat detection.

[0081] S6. Record all security-related operations, including device access, permission changes, data access, etc., through the built-in audit log record management system. Regularly analyze and review the audit logs to identify abnormal behavior patterns; record and analyze the access behavior, data transmission process, and security events of IoT devices to promptly identify potential security threats and handle them. Ensure the integrity and confidentiality of the logs to prevent unauthorized access and tampering.

[0082] S7. Establish a data backup and recovery system, and use the performance monitoring system to monitor the operating status of IoT devices, network communication quality, etc. in real time, and optimize after analysis. Through the performance monitoring system, monitor the operating status of IoT devices, network communication quality, etc. in real time, analyze and optimize to improve data transmission speed and processing efficiency, and regularly evaluate and optimize the performance of IoT devices. Monitor the operating status of IoT devices and network communication quality in real time, and improve the overall performance and stability of the system through analysis and optimization.

[0083] Example:

[0084] In a smart home system, there are multiple IoT devices, including smart door locks, smart cameras, smart thermostats, etc. These devices need to be connected to the home network through the mobile communication network to achieve remote control and management.

[0085] 1. IoT device identity authentication

[0086] Assigning a unique identifier: Each IoT device is assigned a unique MAC address or serial number as an identification when it leaves the factory.

[0087] Key management: The device manufacturer generates a pair of public and private keys for each device and registers the public key and the device's identity to the smart home management platform. The private key is securely stored inside the device.

[0088] Identity authentication protocol: When the device is connected to the home network for the first time, it establishes an encrypted communication connection with the smart home management platform through the TLS / SSL protocol and uses a private key to sign the identity information. The platform confirms the device identity after verifying the signature and public key.

[0089] 2. IoT device permission settings

[0090] Fine-grained permission management: In the smart home management platform, specific operation permissions are set for each device. For example, only authorized users can remotely unlock smart door locks, and smart cameras can be set to be accessible only to family members.

[0091] Role definition: Define different user roles, such as administrator, family member, guest, etc., and assign corresponding device access permissions to each role.

[0092] Dynamic permission adjustment: Based on changes in family members or security needs, administrators can dynamically adjust device access permissions on the platform.

[0093] 3. Data encryption

[0094] Storage data encryption: IoT devices encrypt the collected data (such as door lock status, camera video, etc.) using the national secret encryption algorithm and then upload it to the cloud or local storage.

[0095] Regularly change keys: To ensure data security, the smart home management platform will regularly generate new keys for devices and require devices to update keys to encrypt subsequent data transmission.

[0096] 4. Data transmission encryption

[0097] Secure communication protocol: IoT devices and smart home management platforms use secure communication protocols such as DTLS to transmit data to ensure data confidentiality and integrity.

[0098] End-to-end encryption: For sensitive data (such as video streaming, voice communication, etc.), end-to-end encryption technology is used to ensure that the data cannot be stolen or tampered with by middlemen during transmission.

[0099] 5. Firewall and Intrusion Prevention Detection

[0100] Deep learning technology can help smart home systems better understand various data in the home, including face recognition, voice recognition, and behavior recognition. These technologies enable smart home devices to more accurately identify users, understand user instructions, and provide personalized services accordingly. Through deep learning algorithms, smart home systems can analyze network traffic and device behavior in real time to identify potential threats and abnormal behaviors. These threats may include password cracking, data tampering, and network attacks. Once a threat is detected, the system can immediately take defensive measures to protect the security of the home network and devices. This real-time response mechanism can significantly reduce the risk of smart home devices being attacked. In a smart home system, different devices and components can form a collaborative defense system. By sharing threat intelligence and detection results, different devices can collaborate with each other to jointly resist network attacks. When a device detects a threat, it can trigger the linkage response mechanism of other devices. For example, when a smart security device detects an intrusion, it can automatically start the defense mode of the smart door lock and notify the smart lighting device to adjust the light to interfere with the intruder.

[0101] 6. Security audit and log management

[0102] Audit system: The smart home management platform establishes a security audit system to record all security-related operations, including device access, permission changes, data access, etc.

[0103] Log analysis: Regularly analyze and review audit logs to identify potential security threats and abnormal behavior patterns.

[0104] Log confidentiality: Ensure the integrity and confidentiality of audit logs to prevent unauthorized access and tampering.

[0105] 7. Emergency response and data backup and recovery

[0106] Emergency Response Plan: Develop a detailed emergency response plan, including incident reporting process, handling steps, recovery strategies, etc.

[0107] Data backup and recovery: Implement data backup and recovery strategies to ensure rapid recovery in the event of data loss or corruption.

[0108] Specifically, it also includes firmware and software protection

[0109] Regular updates: Keep your IoT device’s firmware and software up to date to fix known security vulnerabilities and improve the device’s security.

[0110] Security audits: Regularly perform security audits on the device's firmware and software to ensure that they have not been implanted with malicious code or have other security risks.

[0111] Specifically, it also includes compliance and standardization, and compliance with regulatory standards: ensuring that the design, deployment, and operation of IoT devices comply with relevant regulations and standards, such as GDPR, HIPAA, etc.

[0112] Standardized access: Use standardized access protocols and interfaces to improve interoperability and security between devices.

[0113] In summary, achieving secure access on IoT devices requires comprehensive consideration of identity authentication, data encryption, protection measures, firmware and software protection, and compliance and standardization. By implementing these measures, the security risks of IoT devices can be significantly reduced and user data and privacy can be protected.

