Internet of things terminal dynamic access method and system in network stealth environment

Abstract

The invention provides an Internet of Things terminal dynamic access method and system in a network stealth environment, and relates to the technical field of network security, and the method comprises the steps: initializing a server, a terminal and a gateway; the business capabilities of different servers are re-aggregated and divided according to different systems, different businesses, different data security protection levels and different business access volumes, and are loaded to different BDP business gateways; when the Internet of Things terminal initiates service access, the BDP terminal network access control application takes over the service access process in a proxy mode, and establishes an access strategy and service connection to the BDP admission gateway and the BDP service gateway respectively to realize the access of the Internet of Things terminal; in the access process, user behavior scores are calculated through a multi-user behavior analysis model, safety level evaluation is continuously carried out on user behaviors, the access authority and strategy of the Internet of Things terminal are dynamically adjusted according to the user credit level, and dynamic control over risk behaviors is achieved.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to a method and system for dynamic access of an Internet of Things terminal in a network stealth environment. Background Art

[0002] The statements in this section merely provide background information related to the present disclosure and do not necessarily constitute prior art.

[0003] Traditional IoT terminals lack application security mechanisms, let alone strong security and strong identity authentication mechanisms. Simple password verification can be easily cracked or bypassed, and it is easy to directly attack the device system and be controlled, becoming a new direction for network attacks. The large connection, large bandwidth, and low latency characteristics of 5G networks have greatly increased the potential scale of attacks. Once a large number of devices are illegally controlled, they will launch unprecedented large-scale network attacks and paralyze the basic network. New network architectures such as SDN, NFV, cloud, and MEC in 5G communications have blurred network boundaries, making boundary protection ineffective. While increasing flexibility, it has also expanded the attack exposure surface, facing problems such as DDoS attacks, side channel attacks, and open API threats. Network slicing technology also brings new network security issues such as resource sharing, cross-domain security, and authentication and authorization.

[0004] Under the traditional network access mode, the overall solution for IoT terminals and network security is based on the functional superposition of network security equipment and the development of network security situation awareness technology supported by AI big data. The traditional IoT system security solution idea is basically focused on the detection and blocking at the edge of the network and post-event remediation. It adopts a mechanism of connecting first and then authenticating. Based on the TCP / IP protocol, it combines the VPN mode to achieve end-to-end communication. However, it lacks a zero-trust system idea and cannot solve fundamental security problems from the security architecture level. Summary of the invention

[0005] In order to solve the above problems, the present disclosure proposes a method and system for dynamic access to IoT terminals in a network stealth environment, which hides the network and resources through single-packet knocking technology to ensure that only legitimate IoT terminals can access, thereby preventing unauthorized access and attacks. At the same time, during the access process, the user behavior is continuously evaluated for security level, and risky behaviors are dynamically controlled to protect the security of enterprise data assets.

[0006] According to some embodiments, the present disclosure adopts the following technical solutions: The method for dynamic access of an Internet of Things terminal in a network stealth environment includes: Initialization of servers, terminals and gateways; Reaggregate and divide the business capabilities of different servers according to different systems, businesses, data security protection levels and business access volumes, and load them to different BDP business gateways; When the IoT terminal initiates service access, the BDP terminal network access control application takes over the service access process through proxy mode, establishes access policies and service connections to the BDP admission gateway and BDP service gateway respectively, and realizes IoT terminal access; During the access process, the user behavior score is calculated through a multi-user behavior analysis model, and the security level of user behavior is continuously evaluated. The access rights and policies of the IoT terminal are dynamically adjusted according to the user's credit level to achieve dynamic control of risky behavior.

[0007] According to some embodiments, the present disclosure adopts the following technical solutions: The IoT terminal dynamic access system in a network stealth environment includes: Initialization module, used for server, terminal and gateway initialization; Reaggregate and divide the business capabilities of different servers according to different systems, businesses, data security protection levels and business access volumes, and load them to different BDP business gateways; The access module is used for when the IoT terminal initiates service access, the BDP terminal network access control application takes over the service access process through the proxy mode, and establishes access policies and service connections to the BDP admission gateway and the BDP service gateway respectively, so as to realize the access of the IoT terminal; The behavior assessment module is used to calculate the user behavior score through a multi-user behavior analysis model during the access process, continuously evaluate the security level of user behavior, dynamically adjust the access rights and policies of the IoT terminal according to the user's credit level, and realize dynamic control of risky behavior.

