Forest and grass Internet of Things independent security auditing method and system based on smart contract

Abstract

The invention relates to a forest and grass Internet of Things independent security auditing method and system based on a smart contract. The method comprises the following steps: S1, initializing a block chain network and defining the smart contract; s2, periodically operating the forest and grass Internet of Things system; s3, triggering auditing; s4, generating an independent audit notification and encrypting the broadcast; s5, the audited equipment receives the auditing notification and carries out auditing; s6, verifying an audit result returned by the audited equipment; s7, storing the audit session and the audit result; s8, security situation awareness and emergency disposal; s9, judging whether the monitoring work is finished or not; the system is used for executing the independent security auditing method. The technical scheme of the invention has the characteristics of independence, high efficiency, dynamic adjustment, decentralization, transparency, non-tampering and traceability, and can discover the data distortion problem caused by internal and external collusion, up and down series connection and long-term hiding and camouflage in an independent third-party form.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things security technology, and specifically to an independent security audit method and system for forest and grassland Internet of Things based on smart contracts. Background Art

[0002] Compared with the power Internet of Things, the Internet of Vehicles, and the Industrial Internet of Things, the forestry and grassland Internet of Things has the industry characteristics of "difficult terminal protection, difficult power supply, difficult network communication, difficult system maintenance, and difficult security protection" because the terminals are deployed in an open natural environment. The probability and breach rate of external attacks are relatively high. If internal security threats such as internal attacks and account theft are superimposed, it will be difficult to detect long-term covert attacks after being breached. Long-term false data injection or equipment damage will cause decision-making errors or inability to make decisions, causing huge economic and social losses.

[0003] To sum up, in a complex and open environment where internal attack threats coexist, there is an urgent need to provide an independent, efficient, dynamically adjustable, decentralized, transparent, tamper-proof and traceable method and system to discover and solve the problem of data distortion caused by collusion between insiders and outsiders, connection between top and bottom, and long-term covert disguise attacks. Summary of the invention

[0004] The purpose of this invention is to provide an independent, efficient, dynamically adjustable, decentralized, transparent, tamper-proof and traceable independent security audit method and system for forest and grassland Internet of Things based on smart contracts.

[0005] The above purpose is achieved through the following technical solution: an independent security audit method for forest and grassland Internet of Things based on smart contracts, including the following steps: S1, blockchain network initialization and smart contract definition: select the blockchain type and blockchain platform, initialize the blockchain network, complete the independent security audit smart contract definition and chain code installation, as well as the security situation awareness smart contract definition and chain code installation; S2, the forest and grassland IoT system operates periodically: the forest and grassland IoT system wakes up the forest and grassland IoT gateway and the forest and grassland IoT terminal at the scheduled time to complete data collection, aggregation and transmission. After completion, the forest and grassland IoT gateway and the forest and grassland IoT terminal enter sleep mode and wait for the next data collection cycle; S3, triggering audit: the Lincao Cloud Platform executes the independent security audit smart contract and determines whether the independent audit start condition is triggered. If so, it executes step S4, otherwise, it executes step S2; S4, generate independent audit notification and encrypt and broadcast: the forest and grass cloud platform generates an independent audit notification, encrypts the independent audit notification using ciphertext attribute encryption, and the forest and grass cloud platform broadcasts the ciphertext of the independent audit notification to the forest and grass IoT gateway in the next data collection cycle; S5, the audited device receives the audit notification and conducts the audit: decrypts the ciphertext of the independent audit notification, obtains the content of the independent audit notification, conducts an independent security audit according to the requirements of the independent audit notification, and transmits the audit data back; S6, verify the audit result returned by the audited device: the Lincao Cloud Platform decrypts the returned audit data and compares it with the historical data stored in the blockchain network. By judging the consistency of the data, the data integrity and system security detection are completed. If the judgment and verification result is passed, step S7 is executed, otherwise, step S8 is executed; S7, store audit session and audit results: Lincao Cloud Platform records this independent audit session into the blockchain network, and stores the audit data and audit conclusions obtained by the local audit in the audit database; S8, security situation awareness and emergency disposal: The forest and grassland IoT gateway will record the failed independent audit session into the blockchain network, and perform security situation awareness and emergency disposal according to the audit conclusions and types; S9, determine whether the monitoring work is completed, if not, execute step S2, if yes, the process ends.

[0006] The technical solution of the present invention aims at the problems of data integrity and system security detection of forestry and grassland Internet of Things systems under internal attack threats and in complex open environments. By defining an independent security audit smart contract in the blockchain network, an independent audit notification is generated by encrypting it using ciphertext attribute encryption, broadcasting it to the audited forestry and grassland Internet of Things devices, and obtaining the audit content and audit results through attribute decryption, the forestry and grassland Internet of Things system is decentralized, transparent, tamper-proof and traceable, while an independent security audit mode that is flexible, efficient and dynamically adjustable is achieved, effectively solving the problems of data integrity and system security detection of forestry and grassland Internet of Things systems in complex open environments.

[0007] A further technical solution is that step S1 specifically includes the following steps: S1.1, blockchain network initialization; S1.2, independent security audit smart contract and chain code installation, where the independent security audit smart contract includes the audit session on-chain operation strategy carried out by the Lincao Cloud Platform in the blockchain network, as well as the independent security audit operation strategy; S1.3, security situation awareness smart contract definition and chain code installation, where the security situation awareness smart contract includes the data exchange operation strategy in the blockchain network after the independent audit results of the Lincao IoT gateway and the Lincao cloud platform are successfully verified, and the security situation awareness operation strategy in the blockchain network after the independent audit results verification fails.

[0008] A further technical solution is that the audit session on-chain operation strategy includes: Independent audit notification session chain strategy: used for Lincao Cloud Platform to generate audit notifications, issue audit notifications to initiate transactions, and form new blocks after calculation through the blockchain network consensus algorithm and store them in the blockchain network; The audit reply session chain strategy of the forest and grassland IoT gateway is used for the forest and grassland IoT gateway to submit audit data according to the audit notification requirements, and initiate a transaction for the audit reply session. After calculation by the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network; Independent audit successfully completes the session on-chain strategy: It is used for the Lincao Cloud Platform to initiate a transaction after the audit successfully completes the session. After calculation through the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network; Independent audit failure end session chain strategy: used for the Lincao Cloud Platform to initiate a transaction for the audit failure end session, and after calculation by the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network; The independent security audit operation strategy includes: Independent audit initiation decision strategy: The independent audit organization used for the forestry and grassland cloud platform determines whether to initiate an independent audit action based on the independent audit initiation conditions set by the forestry and grassland IoT system; Independent audit notification attribute generation strategy: used by the independent audit organization of the Lincao Cloud Platform to generate the attributes of this independent audit notification; Independent audit notification attribute encryption policy: used by the independent audit organization of the Lincao Cloud Platform to use encryption mechanism to initialize the generation of the system public key, system master key, and decryption key of the audited device of the Lincao Cloud Platform, and encrypt the generated independent audit access control policy; Independent audit notification attribute broadcast strategy: The independent audit organization used in the forest and grassland cloud platform adds an extended audit decision based on the object attribute of the independent audit notification attribute, and broadcasts the ciphertext to the forest and grassland IoT gateway to be audited; Independent security audit detection strategy: The independent audit organization used for the Lincao cloud platform obtains the audit data sent back by the Lincao IoT gateway, decrypts the data using the symmetric key generated when the independent audit notification attribute is encrypted, reads the data in the blockchain network for comparative analysis, and detects the integrity and authenticity of the current and previous data; The data exchange operation strategy includes: Independent audit results storage strategy: The independent audit organization used in the Lincao Cloud Platform initiates a transaction on the decrypted audit results data, which is calculated through the blockchain network consensus algorithm to form a new block storage and enter the blockchain network; The security situation awareness operation strategy includes: DOS attack monitoring strategy: used by the Lincao cloud platform to monitor the Lincao IoT gateways that failed independent audit verification; Injection attack detection strategy: used to check for false data injection attacks on forestry and grassland IoT gateways and / or forestry and grassland IoT terminals.

