Internet of Things data security protection method and system, and storage medium

Abstract

The invention provides an Internet of Things data security protection method and system and a storage medium, and relates to the technical field of data security, and the method comprises the steps of first acquisition, first extraction, data encryption, first verification, data transmission, replacement, data storage and the like. The system comprises a first acquisition module, a first extraction module, a data encryption module, a first verification module, a data transmission module, a replacement module and a data storage module, the security of a data receiving end is verified before data transmission, data transmission is performed on the premise of security of target equipment, and the security of the target equipment is ensured. And the security of data transmission is improved.

Description

Technical Field

[0001] The present application relates to the technical field of data security, and in particular to an Internet of Things data security protection method, system and storage medium. Background Art

[0002] With the rapid development of IoT technology, more and more devices are connected to the network, forming a huge IoT system. These devices are not only numerous, but also widely distributed, and involve a wide variety of application areas. In IoT systems such as hospitals, social security, banks, and enterprises, the data transmitted between devices often contains very important sensitive or critical information, such as personal privacy, commercial secrets, etc. Therefore, improving the security of this data during transmission and storage has become one of the important challenges in the development of IoT technology.

[0003] The Chinese invention patent with application publication date of July 19, 2024 and application publication number CN118368152A discloses a big data security protection method and system based on the Internet of Things. The central processor issues numbers to each Internet of Things terminal according to a unified numbering rule. When the central processor detects a data security threat, it automatically disconnects the communication connection with each Internet of Things terminal. When any Internet of Things terminal detects a data security threat, the stored sensitive data is randomly shuffled and then stored. After sending an early warning of the attack to the central processor, the communication connection with each Internet of Things terminal and the communication connection with the central processor are automatically disconnected.

[0004] However, IoT devices (i.e. IoT terminals) play the role of core nodes for data transmission, and their stability and security are of vital importance to the smooth operation of the entire system. In the actual deployment and application process, these IoT devices may encounter failures or be maliciously invaded, thus posing a potential threat to the real-time and secure transmission of data. Summary of the invention

[0005] In order to improve the stability and security of IoT devices, the present application provides an IoT data security protection method, system and storage medium.

[0006] In the first aspect, the present application provides a method for protecting IoT data security, which adopts the following technical solutions: A method for protecting Internet of Things data security comprises the following steps: First collection: collect the data to be transmitted in the current device, recorded as the first data; First extraction: extracting sensitive data and non-sensitive data from the first data; Data encryption: using an encryption algorithm to encrypt sensitive data, and obtaining the encrypted sensitive data, which is recorded as the second data; First verification: verify whether the target device is safe. If so, perform the data transmission step; if not, perform the replacement step; Data transmission: transmitting and storing the second data to the target device; Replace: Start the standby device and use it as the new target device; Data storage: Store non-sensitive data in the cloud.

[0007] By adopting the above technical solution, the present application verifies the security of the target device before data transmission, can timely discover and reduce potential security risks, and improve the security of data transmission. The present application also transmits and stores the encrypted sensitive data (second data) to the target device, which improves the security and integrity of the data during transmission, and realizes the storage of data. When the target device is not safe, the backup device is started and used as a new target device, providing an alternative solution for data transmission, enhancing reliability and flexibility, so that the data in the current device can be processed and stored in a timely manner, and improving timeliness. When processing sensitive data, the present application enhances the security of the data through steps such as first extraction, data encryption, and first verification.

[0008] Optionally, after performing the first verification step and before performing the data transmission step, the method further includes: Second collection: collect the IP address of the target device and record it as the first IP address; Data update: adding a mark to the second data, wherein the mark is the first IP address; Third collection: collecting UUIDs of all receiving ends and storing all UUIDs in a preset UUID library, wherein the receiving end refers to a device that has the authority to receive the first data; Association: Associate each UUID in the UUID database with the corresponding IP address; Fourth collection: retrieving the UUID of the target device based on the tag of the second data, and recording it as the first UUID; Second verification: verify whether the first UUID meets expectations. If so, execute the data transmission step; if not, execute the replacement step.

