An Internet of Things data security protection method and system, and a storage medium

Abstract

The application provides an Internet of Things data security protection method and system and a storage medium, relates to the technical field of data security, and comprises the steps of first acquisition, first extraction, data encryption, first verification, data transmission, replacement and data storage.The system comprises a first acquisition module, a first extraction module, a data encryption module, a first verification module, a data transmission module, a replacement module and a data storage module.The application verifies the security of a data receiving end before data transmission, performs data transmission on the premise that the target equipment is secure, and improves the security of data transmission.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of data security, in particular to an Internet of Things data security protection method and system and a storage medium. BACKGROUND

[0002] With the rapid development of the Internet of Things technology, more and more devices are connected to the network, forming a huge Internet of Things system. These devices not only have a large number, but also are widely distributed, and involve a very diverse application field. In the Internet of Things system of hospitals, social security, banks and enterprises, the data transmitted between devices often contain important sensitive or critical information, such as personal privacy, business secrets, etc. Therefore, improving the security of these data in the transmission and storage process has become one of the important challenges for the development of the Internet of Things technology.

[0003] A Chinese invention patent with the application publication date of July 19, 2024 and the application publication number of CN118368152A discloses an Internet of Things-based big data security protection method and system. A central processing unit issues a number to each Internet of Things terminal according to a unified numbering rule. When the central processing unit monitors a data security threat, it automatically disconnects the communication connection with each Internet of Things terminal. When any Internet of Things terminal monitors a data security threat, it stores the sensitive data after randomly scrambling it, sends a warning to the central processing unit that it has been attacked, and automatically disconnects the communication connection with each Internet of Things terminal and the communication connection with the central processing unit.

[0004] However, the Internet of Things device (i.e. the Internet of Things terminal) plays the role of a core node of data transmission. Its stability and security are of great significance to the smooth operation of the entire system. In the actual deployment and application process, these Internet of Things devices may encounter failures or be maliciously invaded, thereby posing a potential threat to the real-time and secure transmission of data. SUMMARY

[0005] In order to improve the stability and security of the Internet of Things device, the application provides an Internet of Things data security protection method, system and storage medium.

[0006] In a first aspect, the application provides an Internet of Things data security protection method, which adopts the following technical solution:

[0007] An Internet of Things data security protection method, comprising the following steps:

[0008] First acquisition: acquiring data to be transmitted in the current device, denoted as first data;

[0009] First extraction: extracting sensitive data and non-sensitive data in the first data;

[0010] Data encryption: sensitive data is encrypted using an encryption algorithm to obtain encrypted sensitive data, denoted as second data;

[0011] First verification: verifying whether the target device is secure, if so, performing the data transmission step; if not, performing the replacement step;

[0012] Data transmission: transmitting and storing the second data to the target device;

[0013] Replacement: starting a backup device, and taking the backup device as a new target device;

[0014] Data storage: storing non-sensitive data to the cloud.

[0015] By adopting the above technical solutions, the security of the target device is verified before data transmission, potential security risks can be found and reduced in time, and the security of data transmission is improved. The encrypted sensitive data (second data) is transmitted and stored to the target device, improving the security and integrity of data during transmission, and realizing data storage. When the target device is not secure, the backup device is started and used as a new target device, providing an alternative for data transmission, enhancing reliability and flexibility, so that data in the current device can be processed and stored in time, improving timeliness. When processing sensitive data, the first extraction, data encryption and first verification steps are used to enhance the security of the data.

[0016] Optionally, after the step of performing the first verification, before the step of performing the data transmission, further comprising:

[0017] Second collection: collecting the IP address of the target device, denoted as the first IP address;

[0018] Data update: adding a label to the second data, the label being the first IP address;

[0019] Third collection: collecting the UUID of all receiving ends, and storing all UUIDs in a preset UUID library, the receiving end being a device authorized to receive the first data;

[0020] Association: associating each UUID in the UUID library with the corresponding IP address;

[0021] Fourth collection: retrieving the UUID of the target device based on the label of the second data, denoted as the first UUID;

[0022] Second verification: verifying whether the first UUID meets the expectation, if so, performing the data transmission step; if not, performing the replacement step.

