Internet of Things equipment security protection method and system based on big data

Abstract

The invention discloses an Internet of Things equipment security protection method based on big data, and the method comprises the steps: screening obtained original data sent by Internet of Things equipment, and determining to-be-encrypted target data in the original data; matching in a Hash tree library based on the Hash calculation value of the target data to obtain a target Hash tree matched with the Hash calculation value; splitting the target data to obtain a plurality of sub-data, and performing modulo conversion on each sub-data to obtain a modulo result value of each sub-data; determining an encryption mode of the sub-data based on the total number of the sub-data in the target data, and encrypting each sub-data based on the target hash tree, the modulo result value of each sub-data and the encryption mode to obtain an encryption result of each sub-data; and combining the encryption results of the sub-data to obtain an encryption result of the target data, and uploading the encryption result to a cloud for storage. According to the invention, the cracking difficulty is increased, and the security protection capability of the Internet of Things equipment is improved at the same time.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things device security protection technology, and in particular to a big data-based Internet of Things device security protection method and system. Background Art

[0002] With the rapid development of IoT technology, more and more devices are connected to the Internet, forming a huge IoT ecosystem. These devices include smart home devices, industrial sensors, medical equipment, etc., which have brought great convenience to people's lives and work. However, the security issues of IoT devices are also becoming increasingly prominent. Since many IoT devices are originally designed for convenience and cost-effectiveness, security protection is often overlooked, making them easy targets for hacker attacks. Therefore, it is particularly important to develop effective security protection methods for IoT devices.

[0003] At present, in the process of data transmission and storage, IoT devices generally transmit the data from the IoT devices to the server first, and then upload the data from the server to the cloud for storage. In the process of cloud storage of IoT data, since the data generated by IoT devices usually contains sensitive information, if it is not protected during the data transmission process, it is easy to cause the leakage of sensitive information. However, the current protection method generally adopts the method of encrypting the data transmitted by IoT devices. Due to the large amount of data transmitted by IoT devices, when all the data in transmission is encrypted, the calculation amount is large and the efficiency is poor. At the same time, the current encryption method is too simple and easy to be cracked, resulting in a low security risk. Summary of the invention

[0004] The purpose of the present invention is to solve the problems in the prior art and to propose a security protection method and system for Internet of Things devices based on big data.

[0005] In order to achieve the above object, the present invention adopts the following technical solutions:

[0006] A security protection method for IoT devices based on big data, comprising the following steps:

[0007] Screening the original data sent by the IoT device to determine the target data to be encrypted in the original data;

[0008] Matching in a hash tree library based on the hash calculation value of the target data to obtain a target hash tree matching the hash calculation value;

[0009] The target data is split to obtain a plurality of sub-data, and each sub-data is subjected to a modulus conversion to obtain a modulus result value of each sub-data;

[0010] Determine the encryption mode of the sub-data based on the total number of sub-data in the target data, and encrypt each sub-data based on the target hash tree, the modulus result value of each sub-data and the encryption mode to obtain an encryption result of each sub-data;

[0011] The encryption results of each sub-data are combined to obtain the encryption result of the target data, and the encryption result is uploaded to the cloud storage.

[0012] A security protection system for IoT devices based on big data, comprising:

[0013] Screening unit: used to screen the original data sent by the IoT device and determine the target data to be encrypted in the original data;

[0014] Matching unit: used for matching in a hash tree library based on the hash calculation value of the target data to obtain a target hash tree matching the hash calculation value;

[0015] Splitting and conversion unit: used for splitting the target data to obtain multiple sub-data, and performing modulus conversion on each sub-data to obtain the modulus result value of each sub-data;

[0016] Encryption unit: used to determine the encryption mode of the sub-data based on the total number of sub-data in the target data, and encrypt each sub-data based on the target hash tree, the modulus result value of each sub-data and the encryption mode to obtain the encryption result of each sub-data;

[0017] Combined upload unit: used to combine the encryption results of each sub-data to obtain the encryption result of the target data, and upload the encryption result to the cloud storage.

[0018] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the above-mentioned method for security protection of IoT devices based on big data are implemented.

[0019] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned method for security protection of Internet of Things devices based on big data are implemented.