[0009] A further technical solution is that step S2 includes the following steps: S2.1, determine whether the wake-up time has arrived, if yes, execute step S2.2, if no, wait until the wake-up time arrives; S2.2, the forest and grass IoT gateway wakes up and synchronizes the time with the forest and grass cloud platform; S2.3, the forestry and grassland IoT terminal wakes up and sends the collected data and time synchronization to the forestry and grassland IoT; the forestry and grassland IoT terminal starts to communicate with the forestry and grassland IoT gateway, transmits the collected data to the forestry and grassland IoT gateway, performs clock synchronization and obtains configuration information for local storage; S2.4, the forest and grassland IoT gateway transmits data back to the forest and grassland cloud platform: the forest and grassland IoT gateway transmits the collected data obtained from the forest and grassland IoT terminal to the forest and grassland cloud platform; S2.5, the forestry and grassland IoT gateway and forestry and grassland IoT terminal enter sleep mode.

[0010] A further technical solution is that step S4 includes the following steps: S4.1, Lincao Cloud Platform executes and generates audit notification: Lincao Cloud Platform executes independent audit notification attribute generation strategy to generate audit notification; S4.2, Lincao Cloud Platform puts independent audit notification session on the chain: Lincao Cloud Platform issues the audit notification to the Lincao IoT gateway and / or Lincao IoT terminal, and initiates the transaction of the audit notification issuance session. After calculation by the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network; S4.3, Lincao Cloud Platform uses ciphertext attribute encryption to encrypt audit notifications: Lincao Cloud Platform implements independent audit notification attribute encryption strategy and uses ciphertext attribute encryption to encrypt audit notifications; S4.4, the Lincao Cloud Platform broadcasts the audit notification to the Lincao IoT Gateway: The Lincao Cloud Platform executes and sends the encrypted audit notification ciphertext to the Lincao IoT Gateway in the next data collection cycle.

[0011] A further technical solution is that step S5 includes the following steps: S5.1, the forestry and grassland IoT gateway decrypts the audit notification and conducts an independent audit according to the audit notification requirements: the forestry and grassland IoT gateway uses the forestry and grassland cloud platform system public key, the current forestry and grassland IoT gateway attributes and private key obtained to decrypt the audit notification ciphertext. If the forestry and grassland IoT gateway attributes meet the access policy of the audit notification ciphertext, the ciphertext is decrypted to obtain the audit notification content; S5.2, whether to extend the audit: read the audit content requirements, and determine whether to extend the audit to the forest and grassland IoT terminal according to the extended audit requirements of the audit notice. If yes, execute step S5.3; if no, execute step S5.4. If the decryption of the audit notice fails, execute step S8; S5.3, the forestry and grassland IoT terminal decrypts the audit notification and conducts an independent audit according to the audit notification requirements: the forestry and grassland IoT gateway uses the forestry and grassland cloud platform system public key, the current forestry and grassland IoT terminal attributes and private key obtained to decrypt the audit notification ciphertext. If the forestry and grassland IoT gateway attributes meet the access policy of the audit notification ciphertext, the ciphertext is decrypted to obtain the audit notification content; S5.4. The forestry and grassland IoT gateway submits audit data as required by the audit notice: The forestry and grassland IoT gateway, in accordance with the audit notice, encrypts the data collected locally from the forestry and grassland IoT terminals and locally stored data and transmits them back to the forestry and grassland cloud platform for audit.

[0012] A further technical solution is that step S6 includes the following steps: S6.1, Lincao Cloud Platform Lincao IoT Gateway Audit Response Session on Chain: Lincao IoT Gateway Audit Response Session initiates a transaction, which is calculated by the blockchain network consensus algorithm to form a new block storage and enter the blockchain network; S6.2, Lincao Cloud Platform decrypts the audit return data and conducts comparative audit: Lincao Cloud Platform uses a symmetric key to decrypt the return data to obtain the audit data, and then reads the historical data of the audited device from the blockchain network, and conducts comparative audit on the historical data and the audit data; S6.3, Lincao Cloud Platform conducts independent security audit and gives audit results: Lincao Cloud Platform implements independent security audit strategy to detect the integrity and authenticity of current and previous data; if the audit device replies that the audit data is consistent with the historical data in the blockchain network, the audit passes and step S7 is executed; if the audit device replies to the audit data, but there is no historical data in the blockchain network, the audit fails and step S8 is executed; if the audit device replies to the audit data, but the historical data in the blockchain network is inconsistent, the audit fails and step S8 is executed; if the audit device does not reply to the audit data, but there is historical data in the blockchain network, the audit fails and step S8 is executed; if the audit device does not reply to the audit data, and there is historical data in the blockchain network, the audit fails and step S8 is executed; if the audit device does not reply to the audit data and there is no historical data in the blockchain network, the audit fails and step S8 is executed.

[0013] A further technical solution is that step S7 includes the following steps: S7.1, Lincao Cloud Platform independently audits and successfully completes the session on-chain: Lincao Cloud Platform will audit the successful completion of the session initiation transaction, and after calculation through the blockchain network consensus algorithm, a new block will be formed and stored in the blockchain network; S7.2, Lincao Cloud Platform records and stores audit sessions and results: Lincao Cloud Platform calls the independent audit results storage strategy to store the audit data and audit results obtained by local audits into the database.

[0014] A further technical solution is that step S8 includes the following steps: S8.1, Lincao Cloud Platform independent audit failure end session chain strategy: Lincao Cloud Platform will initiate a transaction to end the session due to audit failure, and after calculation through the blockchain network consensus algorithm, a new block will be formed and stored in the blockchain network; S8.2, Lincao Cloud Platform implements security situation awareness and emergency disposal: Lincao Cloud Platform implements the security situation awareness smart contract disposal strategy based on the audit results and makes rectifications to the audit results.

[0015] To achieve the above purpose, the present invention also provides an independent security audit system of forest and grassland Internet of Things based on smart contracts, which is used to implement any of the above-mentioned independent security audit methods of forest and grassland Internet of Things based on smart contracts. The independent security audit system of forest and grassland Internet of Things based on smart contracts is established on a blockchain network, and the independent security audit of the forest and grassland cloud platform by the forest and grassland Internet of Things gateway is realized by calling and executing smart contracts. The independent security audit system of forest and grassland Internet of Things based on smart contracts includes: Blockchain initialization and smart contract definition module: used to initialize the blockchain network, complete independent security audit smart contract definition and chain code installation, as well as security situation awareness smart contract definition and chain code installation; The periodic operation module of the forest and grassland IoT gateway is used to wake up the forest and grassland IoT gateway according to the configured periodic operation strategy at fixed intervals, obtain configuration information from the forest and grassland cloud platform, and complete data collection, aggregation and transmission from the forest and grassland IoT terminal, and then sleep after completion and wait for the next data collection cycle; The periodic operation module of the forestry and grassland IoT terminal is used to wake up the forestry and grassland IoT terminal according to the configured periodic operation strategy at fixed intervals, obtain configuration information from the forestry and grassland IoT gateway, collect data, aggregate and transmit it to the forestry and grassland IoT gateway, and sleep after completion to wait for the next data collection cycle; Trigger audit judgment module: used by the Lincao Cloud Platform to determine whether the independent audit start conditions are triggered by executing the independent security audit smart contract; Generate independent audit notification and encrypt broadcast module: used for the Lincao cloud platform to generate independent audit notification, encrypt the independent audit notification using ciphertext attribute encryption, and broadcast the independent audit notification ciphertext from the Lincao cloud platform to the Lincao IoT gateway in the next data collection cycle; Audit module of forestry and grassland IoT gateway: used for the forestry and grassland IoT gateway to decrypt the ciphertext of independent audit notification, and when the attributes of the forestry and grassland IoT gateway meet the access policy of independent audit notification, decrypt the ciphertext to obtain the content of independent audit notification, and conduct independent security audit and return audit data according to the requirements of independent audit notification; Extended audit module for forestry and grassland IoT terminals: used for receiving and decrypting independent audit notifications issued by the forestry and grassland IoT gateway when the independent audit notification requires an extended audit. When the forestry and grassland IoT terminal attributes meet the independent audit notification access policy, decrypt the ciphertext to obtain the independent audit notification content, conduct independent security audits in accordance with the independent audit notification requirements, and return audit data. Verify the audit result module returned by the audited device: It is used by the Lincao Cloud Platform to decrypt the returned audit data and compare it with the historical data stored in the blockchain network, and complete the data integrity and system security detection by judging the consistency of the data; Storage audit session and audit result module: used by the Lincao Cloud Platform to record the independent audit session into the blockchain network, and store the audit data and audit conclusions obtained by the local audit into the audit database; Security situation awareness and emergency response module: used for the forestry and grassland IoT gateway to record the failed independent audit session into the blockchain network, and perform security situation awareness and emergency response according to the audit conclusion type.

