Gateway security protection system and method based on Internet of Things technology

Abstract

The invention provides a gateway security protection system and method based on the Internet of Things technology, and the system comprises a server and at least one gateway device, and the server and the gateway device are connected through the Internet or the Internet of Things. The gateway device comprises a data communication module, an access control module and a gateway safety monitoring and protection module. Wherein the data communication module is used for communication between the gateway equipment and a server, uploading data and receiving a control instruction; the access control module is used for acquiring Internet of Things node information of access gateway equipment, generating a security feature library, and performing integrity and legality verification on data of Internet of Things nodes according to the security feature library; the gateway security monitoring and protection module detects the state of the gateway equipment according to a pre-configured white list and a set security policy, and if the detection result is abnormal, a protection measure is executed; and the server calculates the security of the gateway equipment according to the access number, the location, the communication connection state and the historical communication record of the gateway equipment.

Description

Technical Field

[0001] The present invention belongs to the field of security protection, and in particular relates to a gateway security protection system and method based on Internet of Things technology. Background Art

[0002] At present, the Internet of Things technology realizes the real-time collection, transmission and processing of data by connecting various smart devices, which greatly improves the efficiency of life and work. However, with the continuous increase of IoT devices, its security protection issues are becoming increasingly prominent. The existing technology has some obvious shortcomings in the security protection of IoT gateways.

[0003] As an important part of the Internet of Things, the perception layer, such as RFID and Zigbee wireless sensors, are mostly deployed in public areas and lack real-time monitoring, so they are easily controlled and exploited by attackers. Common attack methods include physical attacks, forgery attacks, replay attacks, and information theft, which may lead to the leakage of sensitive information or malicious control of devices.

[0004] The network layer also faces severe security challenges. DDOS attacks are a common attack method in IoT networks. Attackers launch attacks by controlling a large number of IoT devices, causing network congestion and affecting normal services. In addition, the transmission of malicious data, such as spam and viruses, may also spread through the network layer, posing a threat to the IoT system. Privacy leakage is also a major problem at the network layer. Users' sensitive information may be intercepted or abused during transmission.

[0005] At the application layer, the automated nature of IoT devices makes identity theft possible. Attackers can hijack devices and pretend to be real users to pass the system's authentication, and then send unsecured data. Data protection is also a key issue at the application layer. If the processing of large amounts of data is not perfect or timely, it may lead to data loss or leakage.

[0006] Although existing technologies have taken some security measures, such as encryption technology, identity authentication and access control, firewalls and intrusion detection, these measures are still insufficient in the face of evolving attack methods. Although the IoT access gateway serves as a bridge connecting IoT terminal devices with the cloud or local servers and has the functions of data aggregation and forwarding, its security protection capabilities still need to be further strengthened in the face of complex and changing network attacks.

[0007] Existing technologies face many challenges in the security protection of IoT gateways, and new security protection systems and methods need to be continuously developed and improved to cope with increasingly severe security threats. Summary of the invention

[0008] The present invention proposes a gateway security protection system and method based on Internet of Things technology, which solves the security protection problem of Internet of Things gateway devices in a complex network environment, and particularly provides a comprehensive solution in ensuring the security of data communications, access control of Internet of Things nodes, and overall security monitoring and protection of gateway devices.

[0009] The technical solution of the present invention is implemented as follows: a gateway security protection system based on Internet of Things technology includes a server and at least one gateway device, and the server and the gateway device are connected through the Internet or the Internet of Things; the gateway device includes a data communication module, an access control module and a gateway security monitoring and protection module; wherein the data communication module is used for the gateway device to communicate with the server, upload data and receive control instructions; the access control module is used to obtain the information of the Internet of Things node accessing the gateway device, generate a security feature library, and perform integrity and legality verification on the data of the Internet of Things node according to the security feature library; the gateway security monitoring and protection module detects the status of the gateway device according to the pre-configured white list and the set security policy, and executes protection measures if the detection result is abnormal; the server calculates the security of the gateway device according to the number of accesses, the location, the communication connection status and the historical communication records of the gateway device, and divides the gateway devices into different security levels according to the security level, configures the corresponding security policy for the gateway device, and feeds the security policy back to the gateway security monitoring and protection module; The data communication module includes a data packet transceiver module, a data packet parsing module and a security verification module. The data packet transceiver module receives the control instruction sent by the server and extracts the source IP address; the data packet parsing module is used to parse the control instruction and generate a parsing result, extract and parse the source IP address and transmission sequence of the control instruction; the security verification module is used to verify the integrity and legality of the control instruction, and verify the transmission sequence and source IP address of the control instruction; The access control module includes a device information monitoring module and an access verification module, wherein the device information monitoring module is used to obtain the IoT device information accessing the gateway and analyze whether the IoT device is in the security list; the access verification module is used to generate a security feature library and perform integrity and legality verification on the data of the IoT node based on the security feature library.

[0010] Most existing IoT gateway security protection technologies focus on a single security protection function, such as data communication encryption, access control, etc., but often lack system integration and intelligent security policy configuration. In comparison, this technical solution has the following significant differences: Comprehensive security protection system: This technical solution builds a comprehensive security protection system including data communication module, access control module and gateway security monitoring and protection module. These three modules work together to ensure the safe operation of gateway devices. However, existing technologies often only focus on one or several aspects of security protection and lack overall coordination.