[0009] By adopting the above technical solution, the IP address is the unique identifier of the device in the network. This application realizes the association between the second data and the IP address of the target device by adding a mark to the second data (i.e., the first IP address), which helps to determine whether the device receiving the second data is the target device during directional transmission. This application also collects the UUIDs of all devices that can receive the first data, and establishes a UUID library based on this. After that, each UUID is associated with the first IP address, so that the user can trace the UUID of the target device through the mark of the second data, and then determine whether the target device is correct by verifying whether the UUID meets expectations. By setting a second verification step, this application can further reduce the risk of data leakage caused by errors in the direction of data transmission or malicious attacks (such as forged IP addresses).

[0010] Optionally, after executing the second acquisition step and before executing the data update step, the method further includes: Fifth collection: collect the IP address of the current device and record it as the second IP address; Sixth collection: collecting records of the transmission of historical data from the second IP address to the first IP address, the records including: historical data, type of historical data, and transmission path; First judgment: judging whether the type of the second data is the same as the type of the historical data, if so, taking the transmission path of the historical data as the transmission path of the second data and executing the data updating step; if not, executing the path determining step; Determine a path: Select a transmission path according to the size and type of the second data.

[0011] By adopting the above technical solution, the present application obtains the transmission path of the historical data by recording the transmission of historical data from the second IP address to the first IP address. By comparing the type of the second data with the type of the historical data, the transmission path can be intelligently selected. If the two types are the same, the existing transmission path is used to transmit the second data, reducing the cost of path selection and optimization; if the types are different, the step of determining the path is entered. The first judgment step realizes the intelligent selection of the data transmission path, which not only improves the efficiency, but also ensures the adaptability of data transmission. In the case of different data types, selecting the most appropriate transmission path according to the size and type of the second data helps to improve the smoothness and efficiency of data transmission.

[0012] Optionally, after performing the second verification step and before performing the data transmission step, the method further includes: First calculation: calculating a hash value of the first UUID, and dividing the hash value into m parts, each part being recorded as third data; Segmentation: The sensitive data is divided into m parts, and each part is recorded as the fourth data, where the value of m is greater than 1 and less than the number of characters of the sensitive data; Data merging: The third data and the fourth data having the same position are concatenated to obtain merged data, which is recorded as the fifth data; Re-encryption: re-adopting the encryption algorithm to encrypt the fifth data, and using the encrypted fifth data as new second data.

[0013] By adopting the above technical solution, the present application calculates the hash value of the UUID, further enhancing the uniqueness of the data in the subsequent steps and improving the security of the data. The present application also divides the hash value into m parts (each of which is recorded as the third data), and the corresponding sensitive data is also divided into m parts (each of which is recorded as the fourth data). The third data and the fourth data with the same position are spliced ​​to obtain the fifth data. Since part of the hash value is added to the original sensitive data, even if part of the data is intercepted, it is difficult for the attacker to directly parse the original sensitive data, which further enhances the security of the data.

[0014] Optionally, after performing the step of segmentation and before performing the step of data merging, the method further includes: Get length: Get the length value of each fourth data, and get the maximum value n among all length values; Padding length: padding the fourth data that is less than the maximum value n with 0, and using the padded fourth data as new fourth data.

[0015] By adopting the above technical solution, the present application obtains the length value of each fourth data, can understand the difference in data length, obtain the maximum value n among all length values, and provide a standard data length for the subsequent step of padding the length. The fourth data less than the maximum value n is padded with 0, so that the length of all fourth data is unified to n, thereby realizing the standardized processing of data, which is helpful in determining the position of the fourth data in the step of data merging, and in the subsequent decryption process, the third data and the fourth data can be accurately separated. The padding operation is to add 0 to the end of the data, which will not change any information of the original data, thus maintaining the integrity of the data.

[0016] Optionally, after executing the step of data transmission and before executing the step of data storage, the method further includes: Data decryption: The target device decrypts each second data to obtain m decrypted data; Second extraction: extract the part from the n+1th bit to the end of each decrypted data, and record it as the sixth data; Delete characters: extract the first n characters in each decrypted data, delete the 0 filled in the first n characters, and obtain the seventh data; First sorting: arranging the sixth data in the order of the third data, and sorting the seventh data according to the order of the sixth data; Data recovery: All seventh data are spliced ​​in sequence to obtain sensitive data.