[0016] Compared with the existing technology, the present invention takes advantage of the blockchain technology and the ciphertext policy attribute-based encryption technology to provide a decentralized, transparent, tamper-proof and traceable, flexible, efficient and dynamically adjustable independent security audit mechanism for the forest and grassland Internet of Things, which has the following advantages: (1) Decentralization and distribution: Deployed on the blockchain through smart contracts, the independent security audit method has decentralized and distributed characteristics. There is no single central point that can control or tamper with access rights, which enhances the security and robustness of the system.

[0017] (2) Transparency and immutability: All smart contract executions and transactions are recorded on the blockchain network, ensuring transparency and immutability, which can effectively prevent malicious actors from modifying access control rules or abusing permissions.

[0018] (3) Dynamicity and flexibility: Smart contracts can automatically execute and adjust independent security audit content according to preset rules and conditions. This enables independent security audit strategies to be dynamically adjusted according to the real-time status and needs of the forest and grassland IoT, increasing the flexibility and adaptability of the system.

[0019] (4) Fine-grained access control: CP-ABE allows fine-grained access control based on user attributes and roles. Different access rights can be set for different users or user groups to meet the complex permission requirements in the forest and grassland Internet of Things.

[0020] (5) Enhanced security: CP-ABE uses encryption technology to protect data security and conducts independent security audits based on the attributes of the audit subject and audit object. Only users with appropriate attributes can decrypt and access data, which helps prevent unauthorized access and data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0022] Figure 1 A schematic diagram of a process of an independent security audit method for forest and grassland Internet of Things based on smart contracts according to an embodiment of the present invention; Figure 2 A flowchart of a blockchain network initialization and smart contract definition process according to an embodiment of the present invention; Figure 3 A schematic diagram of the process of periodic operation of a forest and grassland Internet of Things system according to an embodiment of the present invention; Figure 4 A flowchart of the process of generating an audit notification and broadcasting it to the forestry and grassland Internet of Things gateway in an encrypted manner on the forestry and grassland cloud platform involved in one embodiment of the present invention; Figure 5 A schematic diagram of a process for a forest and grassland IoT gateway to decrypt an audit notice and conduct an independent audit process according to the audit notice requirements in accordance with an embodiment of the present invention; Figure 6 A schematic diagram of a process for independently auditing and verifying data security of a forestry and grassland cloud platform according to an embodiment of the present invention; Figure 7 This is a structural block diagram of an independent security audit system for forest and grassland Internet of Things based on smart contracts involved in one implementation mode of the present invention; Figure 8 The present invention is a schematic diagram of the execution process of an independent security audit system for forest and grassland Internet of Things based on smart contracts involved in one embodiment of the present invention. DETAILED DESCRIPTION

[0023] The present invention is described in detail below in conjunction with the accompanying drawings. The description in this part is only exemplary and explanatory and should not have any limiting effect on the scope of protection of the present invention. In addition, those skilled in the art can make corresponding combinations of the features in the embodiments and in different embodiments in this document based on the description of this document.

[0024] The embodiments of the present invention are as follows, referring to Figure 1 , an independent security audit method for forest and grassland Internet of Things based on smart contracts, including the following steps: S1, blockchain network initialization and smart contract definition: system builders select appropriate blockchain types and specific blockchain platforms based on application scenarios, and carry out organization registration, identity authentication and user verification. Define alliances for organizations based on actual business and create channels for alliances. Issue certificates to the organization's client user nodes, peer nodes, sorting nodes, and identity authentication nodes through certificate authorities. Each organization approves the chain code definition and endorsement policy definition and completes storage on the channel ledger. Complete independent security audit smart contract definition and chain code installation, as well as security situation awareness smart contract definition and chain code installation; like Figure 2 , the specific steps in step S1 are as follows: S1.1, blockchain network initialization: select the appropriate blockchain type and specific blockchain platform according to the application scenario, carry out organization registration, identity authentication and verification, define the alliance for the organization according to the actual business and create a channel for the alliance, issue certificates to the organization's client user nodes, peer nodes, sorting nodes, and identity authentication nodes through the certificate authority (CA), and each organization approves the chain code definition and endorsement policy definition and completes the storage on the channel ledger.

[0025] For the forest and grassland IoT application scenario, considering that the users are mainly forest and grassland management departments, the data has strong industry attributes and needs to be connected to the Internet for information exchange. It is most appropriate to use a consortium chain, and Hyperledger Fabric is one of the most widely used consortium chain platforms in the world. Therefore, the Fabric blockchain platform is recommended for the method of the present invention.

[0026] For the forestry and grassland Internet of Things system, the forestry and grassland management departments at all levels are organizations, and usually establish organizations and alliances according to administrative levels. For example, the forestry and grassland management departments at the municipal and county levels are organizations, and alliances are established at the provincial level. Channels are built to enable organizations to communicate with each other and maintain a common ledger.

[0027] Each organization is an organization administrator registered in the Fabric blockchain network MSP, and sends requests and obtains services through the client user node to the Lincao IoT Independent Security Audit Application System deployed on the Lincao Cloud Platform.

[0028] Before the audit, under the supervision of the established audit team, the system administrator will establish an audit department organization in the Fabric blockchain network, register the auditors of the audit department organization through MSP, join the channel to maintain the common ledger, and conduct independent audits on the alliances, organizations and administrators of the audited forest and grassland IoT system.

[0029] S1.2, independent security audit smart contract and chain code installation, where the independent security audit smart contract includes the audit session on-chain operation strategy carried out by the Lincao Cloud Platform in the blockchain network, as well as the independent security audit operation strategy, and the chain code is installed through the client node of the Lincao Cloud Platform; The audit session on-chain operation strategy includes: Independent audit notification session chain strategy: After the triggering audit conditions are met, the Lincao Cloud Platform generates an audit notification and distributes the audit notification to the Lincao IoT gateway and / or Lincao IoT terminal. The client of the Lincao Cloud Platform initiates a transaction for the audit notification distribution session. After calculation by the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network, so that the audit notification behavior cannot be tampered with and can be traced; The audit response session chain strategy of the forest and grass IoT gateway: After the forest and grass IoT gateway submits the audit data according to the audit notification requirements, the client of the forest and grass IoT gateway of the forest and grass cloud platform initiates the transaction of the audit response session of the forest and grass IoT gateway. After the calculation by the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network, so as to realize the tamper-proof and traceable audit response behavior of the forest and grass IoT gateway. Independent audit successfully completes the session chain strategy: After the Lincao Cloud Platform successfully verifies the audit data of the Lincao IoT Gateway and the Lincao IoT Terminal, the client of the Lincao Cloud Platform will initiate a transaction for the successful completion of the audit session. After calculation by the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network, so that the audit results and behaviors cannot be tampered with and can be traced; Strategy for ending the independent audit failure and uploading the session to the blockchain: After the Lincao Cloud Platform fails to verify the audit data of the Lincao IoT Gateway and the Lincao IoT Terminal, the client of the Lincao Cloud Platform will initiate a transaction to end the audit failure session. After calculation by the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network, so that the audit failure behavior cannot be tampered with and can be traced; For the forest and grassland IoT system, the data format of the session is consistent. The structure of the session is as follows: Sessions (session ID, session type, session subject, session object, session send time, session receive time, session status) are stored in key-value pairs. The session ID is the unique number of the session; Session types include but are not limited to independent audit notification session, forest and grassland IoT gateway audit reply session, independent audit successful completion session, and independent audit failure session; The session subject is the attribute of the session generator and sender, which can be represented by a single attribute or a composite key value; The session topic is the receiver and storage attributes of the session, which can be represented by a single attribute or a composite key value; The session sending time is the time when the session subject sends the session; The session receiving time is the time when the session object receives the session; The session status describes the current status of the session, including but not limited to sent, received, failed to send, and failed to receive.

[0030] For example, for an independent audit notification session, the session record is (session_ID: 20210000001, session_Type: "Independent Audit Notification Session", session_subject: {"sjy_ID": SJ001, deviceID: C2300101000XXX01, MAC: 48:e2:xx:xx:6f:f9}, session_object: {"sjy_ID": SJ001, deviceID: C2300101000XXX01, MAC: 48:e2:xx:xx:6f:f9}, createTime: 202104022038, endTime: 202104022039, session_result: "Sent").