[0011] Intelligent security policy configuration: The server dynamically calculates the security of the gateway device based on the number of accesses, location, communication connection status, and historical communication records of the gateway device, and divides the gateway devices into different security levels according to the security level. This intelligent security policy configuration method makes security protection more accurate and efficient. However, the security policy configuration in the existing technology is often relatively fixed and lacks flexibility and adaptability.

[0012] Detailed data communication security verification: In the data communication module, in addition to data packet transmission, reception and analysis, a security verification module is also added to verify the integrity and legality of the control instructions, and verify the transmission order and source IP address of the control instructions. This detailed security verification mechanism greatly enhances the security of data communication. However, the data communication verification in the existing technology is often relatively simple and can be easily bypassed by attackers.

[0013] Double protection of access control: In the access control module, the device information monitoring module and the access verification module work together to ensure that only safe IoT devices can access the gateway. The device information monitoring module first determines whether the device is in the security list, and the access verification module further verifies the integrity and legality of the node data. This double protection method greatly improves the security of access control. However, the access control in the existing technology often relies on a single verification mechanism, which is relatively low in security.

[0014] As a preferred implementation, the device information monitoring module analyzes and identifies the IoT device information. If the IoT device is found to be a trusted device and is in the security list, the device access is allowed, and the device access behavior is monitored and updated; if the IoT device is detected to be an untrusted device, the device is alarmed and the data is discarded; the access verification module generates a security feature library, and establishes a security feature library by obtaining the physical addresses, device port numbers, device IDs, device unique identifiers and IoT device upload data formats of multiple historical IoT access nodes; the control instructions or monitoring data sent to the server are checked for integrity and legality to verify the monitoring data and control instructions; and the verification results are processed. If the verification is successful, the data and control instructions are uploaded to the server; if the verification fails, the data and instructions are discarded and an alarm is sounded.

[0015] As a preferred implementation, the server allocates corresponding security protection measures for the gateway device to send legal data according to the security level when configuring the security policy; the protection measures include managing the whitelist of the gateway device access nodes and monitoring the status of the gateway access device.

[0016] A gateway security protection method based on Internet of Things technology, the method comprising the following steps: S1: The gateway device obtains the physical addresses, device port numbers, device IDs, device unique identifiers, and data upload formats of multiple historical access nodes, and establishes a security feature library for the gateway device; obtains the source IP addresses of multiple historical commands and monitoring data, and establishes a communication feature library for commands and monitoring data; S2: The gateway device obtains the security feature factor of the IoT node, and matches the obtained security feature factor with the information in the security feature library. If the match is successful, the IoT node is allowed to access and transmit data, and step S3 is executed; if the match fails, the IoT node is not allowed to access and transmit data; S3: The gateway device extracts the source IP address of the data packet when uploading data, and compares the source IP and port information contained in the communication feature library with the source IP of the data packet according to the source IP address of the data packet and the communication feature library of the instruction. If the similarity between the source IP address of the data packet and the source IP and port information in the communication feature library of the instruction is higher than a preset threshold, the data is received and step S4 is executed; otherwise, the data packet is rejected; S4: The server evaluates the gateway security level based on the number of gateway devices connected, location information, communication connection status, and historical communication records, and configures security policies for gateway devices of different security levels.

[0017] As a preferred implementation, the security feature factors include a physical address, a device port number, a device ID, and an IoT device upload data format; in the step S2, a security feature library of multiple security feature factors of device access is obtained, and the network to which the node is accessed is analyzed; the node upload data is obtained, the data is verified, and the security feature factors that have been successfully verified are recorded; the recorded security feature factors are analyzed, feature parameters are extracted, and network status evaluation indicators are calculated to establish a security feature library.

[0018] As a preferred implementation, step S2 includes the following sub-steps: S21: Obtain the access device information and the type of the device, and determine whether the device is in the blacklist. If the device is in the blacklist, the device is not allowed to access, and step S24 is executed; if the device is not in the blacklist, the device is allowed to access, and step S22 is executed; S22: judging whether the security factor of the device is included in the blacklist according to the security feature library; if the security factor is included in the blacklist, the device is judged to be unsafe and the device is added to the blacklist; S23: Determine whether the format of the data uploaded by the device is correct, and if it is correct, allow the device to upload data; S24: Record the security feature factors of all devices that pass through; S25: Analyze the security feature factors of the storage device, extract feature parameters and calculate network status evaluation indicators, and establish a security feature library.

[0019] As a preferred implementation, step S3 includes the following sub-steps: S31: Obtain the data uploaded by the legal node and extract the source IP address of the data packet, and match it with the source IP address recorded in the communication feature library. If the match is consistent, the data packet is received and step S32 is executed; otherwise, the data packet is rejected and step S33 is executed; S32: Perform integrity verification on the received data packet; S33: Parse the data, extract the instruction information and the source IP address of the data packet, match the instruction information and the source IP address of the data packet with the format of the data uploaded by the node, if the match is successful, extract the instruction information and the source IP address of the data packet, and return the result of successful data parsing; otherwise, the data parsing fails and an alarm message is issued; if the data parsing is successful, execute step S34; S34: verify the parsed instruction information and return the instruction verification result; S35: Determine whether the instruction verification result is successful. If successful, execute step S36; otherwise, send an alarm message; S36: extract the source IP address from the instruction, and determine whether the source IP address of the instruction is consistent with that of the monitoring data. If they are consistent, return the original data and parsed data of the data packet to the server and execute step S37; otherwise, send an alarm message; S37: Filter the data returned to the server, remove redundant data and malware, and send the filtered data.