[0020] Compared with the prior art, the present invention has the following advantages:

[0021] The present invention provides a big data-based Internet of Things device security protection method and system thereof. The original data sent by the Internet of Things device is screened to determine the target data that needs to be encrypted in the original data. When the data sent by the Internet of Things device is subsequently encrypted, the data can be targeted and encrypted according to the encryption needs, thereby reducing the amount of encryption calculation and improving the encryption efficiency. In addition, the target data is first hashed and then matched with a target hash tree for encryption in a hash tree, and then the modulus result value of each sub-data is obtained by splitting and modulo conversion of the target data. The sub-data is matched with a corresponding hash value in the target hash tree based on the modulo result value, thereby encrypting all the sub-data, and finally the encrypted result of the target data is obtained by combining the encrypted sub-data. When the target data is encrypted, the encryption process is made more complicated, the security and unpredictability of the encryption are enhanced, and the security protection capability of the Internet of Things device is improved while increasing the difficulty of cracking. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0023] Figure 1 A schematic diagram of a process flow of a security protection method for IoT devices based on big data provided by an embodiment of the present invention;

[0024] Figure 2 Schematic diagram of the target hash tree in the big data-based IoT device security protection method provided by the embodiment of the present invention Figure 1 ;

[0025] Figure 3 Schematic diagram of the target hash tree in the big data-based IoT device security protection method provided by the embodiment of the present invention Figure 2 ;

[0026] Figure 4 A schematic diagram of the structure of a security protection system for Internet of Things devices based on big data provided by an embodiment of the present invention;

[0027] Figure 5 This is a schematic diagram of the structure of the electronic device proposed by the present invention. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] Combine the following Figure 1 - Figure 5 The present invention describes a big data-based Internet of Things device security protection method and system.

[0030] Figure 1 This is a flow chart of a method for protecting the security of IoT devices based on big data provided by the present invention. Figure 1 As shown, the method includes:

[0031] Step 101, screen the original data sent by the IoT device to determine the target data to be encrypted in the original data.

[0032] Specifically, when obtaining the original data sent by the IoT device, first clarify the specific type of the IoT device. After determining the type of the IoT device, match and identify the original data according to the database related to the corresponding IoT device, so as to achieve the effect of determining the target data to be encrypted in the original data.

[0033] Furthermore, in order to more quickly screen and judge the raw data sent by IoT devices, a classification model can be built using machine learning algorithms. By training historical data and manually labeled data to be encrypted, the trained classification model can automatically determine which data is the target data to be encrypted based on the raw data transmitted in real time. Finally, by screening and determining the target data, it is possible to focus on the data that really needs to be encrypted instead of processing all the raw data in general, avoiding unnecessary encryption calculation overhead, improving overall processing efficiency and rationally utilizing resources, especially in the IoT scenario of massive data, to accurately ensure the security of key data.

[0034] Step 102: Matching is performed in a hash tree library based on the hash calculation value of the target data to obtain a target hash tree that matches the hash calculation value.

[0035] Specifically, when performing hash calculation on the target data, first determine the type of the target data (such as numeric, text, image, video, etc.). After determining the type of the target data, when the target data is numeric data, the division hash method or the multiplication hash method can be used; when the target data is text data, the character encoding-based addition or bit operation and the Sim hash algorithm can be used; when the target data is image data, the average hash algorithm or the perceptual hash algorithm can be used.

[0036] Furthermore, taking the target data as text data as an example, matching is performed in the hash tree library based on the hash calculation value of the target data to obtain a target hash tree that matches the hash calculation value, including: calculating the target data based on the first preset hash formula and the second preset hash formula to obtain the first hash value and the second hash value; calculating the similarity of the first hash value and the second hash value with the index of each hash tree in the hash tree library to obtain the first index sequence and the second index sequence sorted from high to low similarity; the index of the hash tree is the hash value corresponding to the root node; determining the target index based on the first index sequence and the second index sequence; determining the target hash tree that matches the target index. By using two different preset hash formulas to calculate the hash value, feature extraction of the target data is performed from multiple angles, avoiding the limitations that may exist in a single hash method, making subsequent matching more comprehensive and accurate, and being able to more reliably locate the appropriate target hash tree in the hash tree library.