[0008] According to some embodiments, the present disclosure adopts the following technical solutions: A computer program product includes a computer program, and when the computer program is executed by a processor, the method for dynamically accessing an Internet of Things terminal in a network stealth environment is implemented.

[0009] According to some embodiments, the present disclosure adopts the following technical solutions: A non-transitory computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by a processor, the method for dynamic access of an Internet of Things terminal in a network stealth environment is implemented.

[0010] According to some embodiments, the present disclosure adopts the following technical solutions: An electronic device comprises: a processor, a memory and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory, so that the electronic device executes the method for dynamic access to an Internet of Things terminal in a network stealth environment.

[0011] Compared with the prior art, the present invention has the following beneficial effects: The disclosed method for dynamic access to IoT terminals in a network stealth environment protects IoT devices and data from network attacks such as replay attacks, forgery attacks, data tampering, and session hijacking through innovative single-packet knocking technology and dynamic access control strategies, meets the access security requirements of different types of fragmented IoT terminals, and implements fast authentication access capabilities based on strong security of certificateless identification passwords. It also achieves seamless integration with the enterprise's back-end business platform through a national secret certificateless TLS secure channel, ensures the security of the entire communication link and data integrity, and implements efficient and secure access to IoT terminals in a network stealth environment, effectively improving the overall security and reliability of the IoT system.

[0012] The dynamic access method for IoT terminals in a network stealth environment disclosed in the present invention, through a business hierarchical management method, re-aggregates and divides business capabilities according to different systems, different businesses, different data security protection levels, and different business access volumes, and loads them to different BDP business gateways. The terminal will lose the ability to communicate directly with the business server, further realizing secure access control, reducing the attack surface, and ensuring the security of business data.

[0013] The method for dynamic access to IoT terminals in a network stealth environment disclosed in the present invention monitors and records the behavior data of IoT terminals after accessing the network. The BDP service gateway sends the communication sequence data, authorization information, and service access behavior to the BDP intelligent controller. By constructing a terminal access behavior portrait, the ability to analyze abnormal terminal behavior is realized. The behavior data includes information such as user operation information, user access frequency, and transmission volume of user information, thereby realizing the ability to analyze abnormal terminal behavior and further realizing dynamic security access control. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The accompanying drawings constituting a part of the present disclosure are used to provide a further understanding of the present disclosure. The illustrative embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation on the present disclosure.

[0015] Figure 1 A schematic diagram of a secure access process for an IoT terminal according to an embodiment of the present disclosure; Figure 2 A schematic diagram of a user dynamic access behavior control process according to an embodiment of the present disclosure; Figure 3 The figure is a schematic diagram of the single-packet authorization data packet flow in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0016] The present disclosure is further described below in conjunction with the accompanying drawings and embodiments.

[0017] It should be noted that the following detailed descriptions are all illustrative and are intended to provide further explanation of the present disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present disclosure belongs.

[0018] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present disclosure. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0019] Example 1 An embodiment of the present disclosure provides a method for dynamically accessing an Internet of Things terminal in a network stealth environment, including: Step 1: Initialize the server, terminal and gateway; Step 2: Re-aggregate and divide the business capabilities of different servers according to different systems, different businesses, different data security protection levels, and different business access volumes, and load them to different BDP business gateways; Step 3: When the IoT terminal initiates service access, the BDP terminal network access control application takes over the service access process through proxy mode, establishes access policies and service connections to the BDP admission gateway and BDP service gateway respectively, and realizes IoT terminal access; Step 4: During the access process, the user behavior score is calculated through a multi-user behavior analysis model, and the security level of user behavior is continuously evaluated. The access rights and policies of the IoT terminal are dynamically adjusted according to the user's credit level to achieve dynamic control of risky behavior.

[0020] As an embodiment, the specific implementation process of the method for dynamic access of an IoT terminal in a network stealth environment disclosed in the present invention is as follows: Step 1: Initialize the server, terminal and gateway; Specifically, a BDP security management and control platform is designed, which includes a BDP intelligent controller, a BDP business gateway, and a BDP access gateway, and is ready to be launched online.

