Security protection method, device, medium and program product of internet of things server

Abstract

Embodiments of the present application provide a security protection method and device of an Internet of Things server, a medium and a program product, and relate to the technical field of network security. The method is executed by a server of an Internet of Things system, and includes: obtaining an IP packet sent by a target Internet of Things device, and extracting first check information carried by an option field in an IP header of the IP packet; performing legality check on the IP packet based on the first check information, and releasing or discarding the IP packet according to a result of the legality check. According to the embodiments of the present application, check information is added in the option field of the IP packet, so that the server can check the legality of the packet based on the check information, thereby eliminating the need for a complex traffic detection process, reducing the dependence of the security protection function on the resources of the Internet of Things device, and making the security protection function applicable to an Internet of Things system with limited resources.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and more specifically, to a security protection method, device, medium, and program product for an Internet of Things server. Background Art

[0002] With the rapid development of IoT technology, communication security between IoT devices is becoming increasingly important. In IoT communication scenarios, attackers may capture data packets during communication and forge illegal data packets to detect IoT device service information and launch attacks.

[0003] Currently, existing technologies typically employ firewalls or intrusion detection systems (IDSs) to secure network communications. These solutions effectively ensure network communication security by detecting and blocking malicious traffic that violates security settings. However, IoT devices typically have resource constraints such as computing power, storage space, and power consumption. Solutions like firewalls and IDSs are often overly complex and resource-intensive, significantly impacting the normal operation of IoT devices during the security protection process. Therefore, these solutions are not suitable for large-scale deployment in IoT systems. Summary of the Invention

[0004] The purpose of the embodiments of the present application is to provide a security protection method, device, medium and program product for an Internet of Things server, so as to reduce the dependence of the security protection function on the resources of the Internet of Things device.

[0005] In a first aspect, an embodiment of the present application provides a security protection method for an IoT server, which is executed by a server of an IoT system, comprising:

[0006] Obtain an IP data packet sent by a target IoT device, and extract first verification information carried in an option field from an IP header of the IP data packet;

[0007] The IP data packet is subjected to a validity check based on the first verification information, and the IP data packet is released or discarded according to the result of the validity check.

[0008] In an embodiment of the present application, by adding verification information to the option field of the IP data packet, the server can verify the legitimacy of the data packet based on the verification information, thereby eliminating the need for a complex traffic detection process, reducing the dependence of the security protection function on the resources of the IoT device, and is suitable for resource-constrained IoT systems.

[0009] In some possible embodiments, performing a validity check on the IP data packet based on the first verification information includes:

[0010] Determine the device type of the target IoT device and obtain a verification rule corresponding to the device type;

[0011] Perform a validity check on the IP data packet based on the first verification information according to the verification rule.

[0012] In the embodiment of the present application, different verification rules are set for different types of IoT devices, thereby further improving the flexibility of IoT server security protection.

[0013] In some possible embodiments, performing a validity check on the IP data packet based on the first verification information according to the verification rule includes:

[0014] generating second verification information corresponding to the IP data packet according to a verification algorithm specified by the verification rule;

[0015] The legitimacy of the IP data packet is verified based on the consistency of the first verification information and the second verification information.

[0016] In an embodiment of the present application, by generating second verification information based on a verification algorithm for consistency comparison with the first verification information to implement legitimacy verification of the IP data packet, the reliability of the data packet verification can be further improved.

[0017] In some possible embodiments, generating second verification information corresponding to the IP data packet according to the verification algorithm specified by the verification rule includes:

[0018] Extracting basic content type information carried in an option field from an IP header of the IP data packet, and acquiring basic content corresponding to the basic content type information based on the IP data packet;

[0019] Second verification information corresponding to the IP data packet is generated based on the basic content according to a verification algorithm specified by the verification rule.

[0020] In an embodiment of the present application, by specifying the basic content type used to calculate the verification information in the IP data packet, the content basis for calculating the verification information can be adjusted in a timely manner according to demand, thereby improving the randomness of the calculated verification information and further improving the reliability of the data packet verification.

[0021] In some possible embodiments, generating second verification information corresponding to the IP data packet based on the basic content according to the verification algorithm specified by the verification rule includes:

[0022] According to the verification algorithm specified by the verification rule, second verification information corresponding to the IP data packet is generated based on the basic content and preset key information; wherein the key information is pre-negotiated and determined by the target Internet of Things device and the server.