[0023] By adopting the technical scheme, the IP address is a unique identifier of the device in the network, and the application realizes the association of the second data and the target device IP address by adding a mark (i.e., the first IP address) to the second data, which helps to determine whether the device receiving the second data is the target device in directional transmission. The application also collects the UUIDs of all devices capable of receiving the first data, and establishes a UUID library accordingly, and then associates each UUID with the first IP address, so that the user can trace the UUID of the target device through the mark of the second data, and then determine whether the target device is correct by verifying whether the UUID meets the expectation. The application can further reduce the risk of data leakage caused by errors in data transmission direction or malicious attacks (such as fake IP addresses) by setting the second verification step.

[0024] Optionally, after the step of performing the second collection, before the step of performing the data updating, further comprising:

[0025] The fifth collection: collecting the IP address of the current device, denoted as the second IP address;

[0026] The sixth collection: collecting the record of the historical data transmitted from the second IP address to the first IP address, the record including: the historical data, the type of the historical data, and the transmission path;

[0027] The first judgment: judging whether the type of the second data is the same as the type of the historical data, if yes, taking the transmission path of the historical data as the transmission path of the second data, and performing the step of data updating; if no, performing the step of determining the path;

[0028] Determine the path: selecting the transmission path according to the size and type of the second data.

[0029] By adopting the technical scheme, the application obtains the transmission path of the historical data by the record of the historical data transmitted from the second IP address to the first IP address, and intelligently selects the transmission path by comparing the type of the second data with the type of the historical data. If the types are the same, the existing transmission path is used to transmit the second data, reducing the cost of path selection and optimization; if the types are different, the step of determining the path is entered, and the step of the first judgment realizes intelligent selection of the data transmission path, which improves the efficiency and ensures the adaptability of data transmission. In the case of different data types, the most suitable transmission path is selected according to the size and type of the second data, which helps to improve the smoothness and efficiency of data transmission.

[0030] Optionally, after the step of performing the second verification, before the step of performing the data transmission, further comprising:

[0031] First calculation: calculate the hash value of the first UUID, and divide the hash value into m parts, each part is recorded as third data;

[0032] Segmentation: divide the sensitive data into m parts, each part is recorded as fourth data, the value of m is greater than 1 and less than the number of characters of the sensitive data;

[0033] Data merging: splice the third data and the fourth data with the same position to obtain the merged data, recorded as fifth data;

[0034] Re-encryption: re-encrypt the fifth data using the encryption algorithm, and the encrypted fifth data is used as the new second data.

[0035] By adopting the above technical solution, the hash value of the UUID is calculated, which further enhances the uniqueness of the data in the subsequent steps and improves the security of the data. The hash value is divided into m parts (each part is recorded as third data), and the corresponding sensitive data is also divided into m parts (each part is recorded as fourth data). The third data and the fourth data with the same position are spliced to obtain the fifth data. Since part of the hash value is added to the original sensitive data, even if part of the data is intercepted, it is difficult for the attacker to directly analyze the original sensitive data, further enhancing the security of the data.

[0036] Optionally, after the step of performing segmentation, before the step of performing data merging, it further includes:

[0037] Obtaining length: obtaining the length value of each fourth data, and obtaining the maximum value n in all length values;

[0038] Padding length: padding the fourth data smaller than the maximum value n with 0, and the fourth data after padding is used as the new fourth data.

[0039] By adopting the above technical solution, the length value of each fourth data is obtained, the difference of the data length can be understood, the maximum value n in all length values is obtained, and the standard data length is provided for the subsequent padding length step. The fourth data smaller than the maximum value n is padded with 0, so that the length of all fourth data is unified to n, thereby realizing the standardization processing of the data, which helps to determine the position of the fourth data in the data merging step, and accurately separates the third data and the fourth data in the subsequent decryption process. The padding operation adds 0 at the end of the data, which does not change any information of the original data, so the integrity of the data is maintained.

[0040] Optionally, after the step of performing data transmission, before the step of performing data storage, it further includes:

[0041] Data decryption: the target device decrypts each second data to obtain m decrypted data;

[0042] Second extraction: the part from the n+1th bit to the end of each decrypted data is extracted, denoted as sixth data;

[0043] Delete characters: the first n characters in each decrypted data are extracted, and the filled 0 in the first n characters is deleted to obtain seventh data;

[0044] First sorting: the sixth data is arranged according to the order of the third data, and the seventh data is sorted according to the order of the sixth data;

[0045] Data recovery: all seventh data are spliced in turn to obtain sensitive data.