[0114] Any example of the present invention can be used as an independent technical solution or combined with other examples. All patents and publications mentioned in the specification of the present invention indicate that these are public technologies in the field and can be used in the present invention. All patents and publications cited here are also listed in the references, just like each publication is specifically cited separately. The present invention here can be implemented in the absence of any element or elements, one limitation or multiple limitations, and this limitation is not specifically stated here. The terms and expressions used here are descriptive methods, but not limited by them. There is no intention to indicate that these terms and explanations described in this book exclude any equivalent features, but it can be known that any appropriate changes or modifications can be made within the scope of the present invention and the claims. It can be understood that the embodiments described in the present invention are embodiments and features in some embodiments, and any person skilled in the art can make some changes and variations based on the essence of the present invention, and these changes and variations are also considered to belong to the scope of the present invention and the scope limited by the independent claims and the appended claims.

Claims

1. A method for secure access of Internet of Things devices based on a mobile communication network, characterized in that: The specific steps include: S1. IoT device identity authentication, matching the corresponding identity authentication identifier for each IoT device, including assigning a unique identifier to each IoT device, performing key management, and establishing an encrypted communication connection through the identity authentication protocol; S2. IoT device permission setting: matching corresponding access rights for each IoT device, assigning different access rights and operation scopes to each IoT device through fine-grained permission management and role definition, and dynamically adjusting device permissions; S3. Encrypt the data transmitted by IoT devices. Encrypt the data stored in IoT devices or the cloud through encryption algorithms, and change the keys regularly. S4. Encrypt the data transmission process of IoT devices, use secure communication protocols to encrypt the communication between IoT devices, and perform end-to-end encryption on sensitive data; S5, anomaly detection based on communication traffic and historical data through deep learning models; S6. Record all security-related operations, including device access, permission changes, data access, etc., through the built-in audit log record management system, and regularly analyze and review the audit logs to identify abnormal behavior patterns; S7. Establish a data backup and recovery system, and use the performance monitoring system to monitor the operating status of IoT devices, network communication quality, etc. in real time, and optimize after analysis.

2. According to claim 1, a method for secure access to an Internet of Things device based on a mobile communication network is characterized in that: The S1 specifically includes: allocating a unique identifier including MAC address, serial number, etc. to each IoT device for device identification, presetting a unique device key for each device when leaving the factory for secure communication with the platform or server, generating a pair of dynamic keys through a key exchange protocol when the device accesses the network, for encryption and decryption of communication data, and using the transport layer security protocol TLS or the secure socket layer protocol SSL to establish an encrypted communication connection to ensure the identity authentication and data transmission security of the device when it accesses the network.

3. According to claim 1, a method for secure access to an Internet of Things device based on a mobile communication network is characterized in that: The key management in S1 specifically includes the following steps: S11. Generate a key in a trusted secure environment; S12. Use distributed key distribution to distribute keys through encrypted communication channels TLS / SSL, register the public key of the IoT device to the IoT platform or key management center, and perform identity authentication and permission control; S13. Use a secure chip or hardware security module HSM to store critical keys. Use a strong encryption algorithm to encrypt and store keys stored in non-secure hardware. S14. Implement strict access control policies to limit access to keys; S15. Set the key update cycle to realize automatic key update, revoke the relevant keys when the device is lost, stolen or the keys are leaked, and properly manage the revoked or expired keys; S16. When establishing encrypted communication between IoT devices or between IoT devices and a server, use a key for encryption and decryption; S17. Record key operations such as key generation, distribution, storage, use and destruction through audit logs, and review and analyze audit logs regularly.

4. According to claim 1, a method for secure access to an Internet of Things device based on a mobile communication network is characterized in that: The S2 specifically includes: the fine-grained permission management is to assign different access rights and operation scopes to the device according to the type, purpose and user of the device. The roles and permissions specifically define different roles, including administrators, ordinary users, etc., and assign corresponding permissions to each role. The access rights and operation scope of the device are dynamically adjusted according to changes in business needs and security policies.

5. According to claim 1, a method for secure access to an Internet of Things device based on a mobile communication network is characterized in that: The S3 specifically includes: the encryption algorithm is a national secret algorithm, specifically the SM4 national secret algorithm.

6. A method for secure access to an Internet of Things device based on a mobile communication network according to claim 1, characterized in that: The S4 specifically includes: the specific secure communication protocol: using security protocols such as TLS / SSL to encrypt communications between IoT devices, implementing encryption and authentication through the IPSec protocol at the IP layer, and for devices that require remote access, using VPDN+SDP single-packet authorization to transmit data through an end-to-end dedicated encrypted tunnel.

7. The method for secure access of an Internet of Things device based on a mobile communication network according to claim 1, characterized in that: The S5 specifically further comprises the following steps: S51, collecting communication traffic data and related historical data, including network traffic records in different time periods, user behavior data, network configuration parameters, etc.; S52, cleaning the collected data to remove outliers, missing values ​​and duplicate data; S53, perform data normalization to convert data of different scales into a unified scale to facilitate model training; S54, extracting features related to traffic prediction and anomaly detection, such as historical traffic, timestamp, user activity, etc.; S55. Using a convolutional neural network model, the convolutional layer, pooling layer and fully connected layer are designed to extract and classify the features in the traffic data and mark them. The marked data forms a database. S56, using the labeled database to train the convolutional neural network model to obtain a prediction error and a probability value of the convolutional neural network model; S57. The trained deep learning model predicts and analyzes new communication traffic data. If the prediction error of a certain data exceeds the set threshold or its probability value is low, it is considered an anomaly.

8. According to claim 1, a method for secure access to an Internet of Things device based on a mobile communication network is characterized in that: The S7 specifically includes: through the performance monitoring system, real-time monitoring of the operating status of the IoT devices, network communication quality, etc., analysis and optimization to improve data transmission speed and processing efficiency, and regular performance evaluation and optimization adjustments of the IoT devices.

Images