[0023] In the embodiment of the present application, by further combining the key information to calculate the corresponding verification information, double encryption of the verification information can be achieved, further improving the reliability of the data packet verification.

[0024] In some possible embodiments, obtaining an IP data packet sent by a target IoT device and extracting first verification information carried in an option field from an IP header of the IP data packet includes:

[0025] If it is determined that the IP data packet sent by the target IoT device meets the preset verification condition, extracting the first verification information carried by the option field from the IP header of the IP data packet;

[0026] If it is determined that the IP data packet sent by the target IoT device does not meet the preset verification conditions, the verification process of the IP data packet is skipped;

[0027] Among them, the determination that the IP data packet sent by the target Internet of Things device meets the preset verification conditions includes: if it is determined that the time interval between the historical moment when the IP data packet sent by the target Internet of Things device was last verified and the current moment exceeds the preset verification period, then it is determined that the IP data packet sent by the target Internet of Things device meets the preset verification conditions.

[0028] In the embodiment of the present application, by setting verification conditions and performing legitimacy verification on IP data packets based on conditions that meet the conditions, the flexibility of data packet verification is further improved.

[0029] In some possible embodiments, the first verification information is a predetermined fixed verification value, or the first verification information is a verification value that is dynamically updated according to a preset update rule.

[0030] In the embodiment of the present application, by using a fixed check value or a dynamically updated check value as the check information, the resource consumption of the device in calculating the check information can be reduced, further reducing the dependence of the security protection function on the resources of the IoT device.

[0031] In a second aspect, an embodiment of the present application provides a security protection device for an IoT server, which is applied to a server of an IoT system, including:

[0032] A verification information extraction module is used to obtain an IP data packet sent by a target IoT device and extract first verification information carried in an option field from an IP header of the IP data packet;

[0033] The data packet verification module is used to perform a validity check on the IP data packet based on the first verification information, and to release or discard the IP data packet according to the result of the validity check.

[0034] In a third aspect, an embodiment of the present application provides an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor can implement the method described in any embodiment of the first aspect when executing the program.

[0035] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method described in any embodiment of the first aspect can be implemented.

[0036] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the method described in any embodiment of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0038] Figure 1 A flowchart of a security protection method for an Internet of Things server provided in an embodiment of the present application;

[0039] Figure 2 A schematic diagram of the structure of a security protection device for an Internet of Things server provided in an embodiment of the present application;

[0040] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0041] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0042] It should be noted that similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and should not be understood as indicating or implying relative importance.

[0043] It is understandable that devices in IoT systems usually have limited resources such as computing power, storage space and power consumption. If traditional network security protection solutions are adopted, such as firewalls and intrusion detection systems, these systems are relatively complex and occupy more computing resources, which will have a significant impact on the normal operation of IoT devices.

[0044] To this end, an embodiment of the present application provides a security protection method for an IoT server. By utilizing the option field of an IP data packet to carry verification information for the server to verify the legitimacy of this data, the purpose of communication security protection for the IoT system is achieved, and the complex traffic detection and interception process is avoided, without affecting the normal operation of IoT devices.

[0045] like Figure 1 As shown, the embodiment of the present application provides a security protection method for an Internet of Things server, which is executed by a server of an Internet of Things system and may include the following steps:

[0046] S1. Obtain an IP data packet sent by a target IoT device, and extract first verification information carried in an option field from an IP header of the IP data packet.

[0047] It's important to note that IPv4 and IPv6 protocols provide various option fields to extend their functionality. These option fields can be used to carry additional information. These option fields allow for customized packet processing without changing the existing network architecture, such as adding custom checksums to enhance security.

[0048] Based on this, the IoT device as the data sender (target IoT device) can add a predefined verification data (first verification information) to the option field of the IP header when constructing the data packet. For example, the verification data can be a predefined fixed value or dynamically generated according to a preset algorithm.

[0049] When the IP data packet arrives at the server of the IoT system as the data receiver, the server's kernel can extract the first verification information carried in the option field from its IP header as the basis for verifying the legitimacy of the IP data packet.

[0050] S2. Perform a validity check on the IP data packet based on the first verification information, and release or discard the IP data packet according to the result of the validity check.