[0037] In addition, based on the first index sequence and the second index sequence, the target index is determined, including: comparing the first index sequence with the second index sequence to obtain a third index sequence common to the first index sequence and the second index sequence; adding the similarity between each index in the third index sequence and the first hash value and the similarity between each index and the second hash value to obtain the total similarity of each index; determining the index corresponding to the largest total similarity value in the third index sequence as the target index. In the process of obtaining the maximum total similarity, the indexes in the third index sequence can also be sorted from high to low according to the total similarity, and the candidate indexes can be evaluated in order, and the index that best matches the target data in multiple dimensions is preferentially selected as the target index, so that the final selection is more reasonable, and it is also helpful to make the best decision when there are multiple similar indexes.

[0038] Step 103, split the target data to obtain multiple sub-data, and perform modulus conversion on each sub-data to obtain the modulus result value of each sub-data.

[0039] Specifically, when splitting the target data, it can be split according to the internal logical structure of the target data, or it can be split intelligently according to the data format. For example, for image data, it can be split according to the pixel area, color channel, etc. of the image; for text data, it can be split according to semantic paragraphs, sentence structures, etc. For example, in an intelligent transportation system, the traffic road condition image data taken by the camera can be split into sub-data according to the image areas corresponding to different lanes, so that the subsequent modulus conversion and encryption can be more in line with the actual application scenario of the data and improve the overall encryption effect.

[0040] At the same time, when performing modulo calculations on each sub-data, the modulo parameters can be adjusted dynamically, and the modulo and other parameters in the modulo operation are not fixed, but are dynamically adjusted according to factors such as the characteristics of the sub-data, the current network security environment, and data transmission requirements. For example, in the processing of IoT financial transaction data, the modulo of the modulo operation is determined in real time based on factors such as the size range of the transaction amount and the transaction time, making the modulo result value more random and secure, preventing attackers from cracking encrypted data through fixed rules.

[0041] Step 104, determining the encryption mode of the sub-data based on the total number of sub-data in the target data, and encrypting each sub-data based on the target hash tree, the modulus result value of each sub-data and the encryption mode to obtain the encryption result of each sub-data.

[0042] Specifically, the encryption mode is determined according to the total number of sub-data, so that the encryption method can be flexibly adjusted according to the data scale. Different numbers of sub-data use different encryption modes, which increases the difficulty for attackers to crack and improves encryption adaptability and security.

[0043] On the one hand, if the encryption mode is the first mode, the total number of sub-data represented is less than the total number of layers of the target hash tree. Among them, the matching relationship between the sub-data and the target hash value is: the sub-data at the nth position matches the n+1th layer in the target hash tree; n is an integer and n≥1, then each sub-data is encrypted based on the target hash tree, the modulo result value of each sub-data and the encryption mode to obtain the encryption result of each sub-data, including: determining the first target position of each first target sub-data among multiple sub-data; determining the first target layer that the first target sub-data matches in the target hash tree based on the first target position; matching the modulo result value of the first target sub-data with the number of each sub-node in the first target layer to obtain the first target sub-node in the target layer; determining the encrypted hash value corresponding to the first target sub-node as the encryption result of the first target sub-data. The first target sub-data is any sub-data among the multiple sub-data, the first target layer is any layer in the target hash tree except the root node, and the first target sub-node is any node in each target layer.

[0044] Furthermore, when the encryption mode is the first mode (the total number of sub-data is less than the total number of layers of the target hash tree), the layer that the sub-data matches in the target hash tree is determined according to its position in multiple sub-data, and the corresponding target sub-node is found by matching the modulo result value of the sub-data with the sub-node number of the matching layer, and then the encrypted hash value of the sub-node is used as the encryption result of the sub-data. A clear and definite correspondence between the sub-data position and the hash tree matching layer is established, making the encryption process easy to understand and implement, reducing the complexity of the encryption algorithm and improving the encryption efficiency. The hierarchical structure of the hash tree is fully utilized, and each sub-data can be matched at different levels, which increases the diversity of the encryption results and improves the security of encryption, because it is difficult for attackers to infer the relationship between the sub-data and the encryption result through simple rules. The matching layer of the sub-data is dynamically determined according to its position, and the sub-data at different positions have different encryption paths. Even if the sub-data itself is similar, its encryption results will be different due to different matching layers, further enhancing the randomness and unpredictability of encryption.