[0046] By using the above technical scheme, the part from the n+1th bit to the end of the decrypted data is extracted, which actually extracts the third data. The extracted content is denoted as the sixth data. The sixth data is arranged according to the order of the third data, and the recovered hash value can be obtained. The first n characters in each decrypted data are extracted, and the filled 0 in the first n characters is deleted to obtain the seventh data. The seventh data is sorted according to the order of the sixth data. Finally, the seventh data is spliced according to the order of the sorting, so as to recover the sensitive data. The application can ensure data security without losing data.

[0047] Optionally, after the step of performing the first calculation, before the step of performing the segmentation, the method further comprises:

[0048] Second judgment: all third data are integrated into a data set, and it is judged whether there is the same third data in the data set. If yes, the step of performing the second calculation is executed; if no, the step of performing the segmentation is executed;

[0049] Second calculation: the length of the hash value is calculated, denoted as eighth data, and a factor set of the eighth data is obtained;

[0050] Data elimination: m is eliminated from the factor set to obtain a new factor set;

[0051] Data replacement: one factor in the new factor set is taken as a new m, and the step of performing the first calculation is executed.

[0052] By using the above technical scheme, all third data are integrated into a data set, and it is judged whether there is the same third data in the data set. If there is the same third data, it will lead to the failure to recover the original sensitive data. Therefore, if there is the same third data, the application re-divides the hash value, so as to accurately recover the sensitive data.

[0053] Optionally, after the step of performing data replacement, before the step of performing the first calculation, further comprising:

[0054] Third judgment: judging whether the m is greater than a preset threshold and the remaining factors in the factor set are all greater than the preset threshold, if yes, performing the third extraction step; if no, performing the first calculation step;

[0055] Third extraction: extracting the same third data, denoted as ninth data;

[0056] Second sorting: adding a number after the last character of the ninth data according to the order of appearance of the ninth data in the hash value of the first UUID, and taking the ninth data after adding the number as new third data.

[0057] By adopting the above technical solution, when the m is greater than the preset threshold and the remaining factors in the factor set are all greater than the preset threshold, it is indicated that even if the first calculation step is re-executed, the result of the segmentation will still have a high probability of existing the same part, because the larger the m is, the more the third data obtained after the hash value is segmented, and the greater the possibility of repetition is, therefore, the third extraction and the second sorting steps are set in the present application, and the number is additionally added to the repeated third data, so that the third data has uniqueness, and the sensitive data can be accurately recovered based on the third data.

[0058] In a second aspect, the present application provides an Internet of Things data security protection system, which adopts the following technical solution:

[0059] An Internet of Things data security protection system, comprising:

[0060] A first collection module, configured to collect data to be transmitted in a current device, denoted as first data;

[0061] A first extraction module, in communication connection with the first collection module, configured to extract sensitive data and non-sensitive data in the first data;

[0062] A data encryption module, in communication connection with the first extraction module, configured to encrypt the sensitive data by using an encryption algorithm to obtain encrypted sensitive data, denoted as second data;

[0063] A first verification module, configured to verify whether a target device is secure, if yes, triggering a data transmission module; otherwise, triggering a replacement module;

[0064] A data transmission module, in communication connection with the data encryption module and the first verification module, configured to transmit and store the second data to the target device;

[0065] The replacement module is in communication connection with the first verification module, and is configured to start a backup device and take the backup device as a new target device.

[0066] The data storage module is in communication connection with the first extraction module, and is configured to store the non-sensitive data to the cloud.

[0067] By using the above technical solutions, the first acquisition module can collect data in the device in real time or on demand, providing a basis for subsequent processing. The first extraction module can more effectively process data of different importance by classifying the data. The data encryption module can enhance the security of data transmission and reduce the risk of sensitive data leakage. Then, the first verification module verifies the security of the target device to prevent sensitive data from falling into an unsafe environment. The data transmission module can achieve reliable transmission and storage of data. The replacement module can replace the target device to enhance the reliability of the system. The data storage module stores the non-sensitive data in the first data to the cloud to achieve storage of all data.

[0068] In a third aspect, the present application provides a computer readable storage medium having a computer program stored thereon, wherein the computer program, when processed by a processor, can implement the method.