[0020] As a preferred implementation, step S4 includes the following sub-steps: S41: Obtain the number, location and network status evaluation index of access gateway devices, count the number of access gateway devices at each location, and calculate the network reliability index; create a data space distribution map with the spatial location and network reliability index as the horizontal axis and the number of gateways and network status evaluation index as the vertical axis; S42: Acquire network status information, and create a status assessment diagram according to the network status assessment result; S43: Counting the network connection status of the gateway device and calculating the network connection status index value as a network security index; S44: Calculate the security of legal instructions according to the state evaluation diagram and the data space distribution diagram; S45: The server obtains the security of each gateway device and configures corresponding network security services for the gateway device; S46: monitor the communication behavior of the node device and collect node data; S47: Verify the format of node data and the uniqueness of data uploaded by IoT devices; S48: Obtain the data timestamp and unique number of the node device, generate a verification string based on the unique number and data timestamp; perform multiple decryptions on the verification string, perform format processing, feature extraction and data cleaning on the decoded data, perform aggregation analysis on the legitimate node data, and return the aggregated data.

[0021] After adopting the above technical scheme, the beneficial effect of the present invention is that by constructing a comprehensive security protection system, the present technical scheme realizes all-round security protection for gateway devices from data communication to access control to security monitoring and protection. This comprehensive and systematic security protection method makes the gateway device more secure and reliable in a complex network environment. By constructing a comprehensive security protection system, the present technical scheme realizes all-round security protection for gateway devices from data communication to access control to security monitoring and protection. This comprehensive and systematic security protection method makes the gateway device more secure and reliable in a complex network environment. By constructing a comprehensive security protection system, the present technical scheme realizes all-round security protection for gateway devices from data communication to access control to security monitoring and protection. This comprehensive and systematic security protection method makes the gateway device more secure and reliable in a complex network environment. By constructing a comprehensive security protection system, the present technical scheme realizes all-round security protection for gateway devices from data communication to access control to security monitoring and protection. This comprehensive and systematic security protection method makes the gateway device more secure and reliable in a complex network environment. By constructing a comprehensive security protection system, the present technical scheme realizes all-round security protection for gateway devices from data communication to access control to security monitoring and protection. This comprehensive and systematic security protection method makes gateway devices more secure and reliable in complex network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0023] Figure 1 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0024] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0025] Example: like Figure 1 As shown in the figure, the working principle of the gateway security protection system based on the Internet of Things technology and its implementation process in a specific working scenario is a complex and delicate process, which aims to ensure the security and stability of data communication in the Internet of Things environment. The system integrates a server and at least one gateway device, which are interconnected through the Internet or the Internet of Things to form an efficient and intelligent security protection network. The working principle of the system will be explained in detail below, and its operation process will be demonstrated through a specific working scenario.

[0026] Data communication module: The data communication module is the bridge for information exchange between the gateway device and the server, and is mainly composed of a data packet transceiver module, a data packet parsing module, and a security verification module. Data packet transceiver module: Responsible for receiving the control instructions sent by the server and extracting the source IP address. This is the first step to ensure that the source of information is traceable, which helps to identify potential malicious attacks. Data packet parsing module: Deeply parses the received control instructions, generates parsing results, and extracts the source IP address and transmission order in the control instructions. This step aims to understand the specific content of the instructions and verify whether the transmission order of the instructions is compliant to prevent tampering. Security verification module: After parsing the instructions, the security verification module will further check the integrity and legality of the control instructions, including verifying the transmission order of the instructions, whether the source IP address is consistent with expectations, and whether the instructions themselves contain malicious code or abnormal behavior patterns. This link is the key to ensuring the safe execution of instructions.

[0027] Access Control Module: The access control module is responsible for managing and verifying IoT nodes that access the gateway, ensuring that only secure devices can access the network. Device Information Monitoring Module: This module continuously monitors the information of IoT devices that attempt to access the gateway, including device type, serial number, manufacturer, etc., and compares this information with the pre-set security list to determine whether the device is authorized or has known security risks. Access Verification Module: Based on the output of the device information monitoring module, the access verification module generates a security feature library that contains the data features of all known secure devices. Subsequently, the module uses these features to verify the integrity and legitimacy of the data of the IoT nodes, effectively preventing unauthorized or potential security devices from accessing the network. Gateway Security Monitoring and Protection Module: This module is responsible for real-time monitoring of the operating status of gateway devices and taking corresponding protective measures based on pre-configured whitelists and security policies. Once abnormal behavior or potential threats are detected, such as unauthorized access attempts, signs of data leakage, etc., the system will immediately trigger the preset protection mechanism, such as isolating infected devices, blocking malicious traffic, recording event logs, etc., to minimize security risks.

[0028] Policy configuration and security assessment on the server side: The server plays the role of a policy maker in the system. It comprehensively assesses the security of gateway devices based on multi-dimensional information such as the number of gateway device accesses, geographic location, communication connection status, and historical communication records, and then divides the gateway devices into different security levels. For gateway devices at different levels, the server configures corresponding security policies and sends these policies to the corresponding gateway security monitoring and protection modules through the data communication module to achieve personalized security protection.