[0031] The independent security audit operation strategy includes: Independent audit initiation decision strategy: The independent audit organization of the Lincao Cloud Platform determines whether to initiate an independent audit action based on the independent audit initiation conditions set by the Lincao IoT system. The independent audit initiation conditions here may include but are not limited to reaching a specified time node or a specified period of time, such as an audit once a year, or starting an audit on December 1st of each year, touching on an emergency security status or a fixed business function, such as network situational awareness entering an emergency disposal state, and automatically initiating an independent audit after disposal; Independent audit notification attribute generation strategy: The independent audit organization of the Lincao Cloud Platform generates the attributes of this independent audit notification. The audit notification is an attribute-based access control request, which consists of audit subject attributes, audit object attributes, permission attributes, and environmental attributes. For the Lincao IoT system, the audit subject attributes are the audit organization and audit client information, and a symmetric encryption algorithm and key are generated for encrypting the return data of the audit object. The object attributes are the Lincao IoT gateway and / or the Lincao IoT system terminal. The permission attributes are the Lincao Cloud Platform’s operating permissions for the Lincao IoT gateway and / or the Lincao IoT terminal. The environmental attributes are the environmental information when the independent audit is generated; The audit subject attributes are the audit organization and audit client information, such as client IP, client port number, client account, encryption algorithm, and symmetric key. {Client IP: 192.168.8.106, client port number: 5058, client account: auditadmin, encryption algorithm: SM4, symmetric key: Sa@123456}.

[0032] The object attributes are forestry and grass IoT gateways and / or forestry and grass IoT system terminals, such as device name, device type, device MAC and other information, which are stored in key-value pairs. {Device type: forestry and grass IoT gateway, gateway location: Luhuo County, device name: Getwey101, device MAC: 23:e4:xx:xx:5f:k9, extended audit: yes, device type: forestry and grass IoT terminal, terminal location: Luhuo County, device name: ALL, device MAC: ALL}.

[0033] The operations of permission attributes include read, write, and execute; Environmental attributes include, but are not limited to, controlling the start time, end time, and initiator of the access session.

[0034] An audit notification initiated by the client with IP address 192.168.8.106 and the audit account auditadmin to audit all forest and grassland IoT gateways and forest and grassland IoT terminals deployed in Luhuo County from 20:38 on April 2, 2021 to 20:38 on April 3, 2021 is as follows: {"Action":"audit","Notice":{AS:{Client IP:192.168.8.106, Client user: auditadmin, Encryption algorithm: SM4, Symmetric key: Sa@123456}}, AO:{Device type: Lincao IoT Gateway, Device location: Luhuo County, Device name: ALL, Device MAC: ALL, Extended audit: Yes, Device type: Lincao IoT Terminal, Terminal location: Luhuo County, Device name: ALL, Device MAC: ALL}, AP:"read", AE:{Start time:202104022038, End time:202104032038, Initiator: auditadmin}}}.

[0035] Independent audit notification attribute encryption strategy: The independent audit organization of the Lincao Cloud Platform uses the CP-ABE encryption mechanism to initialize and generate the Lincao Cloud Platform system public key PK, system master key MK, and the decryption key S of the audited device, and encrypts them using PK, MK and the generated independent audit access control policy; (1) The certificate authority CA of the Lincao Cloud Platform initializes and generates the Lincao Cloud Platform system public key PK, system master key MK, and decryption key S of the audited device based on the attributes of the audited device.

[0036] (2) The independent audit organization of the Lincao Cloud Platform encrypts the audit notification using PK, MK and independent audit access control policy.

[0037] Since the ciphertext length is small, the ciphertext attribute encryption method here uses the classic linear secret sharing matrix CP-ABE scheme, which will not be described here.

[0038] The independent audit access control policy here is determined by the audit object and audit content. For example, if all IoT terminals in Luhuo County are audited, the independent audit access control policy is "Device Type = Forestry and Grassland IoT Terminal AND Terminal Location = Luhuo County AND Device Name = ALL".

[0039] Because of the use of ciphertext attribute encryption, the Lincao Cloud Platform can control who can access the data, ensuring that the independent audit organization of the Lincao Cloud Platform and the Lincao IoT terminals can conduct encrypted communications without exposing the keys.

[0040] Independent audit notification attribute broadcast strategy: The independent audit organization of the forestry and grassland cloud platform attaches an extended audit decision based on the object attributes of the independent audit notification attributes, and broadcasts the ciphertext to the forestry and grassland IoT gateway to be audited; Independent security audit detection strategy: The independent audit organization of the Lincao Cloud Platform obtains the audit data sent back by the Lincao IoT gateway, decrypts the data using the symmetric key generated when the independent audit notification attribute is encrypted, reads the data in the blockchain network for comparative analysis, and detects the integrity and authenticity of this and previous data; S1.3, security situation awareness smart contract definition and chain code installation, where the security situation awareness smart contract includes the data exchange operation strategy in the blockchain network after the independent audit results of the Lincao IoT Gateway and Lincao Cloud Platform are successfully verified, and the security situation awareness operation strategy in the blockchain network after the independent audit results are verified and failed; The data exchange operation strategy includes: Independent audit results storage strategy: The independent audit organization of the Lincao Cloud Platform initiates a transaction on the decrypted audit results data. Specifically, the client of the Lincao Cloud Platform initiates a transaction on the audit results data. After calculation through the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network, so that the audit results data cannot be tampered with and can be traced; The security situation awareness operation strategy includes: DOS attack monitoring strategy: The Lincao Cloud Platform monitors the Lincao IoT gateways that have failed independent audit verification. When the number of failed accesses to the same Lincao IoT gateway exceeds the specified threshold, the security threat emergency disposal strategy is triggered. Injection attack detection strategy: Check whether there is false data injection attack on the forestry and grassland IoT gateway and / or forestry and grassland IoT terminal. The mainstream methods include Kalman filter, deep learning, and neural network, which are not elaborated here.

[0041] S2, the forest and grassland IoT system operates periodically: the forest and grassland IoT system wakes up the forest and grassland IoT gateway and the forest and grassland IoT terminal at the scheduled time to complete data collection, aggregation and transmission. After completion, the forest and grassland IoT gateway and the forest and grassland IoT terminal enter sleep mode and wait for the next data collection cycle; like Figure 3 , the specific steps in step S2 are as follows: S2.1, determine whether the wake-up time has arrived, if yes, execute step S2.2, if no, wait until the wake-up time arrives; S2.2, the Forestry and Grassland IoT Gateway wakes up and synchronizes with the Forestry and Grassland Cloud Platform time; The Forestry and Grassland IoT Gateway starts running and communicates with the Forestry and Grassland Cloud Platform through the wireless communication network through its own real-time clock and the Forestry and Grassland IoT Gateway wake-up time in the locally stored configuration information, synchronizes the clock with the Forestry and Grassland Cloud Platform and obtains the configuration information for local storage. The configuration information includes but is not limited to the Forestry and Grassland IoT Gateway wake-up time, the Forestry and Grassland IoT Gateway wake-up duration, the Forestry and Grassland IoT Terminal wake-up time, and the Forestry and Grassland IoT Terminal wake-up duration. Wireless communication networks include but are not limited to cellular networks such as 2G, 3G, 4G, and 5G.

[0042] S2.3, the forest and grassland IoT terminal wakes up and sends the collected data and time synchronization to the forest and grassland IoT; the forest and grassland IoT terminal starts running and communicates with the forest and grassland IoT gateway through the wireless networking network through its own real-time clock and the forest and grassland IoT terminal wake-up time in the local storage configuration information, transmits the collected data to the forest and grassland IoT gateway, and performs clock synchronization and obtains the configuration information for local storage. The configuration information is consistent with that of the forest and grassland IoT gateway. Wireless ad hoc networks include but are not limited to wireless communication networks such as WiFi, Bluetooth, and Lora. The collected data includes but is not limited to the tree diameter at breast height, location, temperature and humidity, tilt angle, etc.

[0043] S2.4, the forestry and grassland IoT gateway transmits data back to the forestry and grassland cloud platform: the forestry and grassland IoT gateway transmits the collected data obtained from the forestry and grassland IoT terminal to the forestry and grassland cloud platform through the wireless communication network, and disconnects the wireless self-organizing network connection with the forestry and grassland IoT terminal.

[0044] S2.5, the forestry and grassland IoT gateway and the forestry and grassland IoT terminal enter sleep mode: the forestry and grassland IoT gateway and the forestry and grassland IoT terminal enter sleep mode after reaching the wake-up time of the forestry and grassland IoT gateway and the forestry and grassland IoT terminal respectively, and wait for the wake-up time to arrive.