[0017] By adopting the above technical solution, the part from the n+1th bit to the end is extracted from the decrypted data, which is actually extracting the third data. The extracted content is recorded as the sixth data, and the sixth data is arranged in the order of the third data to obtain the restored hash value. The first n characters in each decrypted data are extracted, and the 0s filled in the first n characters are deleted to obtain the seventh data. The seventh data is sorted according to the order of the sixth data, and finally the seventh data is spliced ​​in the order of sorting, so as to restore sensitive data. The present application can ensure data security without losing data.

[0018] Optionally, after performing the first calculation step and before performing the segmentation step, the method further includes: Second judgment: integrating all third data into a data set, judging whether there is the same third data in the data set, if so, executing the second calculation step; if not, executing the segmentation step; Second calculation: calculating the length of the hash value, recording it as the eighth data, and obtaining a factor set of the eighth data; Data elimination: Eliminate m from the factor set to obtain a new factor set; Data replacement: Use one of the factors in the new factor set as the new m and execute the first calculation step.

[0019] By adopting the above technical solution, the present application integrates all the third data into a data set and determines whether the same third data exists in the data set. If the same third data exists, the original sensitive data cannot be restored. Therefore, if the same third data exists, the present application re-splits the hash value, thereby achieving the purpose of accurately restoring the sensitive data.

[0020] Optionally, after the step of performing data replacement and before the step of performing the first calculation, the method further includes: Third judgment: judging whether m is greater than a preset threshold and whether the remaining factors in the factor set are greater than the preset threshold, if so, executing the third extraction step; if not, executing the first calculation step; Third extraction: extract the same third data and record it as the ninth data; Second sorting: according to the order in which the ninth data appears in the hash value of the first UUID, a number is added after the last character of the ninth data, and the ninth data with the added number is used as the new third data.

[0021] By adopting the above technical solution, when m is greater than the preset threshold and the remaining factors in the factor set are all greater than the preset threshold, it means that even if the first calculation step is re-executed, the result of the segmentation will still have a high probability of having the same part, because the larger the m is, the more the number of third data obtained after the hash value is segmented, and the greater the possibility of duplication. Therefore, the present application sets up the third extraction and second sorting steps, and adds additional numbers to the repeated third data to make it unique, so that sensitive data can be accurately restored based on the third data.

[0022] In the second aspect, the present application provides an IoT data security protection system, which adopts the following technical solutions: An Internet of Things data security protection system, comprising: A first acquisition module, used for acquiring data to be transmitted in the current device, recorded as first data; A first extraction module, connected to the first acquisition module for extracting sensitive data and non-sensitive data from the first data; A data encryption module, which is in communication with the first extraction module and is used to encrypt the sensitive data using an encryption algorithm to obtain the encrypted sensitive data, which is recorded as the second data; The first verification module is used to verify whether the target device is safe. If it is safe, the data transmission module is triggered; otherwise, the replacement module is triggered; A data transmission module, which is in communication with the data encryption module and the first verification module, and is used to transmit and store the second data to the target device; A replacement module, which is in communication with the first verification module and is used to start the backup device and use the backup device as a new target device; The data storage module is communicatively connected to the first extraction module and is used to store non-sensitive data in the cloud.

[0023] By adopting the above technical solution, the first acquisition module can collect data in the device in real time or on demand, providing a basis for subsequent processing. The first extraction module can more effectively process data of different importance by classifying the data. The data encryption module can enhance the security of data transmission and reduce the risk of sensitive data leakage. The security of the target device is then verified by the first verification module to prevent sensitive data from falling into an unsafe environment. The data transmission module can realize reliable transmission and storage of data. The replacement module can replace the target device and enhance the reliability of the system. The data storage module stores non-sensitive data in the first data to the cloud to realize the storage of all data.

[0024] In a third aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program can implement the described method when processed by a processor.

[0025] In summary, the present application includes at least one of the following beneficial technical effects: 1. This application verifies the security of the target device before data transmission, can promptly detect and reduce potential security risks, and improve the security of data transmission.