[0069] In summary, the present application has at least one of the following beneficial technical effects:

[0070] 1. The present application verifies the security of the target device before data transmission, which can timely discover and reduce potential security risks, and improves the security of data transmission.

[0071] 2. The present application also transmits and stores the encrypted sensitive data (second data) to the target device, which improves the security and integrity of data in the transmission process, and realizes the storage of data. When the target device is not secure, a backup device is started and taken as a new target device, which provides an alternative solution for data transmission, enhances the reliability and flexibility, and enables the data in the current device to be processed and stored in time, improving the timeliness. BRIEF DESCRIPTION OF DRAWINGS

[0072] Figure 1 is a flowchart of embodiment 1 of the present application;

[0073] Figure 2 is a flowchart of S41 second acquisition to S48 re-encryption in embodiment 2 of the present application;

[0074] Figure 3 is a flowchart of S48 re-encryption in embodiment 2 of the present application;

[0075] Figure 4 is a flowchart of S51 data decryption to S55 data recovery in embodiment 2 of the present application;

[0076] Figure 5 is a flowchart of S81 second judgment to S87 second sorting in embodiment 3 of the present application. DETAILED DESCRIPTION

[0077] The following will be described in detail in combination with Figures 1 to 5 The present application is further described.

[0078] Embodiment 1: The present embodiment discloses an Internet of Things data security protection method, referring to Figure 1 , the method comprises: S1 first acquisition, S2 first extraction, S3 data encryption, S4 first verification, S5 data transmission, S6 replacement and S7 data storage, first, collecting the data to be transmitted, then extracting the sensitive data and non-sensitive data in the data to be transmitted, then verifying whether the target device is safe, if the target device is safe, then performing data transmission, otherwise, using the standby device to replace the target device, finally storing the non-sensitive data to the cloud, the process of the present embodiment is as follows:

[0079] S1 first acquisition, collecting the data to be transmitted in the current device, denoted as first data.

[0080] S2 first extraction, extracting the sensitive data and non-sensitive data in the first data.

[0081] The extraction method comprises a rule-based extraction method and a machine learning-based method.

[0082] The rule-based extraction method is: according to the previously formulated sensitive data standard, a rule is written to extract sensitive data, which can be realized by using string processing functions or regular expression libraries in programming languages (such as Python, Java, etc.).

[0083] The machine learning-based method is: training a machine learning model to identify sensitive data. By adding labels of sensitive data and non-sensitive data to each part of the historical data, and using the labeled historical data to train the machine learning model, so that it has the ability to distinguish sensitive data and non-sensitive data, then inputting the first data into the trained machine learning model to obtain the sensitive data and non-sensitive data in the first data.

[0084] S3 data encryption, selecting a suitable encryption algorithm to encrypt the sensitive data, obtaining the encrypted sensitive data, denoted as second data. The encryption algorithm includes: AES, RSA, etc.

[0085] S4 first verification, verifying whether the target device is safe, if yes, executing S5 data transmission; if not, executing S6 replacement.

[0086] The standard for the security of the target device is that the target device is in a normal operating state and has the right to receive the second data, or the target device is in a normal operating state and the device information (such as the IP address) of the target device passes the verification.

[0087] S5 data transmission, any transmission path from the current device to the target device is selected, and the second data is transmitted and stored to the target device.

[0088] The transmission path selects a transmission protocol with strong security, such as HTTPS, SFTP, etc.

[0089] S6 replacement, starting a backup device, taking the backup device as a new target device, and then re-executing S4 first verification to verify the security of the backup device again.

[0090] S7 data storage, storing non-sensitive data in the first data to the cloud.

[0091] Before data transmission, the security of the data receiving end (i.e. the target device) is verified, and data transmission is performed only when the target device is secure, thereby improving the security of data transmission.

[0092] Embodiment 2: Refer to Figure 2 The difference between this embodiment and embodiment 1 is that after performing S4 first verification, before performing S5 data transmission, it further includes:

[0093] S41 second acquisition, acquiring the IP address of the target device, and recording the IP address of the target device as the first IP address.

[0094] This step obtains the IP address of the target device through network scanning or known configuration information, etc.