[0045] S3, triggering audit: the Lincao Cloud Platform executes the independent security audit smart contract and determines whether the independent audit start condition is triggered. If so, it executes step S4, otherwise, it executes step S2; The forestry and grassland Internet of Things system executes the independent audit startup strategy of the independent security audit smart contract to determine whether an independent audit is triggered. If the independent audit startup conditions are met, the auditor account organized by the MSP registration and audit department in the blockchain network will conduct an independent audit of the alliance, organization and administrator of the audited forestry and grassland Internet of Things system.

[0046] The conditions for initiating an independent audit here may include but are not limited to reaching a specified time node or passing a specified period of time, such as an audit once a year, or starting an audit on December 1st of each year, triggering an emergency security status or a fixed business function, such as network situation awareness entering an emergency disposal state, and automatically initiating an independent audit after the disposal.

[0047] S4, generate independent audit notification and encrypt and broadcast: the forest and grass cloud platform generates an independent audit notification, encrypts the independent audit notification using ciphertext attribute encryption, and the forest and grass cloud platform broadcasts the ciphertext of the independent audit notification to the forest and grass IoT gateway in the next data collection cycle; like Figure 4 , the specific steps in step S4 are as follows: S4.1, Lincao Cloud Platform executes and generates audit notification: Lincao Cloud Platform executes the independent audit notification attribute generation strategy of the independent security audit smart contract to generate audit notification. Audit notification is an attribute-based access control request, which consists of audit subject attributes, audit object attributes, permission attributes, and environmental attributes. For the Lincao IoT system, the audit subject attributes are the audit organization and audit client information, and a symmetric encryption algorithm and key are generated for encrypting and returning data of the audit object. The object attributes are the Lincao IoT gateway and / or the Lincao IoT system terminal. The permission attributes are the Lincao Cloud Platform’s operating authority over the Lincao IoT gateway and / or the Lincao IoT terminal. The environmental attributes are the environmental information when the independent audit is generated.

[0048] The audit subject attributes are the audit organization and audit client information, such as client IP, client port number, client account, encryption algorithm, and symmetric key. {Client IP: 192.168.8.106, client port number: 5058, client account: auditadmin, encryption algorithm: SM4, symmetric key: Sa@123456}.

[0049] The object attributes are forestry and grass IoT gateways and / or forestry and grass IoT system terminals, such as device name, device type, device MAC and other information, which are stored in key-value pairs. {Device type: forestry and grass IoT gateway, gateway location: Luhuo County, device name: Getwey101, device MAC: 23:e4:xx:xx:5f:k9, extended audit: yes, device type: forestry and grass IoT terminal, terminal location: Luhuo County, device name: ALL, device MAC: ALL}.

[0050] The operations of permission attributes include read, write, and execute; Environmental attributes include, but are not limited to, controlling the start time, end time, and initiator of the access session.

[0051] An audit notification initiated by the client with IP address 192.168.8.106 and the audit account auditadmin to audit all forest and grassland IoT gateways and forest and grassland IoT terminals deployed in Luhuo County from 20:38 on April 2, 2021 to 20:38 on April 3, 2021 is as follows: {"Action":"audit","Notice":{AS:{Client IP:192.168.8.106, Client user: auditadmin, Encryption algorithm: SM4, Symmetric key: Sa@123456}}, AO:{Device type: Lincao IoT Gateway, Device location: Luhuo County, Device name: ALL, Device MAC: ALL, Extended audit: Yes, Device type: Lincao IoT Terminal, Terminal location: Luhuo County, Device name: ALL, Device MAC: ALL}, AP:"read", AE:{Start time:202104022038, End time:202104032038, Initiator: auditadmin}}}.

[0052] S4.2, Lincao Cloud Platform puts independent audit notification sessions on the chain: After the triggering audit conditions are met, the Lincao Cloud Platform generates an audit notification and sends the audit notification to the Lincao IoT gateway and / or Lincao IoT terminal. The client of the Lincao Cloud Platform initiates a transaction for the audit notification session. After calculation by the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network, so that the audit notification behavior cannot be tampered with and can be traced; S4.3, Lincao Cloud Platform uses ciphertext attribute encryption to encrypt audit notifications: The Lincao Cloud Platform implements the independent audit notification attribute encryption strategy of the independent security audit smart contract and uses ciphertext attribute encryption to encrypt audit notifications.

[0053] Before encryption, the certificate authority CA of the Lincao Cloud Platform will initialize and generate the Lincao Cloud Platform system public key PK, system master key MK, and decryption key S of the audited device based on the attributes of the audited device.

[0054] The independent audit organization of the Lincao Cloud Platform uses PK, MK and independent audit access control policy to encrypt the audit notification. Due to the small length of the ciphertext, the ciphertext attribute encryption method here uses the classic linear secret sharing matrix CP-ABE scheme, which is not described here. The independent audit access control policy here is determined by the audit object and the audit content. For example, if all IoT terminals in Luhuo County are audited, then the independent audit access control policy is "Device Type = Lincao IoT Terminal AND Terminal Location = Luhuo County AND Device Name = ALL". Due to the use of ciphertext attribute encryption, the Lincao Cloud Platform can control who can access the data, and ensure that the independent audit organization of the Lincao Cloud Platform and the Lincao IoT Terminal can communicate encrypted without exposing the key; S4.4, Lincao Cloud Platform broadcasts audit notification to Lincao IoT Gateway: Lincao Cloud Platform executes and sends the encrypted audit notification ciphertext to Lincao IoT Gateway in the next data collection cycle. The audit notification here is encrypted by CP-ABE scheme, and the audit notification content can only be decrypted and obtained when the attributes of the audited device meet the access policy of CP-ABE.

[0055] S5, the audited device receives the audit notification and conducts the audit: decrypts the ciphertext of the independent audit notification, obtains the content of the independent audit notification, conducts an independent security audit according to the requirements of the independent audit notification, and transmits the audit data back; like Figure 5 , the specific steps in step S5 are as follows: S5.1, the forestry and grassland IoT gateway decrypts the audit notification and conducts an independent audit according to the audit notification requirements: the forestry and grassland IoT gateway uses the forestry and grassland cloud platform system public key PK, obtains the current forestry and grassland IoT gateway attributes and private key, and decrypts the audit notification ciphertext. If the forestry and grassland IoT gateway attributes meet the access policy of the audit notification ciphertext, the ciphertext is decrypted to obtain the audit notification content; S5.2, whether to extend the audit: read the audit content requirements, and determine whether to extend the audit to the forest and grassland IoT terminal according to the extended audit requirements of the audit notice. If yes, execute step S5.3; if no, execute step S5.4. If the decryption of the audit notice fails, execute step S8; Read the audit content requirements and process the forest and grassland IoT gateway devices and data according to the permission attributes and environment attribute requirements. For example, if the end time is 202104032038 and the AP is "read", it means that the forest and grassland IoT gateway data must be read and sent back to the independent audit organization of the forest and grassland cloud platform before 20:38 on April 3, 2021.

[0056] S5.3, the forestry and grassland IoT terminal decrypts the audit notification and conducts an independent audit according to the audit notification requirements: the forestry and grassland IoT gateway uses the forestry and grassland cloud platform system public key PK, obtains the attributes and private key of the current forestry and grassland IoT terminal, and decrypts the audit notification ciphertext. If the forestry and grassland IoT gateway attributes meet the access policy of the audit notification ciphertext, the ciphertext is decrypted to obtain the audit notification content; S5.4. The forestry and grassland IoT gateway submits audit data as required by the audit notice: The forestry and grassland IoT gateway, in accordance with the audit notice, encrypts the data collected locally from the forestry and grassland IoT terminals and locally stored data and transmits them back to the forestry and grassland cloud platform for audit.