[0029] Assume that in a smart city project, multiple smart street lights are deployed as IoT nodes, and these street lights are connected to the city's management center server through gateway devices. The following is the workflow of the gateway security protection system in this scenario: Initial configuration: First, the server collects basic information of all smart street lights, such as device ID, location, manufacturer, etc., and establishes a security list. At the same time, different security policies are preset for different types of street lights based on historical data and risk assessment. Device access verification: When a new street light attempts to access the network, the device information monitoring submodule of the access control module captures its information and compares it with the security list. If the device is in the security list, the access verification module will generate a security feature library for the device and start to verify its data integrity and legitimacy. Data communication security: Once the device is verified and successfully connected, the data communication module starts working. The server sends control instructions (such as adjusting brightness, switching light time, etc.), and the data packet transceiver module receives and extracts the source IP address. The data packet parsing module parses the instruction content, and the security verification module ensures that the instruction has not been tampered with and comes from a legitimate source.

[0030] Real-time monitoring and protection: The gateway security monitoring and protection module continuously monitors the data transmission and status changes of street light equipment. If abnormal behavior is detected, such as data transmission interruption, abnormal data pattern, etc., the system immediately initiates protection measures, such as isolating the problem device, and reporting the event details to the server. Dynamic policy adjustment: The server adjusts security policies regularly or on demand based on the collected security events, device health status and other information. For example, if it is found that street lights in a certain area are frequently attacked, the server may enhance the security policy of the area, such as increasing the encryption level, shortening the password update cycle, etc. Log recording and analysis: All security events, device status changes, policy adjustments and other operations are recorded in the log for subsequent analysis and auditing. This helps identify security vulnerabilities, optimize protection strategies, and provide data support for future security decisions. Through the above process, the gateway security protection system based on IoT technology can not only effectively identify and prevent potential security threats, but also dynamically adjust security strategies according to real-time conditions, ensuring efficient and stable operation of the IoT environment, and providing solid security guarantees for the construction of smart cities.

[0031] The device information monitoring module analyzes and identifies the IoT device information. If the IoT device is found to be a trusted device and is in the security list, the device access is allowed, and the device access behavior is monitored and updated; if the IoT device is detected to be an untrusted device, the device is alarmed and the data is discarded; the access verification module generates a security feature library, and establishes the security feature library by obtaining the physical addresses, device port numbers, device IDs, device unique identifiers and IoT device upload data formats of multiple historical IoT access nodes; the control instructions or monitoring data sent to the server are checked for integrity and legality to verify the monitoring data and control instructions; and the verification results are processed. If the verification is successful, the data and control instructions are uploaded to the server; if the verification fails, the data and instructions are discarded and an alarm is issued.

[0032] In the smart city traffic management system, the Internet of Things technology is widely used in the interconnection of smart street lights, traffic lights, environmental monitoring stations and other equipment. The device information monitoring and access verification module under this preferred implementation provides a solid guarantee for the security of the system.

[0033] In actual applications, when an autonomous vehicle passes through an intersection equipped with smart sensors, these sensors will collect vehicle information and try to upload it to the traffic management center through the gateway device. At this time, the device information monitoring module quickly intervenes to analyze the sensor information in detail. If the sensor is a known trusted device, and its physical address, device port number, device ID, device unique identifier, and data upload format all match the records in the security list, the module will allow it to access the network and continuously monitor its access behavior to ensure the secure transmission of data. Once the sensor data or behavior is abnormal, the system will immediately update its status and take corresponding measures.

[0034] On the contrary, if the device information monitoring module identifies a sensor as an untrusted device, or its behavior matches a known malicious behavior pattern, the system will immediately trigger an alarm mechanism and discard the data that the device attempts to upload, effectively preventing potential security threats.

[0035] On this basis, the access verification module further constructs a comprehensive security feature library through the data of historical IoT access nodes. This library not only contains the physical characteristics of the device, but also covers the format and behavior pattern of its data transmission. When new control instructions or monitoring data are sent from the server to the gateway device, the access verification module will use this feature library to perform strict integrity and legality verification. Only verified data and control instructions will be allowed to be uploaded to the server. Any data that fails verification will be discarded and an alarm will be triggered, thus ensuring the reliability and security of data transmission.

[0036] Compared with the existing technology, the creative feature of this implementation is that it combines the dual protection of device information monitoring and access verification. It not only relies on static security lists, but also builds a dynamic security feature library through historical data, realizing comprehensive and real-time monitoring of IoT device access behavior. In addition, the instant alarm and data discard mechanism for untrusted devices also greatly improves the response speed and security of the system.

[0037] When configuring the security policy, the server allocates corresponding security protection measures for the gateway device to send legal data according to the security level; the protection measures include managing the white list of the gateway device access node and monitoring the status of the gateway access device.

[0038] In the energy management system of smart cities, gateway devices are key hubs that connect IoT nodes such as smart meters and distributed energy stations, and their security is of vital importance. The server assigns corresponding security protection measures to the legitimate data sent by the gateway device according to the security level. This implementation method provides more refined security protection for the transmission of energy data.