[0051] Specifically, based on the acquired first verification information, the server may perform a validity verification on the IP data packet according to pre-set rules.

[0052] Exemplarily, the first verification information can be a predefined fixed value. Accordingly, the server determines whether the fixed value is equal to the pre-agreed verification value. If so, the legitimacy check passes and the IP data packet is released, thereby allowing the data packet to enter the subsequent processing stage; otherwise, the legitimacy check fails and the data packet is directly discarded.

[0053] Exemplarily, the first verification information may be a verification code dynamically generated according to a preset algorithm, for example, a verification code is calculated based on the current timestamp according to a set period, wherein the set period and the algorithm for calculating the verification code are pre-negotiated and determined by the sender and the receiver.

[0054] Based on this, by adding verification information in the option field of the IP data packet, the server can verify the legitimacy of the data packet based on the verification information. Even if the attacker can capture the data packet and forge a probe data packet, due to the lack of correct verification information, their request will not pass the verification of the server and will be directly discarded, thereby effectively hiding the existence of the real service port or service, and thus achieving communication security protection for the Internet of Things system; at the same time, since the security verification process of the embodiment of the present application does not require complex traffic detection or matching operations, it reduces the dependence of the security protection function on the resources of the Internet of Things device, and is suitable for deployment in resource-constrained Internet of Things systems.

[0055] In some possible embodiments, in step S2, performing a validity check on the IP data packet based on the first verification information may include:

[0056] S201: Determine the device type of the target IoT device and obtain a verification rule corresponding to the device type;

[0057] S202: Perform a validity check on the IP data packet based on the first verification information according to the verification rule.

[0058] It should be noted that the IoT system usually includes different types of IoT devices. Due to differences in functional characteristics, the computing power, storage performance and other resources of these IoT devices are usually different. Therefore, different data verification strategies can be configured for different types of IoT devices.

[0059] Specifically, for IoT devices with abundant computing resources, a more complex verification information generation and verification mechanism can be set up to maximize the reliability of data verification and communication security.

[0060] In some embodiments, the first verification information is a predetermined fixed verification value, or the first verification information is a verification value that is dynamically updated according to a preset update rule.

[0061] It should be noted that for IoT devices with relatively limited computing resources, the verification information generation and verification mechanism can be simplified as much as possible. For example, the verification information can be directly set to a fixed value or a fixed value that is dynamically updated according to a time period. Based on this, the complex verification value calculation process is omitted, thereby minimizing the impact of communication security protection functions on the normal operation of IoT devices.

[0062] It is understandable that, as the data receiver and verifier, the server of the Internet of Things system can pre-set and store verification rules corresponding to different types, so that after receiving the IP data packet, it can search and obtain the corresponding verification rules according to the device type of the data sender, so as to perform legitimacy verification on the IP data packet based on the first verification information according to the verification rules.

[0063] Based on this, for different types of IoT devices, an appropriate balance can be struck between the security and efficiency of data verification, thereby further improving the flexibility of IoT server security protection.

[0064] In some possible embodiments, in step S202, performing a validity check on the IP data packet based on the first verification information according to the verification rule may include:

[0065] S2021. Generate second verification information corresponding to the IP data packet according to the verification algorithm specified by the verification rule;

[0066] S2022. Perform a validity check on the IP data packet based on the consistency between the first verification information and the second verification information.

[0067] It should be noted that for IoT devices with relatively abundant computing resources, they can be set to perform calculations based on verification algorithms and generate more complex verification codes. For example, the verification code can be generated by calculating the preset basic content based on a hash algorithm (such as HMAC-SHA-256, etc.), where the basic content can be information such as the current timestamp.

[0068] Correspondingly, the server of the Internet of Things system as the data receiver and the verifier can acquire the second verification information corresponding to the IP packet according to the verification rule determined at present, and generate the second verification information corresponding to the IP packet according to the verification algorithm specified by the rule, wherein the required basic content and the verification algorithm are determined by the pre-negotiation of the data sender. Then, it is determined whether the IP packet is legal according to whether the second verification information is consistent with the first verification information.

[0069] In some possible embodiments, the step S2021 of generating the second verification information corresponding to the IP packet according to the verification algorithm specified by the verification rule can include:

[0070] S20211, extracting the basic content type information carried by the option field in the IP header of the IP packet, and acquiring the basic content corresponding to the basic content type information based on the IP packet;

[0071] S20212, generating the second verification information corresponding to the IP packet based on the basic content according to the verification algorithm specified by the verification rule.