[0026] 2. This application also transmits and stores the encrypted sensitive data (second data) to the target device, which improves the security and integrity of the data during transmission and realizes data storage. When the target device is not secure, the backup device is started and used as the new target device, providing an alternative solution for data transmission, enhancing reliability and flexibility, so that the data in the current device can be processed and stored in a timely manner, improving timeliness. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 is a flow chart of Example 1 of the present application; Figure 2 This is the flow chart from the second collection in S41 to the re-encryption in S48 in Example 2 of the present application; Figure 3 This is a flowchart of re-encryption of S48 in Example 2 of the present application; Figure 4 This is a flow chart from data decryption at S51 to data recovery at S55 in Example 2 of the present application; Figure 5 This is a flowchart of the second judgment from S81 to the second sorting from S87 in Example 3 of the present application. DETAILED DESCRIPTION

[0028] The following combination Figures 1 to 5 This application is described in further detail.

[0029] Embodiment 1: This embodiment discloses a method for protecting IoT data security. Figure 1 The method includes: S1 first collection, S2 first extraction, S3 data encryption, S4 first verification, S5 data transmission, S6 replacement and S7 data storage. First, the data to be transmitted is collected, and then the sensitive data and non-sensitive data in the data to be transmitted are extracted. Then, it is verified whether the target device is safe. If the target device is safe, data transmission is performed. Otherwise, the target device is replaced by a backup device. Finally, the non-sensitive data is stored in the cloud. The process of this embodiment is as follows: S1 is the first collection, which collects the data to be transmitted in the current device and is recorded as the first data.

[0030] S2 is a first extraction, extracting sensitive data and non-sensitive data from the first data.

[0031] The extraction methods include rule-based extraction methods and machine learning-based methods.

[0032] The rule-based extraction method is to write rules to extract sensitive data according to the previously established sensitive data standards. This can be achieved through string processing functions or regular expression libraries in programming languages ​​(such as Python, Java, etc.).

[0033] The method based on machine learning is: training a machine learning model to identify sensitive data. By adding sensitive data and non-sensitive data labels to each part of the historical data, and using the labeled historical data to train the machine learning model, so that it has the ability to distinguish between sensitive data and non-sensitive data, and then inputting the first data into the trained machine learning model, the sensitive data and non-sensitive data in the first data are obtained.

[0034] S3 data encryption, select a suitable encryption algorithm to encrypt the sensitive data, obtain the encrypted sensitive data, and record it as the second data. The encryption algorithm includes: AES, RSA, etc.

[0035] S4 is the first verification, verifying whether the target device is safe. If so, execute S5 data transmission; if not, execute S6 replacement.

[0036] The target device security standard is: the target device is in a normal operating state and has the authority to receive the second data, or the target device is in a normal operating state and the device information (such as IP address) of the target device has passed the verification.

[0037] S5 data transmission, arbitrarily selecting a transmission path from the current device to the target device, and transmitting and storing the second data to the target device.

[0038] The transmission path selects a transmission protocol with strong security, such as HTTPS, SFTP, etc.

[0039] S6 replaces and starts the backup device, and uses the backup device as the new target device. Then, the first verification in S4 can be re-executed to verify the security of the backup device again.

[0040] S7 data storage, storing non-sensitive data in the first data in the cloud.

[0041] This embodiment verifies the security of the data receiving end (ie, the target device) before data transmission. Data transmission is performed only when the target device is secure, thereby improving the security of data transmission.

[0042] Example 2: Reference Figure 2 The difference between this embodiment and embodiment 1 is that after performing S4 first verification and before performing S5 data transmission, it also includes: S41 is a second collection step, in which the IP address of the target device is collected and the IP address of the target device is recorded as the first IP address.

[0043] This step obtains the IP address of the target device through network scanning or known configuration information.

[0044] Network scanning is a method of actively detecting IoT devices. It determines the existence of the target device and its IP address by sending specific data packets to the target device and listening to the returned response. For example, you can use tools such as Nmap to perform network scanning. Nmap detects which IP addresses are active in the network by sending ICMP echo requests (ping), TCP connection requests, or UDP packets, and further obtains information about the open services and ports on these IoT devices.

[0045] Known configuration information refers to the IP address of a known target device, that is, the name or MAC address of a known target device. ARP (Address Resolution Protocol) can be used to find its IP address because the ARP table contains the mapping relationship between the MAC address and IP address of the IoT device.

[0046] S42 selects a transmission path, including: S421 fifth collection, S422 sixth collection, S423 first judgment and S424 determines the path.