[0057] S6, verify the audit result returned by the audited device: the Lincao Cloud Platform decrypts the returned audit data and compares it with the historical data stored in the blockchain network. By judging the consistency of the data, the data integrity and system security detection are completed. If the judgment and verification result is passed, step S7 is executed, otherwise, step S8 is executed; like Figure 6 , the specific steps in step S6 are as follows: S6.1, Lincao Cloud Platform Lincao IoT Gateway Audit Response Session on Chain: After the Lincao IoT Gateway submits the audit data according to the audit notification requirements, the Lincao IoT Gateway Audit Response Session of the Lincao Cloud Platform client initiates a transaction. After calculation through the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network, making the audit response behavior of the Lincao IoT Gateway unalterable and traceable; S6.2, Lincao Cloud Platform decrypts the audit return data and conducts comparative audit: The audit organization client of Lincao Cloud Platform uses a symmetric key to decrypt the return data to obtain the audit data, and then reads the historical data of the audited device from the blockchain network, and conducts comparative audit on the historical data and the audit data; S6.3, Lincao Cloud Platform conducts independent security audit and gives audit results: Lincao Cloud Platform implements the independent security audit strategy of the independent security audit smart contract to detect the integrity and authenticity of current and previous data.

[0058] If the audit device replies with audit data that is consistent with the historical data in the blockchain network, the audit result is: the audit passed, and step S7 is executed; If the audit device has replied audit data, but there is no historical data in the blockchain network, the audit result is: the audit fails, and it is suspected that the Lincao Cloud platform has been attacked, with a focus on denial of service attacks and internal attacks, and step S8 is executed; If the audit device replies with audit data, but the historical data in the blockchain network is inconsistent, the audit result indicates that the audit has failed, and it is suspected that the Lincao Cloud platform has been attacked, with a focus on injection attacks and internal attacks, and step S8 is executed; If the audit device does not reply to the audit data, but there is historical data in the blockchain network, the audit result is: the audit fails, it is suspected that the forestry and grassland IoT device has been attacked, and the focus is on device hijacking, and step S8 is executed; If the audit device does not respond to the audit data and there is no historical data in the blockchain network, the audit result is: the audit fails, and there is a suspected physical attack on the forestry and grassland IoT device. Focus on physical destruction attacks and equipment failures, and execute step S8.

[0059] S7, store audit session and audit results: Lincao Cloud Platform records this independent audit session into the blockchain network, and stores the audit data and audit conclusions obtained by the local audit in the audit database; The specific steps in step S7 are as follows: S7.1, Lincao Cloud Platform independent audit successfully completes the session on-chain: After the Lincao Cloud Platform successfully verifies the audit data of the Lincao IoT Gateway and the Lincao IoT Terminal, the client of the Lincao Cloud Platform will initiate a transaction for the successful completion of the audit session. After calculation by the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network, so that the audit results and behaviors cannot be tampered with and can be traced; S7.2, Lincao Cloud Platform records and stores audit sessions and results: Lincao Cloud Platform calls the independent audit results storage strategy of the security situation awareness smart contract to store the audit data and audit results obtained by local audits into the database.

[0060] S8, security situation awareness and emergency disposal: The forest and grassland IoT gateway will record the failed independent audit session into the blockchain network, and perform security situation awareness and emergency disposal according to the audit conclusions and types; The specific steps in step S8 are as follows: S8.1, Lincao Cloud Platform independent audit failure end session chain strategy: After the Lincao Cloud Platform fails to verify the audit data of the Lincao IoT gateway and the Lincao IoT terminal, the client of the Lincao Cloud Platform will initiate a transaction to end the audit failure session. After calculation by the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network, so as to achieve the immutability and traceability of the audit failure behavior; S8.2, Lincao Cloud Platform implements security situation awareness and emergency disposal: Lincao Cloud Platform implements the security situation awareness smart contract disposal strategy based on the audit results and makes rectifications to the audit results: When the audit result is: the audit fails, it is suspected that the Lincao Cloud platform has been attacked, and the focus is on denial of service attacks and internal attacks. Execute the DOS attack monitoring strategy of the security situation awareness smart contract to check whether the access IP and / or access port exceeds the access upper limit threshold. If not, focus on screening internal attacks.

[0061] When the audit result is: the audit fails, it is suspected that the Lincao cloud platform has been attacked, and the focus is on injection attacks and internal attacks. Execute the injection attack detection strategy of the security situation awareness smart contract to check whether there is false data injection attack on the Lincao IoT gateway and / or Lincao IoT terminal. The mainstream methods include Kalman filter, deep learning, and neural network, which are not described here. No, focus on screening internal attacks.

[0062] When the audit result is: audit failed, it is suspected that the forestry and grassland IoT device has been attacked, and the focus is on device hijacking. Investigators will check on-site whether the forestry and grassland IoT device is currently lost or damaged.

[0063] When the audit result is: audit failed, suspected physical attack on forestry and grassland IoT devices, focus on physical damage attack and equipment failure. Investigators will check on-site whether the forestry and grassland IoT devices are currently lost or damaged.

[0064] S9, determine whether the monitoring work is completed, if not, execute step S2, if yes, the process ends.

[0065] The technical solution of the present invention aims at the problems of data integrity and system security detection of forestry and grassland Internet of Things systems under internal attack threats and in complex open environments. By defining an independent security audit smart contract in the blockchain network, an independent audit notification is generated by encrypting it using ciphertext attribute encryption, broadcasting it to the audited forestry and grassland Internet of Things devices, and obtaining the audit content and audit results through attribute decryption, the forestry and grassland Internet of Things system is decentralized, transparent, tamper-proof and traceable, while an independent security audit mode that is flexible, efficient and dynamically adjustable is achieved, effectively solving the problems of data integrity and system security detection of forestry and grassland Internet of Things systems in complex open environments.

[0066] The present invention also provides an independent security audit system for forest and grassland Internet of Things based on smart contracts, which is used to implement any of the above-mentioned independent security audit methods for forest and grassland Internet of Things based on smart contracts. The embodiments are as follows: the independent security audit system for forest and grassland Internet of Things based on smart contracts is established on a blockchain network, and the independent security audit of the forest and grassland cloud platform by the forest and grassland Internet of Things gateway is realized by calling and executing smart contracts, such as Figure 7 The forest and grassland IoT independent security audit system based on smart contracts includes: Blockchain initialization and smart contract definition module: used to initialize the blockchain network, complete independent security audit smart contract definition and chain code installation, as well as security situation awareness smart contract definition and chain code installation; The periodic operation module of the forest and grassland IoT gateway is used to wake up the forest and grassland IoT gateway according to the configured periodic operation strategy at fixed intervals, obtain configuration information from the forest and grassland cloud platform, and complete data collection, aggregation and transmission from the forest and grassland IoT terminal, and then sleep after completion and wait for the next data collection cycle; The periodic operation module of the forestry and grassland IoT terminal is used to wake up the forestry and grassland IoT terminal according to the configured periodic operation strategy at fixed intervals, obtain configuration information from the forestry and grassland IoT gateway, collect data, aggregate and transmit it to the forestry and grassland IoT gateway, and sleep after completion to wait for the next data collection cycle; Trigger audit judgment module: used by the Lincao Cloud Platform to determine whether the independent audit start conditions are triggered by executing the independent security audit smart contract; Generate independent audit notification and encrypt broadcast module: used for the Lincao cloud platform to generate independent audit notification, encrypt the independent audit notification using ciphertext attribute encryption, and broadcast the independent audit notification ciphertext from the Lincao cloud platform to the Lincao IoT gateway in the next data collection cycle; Audit module of forestry and grassland IoT gateway: used for the forestry and grassland IoT gateway to decrypt the ciphertext of independent audit notification, and when the attributes of the forestry and grassland IoT gateway meet the access policy of independent audit notification, decrypt the ciphertext to obtain the content of independent audit notification, and conduct independent security audit and return audit data according to the requirements of independent audit notification; Extended audit module for forestry and grassland IoT terminals: used for receiving and decrypting independent audit notifications issued by the forestry and grassland IoT gateway when the independent audit notification requires an extended audit. When the forestry and grassland IoT terminal attributes meet the independent audit notification access policy, decrypt the ciphertext to obtain the independent audit notification content, conduct independent security audits in accordance with the independent audit notification requirements, and return audit data. Verify the audit result module returned by the audited device: It is used by the Lincao Cloud Platform to decrypt the returned audit data and compare it with the historical data stored in the blockchain network, and complete the data integrity and system security detection by judging the consistency of the data; Storage audit session and audit result module: used by the Lincao Cloud Platform to record the independent audit session into the blockchain network, and store the audit data and audit conclusions obtained by the local audit into the audit database; Security situation awareness and emergency response module: used for the forestry and grassland IoT gateway to record the failed independent audit session into the blockchain network, and perform security situation awareness and emergency response according to the audit conclusion type.