[0072] It should be noted that, in addition to the current timestamp and the like as the basic content for calculating the verification code, the present example further adds information for indicating the basic content type in the IP header of the IP packet, so that the data sender and the data receiver can adjust the basic content type for calculating the verification information according to the requirements.

[0073] Exemplarily, the basic content type can include one or more data contents in the IP header, such as the source address, the destination address, the timestamp, the device ID, and the like. Exemplarily, these contents can correspond to a number ID respectively, and after the data receiver selects the appropriate type of content to calculate the verification code, the number ID corresponding to the basic content can be added to the option field in the IP header; correspondingly, the server can extract the basic content type information carried by the option field in the IP header of the received IP packet, and acquire the corresponding basic content to calculate the corresponding second verification information.

[0074] Exemplarily, the target Internet of Things device can select different basic content types when generating the first verification information each time (or according to the set period), so as to further improve the reliability of data verification by timely changing the basic content type for calculating the verification code.

[0075] In some possible embodiments, the step S20212 of generating the second verification information corresponding to the IP packet based on the basic content according to the verification algorithm specified by the verification rule can include:

[0076] According to the verification algorithm specified by the verification rule, second verification information corresponding to the IP data packet is generated based on the basic content and preset key information; wherein the key information is pre-negotiated and determined by the target IoT device and the server.

[0077] It should be noted that the data sender and the data receiver (verifier) ​​can also pre-negotiate and determine a key information. In the process of generating verification information according to the preset verification algorithm, in addition to the basic content, the key information can be further combined to generate the corresponding first verification information and second verification information, thereby achieving the purpose of multiple encryption of the verification information through the verification algorithm and key information, further improving the reliability of data packet verification.

[0078] In some possible embodiments, step S1, obtaining an IP data packet sent by a target IoT device and extracting first verification information carried in an option field from an IP header of the IP data packet, may include:

[0079] S101: When it is determined that the IP data packet sent by the target IoT device meets a preset verification condition, extracting first verification information carried in an option field from an IP header of the IP data packet;

[0080] S101: If it is determined that the IP data packet sent by the target IoT device does not meet the preset verification condition, then the verification process of the IP data packet is skipped;

[0081] Among them, determining that the IP data packet sent by the target Internet of Things device meets the preset verification conditions includes: if it is determined that the time interval between the historical moment when the IP data packet sent by the target Internet of Things device was last verified and the current moment exceeds the preset verification period, then determining that the IP data packet sent by the target Internet of Things device meets the preset verification conditions.

[0082] Specifically, when the server receives the IP data packet sent by the target IoT device, it can first determine whether the current IP data packet meets the preset verification conditions. If it meets the conditions, the verification operation is performed according to the above process. If it does not meet the conditions, the verification process of the IP data packet can be omitted and the data packet can be released directly.

[0083] Based on this, the timing or frequency of packet verification can be set according to needs, thereby further improving the flexibility of packet verification.

[0084] For example, the system can be configured to perform data verification on IP packets sent by the target IoT device according to a certain verification period. Specifically, the corresponding time information can be recorded each time a packet verification is performed. If the time interval between the last time the IP packet sent by the target IoT device was verified and the current time exceeds the preset verification period, the IP packet sent by the target IoT device is determined to meet the preset verification conditions.

[0085] Exemplarily, it is also possible to determine whether the current IP data packet meets the preset verification conditions based on a specific event trigger. For example, when an anomaly is detected based on other traffic detection strategies and the target IoT device is marked as a suspicious device, when an IP data packet sent by the target IoT device is subsequently received, it will be determined to meet the preset verification conditions.

[0086] Compared with the existing technology, the embodiment of the present application implements data packet verification by utilizing the IP option field, without the need for additional hardware support, and is suitable for resource-constrained IoT devices; secondly, the existence of service ports or services is hidden through the verification mechanism, reducing the risk of IoT servers being attacked; in addition, compared with the solution of implementing data verification using the TCP handshake mechanism, the embodiment of the present application can implement the service hiding function of any protocol, including but not limited to TCP, UDP, ICMP, etc., thereby effectively improving the scalability of security protection functions.