[0047] S421 fifth collection, collect the IP address of the current device, record the IP address of the current device as the second IP address, and obtain the second IP address through the network interface or the system configuration information of the current device.

[0048] S422 is a sixth collection, collecting records of the transmission of historical data from the second IP address to the first IP address, wherein the records include: historical data, the type of historical data, and the transmission path.

[0049] By analyzing the previous data transmission records from the second IP address to the first IP address, it is possible to understand which transmission paths can be successfully transmitted.

[0050] S423 is the first judgment, determining whether the type of the second data is the same as the type of the historical data. If so, the transmission path of the historical data is used as the transmission path of the second data to improve the efficiency and reliability of the transmission, and then S43 data update is executed; if not, S424 is executed to determine the path.

[0051] S424 determines a path, and selects a transmission path according to the size and type of the second data. The transmission path is selected in the following manner: Data size: Big data: For large data sets (such as video files, database backups, etc.), choose a transmission path with higher bandwidth and more stable transmission to improve transmission efficiency and reliability.

[0052] Small data: For small data sets (such as text files, pictures, etc.), choose a transmission path with higher real-time performance and lower latency.

[0053] Data Type: Real-time data: such as video streaming and audio calls, is very sensitive to delay and jitter, and requires the selection of a low-latency, high-stability transmission path.

[0054] Non-real-time data: such as file transfers and emails, have a higher tolerance for delays and choose a transmission path with higher bandwidth but relatively less stable.

[0055] S43 data update, inserting the first IP address as a marker of the second data in the data packet header or a specific field of the second data.

[0056] S44 is the third collection, traversing all receiving ends in the network, querying and recording the UUID of each receiving end, and storing the collected UUID in a preset UUID library. The receiving end refers to a device that has the authority to receive the first data, and the target device is a receiving end among all the receiving ends, which is the device that is ultimately responsible for receiving the first data.

[0057] S45 builds a connection and adds a corresponding IP address field to each UUID in the UUID library.

[0058] S46 fourth collection, parsing the mark in the second data, obtaining the first IP address, calling the UUID of the target device based on the first IP address, and recording it as the first UUID.

[0059] S47 is the second verification, verifying whether the first UUID is as expected. If so, it means that the target device is the receiver of the first data, rather than a device with a wrong or forged IP address, and then S48 is executed to encrypt again; if not, S6 is executed to replace.

[0060] The first UUID being as expected means that the UUID library has a UUID that is the same as the first UUID.

[0061] Reference Figure 3 , S48 is encrypted again, including: S481 first calculation, S482 segmentation, S483 obtaining length, S484 filling length, S485 data merging and S486 re-encryption.

[0062] S481 is a first calculation, in which a hash function is used to calculate a hash value of the first UUID, and the hash value is evenly divided into m parts, and each part is recorded as third data.

[0063] S482 segmentation: segment the sensitive data into m parts, and record each part as fourth data, where the value of m is greater than 1 and less than the number of characters of the sensitive data.

[0064] S483 obtains the length, obtains the length value of each fourth data, and obtains the maximum value n of all length values.

[0065] S484 pads the length, traverses each fourth data, checks whether its length is less than n, and if so, pads the end of the fourth data with 0, and uses the padded fourth data as the new fourth data.

[0066] S485 data merging, concatenating the third data and the fourth data whose positions in the hash value are the same as those in the sensitive data, to obtain merged data, which is recorded as the fifth data.

[0067] During the splicing process, the fourth data is in front and the third data is in the back.

[0068] S486 re-encrypts, re-using the encryption algorithm to encrypt the fifth data, and uses the encrypted fifth data as new second data.

[0069] This embodiment obtains the IP address (first IP address) of the target device, then obtains the IP address (second IP address) of the current device, and then analyzes the historical data transmission records based on the two IP addresses to select a possible transmission path, and then matches the historical path according to the data type or optimizes the transmission efficiency and reliability based on the data size and type. Then, the first IP address is added as a mark to the second data. Then, the historical network record receiving end UUID is traversed, and then the UUID is associated with the first IP address, and then the UUID (i.e., the first UUID) of the target device is obtained through the mark in the second data. Then, it is checked whether the first UUID meets the expectations. If it does, S48 is executed to encrypt again. After the second data is split, each split part is encrypted and transmitted to improve the security of the data.