[0095] Network scanning is a method of actively detecting Internet of Things devices. It determines the existence of a target device and its IP address by sending specific data packets to the target device and listening to the returned response. For example, tools such as Nmap can be used for network scanning. Nmap sends ICMP echo requests (ping), TCP connection requests, or UDP packets to detect which IP addresses are active in the network, and further obtains the open services and port information on these Internet of Things devices.

[0096] Known configuration information refers to the IP address of the target device, i.e. the name or MAC address of the target device, which can be used to find its IP address using ARP (Address Resolution Protocol), because the ARP table contains the mapping relationship between the MAC address and IP address of the Internet of Things device.

[0097] S42 selecting a transmission path, including: S421 fifth acquisition, S422 sixth acquisition, S423 first judgment and S424 determining path.

[0098] S421 fifth acquisition, acquiring the IP address of the current device, recording the IP address of the current device as the second IP address, and obtaining the second IP address through the network interface or the system configuration information of the current device.

[0099] S422 sixth acquisition, collecting records of historical data transmission from the second IP address to the first IP address, including: historical data, type of historical data and transmission path.

[0100] By analyzing the data transmission records from the second IP address to the first IP address before, it can be known which transmission path can be successfully transmitted.

[0101] S423 first judgment, judging whether the type of second data is the same as the type of historical data, if yes, the transmission path of historical data is used as the transmission path of second data, improving the efficiency and reliability of transmission, and then executing S43 data update; if not, executing S424 determining path.

[0102] S424 determining path, selecting transmission path according to the size and type of second data, the selection method of transmission path is as follows:

[0103] Data size:

[0104] Large data: for large data set (such as video file, database backup, etc.), select transmission path with higher bandwidth and more stable, to improve the transmission efficiency and reliability.

[0105] Small data: for small data set (such as text file, picture, etc.), select transmission path with higher real-time performance and lower delay.

[0106] Data type:

[0107] Real-time data: such as video stream, audio call, etc., which is very sensitive to delay and jitter, and needs to select low delay and high stability transmission path.

[0108] Non real-time data: such as file transfer, email, etc., which has higher tolerance to delay, and selects transmission path with higher bandwidth but relatively unstable.

[0109] S43 data update, inserting the first IP address as the mark of second data in the data packet header or specific field of second data.

[0110] S44 third acquisition, traversing all receiving ends in the network, querying and recording the UUID of each receiving end, storing the acquired UUID in a preset UUID library, the receiving end refers to a device with the right to receive the first data, the target device is a certain receiving end among all receiving ends, and is a device finally responsible for receiving the first data.

[0111] S45 association, adding an IP address field corresponding to each UUID in the UUID library.

[0112] S46 fourth acquisition, parsing the mark in the second data, obtaining the first IP address, calling the UUID of the target device based on the first IP address, and recording it as the first UUID.

[0113] S47 second verification, verifying whether the first UUID is expected, if so, it means that the target device is the receiving end of the first data, not a device with a false or forged IP address, and then performing S48 encryption again; if not, performing S6 replacement.

[0114] The first UUID is expected to mean that the UUID library has the same UUID as the first UUID.

[0115] Referring to Figure 3 , S48 re-encryption, including: S481 first calculation, S482 segmentation, S483 length acquisition, S484 length padding, S485 data merging and S486 re-encryption.

[0116] S481 first calculation, using a hash function to calculate the hash value of the first UUID, and dividing the hash value into m parts, each part is recorded as third data.

[0117] S482 segmentation, the sensitive data is divided into m parts, each part is recorded as fourth data, and the value of m is greater than 1 and less than the number of characters of the sensitive data.

[0118] S483 length acquisition, acquiring the length value of each fourth data, and acquiring the maximum value n among all length values.

[0119] S484 length padding, traversing each fourth data, checking whether its length is less than n, if so, padding with 0 at the end of the fourth data, and taking the fourth data after padding as new fourth data.

[0120] S485 data merging, the third data and the fourth data in the same position in the hash value and the sensitive data are spliced to obtain the merged data, which is recorded as fifth data.

[0121] In the splicing process, the fourth data is in front, and the third data is in back.

[0122] S486 re-encryption, re-encrypt the fifth data by re-adopting the encryption algorithm, and take the encrypted fifth data as new second data.