[0039] In actual applications, the server will assign different security levels to the data according to the importance, sensitivity and potential security risks of the data, such as the power consumption data uploaded by the smart meter and the power generation data of the distributed energy station. For data with high security levels, the server will take more stringent protection measures, such as encrypted transmission and access control. At the same time, the server will also manage the whitelist to ensure that only authenticated gateway device access nodes can access this data. In addition, the server will continue to monitor the status of the gateway access device. Once abnormal behavior or potential security threats are found, such as unauthorized access attempts, data transmission interruptions, etc., the system will immediately trigger the alarm mechanism and take corresponding measures, such as isolating infected devices and blocking malicious traffic, to prevent the spread of security risks.

[0040] Compared with the existing technology, the creative feature of this implementation is that it realizes the refined configuration and dynamic adjustment of security policies. The server can not only assign corresponding protection measures according to the security level of the data, but also monitor the status of the gateway device in real time, and promptly detect and respond to potential security threats. This dynamic and flexible security policy configuration method greatly improves the security and reliability of the energy management system. At the same time, through the strict management of the whitelist, unauthorized access and data leakage risks are also effectively prevented.

[0041] The gateway security protection method based on IoT technology aims to achieve strict monitoring and protection of IoT node access and data transmission by building a comprehensive security feature library and communication feature library. The core of this method is to use historical data to establish a feature library, based on which the access request and data transmission of IoT nodes are matched and verified. At the same time, the security level of the gateway device is evaluated based on its comprehensive information, and the corresponding security policy is configured accordingly. This method not only improves the security of the IoT environment, but also realizes dynamic identification and response to potential security risks.

[0042] Specifically, the method includes the following key steps: Establishment of security feature library and communication feature library: The gateway device first collects the physical address, device port number, device ID, device unique identifier and data format uploaded by IoT devices of multiple historical access nodes, which together constitute the security feature library. At the same time, the gateway also records the source IP addresses of multiple historical instructions and monitoring data to establish a communication feature library. These two feature libraries provide basic data support for subsequent security verification.

[0043] IoT node access verification: When a new IoT node attempts to access the network, the gateway device will obtain the security feature factor of the node and match it with the information in the security feature library. If the match is successful, it indicates that the node is a known and trusted device, and the gateway will allow it to access and transmit data; if the match fails, it is regarded as an unknown or potentially unsafe device, and the gateway will reject its access request, thereby effectively preventing unauthorized access and data leakage.

[0044] Data transmission verification: After allowing IoT nodes to access, the gateway device will further verify the uploaded data packets. It extracts the source IP address of the data packet and compares it with the source IP and port information in the communication feature library to calculate the similarity. If the similarity is higher than the preset threshold, it indicates that the data packet comes from a known and trusted source, and the gateway will receive and process the data; if the similarity is lower than the threshold, it is considered an abnormal data packet and the gateway will refuse to receive it to avoid potential data tampering or injection attacks.

[0045] Gateway security level assessment and security policy configuration: The server will comprehensively assess the gateway's security level based on the number of gateway devices connected, location information, communication connection status, historical communication records and other multi-dimensional information. For gateway devices of different security levels, the server will configure corresponding security policies, such as encrypted transmission, access control, data backup and recovery, etc., to ensure the data security of the gateway and the IoT nodes it connects to.

[0046] The gateway security protection method based on IoT technology aims to achieve strict monitoring and protection of IoT node access and data transmission by building a comprehensive security feature library and communication feature library. The core of this method is to use historical data to establish a feature library, based on which the access request and data transmission of IoT nodes are matched and verified. At the same time, the security level of the gateway device is evaluated based on its comprehensive information, and the corresponding security policy is configured accordingly. This method not only improves the security of the IoT environment, but also realizes dynamic identification and response to potential security risks.

[0047] Specifically, the method includes the following key steps: Establishment of security feature library and communication feature library: The gateway device first collects the physical address, device port number, device ID, device unique identifier and data format uploaded by IoT devices of multiple historical access nodes, which together constitute the security feature library. At the same time, the gateway also records the source IP addresses of multiple historical instructions and monitoring data to establish a communication feature library. These two feature libraries provide basic data support for subsequent security verification.

[0048] IoT node access verification: When a new IoT node attempts to access the network, the gateway device will obtain the security feature factor of the node and match it with the information in the security feature library. If the match is successful, it indicates that the node is a known and trusted device, and the gateway will allow it to access and transmit data; if the match fails, it is regarded as an unknown or potentially unsafe device, and the gateway will reject its access request, thereby effectively preventing unauthorized access and data leakage.

[0049] Data transmission verification: After allowing IoT nodes to access, the gateway device will further verify the uploaded data packets. It extracts the source IP address of the data packet and compares it with the source IP and port information in the communication feature library to calculate the similarity. If the similarity is higher than the preset threshold, it indicates that the data packet comes from a known and trusted source, and the gateway will receive and process the data; if the similarity is lower than the threshold, it is considered an abnormal data packet and the gateway will refuse to receive it to avoid potential data tampering or injection attacks.

[0050] Gateway security level assessment and security policy configuration: The server will comprehensively assess the gateway's security level based on the number of gateway devices connected, location information, communication connection status, historical communication records and other multi-dimensional information. For gateway devices of different security levels, the server will configure corresponding security policies, such as encrypted transmission, access control, data backup and recovery, etc., to ensure the data security of the gateway and the IoT nodes it connects to.

[0051] The security feature factors include physical address, device port number, device ID and data format uploaded by IoT device; in step S2, a security feature library of multiple security feature factors of device access is obtained, and the network accessed by the node is analyzed; data uploaded by the node is obtained, the data is verified, and the security feature factors that have been successfully verified are recorded; the recorded security feature factors are analyzed, feature parameters are extracted, and network status evaluation indicators are calculated to establish a security feature library.