[0070] Reference Figure 4 In other embodiments, after executing S5 data transmission and before executing S7 data storage, the method further includes: S51 data decryption: the target device decrypts each second data re-encrypted in S486 to obtain m decrypted data.

[0071] During decryption, each second data is decrypted using the decryption algorithm and key corresponding to the re-encryption in S486.

[0072] S52 is the second extraction, extracting all characters from the n+1th bit to the end of each decrypted data respectively, and recording them as the sixth data. The purpose of extracting the sixth data is to obtain each fragment of the hash value, and then restore the hash value.

[0073] S53 deletes characters, extracts the first n characters in each decrypted data, deletes the 0s filled in the length padding in S484 in the first n characters, so as to restore the actual content of each part after the sensitive data is segmented, and records the remaining part after deleting 0 as the seventh data.

[0074] S54: first sorting, arranging the sixth data according to the order of the third data in the hash value, and sorting the seventh data according to the order of the sixth data.

[0075] After arranging the sixth data in the order of the third data in the hash value in this step, the hash value composed of the sixth data can also be extracted, and the hash value is compared with the hash value calculated in the first calculation of S481. If the two are the same, S55 data recovery is executed, otherwise, S6 replacement is executed.

[0076] S55 data recovery, all the seventh data are spliced ​​according to the order of the first sort in S54 to obtain sensitive data.

[0077] In order to facilitate the recovery of sensitive data, during the segmentation in S482, the segmentation is performed after the non-zero character to ensure that the last character of the fourth data after the segmentation is a non-zero number.

[0078] The present embodiment is further explained below using a specific example.

[0079] Decrypted data: Assume that the decrypted data is: 123456789000a94f, 987654321000fa94 (the data here is in hexadecimal, just for example). Assume that you need to extract the first 12 characters (n=12), extract the first 12 characters from the decrypted data: 123456789000, 987654321000.

[0080] Extract characters from the 13th position to the end: a94f, fa94.

[0081] Delete the padding 0: In this example, you can see that the last three characters are all 0. These 0s are filled in the previous S484 padding length. These 0s need to be deleted until a non-0 character is encountered. Therefore, the data after deletion is: 123456789, 987654321.

[0082] Sorting the seventh data: The sixth data is sorted according to the hash value as follows: fa94, a94f. Then the seventh data is sorted as follows: 987654321, 123456789.

[0083] The restored sensitive data is: 987654321123456789.

[0084] This embodiment restores the sensitive data according to the order of the third data, that is: since the third data and the segmented part of the sensitive data (i.e., the fourth data) are spliced ​​together to form the fifth data in the S485 data merging step, and the fifth data is encrypted into the second data in the S486 re-encryption step, the order of the third data actually represents the original order of the segmented part of the sensitive data, so the sixth data can be sorted according to the third order, and then the seventh data can be sorted according to the order of the sixth data, thereby restoring the sensitive data.

[0085] Example 3: Reference Figure 5 The difference between this embodiment and embodiment 2 is that after performing the first calculation in step S481 and before performing the segmentation in step S482, the following is further included: S81 is the second judgment, integrating all the third data into a data set to determine whether there is the same third data in the data set. If so, it means that there are repeated fields after segmentation, which will interfere with the subsequent recovery of sensitive data, and it is necessary to execute S82 second calculation; if not, it means that each part after segmentation is a unique part, which will not interfere with the subsequent recovery of sensitive data, and continue to execute S482 segmentation.

[0086] S82 is a second calculation, calculating the length of the hash value of the first UUID, recording the length of the hash value as the eighth data, calculating the factors of the eighth data, and integrating all the factors into a factor set.

[0087] S83 data elimination: eliminate m from the factor set, and use the factor set without m as a new factor set.

[0088] S84 data replacement, select a factor from the new factor set, use it as the new m, and re-split the hash value of the first UUID calculated in the first calculation in S481.

[0089] S85 is the third judgment, judging whether the m is greater than the preset threshold and the remaining factors in the factor set are greater than the preset threshold. If so, it means that using this m to execute the first calculation of S481 will also result in duplicate third data, and it is necessary to execute S86 third extraction; if not, it means that using this m to re-split the hash value may not result in duplicate third data, and then execute S481 first calculation.