[0123] This embodiment obtains the IP address (first IP address) of the target device, then obtains the IP address (second IP address) of the current device, then analyzes the historical data transmission record based on the two IP addresses to select the possible transmission path, then matches the historical path according to the data type or optimizes the transmission efficiency and reliability based on the data size and type. Then add the first IP address as a mark on the second data. Then traverse the historical network record receiving end UUID, then associate the UUID with the first IP address, then obtain the UUID (i.e. first UUID) of the target device through the mark in the second data. Then check whether the first UUID is as expected, if so, perform S48 re-encryption, by splitting the second data, and encrypting each part after splitting to improve data security.

[0124] Reference Figure 4 In other embodiments, after performing S5 data transmission, before performing S7 data storage, it further includes:

[0125] S51 data decryption, the target device decrypts each second data in S486 re-encryption to obtain m decrypted data.

[0126] In decryption, a decryption algorithm and key corresponding to S486 re-encryption are used to decrypt each second data.

[0127] S52 second extraction, extract all characters from the n+1th to the end of each decrypted data, and mark it as the sixth data. The purpose of extracting the sixth data is to obtain each segment of the hash value, and then restore the hash value.

[0128] S53 delete characters, extract the first n characters in each decrypted data, delete the 0 filled in S484 length padding to restore the actual content of each part of the sensitive data after splitting, and mark the remaining part after deleting 0 as the seventh data.

[0129] S54 first sorting, arrange the sixth data according to the order of the third data in the hash value, and sort the seventh data according to the order of the sixth data.

[0130] After arranging the sixth data according to the order of the third data in the hash value, the hash value composed of the sixth data can also be extracted, and the hash value is compared with the hash value calculated in S481 first calculation. If they are the same, perform S55 data recovery, otherwise, perform S6 replacement.

[0131] S55 data recovery, splice all the seventh data according to the order in the S54 first sorting, and obtain the sensitive data.

[0132] In order to facilitate the recovery of sensitive data, when S482 is divided, it is divided behind the non-zero character, and the last character of the fourth data after division is guaranteed to be a non-zero digit.

[0133] The following uses a specific example to further explain this embodiment.

[0134] Decrypted data: assume that the decrypted data is: 123456789000a94f, 987654321000fa94 (the data here is hexadecimal representation, only as an example). Assume that the first 12 characters (n=12) need to be extracted, and the first 12 characters are extracted from the decrypted data: 123456789000, 987654321000.

[0135] Extract the 13th character to the end: a94f, fa94.

[0136] Delete the filled 0: in this example, it can be seen that the last 3 characters are 0, which are filled in the previous S484 length padding, and these 0 need to be deleted until a non-0 character is encountered. Therefore, the data after deletion is: 123456789, 987654321.

[0137] Sort the seventh data: the sorting of the sixth data according to the hash value is: fa94, a94f. Then the sorting of the seventh data is: 987654321, 123456789.

[0138] The sensitive data is recovered to: 987654321123456789.

[0139] This embodiment recovers the sensitive data according to the order of the third data, that is, because the third data and the sensitive data are divided into the fourth data in the S485 data merging step, and the fifth data is formed by splicing, and the fifth data is encrypted into the second data in the S486 re-encryption step, the order of the third data actually represents the original order of the sensitive data division part, so the sixth data can be sorted according to the third order, and the seventh data can be sorted according to the order of the sixth data, and then the sensitive data is recovered.

[0140] Embodiment 3: refer to Figure 5 The difference between this embodiment and embodiment 2 is that after performing S481 first calculation, before performing S482 division, it further includes:

[0141] S81 Second judgment, integrate all third data into a data set, judge whether there is the same third data in the data set, if yes, it means that there is repeated field after segmentation, which will interfere with the subsequent sensitive data recovery, and S82 second calculation needs to be performed; if not, it means that each part is a unique part after segmentation, which will not interfere with the subsequent sensitive data recovery, and S482 segmentation is continued.

[0142] S82 Second calculation, calculate the length of the hash value of the first UUID, and record the length of the hash value as the eighth data, calculate the factors of the eighth data, and integrate all the factors into a factor set.

[0143] S83 Data rejection, remove m from the factor set, and take the factor set after removing m as a new factor set.

[0144] S84 Data replacement, select a factor in the new factor set, take it as a new m, and re-segment the hash value of the first UUID calculated in S481 first calculation.