[0052] In smart cities, IoT technology is widely used in environmental monitoring, intelligent transportation, public safety and other fields. Taking environmental monitoring as an example, IoT devices such as air quality monitoring stations and water quality monitoring sensors need to be connected to the IoT platform through gateway devices to achieve real-time data upload and analysis. In this scenario, the acquisition of security feature factors and the establishment of a security feature library are particularly important.

[0053] In actual applications, when an IoT device accesses the gateway, it will first submit its physical address, device port number, device ID, and data upload format and other security feature factors. The gateway device uses these factors to analyze the network to which the node is connected. For devices that access for the first time, the gateway will first check whether it is in the blacklist. If the device is on the blacklist, access will be directly denied and relevant logs will be recorded. If the device is not on the blacklist, the gateway will allow it to access and further determine the security factors of the device based on the security feature library. If there is already a blacklist record of the device or its security factors in the security feature library, the gateway will also determine that the device is unsafe and add it to the blacklist to prevent potential security threats.

[0054] For devices that pass verification, the gateway will record their security feature factors and analyze them. By extracting feature parameters such as device type, data upload frequency, etc., and combining them with network status evaluation indicators such as data transmission delay and packet loss rate, the gateway device can establish a comprehensive security feature library. This library not only contains basic information about the device, but also reflects the behavior pattern of the device in the network, providing strong support for subsequent data verification and network security evaluation.

[0055] The creative feature of this implementation is that it comprehensively considers the physical characteristics, behavior patterns and network status of the device, and realizes comprehensive monitoring and dynamic evaluation of IoT device access. Through blacklist management and the establishment of a security feature library, the gateway device can quickly identify and isolate potentially unsafe devices, effectively improving the security of the IoT environment.

[0056] The step S2 includes the following sub-steps: S21: obtaining the access device information and the type of the device, and determining whether the device is in the blacklist. If the device is in the blacklist, the device access is not allowed, and step S24 is executed; if the device is not in the blacklist, the device access is allowed, and step S22 is executed; S22: determining whether the security factor of the device is included in the blacklist according to the security feature library. If there is a security factor included in the blacklist, the device is determined to be unsafe and the device is added to the blacklist; S23: determining whether the format of the data uploaded by the device is correct. If it is correct, the device data upload is allowed; S24: recording the security feature factors of all devices passing through; S25: analyzing the security feature factors of the storage device, extracting feature parameters and calculating network status evaluation indicators, and establishing a security feature library.

[0057] The step S3 includes the following sub-steps: S31: obtain the data uploaded by the legal node and extract the source IP address of the data packet, and match it with the source IP address recorded in the communication feature library. If the match is consistent, the data is received and step S32 is executed; otherwise, the data packet is rejected and step S33 is executed; S32: the integrity of the received data packet is verified; S33: the data is parsed, the instruction information and the source IP address of the data packet are extracted, and the instruction information and the source IP address of the data packet are matched with the format of the data uploaded by the node. If the match is successful, the instruction information and the source IP address of the data packet are extracted, and the result of successful data parsing is returned; otherwise, the data is If the parsing fails, an alarm message is issued; if the data parsing is successful, execute step S34; S34: verify the parsed instruction information and return the instruction verification result; S35: determine whether the instruction verification result is successful, if successful, execute step S36; otherwise, send an alarm message; S36: extract the source IP address from the instruction, determine whether the source IP address of the instruction and the monitoring data are consistent, if consistent, return the original data of the data packet and the parsed data to the server, execute step S37; otherwise, send an alarm message; S37: filter the data returned to the server, remove redundant data and malware, and send the filtered data. In smart cities, gateway devices serve as a bridge between IoT devices and cloud platforms, and their security directly affects the stable operation of the entire IoT system. Therefore, it is particularly important to evaluate the security level of gateway devices and configure corresponding security policies based on the evaluation results.

[0058] In actual applications, the server will first obtain information such as the number of access gateway devices, their locations, and network status evaluation indicators. By counting the number of access gateway devices at each location and calculating the network reliability index, the server can create a data space distribution map to intuitively display the distribution of gateway devices and network reliability. At the same time, the server will also create a status evaluation map based on the network status evaluation results to reflect the overall operation status of the network in real time.

[0059] After obtaining the network connection status of the gateway device, the server will calculate the network connection status indicator value as a network security indicator. By combining the status evaluation diagram and the data space distribution diagram, the server can further calculate the security of legal instructions to ensure the legality and effectiveness of the instructions.

[0060] Based on the above information, the server will configure corresponding network security services for each gateway device. These services may include encrypted transmission, access control, data backup and recovery, etc., aiming to improve the security and reliability of gateway devices. At the same time, the server will also monitor the communication behavior of node devices, collect node data, and perform format verification and uniqueness verification. By obtaining the data timestamp and unique number of the node device, the server can generate a verification string and perform multiple decryption and decoding of the verification string. The decoded data will go through steps such as format processing, feature extraction and data cleaning, and finally perform aggregate analysis, and return the aggregated data to the management platform.