[0090] S86: third extraction, extracting the same third data and recording it as ninth data.

[0091] S87 second sorting, adding a number after the last character of the ninth data according to the order in which the ninth data appears in the hash value of the first UUID, and using the ninth data with the added number as the new third data.

[0092] For example, if there are three repeated third data: a94f, then the corresponding number is added after the last character f, and the ninth data after adding the number are: a94f1, a94f2, a94f3.

[0093] This embodiment integrates the third data and determines its repeatability. If there is repetition, the segmentation parameter m is reselected by calculating the hash value length and the factor set, and it is checked whether the new m and the factor set meet the preset conditions; if so, the repeated data is extracted and a sequential number is added, and at the same time, part of the content of the fifth data is extracted as the new sixth data according to specific rules in subsequent processing; if the conditions are not met or the data is not repeated, the original data segmentation operation is performed.

[0094] Embodiment 4: This embodiment discloses an IoT data security protection system, the system comprising: The first acquisition module is used to collect the data to be transmitted in the current device, which is recorded as the first data. These first data include various types of information, such as user information, device status, operation log, etc. The first acquisition module obtains these first data from the device through specific technical means (such as API interface, file system reading, etc.).

[0095] The first extraction module is connected to the first acquisition module for extracting sensitive data and non-sensitive data from the first data. Sensitive data generally refers to data that may cause loss or harm to users or devices if leaked, such as personal information, passwords, keys, etc. Non-sensitive data is relatively common, such as device model, operating system version, etc.

[0096] The data encryption module is in communication with the first extraction module and is used to encrypt the sensitive data using an encryption algorithm to obtain the encrypted sensitive data, which is recorded as the second data.

[0097] The first verification module is used to verify whether the target device is safe, and if it is safe, the data transmission module is triggered to transmit the second data (ie, the encrypted sensitive data) to the device. Otherwise, the replacement module is triggered.

[0098] The data transmission module is communicatively connected with the data encryption module and the first verification module, and is used for transmitting and storing the second data to the target device.

[0099] The replacement module is connected to the first verification module for starting the backup device and using the backup device as a new target device.

[0100] The data storage module is communicated with the first extraction module and is used to store the non-sensitive data in the first data to the cloud, thereby releasing the storage space inside the current device and facilitating the user to access the non-sensitive data anytime and anywhere.

[0101] The first acquisition module of this system is responsible for collecting the data to be transmitted, the first extraction module is responsible for separating sensitive and non-sensitive data, the data encryption module encrypts the sensitive data, and the first verification module ensures the security of the target device and then triggers the data transmission module to transmit the encrypted data to the target device or start the backup device. At the same time, the data storage module saves the non-sensitive data to the cloud. The whole process can ensure the safe transmission and storage of data.

[0102] Embodiment 5: This embodiment further provides a computer-readable storage medium on which a computer program is stored. When the computer program is processed by a processor, it can implement the described method.

[0103] The above are all preferred embodiments of the present application, and the protection scope of the present application is not limited thereto. Therefore, any equivalent changes made according to the structure, shape, and principle of the present application should be included in the protection scope of the present application.

Claims

1. A method for protecting Internet of Things data security, characterized in that: include: First collection: collect the data to be transmitted in the current device, recorded as the first data; First extraction: extracting sensitive data and non-sensitive data from the first data; Data encryption: using an encryption algorithm to encrypt sensitive data, and obtaining the encrypted sensitive data, which is recorded as the second data; First verification: verify whether the target device is safe. If so, perform the data transmission steps; If not, then perform the replacement step; Data transmission: transmitting and storing the second data to the target device; Replace: Start the standby device and use it as the new target device; Data storage: Store non-sensitive data in the cloud.

2. The IoT data security protection method according to claim 1, characterized in that: After performing the first verification step and before performing the data transmission step, the method further includes: Second collection: collect the IP address of the target device and record it as the first IP address; Data update: adding a mark to the second data, wherein the mark is the first IP address; Third collection: collecting UUIDs of all receiving ends and storing all UUIDs in a preset UUID library, wherein the receiving end refers to a device that has the authority to receive the first data; Association: Associate each UUID in the UUID database with the corresponding IP address; Fourth collection: retrieve the UUID of the target device based on the tag of the second data, and record it as the first UUID; Second verification: verify whether the first UUID meets expectations. If so, execute the data transmission step; if not, execute the replacement step.