[0021] Step 2: Re-aggregate and divide the business capabilities of different servers according to different systems, businesses, data security protection levels, and business access volumes, and load them to different BDP business gateways; Specifically, in order to further reduce the attack surface and ensure the security of business data, the business capabilities of different servers are re-aggregated and divided according to different systems, businesses, data security protection levels, and business access volumes through business hierarchical management, and loaded onto different BDP business gateways. The terminal will lose the ability to communicate directly with the business server, including: 1) Organize the business capability resources that require authorized access and form an inventory, record the name and purpose of each system and capability in detail, and classify the security level of each business capability based on the sensitivity, integrity and confidentiality requirements of the data. Usually, it can be divided into highly confidential data (such as industry secrets, core business information, etc.), moderately sensitive data (such as equipment information, business operation data, etc.) and ordinary data (such as public parameter information, dictionary information, etc.).

[0022] 2) Based on the type of IoT terminal device and the expected service access frequency, the access frequency of business capabilities is graded, which can usually be divided into high-frequency access (such as public parameter information, positioning data, etc.), medium-frequency access (such as core business, operational data, etc.) and low-frequency access (such as industry confidential data, etc.).

[0023] 3) Build a multi-dimensional matrix, taking system category, data security protection level and business access volume as different dimensions of the matrix, forming new classifications and loading them to different BDP business gateways. For example, aggregate all core businesses that process highly confidential data and have high business access volume into a high-security and high-traffic core business group for key monitoring.

[0024] Step 3: When the IoT terminal initiates service access, the BDP terminal network access control application takes over the service access process through proxy mode, establishes access policies and service connections to the BDP admission gateway and BDP service gateway respectively, and realizes IoT terminal access; Specifically, the IoT terminal access process includes: 1) When the IoT terminal initiates service access, the BDP terminal network access controller application will take over the service access process through a proxy. The BDP terminal network access control application will first verify whether there is an available ticket for the corresponding service locally. When the ticket does not exist or the ticket is expired, the access control application will sign the access request and generate a routing data packet.

[0025] Furthermore, the content of the guide package disclosed in the present invention is improved upon that of the knock package. In addition to the unique identification of the terminal device and the type of service requested for access, new service access scope, authorization time limit, and communication sequence data are added.

[0026] 2) The BDP terminal network access control application sends an identity authentication request to the BDP admission gateway; Specifically, before attempting to use the service communication capability, the BDP terminal network access control application first sends a single data packet (pilot data packet) containing necessary information to the BDP admission gateway. After receiving the (pilot data packet), the BDP admission gateway will perform identity verification based on the information in the packet. Only clients that pass the verification can obtain further temporary service authorization and obtain service access capabilities.

[0027] After the BDP access gateway completes the terminal identity authentication through the data packet, it will send the terminal access credit maintenance to the BDP intelligent controller and perform a security assessment through the artificial intelligence model. Since the access behaviors of the same type of terminal devices are similar, such as the order of traffic packets sent for security access and the order of business access have a certain regularity, by continuously collecting the access behaviors of terminal devices, a security access baseline is formed based on the regularity and commonality of the access behaviors. When the access behavior of the IoT terminal is abnormal, the behavior of the device will deviate from the security baseline, and the security credit level of the terminal will be reduced.

[0028] For secure and reliable terminal access requests, the BDP access gateway authenticates the authentication information and sends the terminal access record to the BDP intelligent controller. The BDP will identify the terminal security credit level. If the terminal credit level is too low, the request will be blocked. If the level is high, an end-to-end channel will be established between the BDP terminal network access control application and the BDP service gateway.

[0029] The system will set four security credit levels: Level 1 is the full trust level, and the terminal has full trust access; Level 2 is the restricted trust level, and the terminal is authorized to have trust access to highly confidential information; Level 3 is the severely restricted level, and only ordinary information is authorized to have trust access; Level 4 is the completely restricted level, and the access gateway will deny terminal access.

[0030] Furthermore, identity verification is performed based on the information in the packet. Only clients that pass the verification can obtain further temporary authorization for services. The verification process is as follows: 1. The client combines the timestamp when sending the packet, the client IP address, and the service password to generate a hash value.

[0031] 2. Pack the hash value into a UDP data packet and send it to the server's designated knock port.

[0032] 3. The server generates a hash value based on the timestamp received in the UDP header, the client IP, and the service password stored internally on the server.

[0033] 4. Compare with the received hash value. If they are the same, open the service port requested by the client.