[0067] In order to better understand the technical solution of the present invention, an embodiment of the execution process of the blockchain-based zero-trust forest and grassland Internet of Things identity authentication system of the present invention is provided as follows: Figure 8 : (1) The system administrator executes the blockchain initialization and smart contract definition module to initialize the blockchain network and define smart contracts in the Lincao Cloud Platform.

[0068] (2) The Forestry and Grassland IoT Gateway executes the periodic operation module of the Forestry and Grassland IoT Gateway, periodically collects data from the Forestry and Grassland IoT terminals, and aggregates and transmits it to the Forestry and Grassland Cloud Platform for storage.

[0069] (3) The forest and grassland Internet of Things terminal executes the periodic operation module of the forest and grassland Internet of Things terminal to periodically collect and submit perception data.

[0070] (4) The Lincao Cloud Platform executes the trigger audit judgment module to determine whether the independent audit start condition is triggered. If yes, proceed to step (4); if no, proceed to step (2) (5) The Lincao Cloud Platform executes the module for generating independent audit notifications and encrypting and broadcasting them, generating, encrypting, and broadcasting independent audit notifications to the audited devices.

[0071] (6) The forest and grassland Internet of Things gateway executes the forest and grassland Internet of Things gateway audit module and conducts the forest and grassland Internet of Things gateway audit in accordance with the requirements of the independent audit notice.

[0072] (7) The forest and grassland Internet of Things terminals shall implement the extended audit module of the forest and grassland Internet of Things terminals and conduct the audit of the forest and grassland Internet of Things terminals in accordance with the requirements of the independent audit notice.

[0073] (8) The Lincao Cloud Platform verifies the audit result module returned by the audited device to verify data integrity and system security. If passed, proceed to step (9); if not, proceed to step (10).

[0074] (9) The Lincao Cloud Platform executes the storage audit session and audit result module, and stores the audit data and audit conclusions in the audit database.

[0075] (10) The Lincao Cloud Platform implements the security situation awareness and emergency response module, and performs security situation awareness and emergency response according to the audit conclusions.

[0076] (11) End the process.

[0077] For ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention, and these improvements and modifications should also be considered as the scope of protection of the present invention.

Claims

1. An independent security audit method for forest and grassland Internet of Things based on smart contracts, characterized in that: The steps include: S1, blockchain network initialization and smart contract definition: select the blockchain type and blockchain platform, initialize the blockchain network, complete the independent security audit smart contract definition and chain code installation, as well as the security situation awareness smart contract definition and chain code installation; S2, the forest and grassland IoT system operates periodically: the forest and grassland IoT system wakes up the forest and grassland IoT gateway and the forest and grassland IoT terminal at the scheduled time to complete data collection, aggregation and transmission. After completion, the forest and grassland IoT gateway and the forest and grassland IoT terminal enter sleep mode and wait for the next data collection cycle; S3, triggering audit: the Lincao Cloud Platform executes the independent security audit smart contract and determines whether the independent audit start condition is triggered. If so, it executes step S4, otherwise, it executes step S2; S4, generate independent audit notification and encrypt and broadcast: the forest and grass cloud platform generates an independent audit notification, encrypts the independent audit notification using ciphertext attribute encryption, and the forest and grass cloud platform broadcasts the ciphertext of the independent audit notification to the forest and grass IoT gateway in the next data collection cycle; S5, the audited device receives the audit notification and conducts the audit: decrypts the ciphertext of the independent audit notification, obtains the content of the independent audit notification, conducts an independent security audit according to the requirements of the independent audit notification, and transmits the audit data back; S6, verify the audit result returned by the audited device: the Lincao Cloud Platform decrypts the returned audit data and compares it with the historical data stored in the blockchain network. By judging the consistency of the data, the data integrity and system security detection are completed. If the judgment and verification result is passed, step S7 is executed, otherwise, step S8 is executed; S7, store audit session and audit results: Lincao Cloud Platform records this independent audit session into the blockchain network, and stores the audit data and audit conclusions obtained by the local audit in the audit database; S8, security situation awareness and emergency disposal: The forest and grassland IoT gateway will record the failed independent audit session into the blockchain network, and perform security situation awareness and emergency disposal according to the audit conclusions and types; S9, determine whether the monitoring work is completed, if not, execute step S2, if yes, the process ends.

2. According to the method for independent security audit of forest and grassland Internet of Things based on smart contracts in claim 1, it is characterized in that: The step S1 specifically includes the following steps: S1.1, blockchain network initialization; S1.2, independent security audit smart contract and chain code installation, where the independent security audit smart contract includes the audit session on-chain operation strategy carried out by the Lincao Cloud Platform in the blockchain network, as well as the independent security audit operation strategy; S1.3, security situation awareness smart contract definition and chain code installation, where the security situation awareness smart contract includes the data exchange operation strategy in the blockchain network after the independent audit results of the Lincao IoT gateway and the Lincao cloud platform are successfully verified, and the security situation awareness operation strategy in the blockchain network after the independent audit results verification fails.

3. The independent security audit method for forest and grassland Internet of Things based on smart contracts according to claim 2 is characterized in that: The audit session on-chain operation strategy includes: Independent audit notification session chain strategy: used for Lincao Cloud Platform to generate audit notifications, issue audit notifications to initiate transactions, and form new blocks after calculation through the blockchain network consensus algorithm and store them in the blockchain network; The audit reply session chain strategy of the forest and grassland IoT gateway is used for the forest and grassland IoT gateway to submit audit data according to the audit notification requirements, and initiate a transaction for the audit reply session. After calculation by the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network; Independent audit successfully completes the session on-chain strategy: It is used for the Lincao Cloud Platform to initiate a transaction after the audit successfully completes the session. After calculation through the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network; Independent audit failure end session chain strategy: used for the Lincao Cloud Platform to initiate a transaction for the audit failure end session, and after calculation by the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network; The independent security audit operation strategy includes: Independent audit initiation decision strategy: The independent audit organization used for the forestry and grassland cloud platform determines whether to initiate an independent audit action based on the independent audit initiation conditions set by the forestry and grassland IoT system; Independent audit notification attribute generation strategy: used by the independent audit organization of the Lincao Cloud Platform to generate the attributes of this independent audit notification; Independent audit notification attribute encryption policy: used by the independent audit organization of the Lincao Cloud Platform to use encryption mechanism to initialize the generation of the system public key, system master key, and decryption key of the audited device of the Lincao Cloud Platform, and encrypt the generated independent audit access control policy; Independent audit notification attribute broadcast strategy: The independent audit organization used in the forest and grassland cloud platform adds an extended audit decision based on the object attribute of the independent audit notification attribute, and broadcasts the ciphertext to the forest and grassland IoT gateway to be audited; Independent security audit detection strategy: The independent audit organization used for the Lincao cloud platform obtains the audit data sent back by the Lincao IoT gateway, decrypts the data using the symmetric key generated when the independent audit notification attribute is encrypted, reads the data in the blockchain network for comparative analysis, and detects the integrity and authenticity of the current and previous data; The data exchange operation strategy includes: Independent audit results storage strategy: The independent audit organization used in the Lincao Cloud Platform initiates a transaction on the decrypted audit results data, which is calculated through the blockchain network consensus algorithm to form a new block storage and enter the blockchain network; The security situation awareness operation strategy includes: DOS attack monitoring strategy: used by the Lincao cloud platform to monitor the Lincao IoT gateways that failed independent audit verification; Injection attack detection strategy: used to check for false data injection attacks on forestry and grassland IoT gateways and / or forestry and grassland IoT terminals.

4. The independent security audit method for forest and grassland Internet of Things based on smart contracts according to claim 3 is characterized in that: The step S2 includes the following steps: S2.1, determine whether the wake-up time has arrived, if yes, execute step S2.2, if no, wait until the wake-up time arrives; S2.2, the forest and grass IoT gateway wakes up and synchronizes the time with the forest and grass cloud platform; S2.3, the forestry and grassland IoT terminal wakes up and sends the collected data and time synchronization to the forestry and grassland IoT; the forestry and grassland IoT terminal starts to communicate with the forestry and grassland IoT gateway, transmits the collected data to the forestry and grassland IoT gateway, performs clock synchronization and obtains configuration information for local storage; S2.4, the forest and grassland IoT gateway transmits data back to the forest and grassland cloud platform: the forest and grassland IoT gateway transmits the collected data obtained from the forest and grassland IoT terminal to the forest and grassland cloud platform; S2.5, the forestry and grassland IoT gateway and forestry and grassland IoT terminal enter sleep mode.