[0087] Please refer to Figure 2 , Figure 2 The following is a block diagram showing the components of the security protection device for the Internet of Things server provided by some embodiments of the present application. Figure 1 Corresponding to the method embodiment, the various steps involved in the above method embodiment can be executed. The specific functions of the security protection device of the Internet of Things server can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0088] Figure 2 The security protection device of the Internet of Things server includes at least one software function module that can be stored in a memory in the form of software or firmware or fixed in the security protection device of the Internet of Things server. The security protection device of the Internet of Things server is applied to the server of the Internet of Things system, including:

[0089] The verification information extraction module 210 is used to obtain the IP data packet sent by the target IoT device and extract the first verification information carried in the option field of the IP header of the IP data packet;

[0090] The data packet verification module 220 is used to perform a validity check on the IP data packet based on the first verification information, and to release or discard the IP data packet according to the result of the validity check.

[0091] In some possible embodiments, the data packet checking module 220 is specifically configured to:

[0092] Determine the device type of the target IoT device and obtain the verification rules corresponding to the device type;

[0093] Perform a validity check on the IP data packet based on the first verification information according to the verification rule.

[0094] In some possible embodiments, the data packet checking module 220 is specifically configured to:

[0095] generating second verification information corresponding to the IP data packet according to a verification algorithm specified by the verification rule;

[0096] The validity of the IP data packet is verified based on the consistency of the first verification information and the second verification information.

[0097] In some possible embodiments, the data packet checking module 220 is specifically configured to:

[0098] Extracting basic content type information carried in the option field of the IP header of the IP data packet, and obtaining basic content corresponding to the basic content type information based on the IP data packet;

[0099] Second verification information corresponding to the IP data packet is generated based on the basic content according to a verification algorithm specified by the verification rule.

[0100] In some possible embodiments, the data packet checking module 220 is specifically configured to:

[0101] According to the verification algorithm specified by the verification rule, second verification information corresponding to the IP data packet is generated based on the basic content and preset key information; wherein the key information is pre-negotiated and determined by the target IoT device and the server.

[0102] In some possible embodiments, the verification information extraction module 210 is specifically configured to:

[0103] If it is determined that the IP data packet sent by the target IoT device meets the preset verification condition, first verification information carried in the option field is extracted from the IP header of the IP data packet;

[0104] If it is determined that the IP data packet sent by the target IoT device does not meet the preset verification conditions, the verification process of the IP data packet is skipped;

[0105] Among them, determining that the IP data packet sent by the target Internet of Things device meets the preset verification conditions includes: if it is determined that the time interval between the historical moment when the IP data packet sent by the target Internet of Things device was last verified and the current moment exceeds the preset verification period, then determining that the IP data packet sent by the target Internet of Things device meets the preset verification conditions.

[0106] In some possible embodiments, the first verification information is a predetermined fixed verification value, or the first verification information is a verification value that is dynamically updated according to a preset update rule.

[0107] It can be understood that the above-mentioned device embodiment corresponds to the method embodiment of the present invention. The security protection device of the Internet of Things server provided by the embodiment of the present invention can implement the security protection method of the Internet of Things server provided by any method embodiment of the present invention.

[0108] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0109] like Figure 3 As shown, some embodiments of the present application provide an electronic device 300, which includes: a memory 310, a processor 320, and a computer program stored in the memory 310 and executable on the processor 320, wherein the processor 320 reads the program from the memory 310 through the bus 330 and executes the program to implement any of the embodiments of the security protection method for the Internet of Things server described above.

[0110] Processor 320 can process digital signals and can include various computing architectures, such as a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements a combination of multiple instruction sets. In some examples, processor 320 can be a microprocessor.

[0111] The memory 310 can be used to store instructions executed by the processor 320 or data related to the execution of instructions. These instructions and / or data may include code for implementing some or all functions of one or more modules described in the embodiments of this application. The processor 320 of the embodiment of the present disclosure can be used to execute the instructions in the memory 310 to implement the method shown above. The memory 310 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memory known to those skilled in the art.

[0112] Some embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method described in the method embodiment is executed.

[0113] Some embodiments of the present application further provide a computer program product, which, when running on a computer, enables the computer to execute the method described in the method embodiment.