[0034] 3) The BDP access gateway sends the generated user ticket, temporary authorization time and other authentication information to the BDP business gateway. After identifying the access request, the BDP business gateway will generate a valid access sequence and end-to-end security access policy and return them to the DBP access gateway.

[0035] 4) The BDP access gateway returns the authentication and authorization information to the BDP terminal network access control application, and informs the BDP intelligent controller of the terminal authentication information; the BDP terminal network access control application establishes a TLS connection, encapsulates the access sequence and business data, and sends them to the BDP business gateway after encryption; Specifically, in order to ensure the security of data transmission, a secure key management mechanism needs to be established between the IoT terminal and the server. It involves processes such as generating, distributing, updating and revoking keys. In the key generation phase, a secure random number generation algorithm is used to generate a key pair (public key and private key). In the key distribution phase, the public key is sent to the server through a secure channel, and the private key is stored on the terminal. During the data transmission process, the IoT terminal will use an encryption algorithm to encrypt the transmitted data. After receiving the encrypted data, the server will use the corresponding decryption algorithm to decrypt it to restore the original data. This ensures that the data will not be stolen or tampered with by unauthorized third parties during transmission.

[0036] 5) The BDP service gateway performs service processing after unpacking and sends the terminal access behavior to the BDP intelligent controller. The BDP intelligent controller conducts behavior analysis based on terminal access and service access behavior and dynamically adjusts security policies.

[0037] Specifically, in order to achieve dynamic access control of user behavior, the behavior data of the IoT terminal after accessing the network is monitored and recorded. The behavior data includes information such as user operation information, user access frequency, and transmission volume of user information.

[0038] User evaluation is divided into evaluation based on a single user's historical behavior and evaluation between different users.

[0039] Based on the behavior evaluation of user historical behavior, the user historical data is collected first, including the terminal operation information, the accessed services, the terminal access frequency, the data transmission volume and other information. The user's access frequency and other periodic information are subjected to Fourier transformation and exponential smoothing algorithm to obtain the user's periodic access frequency characteristics and establish the user access baseline, which is:

[0040]

[0041]

[0042] in, , that is, the user's daily access frequency and data transmission volume , i.e., the user’s actual access frequency and data transmission volume; , used to reflect the change speed of daily login access frequency and data transmission volume; , used to reflect seasonal change trends; .

[0043] In this way, the user's daily access frequency data and daily transmission data are obtained, and the user's operation information and access business are used to establish an abnormal access model using the SVM algorithm. According to the user's behavioral abnormal access model, it is judged whether the user's behavior is abnormal and its behavior score is obtained.

[0044] The construction process of the SVM algorithm to establish an abnormal access model is as follows: the user's daily access frequency, daily transmission data volume, user operation information, and access business are standardized to form a user access feature vector, and the vector is marked as normal or abnormal. Use SVM to train the feature vector of historical data, input the above access feature vector, and output whether the behavior is abnormal.

[0045] The evaluation between different users uses the isolation forest algorithm, which analyzes different users of the same type, obtains isolated users, and performs abnormality scores on them.

[0046] Specifically, the daily access frequency, daily transmission data volume, user operation information, and access services of different users of the same type are collected to form a user access feature vector, which is then put into the isolation forest algorithm to obtain abnormal scores for different users.

[0047] Establish a comprehensive analysis model, perform weighted statistics on various user behavior scores, and obtain the user's behavior score. Set a user behavior threshold. If the user score is lower than the specific threshold, the user's security level will be downgraded. If the user score is higher than the threshold, the user's security level will be maintained. The specific calculation process is:

[0048] in, S The specific score of the user; X Analyze model scores for more than one user; Y Analyze model scores for multiple users or more; are weighted parameters, ; when When , it is level 1 full trust level; when When is level 2 limited trust level; when It is a level 3 severely restricted level; when When it is level 4, the fully restricted level, the access gateway will deny terminal access.

[0049] Furthermore, by giving users an initial security level, you can limit the user information within your authority. During the user's access process, dynamically evaluate user behavior and obtain behavior scores. Based on the evaluation results, determine whether the user should be downgraded or maintain the original level, and dynamically adjust the access rights and policies of the IoT terminal according to the security level. For low-risk users, normal access to network resources and services can be allowed; for high-risk users, their access rights will be restricted or they will be prohibited from accessing the network.