[0145] S85 Third judgment, judge whether the m is greater than the preset threshold and all the factors remaining in the factor set are greater than the preset threshold, if yes, it means that using this m to perform S481 first calculation will also appear repeated third data, and S86 third extraction needs to be performed; if not, it means that using this m to re-segment the hash value may not appear repeated third data, and then S481 first calculation is performed.

[0146] S86 Third extraction, extract the same third data, and record it as the ninth data.

[0147] S87 Second sorting, add a number after the last character of the ninth data according to the order of the ninth data in the hash value of the first UUID, and take the ninth data after adding the number as the new third data.

[0148] For example, there are three repeated third data: a94f, add the corresponding number after the last character f, and the ninth data after adding the number is: a94f1, a94f2, a94f3.

[0149] This embodiment integrates the third data and judges its repeatability, if there is repetition, reselects the segmentation parameter m by calculating the hash value length and the factor set, and checks whether the new m and the factor set meet the preset conditions; if yes, extract the repeated data and add the sequence number, and extract part of the content of the fifth data as new sixth data according to the specific rule in subsequent processing; if not, perform the original data segmentation operation.

[0150] Embodiment 4: The embodiment discloses an Internet of Things data security protection system, which comprises:

[0151] A first collection module is configured to collect data to be transmitted in a current device, denoted as first data. The first data includes various types of information, such as user information, device status, operation log, etc. The first collection module obtains the first data from the inside of the device through specific technical means (such as API interface, file system reading, etc.).

[0152] A first extraction module is in communication connection with the first collection module and is configured to extract sensitive data and non-sensitive data from the first data. The sensitive data usually refers to data that will cause loss or harm to users or devices if leaked, such as personal information, passwords, keys, etc. The non-sensitive data is relatively common, such as device model, operating system version, etc.

[0153] A data encryption module is in communication connection with the first extraction module and is configured to encrypt the sensitive data by using an encryption algorithm to obtain encrypted sensitive data, denoted as second data.

[0154] A first verification module is configured to verify whether a target device is secure. If the target device is secure, the first verification module triggers a data transmission module to transmit the second data (i.e., the encrypted sensitive data) to the target device. Otherwise, the first verification module triggers a replacement module.

[0155] The data transmission module is in communication connection with the data encryption module and the first verification module and is configured to transmit and store the second data to the target device.

[0156] The replacement module is in communication connection with the first verification module and is configured to start a backup device and use the backup device as a new target device.

[0157] A data storage module is in communication connection with the first extraction module and is configured to store the non-sensitive data in the first data to the cloud to release the storage space inside the current device and facilitate the user to access the non-sensitive data at any time and any place.

[0158] The first collection module of the system is responsible for collecting data to be transmitted, the first extraction module is responsible for separating sensitive and non-sensitive data, the data encryption module encrypts the sensitive data, the first verification module triggers the data transmission module to transmit the encrypted data to the target device or starts the backup device after ensuring the safety of the target device, and the data storage module saves the non-sensitive data to the cloud. The entire process can guarantee the safe transmission and storage of data.

[0159] Embodiment 5: The embodiment also provides a computer readable storage medium, which stores a computer program. When the computer program is processed by a processor, the method can be implemented.

[0160] The above are all preferred embodiments of the present application, and do not limit the protection scope of the present application, so that: all equivalent changes made according to the structure, shape, principle of the present application should be covered in the protection scope of the present application.