3. The IoT data security protection method according to claim 2, characterized in that: After executing the second acquisition step and before executing the data update step, the method further includes: Fifth collection: collect the IP address of the current device and record it as the second IP address; Sixth collection: collecting records of the transmission of historical data from the second IP address to the first IP address, the records including: historical data, type of historical data, and transmission path; First judgment: judging whether the type of the second data is the same as the type of the historical data, if so, taking the transmission path of the historical data as the transmission path of the second data and executing the data updating step; if not, executing the path determining step; Determine a path: Select a transmission path according to the size and type of the second data.

4. The IoT data security protection method according to claim 3 is characterized in that: After performing the second verification step and before performing the data transmission step, the method further includes: First calculation: calculating a hash value of the first UUID, and dividing the hash value into m parts, each of which is recorded as third data; Segmentation: The sensitive data is divided into m parts, and each part is recorded as the fourth data, where the value of m is greater than 1 and less than the number of characters of the sensitive data; Data merging: The third data and the fourth data having the same position are concatenated to obtain merged data, which is recorded as the fifth data; Re-encryption: re-adopting the encryption algorithm to encrypt the fifth data, and using the encrypted fifth data as new second data.

5. The IoT data security protection method according to claim 4, characterized in that: After the step of performing the segmentation and before the step of performing the data merging, the method further includes: Get length: Get the length value of each fourth data, and get the maximum value n among all length values; Padding length: padding the fourth data that is less than the maximum value n with 0, and using the padded fourth data as new fourth data.

6. The IoT data security protection method according to claim 5, characterized in that: After executing the step of data transmission and before executing the step of data storage, the method further includes: Data decryption: The target device decrypts each second data to obtain m decrypted data; Second extraction: extract the part from the n+1th bit to the end of each decrypted data, and record it as the sixth data; Delete characters: extract the first n characters in each decrypted data, delete the 0 filled in the first n characters, and obtain the seventh data; First sorting: arranging the sixth data in the order of the third data, and sorting the seventh data according to the order of the sixth data; Data recovery: All seventh data are spliced ​​in sequence to obtain sensitive data.

7. The IoT data security protection method according to any one of claims 4 to 6, characterized in that: After performing the first calculation step and before performing the segmentation step, the method further includes: Second judgment: integrating all third data into a data set, judging whether there is the same third data in the data set, if so, executing the second calculation step; if not, executing the segmentation step; Second calculation: calculating the length of the hash value, recording it as the eighth data, and obtaining a factor set of the eighth data; Data elimination: Eliminate m from the factor set to obtain a new factor set; Data replacement: Use one of the factors in the new factor set as the new m and execute the first calculation step.

8. The IoT data security protection method according to claim 7, characterized in that: After the step of performing data replacement and before the step of performing the first calculation, the method further includes: Third judgment: judging whether m is greater than a preset threshold and whether the remaining factors in the factor set are greater than the preset threshold, if so, executing the third extraction step; if not, executing the first calculation step; Third extraction: extract the same third data and record it as the ninth data; Second sorting: according to the order in which the ninth data appears in the hash value of the first UUID, a number is added after the last character of the ninth data, and the ninth data with the added number is used as the new third data.

9. An Internet of Things data security protection system, the system is used to implement the method described in any one of claims 1 to 8, characterized in that: include: A first acquisition module, used for acquiring data to be transmitted in the current device, recorded as first data; A first extraction module, connected to the first acquisition module for extracting sensitive data and non-sensitive data from the first data; A data encryption module, which is in communication with the first extraction module and is used to encrypt the sensitive data using an encryption algorithm to obtain the encrypted sensitive data, which is recorded as the second data; The first verification module is used to verify whether the target device is safe, and if it is safe, trigger the data transmission module; Otherwise, the replacement module is triggered; A data transmission module, which is in communication with the data encryption module and the first verification module, and is used to transmit and store the second data to the target device; A replacement module, which is in communication with the first verification module and is used to start the backup device and use the backup device as a new target device; The data storage module is communicatively connected to the first extraction module and is used to store non-sensitive data in the cloud.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is processed by a processor, it can implement the method according to any one of claims 1 to 8.

Images