[0050] As an embodiment, the BDP intelligent controller dynamic access control process includes: 1. Extract historical behavior information of multiple users and build a multi-user behavior analysis model based on the isolation forest algorithm.

[0051] 2. Extract the historical behavior information of a single user, perform feature extraction and model training based on Fourier transform, exponential smoothing, SVM and other algorithms, and generate a multi-user behavior analysis model.

[0052] 3. Collect user access data and extract data to generate single-user access data and multi-user access data.

[0053] 4. Single user access data is calculated through a single user historical behavior analysis model to obtain each user's behavior score.

[0054] 5. Multi-user data is calculated through a multi-user analysis model to obtain the behavior score of each user.

[0055] 6. Perform a weighted analysis on the two behavior scores to obtain the final score for each user.

[0056] 7. Evaluate the user's credit rating based on the user's total score.

[0057] 8. Dynamically adjust access rights and policies for Internet terminals based on user credit ratings.

[0058] Example 2 In one embodiment of the present disclosure, a dynamic access system for an Internet of Things terminal in a network stealth environment is provided, including: Initialization module, used for server, terminal and gateway initialization; Reaggregate and divide the business capabilities of different servers according to different systems, businesses, data security protection levels and business access volumes, and load them to different BDP business gateways; The access module is used for when the IoT terminal initiates service access, the BDP terminal network access control application takes over the service access process through the proxy mode, and establishes access policies and service connections to the BDP admission gateway and the BDP service gateway respectively, so as to realize the access of the IoT terminal; The behavior assessment module is used to calculate the user behavior score through a multi-user behavior analysis model during the access process, continuously evaluate the security level of user behavior, dynamically adjust the access rights and policies of the IoT terminal according to the user's credit level, and realize dynamic control of risky behavior.

[0059] The dynamic access and control process specifically implemented by each module of the IoT terminal dynamic access access system in the above network stealth environment is as follows: 1. The BDP security management and control platform (including intelligent controller, business gateway, and access gateway) is launched online.

[0060] 2. Reaggregate and divide business capabilities according to different systems, businesses, data security protection levels, and business access volumes, and load them onto different BDP business gateways.

[0061] 3. When the IoT terminal initiates service access, the BDP terminal network access controller application will take over the service access process through proxy.

[0062] 4. The BDP terminal network access control application first verifies whether there is an available ticket for the corresponding service locally. When the ticket does not exist or the ticket is expired, the access control application will sign the access request and generate a routing data packet.

[0063] 5. The BDP terminal network access control application sends an identity authentication request to the BDP admission gateway.

[0064] 6. The BDP access gateway authenticates the authentication information and sends the terminal access record to the BDP intelligent controller. The BDP will identify the terminal security credit level and block the request if the terminal credit level is too low.

[0065] 7. The BDP access gateway sends the generated user ticket, temporary authorization time and other authentication information to the BDP business gateway.

[0066] 8. After identifying the admission request, the BDP service gateway will generate a valid access sequence and end-to-end security access policy and return it to the DBP admission gateway.

[0067] 9. The BDP access gateway returns the authentication and authorization information to the BDP terminal network access control application, and informs the BDP intelligent controller of the terminal authentication information.

[0068] 10. The BDP terminal network access control application establishes a TLS connection, encapsulates the access sequence and business data, and sends them to the BDP business gateway after encryption. 11. The BDP service gateway unpacks the data and processes the data, and sends the terminal access behavior to the BDP intelligent controller.

[0069] 12. The BDP intelligent controller conducts behavioral analysis based on terminal access and business access behavior and dynamically adjusts security policies.

[0070] Example 3 In one embodiment of the present disclosure, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the method for dynamic access of an Internet of Things terminal in a network stealth environment is implemented.

[0071] Example 4 In one embodiment of the present disclosure, a non-transitory computer-readable storage medium is provided, wherein the non-transitory computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by a processor, the method for dynamic access of an Internet of Things terminal in a network stealth environment is implemented.

[0072] Example 5 In one embodiment of the present disclosure, an electronic device is provided, including: a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory, so that the electronic device executes the method for dynamic access to an Internet of Things terminal in a network stealth environment.