[0061] The creative feature of this implementation lies in its comprehensive assessment and dynamic configuration of the security level of gateway devices. By comprehensively considering multiple dimensions such as the number, location, network connection status, and command security of gateway devices, the server can provide personalized security policy configuration for each gateway device. At the same time, through strict verification and cleaning of node data, the server can further improve the accuracy and security of data, providing more reliable data support for the management and decision-making of smart cities.

[0062] The step S4 includes the following sub-steps: S41: obtaining the number of access gateway devices, their locations and network status evaluation indicators, counting the number of access gateway devices at each location, and calculating the network reliability index; creating a data space distribution map with the spatial location and network reliability index as the horizontal axis and the number of gateways and the network status evaluation index as the vertical axis; S42: obtaining the network status information, and creating a status evaluation map based on the network status evaluation result; S43: counting the network connection status of the gateway devices, and calculating the network connection status index value as a network security indicator; S44: calculating the security of legal instructions based on the status evaluation map and the data space distribution map; S45: the server obtains the security of each gateway device and configures corresponding network security services for the gateway device; S46: monitoring the communication behavior of the node device and collecting node data; S47: performing format verification on the node data and performing uniqueness verification on the data uploaded by the Internet of Things device; S48: obtaining the data timestamp and unique number of the node device, and generating a verification string based on the unique number and data timestamp; performing multiple decryptions on the verification string, performing format processing, feature extraction and data cleaning on the decoded data, performing aggregation analysis on the legal node data, and returning the aggregated data.

[0063] In smart cities, gateway devices serve as a bridge between IoT devices and cloud platforms, and their security directly affects the stable operation of the entire IoT system. Therefore, it is particularly important to evaluate the security level of gateway devices and configure corresponding security policies based on the evaluation results.

[0064] In actual applications, the server will first obtain information such as the number of access gateway devices, their locations, and network status evaluation indicators. By counting the number of access gateway devices at each location and calculating the network reliability index, the server can create a data space distribution map to intuitively display the distribution of gateway devices and network reliability. At the same time, the server will also create a status evaluation map based on the network status evaluation results to reflect the overall operation status of the network in real time.

[0065] After obtaining the network connection status of the gateway device, the server will calculate the network connection status indicator value as a network security indicator. By combining the status evaluation diagram and the data space distribution diagram, the server can further calculate the security of legal instructions to ensure the legality and effectiveness of the instructions.

[0066] Based on the above information, the server will configure corresponding network security services for each gateway device. These services may include encrypted transmission, access control, data backup and recovery, etc., aiming to improve the security and reliability of gateway devices. At the same time, the server will also monitor the communication behavior of node devices, collect node data, and perform format verification and uniqueness verification. By obtaining the data timestamp and unique number of the node device, the server can generate a verification string and perform multiple decryption and decoding of the verification string. The decoded data will go through steps such as format processing, feature extraction and data cleaning, and finally perform aggregate analysis, and return the aggregated data to the management platform.

[0067] Compared with the existing technology, the creative feature of this implementation lies in its comprehensive assessment and dynamic configuration of the security level of gateway devices. By comprehensively considering multiple dimensions such as the number, location, network connection status, and command security of gateway devices, the server can provide personalized security policy configuration for each gateway device. At the same time, through strict verification and cleaning of node data, the server can further improve the accuracy and security of data, providing more reliable data support for the management and decision-making of smart cities.

[0068] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A gateway security protection system based on Internet of Things technology, comprising a server and at least one gateway device, wherein the server and the gateway device are connected via the Internet or the Internet of Things; characterized in that: The gateway device includes a data communication module, an access control module and a gateway security monitoring and protection module; wherein the data communication module is used for the gateway device to communicate with the server, upload data and receive control instructions; the access control module is used to obtain the information of the IoT node accessing the gateway device, generate a security feature library, and perform integrity and legality verification on the data of the IoT node according to the security feature library; the gateway security monitoring and protection module detects the status of the gateway device according to the pre-configured white list and the set security policy, and executes protection measures if the detection result is abnormal; the server calculates the security of the gateway device according to the number of accesses, location, communication connection status and historical communication records of the gateway device, and divides the gateway devices into different security levels according to the security level, configures the corresponding security policy for the gateway device, and feeds the security policy back to the gateway security monitoring and protection module; The data communication module includes a data packet transceiver module, a data packet parsing module and a security verification module. The data packet transceiver module receives the control instruction sent by the server and extracts the source IP address; the data packet parsing module is used to parse the control instruction and generate a parsing result, extract and parse the source IP address and transmission sequence of the control instruction; the security verification module is used to verify the integrity and legality of the control instruction, and verify the transmission sequence and source IP address of the control instruction; The access control module includes a device information monitoring module and an access verification module, wherein the device information monitoring module is used to obtain the IoT device information accessing the gateway and analyze whether the IoT device is in the security list; the access verification module is used to generate a security feature library and perform integrity and legality verification on the data of the IoT node based on the security feature library.

2. The gateway security protection system based on Internet of Things technology as claimed in claim 1, characterized in that: The device information monitoring module analyzes and identifies the IoT device information. If the IoT device is found to be a trusted device and is in the security list, the device access is allowed, and the device access behavior is monitored and updated; if the IoT device is detected to be an untrusted device, the device is alarmed and the data is discarded; the access verification module generates a security feature library, and establishes the security feature library by obtaining the physical addresses, device port numbers, device IDs, device unique identifiers and IoT device upload data formats of multiple historical IoT access nodes; the control instructions or monitoring data sent to the server are checked for integrity and legality to verify the monitoring data and control instructions; and the verification results are processed. If the verification is successful, the data and control instructions are uploaded to the server; if the verification fails, the data and instructions are discarded and an alarm is issued.