[0114] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similarities between the various embodiments can be referred to in conjunction with each other. For device embodiments, since they are generally similar to method embodiments, their description is relatively simple, and for relevant details, reference can be made to the description of the method embodiments.

[0115] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions, and operations of the devices, methods, and computer program products according to the multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment, or a portion of code, and the module, program segment, or a portion of code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or can be implemented using a combination of dedicated hardware and computer instructions.

[0116] In addition, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0117] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0118] The foregoing is merely an embodiment of the present application and is not intended to limit the scope of protection of the present application. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included within the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined or explained in subsequent figures.

[0119] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0120] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

Claims

1. A security protection method for an Internet of Things server, characterized in that: Executed by the IoT system's server, including: Obtain an IP data packet sent by a target IoT device, and extract first verification information carried in an option field from an IP header of the IP data packet; Performing a validity check on the IP data packet based on the first verification information, and releasing or discarding the IP data packet according to a result of the validity check; The step of obtaining an IP data packet sent by a target IoT device and extracting first verification information carried in an option field from an IP header of the IP data packet includes: If it is determined that the IP data packet sent by the target IoT device meets the preset verification condition, extracting the first verification information carried by the option field from the IP header of the IP data packet; If it is determined that the IP data packet sent by the target IoT device does not meet the preset verification conditions, the verification process of the IP data packet is skipped; The step of determining whether the IP data packet sent by the target IoT device satisfies a preset verification condition includes: When an anomaly is detected based on the preset traffic detection strategy and the target IoT device is marked as a suspicious device, the IP data packet sent by the target IoT device is subsequently received and judged to meet the preset verification conditions; The performing a validity check on the IP data packet based on the first verification information includes: Determine the device type of the target IoT device and obtain a verification rule corresponding to the device type; Perform a validity check on the IP data packet based on the first verification information according to the verification rule.

2. The security protection method for the Internet of Things server according to claim 1, characterized in that: The performing a validity check on the IP data packet based on the first verification information according to the verification rule includes: generating second verification information corresponding to the IP data packet according to a verification algorithm specified by the verification rule; The legitimacy of the IP data packet is verified based on the consistency of the first verification information and the second verification information.

3. The security protection method for the Internet of Things server according to claim 2, characterized in that: Generating second verification information corresponding to the IP data packet according to the verification algorithm specified by the verification rule includes: Extracting basic content type information carried in an option field from an IP header of the IP data packet, and acquiring basic content corresponding to the basic content type information based on the IP data packet; Second verification information corresponding to the IP data packet is generated based on the basic content according to a verification algorithm specified by the verification rule.

4. The security protection method for the Internet of Things server according to claim 3, characterized in that: Generating second verification information corresponding to the IP data packet based on the basic content according to the verification algorithm specified by the verification rule includes: According to the verification algorithm specified by the verification rule, second verification information corresponding to the IP data packet is generated based on the basic content and preset key information; wherein the key information is pre-negotiated and determined by the target Internet of Things device and the server.

5. The security protection method for the Internet of Things server according to claim 1, characterized in that: The step of obtaining an IP data packet sent by a target IoT device and extracting first verification information carried in an option field from an IP header of the IP data packet includes: If it is determined that the IP data packet sent by the target IoT device meets the preset verification condition, extracting the first verification information carried by the option field from the IP header of the IP data packet; If it is determined that the IP data packet sent by the target IoT device does not meet the preset verification conditions, the verification process of the IP data packet is skipped; Among them, the determination that the IP data packet sent by the target Internet of Things device meets the preset verification conditions includes: if it is determined that the time interval between the historical moment when the IP data packet sent by the target Internet of Things device was last verified and the current moment exceeds the preset verification period, then it is determined that the IP data packet sent by the target Internet of Things device meets the preset verification conditions.

6. The security protection method for the Internet of Things server according to claim 1, characterized in that: The first verification information is a predetermined fixed verification value, or the first verification information is a verification value dynamically updated according to a preset update rule.

7. An electronic device, characterized in that: The invention comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor can implement the security protection method for the Internet of Things server according to any one of claims 1 to 6 when executing the program.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the security protection method for the Internet of Things server according to any one of claims 1 to 6 is executed.

9. A computer program product, characterized in that The computer program product includes a computer program, and when the computer program is executed by a processor, the security protection method for the Internet of Things server according to any one of claims 1 to 6 is implemented.

Images