[0073] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0074] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0075] Although the above describes the specific implementation methods of the present disclosure in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present disclosure. Technical personnel in the relevant field should understand that on the basis of the technical solution of the present disclosure, various modifications or variations that can be made by those skilled in the art without creative work are still within the scope of protection of the present disclosure.

Claims

1. A method for dynamically accessing an Internet of Things terminal in a network stealth environment, characterized in that: include: Initialization of servers, terminals and gateways; Reaggregate and divide the business capabilities of different servers according to different systems, businesses, data security protection levels and business access volumes, and load them to different BDP business gateways; When the IoT terminal initiates service access, the BDP terminal network access control application takes over the service access process through proxy mode, establishes access policies and service connections to the BDP admission gateway and BDP service gateway respectively, and realizes IoT terminal access; During the access process, the user behavior score is calculated through a multi-user behavior analysis model, and the security level of user behavior is continuously evaluated. The access rights and policies of the IoT terminal are dynamically adjusted according to the user's credit level to achieve dynamic control of risky behavior.

2. The method for dynamic access of an Internet of Things terminal in a network stealth environment according to claim 1, characterized in that: After the BDP terminal network access control application takes over the service access process through a proxy, the BDP terminal network access control application first verifies whether there is an available ticket for the corresponding service locally. When the ticket does not exist or the ticket is expired, the access control application will sign the access request and generate a routing data packet.

3. The method for dynamic access of an Internet of Things terminal in a network stealth environment according to claim 1, characterized in that: The BDP terminal network access control application sends an identity authentication request to the BDP access gateway. The BDP terminal network access control application first sends a single routing data packet containing necessary information to the BDP access gateway. After receiving the routing data packet, the BDP access gateway will perform identity verification based on the information in the routing data packet. Only clients that pass the verification can obtain further temporary service authorization and obtain service access capabilities.

4. The method for dynamic access of an Internet of Things terminal in a network stealth environment as claimed in claim 3, characterized in that: The content of the routing package includes the unique identification of the terminal device, the type of service requested for access, the scope of service access, the authorization time limit and the communication sequence data.

5. The method for dynamic access of an Internet of Things terminal in a network stealth environment as claimed in claim 3, characterized in that: The BDP access gateway authenticates the authentication information. After completing the terminal identity authentication, the terminal access record is sent to the BDP intelligent controller. The BDP will identify the terminal security credit level. If the terminal credit level is too low, the request will be blocked. If the level is high, it will establish an end-to-end channel between the BDP terminal network access control application and the BDP service gateway for secure and reliable terminal access requests.

6. The method for dynamic access of an Internet of Things terminal in a network stealth environment as claimed in claim 5, characterized in that: The BDP access gateway will send the generated user ticket, temporary authorization time and other authentication information to the BDP business gateway. After identifying the access request, the BDP business gateway will generate a valid access sequence and end-to-end security access policy and return them to the DBP access gateway. The BDP access gateway will return the authentication and authorization information to the BDP terminal network access control application and inform the BDP intelligent controller of the terminal authentication information. The BDP terminal network access control application will establish a TLS connection, encapsulate the access sequence and business data, and send them to the BDP business gateway after encryption. The BDP business gateway will unpack the data, process the business, and send the terminal access behavior to the BDP intelligent controller.

7. The Internet of Things terminal dynamic access system in a network stealth environment is characterized by: include: Initialization module, used for server, terminal and gateway initialization; Reaggregate and divide the business capabilities of different servers according to different systems, businesses, data security protection levels and business access volumes, and load them to different BDP business gateways; The access module is used for when the IoT terminal initiates service access, the BDP terminal network access control application takes over the service access process through the proxy mode, and establishes access policies and service connections to the BDP admission gateway and the BDP service gateway respectively, so as to realize the access of the IoT terminal; The behavior assessment module is used to calculate the user behavior score through a multi-user behavior analysis model during the access process, continuously evaluate the security level of user behavior, dynamically adjust the access rights and policies of the IoT terminal according to the user's credit level, and realize dynamic control of risky behavior.

8. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method for dynamic access of an Internet of Things terminal in a network stealth environment described in any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by the processor, the dynamic access method for an Internet of Things terminal in a network stealth environment as described in any one of claims 1 to 6 is implemented.

10. An electronic device, characterized in that: include: A processor, a memory and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory so that the electronic device executes the method for dynamic access to an Internet of Things terminal in a network stealth environment as described in any one of claims 1 to 6.

Images