Claims

1. An Internet of Things data security protection method, characterized in that, The method comprises the following steps: First acquisition: collect the data to be transmitted in the current device, denoted as first data; First extraction: extract sensitive data and non-sensitive data from the first data; Data encryption: encrypt the sensitive data using an encryption algorithm to obtain encrypted sensitive data, denoted as second data; First verification: verify whether the target device is secure, if yes, execute the second acquisition step; If not, execute the replacement step; Second acquisition: collect the IP address of the target device, denoted as first IP address; Data update: add a marker to the second data, the marker being the first IP address; Third acquisition: collect all the UUIDs of the receiving ends, which are devices authorized to receive the first data, and store all the UUIDs in a preset UUID library; Association: associate each UUID in the UUID library with the corresponding IP address; Fourth acquisition: based on the marker of the second data, retrieve the UUID of the target device, denoted as first UUID; Second verification: verify whether the first UUID meets the expectation, if yes, execute the first calculation step; if not, execute the replacement step; First calculation: calculate the hash value of the first UUID, and divide the hash value into m parts, each part being denoted as third data; Segmentation: divide the sensitive data into m parts, each part being denoted as fourth data, the last character of the fourth data being a non-zero character, the value of m being greater than 1 and less than the number of characters in the sensitive data; Data merging: splice the third data and the fourth data at the same position to obtain merged data, denoted as fifth data; Re-encryption: re-encrypt the fifth data using the encryption algorithm, and use the encrypted fifth data as new second data; Data transmission: transmit and store the new second data to the target device; Replacement: start the backup device, and use the backup device as the new target device; Data storage: store the non-sensitive data to the cloud; After executing the first calculation step and before executing the segmentation step, the method further comprises the following steps: Second judgment: integrate all the third data into a data set, and determine whether there is the same third data in the data set, if yes, execute the second calculation step; if not, execute the segmentation step; Second calculation: calculate the length of the hash value, denoted as eighth data, and obtain a factor set of the eighth data; Data elimination: eliminate m from the factor set to obtain a new factor set; Data replacement: use one factor in the new factor set as a new m, and execute the first calculation step.

2. The IoT data security protection method of claim 1, wherein, After executing the second acquisition step and before executing the data update step, the method further comprises the following steps: Fifth acquisition: collect the IP address of the current device, denoted as second IP address; Sixth acquisition: collect the record of the historical data transmitted from the second IP address to the first IP address, the record comprising: historical data, type of the historical data, and transmission path; First judgment: determine whether the type of the second data is the same as the type of the historical data, if yes, use the transmission path of the historical data as the transmission path of the second data, and execute the data update step; if not, execute the path determination step; Determining a path: selecting a transmission path according to the size and type of the second data.

3. The IoT data security protection method of claim 1, wherein, After the step of performing segmentation, before the step of performing data merging, further comprising: Obtaining length: obtaining a length value of each fourth data, and obtaining a maximum value n among all length values; Padding length: padding the fourth data smaller than the maximum value n with 0, and taking the fourth data after padding as new fourth data.

4. The IoT data security protection method of claim 3, wherein, After the step of performing data transmission, before the step of performing data storage, further comprising: Data decryption: the target device decrypts each second data to obtain m decrypted data; Second extraction: extracting a part from the n+1th bit to the end of each decrypted data, denoted as sixth data; Deleting characters: extracting the first n characters in each decrypted data, deleting the 0 filled in the first n characters, and obtaining seventh data; First sorting: arranging the sixth data according to the order of the third data, and sorting the seventh data according to the order of the sixth data; Data recovery: sequentially splicing all seventh data to obtain sensitive data.

5. The IoT data security protection method of claim 1, wherein, After the step of performing data replacement, before the step of performing first calculation, further comprising: Third judgment: judging whether m is greater than a preset threshold and the remaining factors in the factor set are all greater than the preset threshold, if yes, performing the step of third extraction; if no, performing the step of first calculation; Third extraction: extracting the same third data, denoted as ninth data; Second sorting: adding a number after the last character of the ninth data according to the order of the ninth data in the hash value of the first UUID, and taking the ninth data after adding the number as new third data.

6. An Internet of Things data security protection system, the system being configured to implement the method of any one of claims 1-5, characterized in that, Comprising: The first acquisition module is used for acquiring data to be transmitted in the current device, denoted as first data; The first extraction module is in communication connection with the first acquisition module, and is used for extracting sensitive data and non-sensitive data in the first data; The data encryption module is in communication connection with the first extraction module, and is used for encrypting the sensitive data by using an encryption algorithm to obtain encrypted sensitive data, denoted as second data; The first verification module is used for verifying whether the target device is safe, if yes, triggering the data transmission module; Otherwise, triggering the replacement module; The data transmission module is in communication connection with the data encryption module and the first verification module, and is used for transmitting and storing the second data to the target device; The replacement module is in communication connection with the first verification module, and is used for starting a backup device, and taking the backup device as a new target device; The data storage module is in communication connection with the first extraction module, and is used for storing the non-sensitive data to the cloud.

7. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program, when processed by the processor, can implement the method of any one of claims 1-5.

Images