3. The gateway security protection system based on Internet of Things technology as claimed in claim 1, characterized in that: When configuring the security policy, the server allocates corresponding security protection measures for the gateway device to send legal data according to the security level; the protection measures include managing the white list of the gateway device access node and monitoring the status of the gateway access device.

4. A gateway security protection method based on Internet of Things technology, characterized in that: The method comprises the following steps: S1: The gateway device obtains the physical addresses, device port numbers, device IDs, device unique identifiers, and data upload formats of multiple historical access nodes, and establishes a security feature library for the gateway device; obtains the source IP addresses of multiple historical commands and monitoring data, and establishes a communication feature library for commands and monitoring data; S2: The gateway device obtains the security feature factor of the IoT node, and matches the obtained security feature factor with the information in the security feature library. If the match is successful, the IoT node is allowed to access and transmit data, and step S3 is executed; if the match fails, the IoT node is not allowed to access and transmit data; S3: The gateway device extracts the source IP address of the data packet when uploading data, and compares the source IP and port information contained in the communication feature library with the source IP of the data packet according to the source IP address of the data packet and the communication feature library of the instruction. If the similarity between the source IP address of the data packet and the source IP and port information in the communication feature library of the instruction is higher than a preset threshold, the data is received and step S4 is executed; otherwise, the data packet is rejected; S4: The server evaluates the gateway security level based on the number of gateway devices connected, location information, communication connection status, and historical communication records, and configures security policies for gateway devices of different security levels.

5. The gateway security protection method based on Internet of Things technology as claimed in claim 4 is characterized in that: The security feature factors include physical address, device port number, device ID and data format uploaded by IoT device; in step S2, a security feature library of multiple security feature factors accessed by the device is obtained, and the network accessed by the node is analyzed; data uploaded by the node is obtained, the data is verified, and the security feature factors that have been successfully verified are recorded; Analyze the recorded security feature factors, extract feature parameters and calculate network status evaluation indicators to establish a security feature library.

6. The gateway security protection method based on Internet of Things technology as claimed in claim 5, characterized in that: The step S2 includes the following sub-steps: S21: Obtain the access device information and the type of the device, and determine whether the device is in the blacklist. If the device is in the blacklist, the device is not allowed to access, and step S24 is executed; if the device is not in the blacklist, the device is allowed to access, and step S22 is executed; S22: judging whether the security factor of the device is included in the blacklist according to the security feature library; if the security factor is included in the blacklist, the device is judged to be unsafe and the device is added to the blacklist; S23: Determine whether the format of the data uploaded by the device is correct, and if it is correct, allow the device to upload data; S24: Record the security feature factors of all devices that pass through; S25: Analyze the security feature factors of the storage device, extract feature parameters and calculate network status evaluation indicators, and establish a security feature library.

7. The gateway security protection method based on Internet of Things technology as claimed in claim 4, characterized in that: The step S3 includes the following sub-steps: S31: Obtain the data uploaded by the legal node and extract the source IP address of the data packet, and match it with the source IP address recorded in the communication feature library. If the match is consistent, the data packet is received and step S32 is executed; otherwise, the data packet is rejected and step S33 is executed; S32: Perform integrity verification on the received data packet; S33: Parse the data, extract the instruction information and the source IP address of the data packet, match the instruction information and the source IP address of the data packet with the format of the data uploaded by the node, if the match is successful, extract the instruction information and the source IP address of the data packet, and return the result of successful data parsing; otherwise, the data parsing fails and an alarm message is issued; if the data parsing is successful, execute step S34; S34: verify the parsed instruction information and return the instruction verification result; S35: Determine whether the instruction verification result is successful. If successful, execute step S36; otherwise, send an alarm message; S36: extract the source IP address from the instruction, and determine whether the source IP address of the instruction is consistent with that of the monitoring data. If they are consistent, return the original data and parsed data of the data packet to the server and execute step S37; otherwise, send an alarm message; S37: Filter the data returned to the server, remove redundant data and malware, and send the filtered data.

8. The gateway security protection method based on Internet of Things technology as claimed in claim 4, characterized in that: The step S4 includes the following sub-steps: S41: Obtain the number, location and network status evaluation index of access gateway devices, count the number of access gateway devices at each location, and calculate the network reliability index; create a data space distribution map with the spatial location and network reliability index as the horizontal axis and the number of gateways and network status evaluation index as the vertical axis; S42: Acquire network status information, and create a status assessment diagram according to the network status assessment result; S43: Counting the network connection status of the gateway device and calculating the network connection status index value as a network security index; S44: Calculate the security of legal instructions according to the state evaluation diagram and the data space distribution diagram; S45: The server obtains the security of each gateway device and configures corresponding network security services for the gateway device; S46: monitor the communication behavior of the node device and collect node data; S47: Verify the format of node data and the uniqueness of data uploaded by IoT devices; S48: Obtain the data timestamp and unique number of the node device, and generate a verification string according to the unique number and the data timestamp; The verification string is decrypted multiple times, the decoded data is formatted, features are extracted, and data cleansed, the legitimate node data is aggregated and analyzed, and the aggregated data is returned.

Images