5. According to the method for independent security audit of forest and grassland Internet of Things based on smart contracts according to claim 4, it is characterized in that: The step S4 includes the following steps: S4.1, Lincao Cloud Platform executes and generates audit notification: Lincao Cloud Platform executes independent audit notification attribute generation strategy to generate audit notification; S4.2, Lincao Cloud Platform puts independent audit notification session on the chain: Lincao Cloud Platform issues the audit notification to the Lincao IoT gateway and / or Lincao IoT terminal, and initiates the transaction of the audit notification issuance session. After calculation by the blockchain network consensus algorithm, a new block is formed and stored in the blockchain network; S4.3, Lincao Cloud Platform uses ciphertext attribute encryption to encrypt audit notifications: Lincao Cloud Platform implements independent audit notification attribute encryption strategy and uses ciphertext attribute encryption to encrypt audit notifications; S4.4, the Lincao Cloud Platform broadcasts the audit notification to the Lincao IoT Gateway: The Lincao Cloud Platform executes and sends the encrypted audit notification ciphertext to the Lincao IoT Gateway in the next data collection cycle.

6. The independent security audit method for forest and grassland Internet of Things based on smart contracts according to claim 5 is characterized in that: The step S5 includes the following steps: S5.1, the forestry and grassland IoT gateway decrypts the audit notification and conducts an independent audit according to the audit notification requirements: the forestry and grassland IoT gateway uses the forestry and grassland cloud platform system public key, the current forestry and grassland IoT gateway attributes and private key obtained to decrypt the audit notification ciphertext. If the forestry and grassland IoT gateway attributes meet the access policy of the audit notification ciphertext, the ciphertext is decrypted to obtain the audit notification content; S5.2, whether to extend the audit: read the audit content requirements, and determine whether to extend the audit to the forest and grassland IoT terminal according to the extended audit requirements of the audit notice. If yes, execute step S5.3; if no, execute step S5.

4. If the decryption of the audit notice fails, execute step S8; S5.3, the forestry and grassland IoT terminal decrypts the audit notification and conducts an independent audit according to the audit notification requirements: the forestry and grassland IoT gateway uses the forestry and grassland cloud platform system public key, the current forestry and grassland IoT terminal attributes and private key obtained to decrypt the audit notification ciphertext. If the forestry and grassland IoT gateway attributes meet the access policy of the audit notification ciphertext, the ciphertext is decrypted to obtain the audit notification content; S5.

4. The forestry and grassland IoT gateway submits audit data as required by the audit notice: The forestry and grassland IoT gateway, in accordance with the audit notice, encrypts the data collected locally from the forestry and grassland IoT terminals and locally stored data and transmits them back to the forestry and grassland cloud platform for audit.

7. The independent security audit method for forest and grassland Internet of Things based on smart contracts according to claim 6 is characterized in that: The step S6 includes the following steps: S6.1, Lincao Cloud Platform Lincao IoT Gateway Audit Response Session on Chain: Lincao IoT Gateway Audit Response Session initiates a transaction, which is calculated by the blockchain network consensus algorithm to form a new block storage and enter the blockchain network; S6.2, Lincao Cloud Platform decrypts the audit return data and conducts comparative audit: Lincao Cloud Platform uses a symmetric key to decrypt the return data to obtain the audit data, and then reads the historical data of the audited device from the blockchain network, and conducts comparative audit on the historical data and the audit data; S6.3, Lincao Cloud Platform conducts independent security audit and gives audit results: Lincao Cloud Platform implements independent security audit strategy to detect the integrity and authenticity of current and previous data; if the audit device replies that the audit data is consistent with the historical data in the blockchain network, the audit passes and step S7 is executed; if the audit device replies to the audit data, but there is no historical data in the blockchain network, the audit fails and step S8 is executed; if the audit device replies to the audit data, but the historical data in the blockchain network is inconsistent, the audit fails and step S8 is executed; if the audit device does not reply to the audit data, but there is historical data in the blockchain network, the audit fails and step S8 is executed; if the audit device does not reply to the audit data, and there is historical data in the blockchain network, the audit fails and step S8 is executed; if the audit device does not reply to the audit data and there is no historical data in the blockchain network, the audit fails and step S8 is executed.

8. The independent security audit method for forest and grassland Internet of Things based on smart contracts according to claim 7 is characterized in that: The step S7 includes the following steps: S7.1, Lincao Cloud Platform independently audits and successfully completes the session on-chain: Lincao Cloud Platform will audit the successful completion of the session initiation transaction, and after calculation through the blockchain network consensus algorithm, a new block will be formed and stored in the blockchain network; S7.2, Lincao Cloud Platform records and stores audit sessions and results: Lincao Cloud Platform calls the independent audit results storage strategy to store the audit data and audit results obtained by local audits into the database.

9. The independent security audit method for forest and grassland Internet of Things based on smart contracts according to claim 8 is characterized in that: The step S8 includes the following steps: S8.1, Lincao Cloud Platform independent audit failure end session chain strategy: Lincao Cloud Platform will initiate a transaction to end the session due to audit failure, and after calculation through the blockchain network consensus algorithm, a new block will be formed and stored in the blockchain network; S8.2, Lincao Cloud Platform implements security situation awareness and emergency disposal: Lincao Cloud Platform implements the security situation awareness smart contract disposal strategy based on the audit results and makes rectifications to the audit results.

10. An independent security audit system for forest and grassland Internet of Things based on smart contracts, characterized in that: The method for implementing the independent security audit of the forest and grassland Internet of Things based on smart contracts as described in any one of claims 1 to 9, wherein the independent security audit system of the forest and grassland Internet of Things based on smart contracts is established on a blockchain network, and the independent security audit of the forest and grassland cloud platform by the forest and grassland Internet of Things gateway is realized by calling and executing smart contracts. The independent security audit system of the forest and grassland Internet of Things based on smart contracts includes: Blockchain initialization and smart contract definition module: used to initialize the blockchain network, complete independent security audit smart contract definition and chain code installation, as well as security situation awareness smart contract definition and chain code installation; The periodic operation module of the forest and grassland IoT gateway is used to wake up the forest and grassland IoT gateway according to the configured periodic operation strategy at fixed intervals, obtain configuration information from the forest and grassland cloud platform, and complete data collection, aggregation and transmission from the forest and grassland IoT terminal, and then sleep after completion and wait for the next data collection cycle; The periodic operation module of the forestry and grassland IoT terminal is used to wake up the forestry and grassland IoT terminal according to the configured periodic operation strategy at fixed intervals, obtain configuration information from the forestry and grassland IoT gateway, collect data, aggregate and transmit it to the forestry and grassland IoT gateway, and sleep after completion to wait for the next data collection cycle; Trigger audit judgment module: used by the Lincao Cloud Platform to determine whether the independent audit start conditions are triggered by executing the independent security audit smart contract; Generate independent audit notification and encrypt broadcast module: used for the Lincao cloud platform to generate independent audit notification, encrypt the independent audit notification using ciphertext attribute encryption, and broadcast the independent audit notification ciphertext from the Lincao cloud platform to the Lincao IoT gateway in the next data collection cycle; Audit module of forestry and grassland IoT gateway: used for the forestry and grassland IoT gateway to decrypt the ciphertext of independent audit notification, and when the attributes of the forestry and grassland IoT gateway meet the access policy of independent audit notification, decrypt the ciphertext to obtain the content of independent audit notification, and conduct independent security audit and return audit data according to the requirements of independent audit notification; Extended audit module for forestry and grassland IoT terminals: used for receiving and decrypting independent audit notifications issued by the forestry and grassland IoT gateway when the independent audit notification requires an extended audit. When the forestry and grassland IoT terminal attributes meet the independent audit notification access policy, decrypt the ciphertext to obtain the independent audit notification content, conduct independent security audits in accordance with the independent audit notification requirements, and return audit data. Verify the audit result module returned by the audited device: It is used by the Lincao Cloud Platform to decrypt the returned audit data and compare it with the historical data stored in the blockchain network, and complete the data integrity and system security detection by judging the consistency of the data; Storage audit session and audit result module: used by the Lincao Cloud Platform to record the independent audit session into the blockchain network, and store the audit data and audit conclusions obtained by the local audit into the audit database; Security situation awareness and emergency response module: used for the forestry and grassland IoT gateway to record the failed independent audit session into the blockchain network, and perform security situation awareness and emergency response according to the audit conclusion type.

Images