[0045] In addition, during the matching process, since the modulo result value of the first target sub-data may be greater than the number range of all sub-nodes in the first target layer, when the modulo result value of the first target sub-data is not within the number range of all sub-nodes in the first target layer, the modulo result value of the first target sub-data is converted in a preset conversion formula, and after obtaining the conversion result value, the conversion result value is matched with the number of each sub-node in the first target layer, thereby obtaining the first target sub-node in the first target layer. When the modulo result value of the first target sub-data is within the number range of all sub-nodes in the first target layer, the modulo result value of the first target sub-data is directly matched with the number of each sub-node in the first target layer, thereby obtaining the first target sub-node in the first target layer. By presetting the conversion formula to handle the problem of the modulo result value out of range, the entire matching process will not be interrupted or unable to proceed due to the value out of range, and can adapt to more modulo result values ​​with different value situations, thereby improving the compatibility and adaptability of the encryption matching process to various types of data.

[0046] On the other hand, if the encryption mode is the second mode, the total number of sub-data is greater than or equal to the total number of layers of the target hash tree. The matching relationship between the sub-data and the target hash tree is: the sub-data at the mth position in each subset matches the m+1th layer in the target hash tree, m≥1 and is an integer; then, based on the target hash tree, the modulo result value of each sub-data and the encryption mode, each sub-data is encrypted to obtain the encryption result of each sub-data, including:

[0047] Based on the total number of layers of the target hash tree, multiple sub-data are segmented to obtain multiple subsets; the number of sub-data in each subset is less than the total number of layers of the target hash tree; the second target position of each second target sub-data in the multiple sub-data in its corresponding subset is determined; based on the second target position, the second target layer that the second target sub-data matches in the target hash tree is determined; the modulo result value of the second target sub-data is matched with the number of each sub-node in the second target layer to obtain the second target sub-node in the second target layer; the encrypted hash value corresponding to the second target sub-node is determined as the encryption result of the second target sub-data. The second target sub-data is any sub-data in the subset. The second target layer is any layer in the target hash tree except the root node, and the second target sub-node is any node in each target layer.

[0048] In the second mode (the total number of sub-data is greater than or equal to the total number of layers of the target hash tree), the numerous sub-data are first segmented according to the total number of layers of the target hash tree to obtain multiple segment subsets. Then, for each second target sub-data in each segment subset, the second target layer that matches in the target hash tree is determined according to its position in the subset, and the second target sub-node is found by matching the modulo result value of the sub-data with the sub-node number of the matching layer, and finally the encrypted hash value corresponding to the sub-node is used as the encryption result of the sub-data. For the situation where the number of sub-data far exceeds the total number of layers of the hash tree, the segmentation strategy can properly handle the situation where the total number of sub-data far exceeds the total number of layers of the target hash tree, so that a large amount of sub-data can be encrypted in an orderly manner in the hash tree structure, avoiding confusion or inability to perform the encryption process due to excessive data volume, and improving the efficiency of large-scale data encryption. The sub-data is divided into multiple subsets, and each subset can be encrypted independently. This independence facilitates parallel computing, error recovery, and data management in practical applications. For example, when a problem occurs in the encryption of a certain subset, it can be checked and processed separately without affecting the encryption process of other subsets, thereby improving the flexibility and maintainability of the encryption system.

[0049] In the second mode, if the modulo result value of the second target sub-data is not within the number range of all sub-nodes in the second target layer, the modulo result value of the second target sub-data is converted in a preset conversion formula to obtain a conversion result value, and the conversion result value is matched with the number of each sub-node in the second target layer to obtain the second target sub-node in the second target layer;

[0050] If the modulo result value of the second target sub-data is within the number range of all sub-nodes in the second target layer, the modulo result value of the second target sub-data is directly matched with the number of each sub-node in the second target layer to obtain the second target sub-node in the second target layer.

[0051] Step 105, combining the encryption results of each sub-data to obtain the encryption result of the target data, and uploading the encryption result to the cloud storage.

[0052] Specifically, when combining the encryption results of sub-data, a structured encapsulation method is adopted. For example, a package structure including header information and data body is constructed. Among them, the header information includes the identifier of the target data, the total number of sub-data, the encryption algorithm identifier and the hash tree identifier, etc., and the data body stores the encryption results of the sub-data in sequence. When uploading to cloud storage, the optimal transmission path and protocol are selected according to the network conditions and the load of the cloud server. If the network is congested, a transmission protocol with a congestion control mechanism (such as TCP) is preferred, and the encryption results are dispersed to different network paths for transmission through multi-path transmission technology.

[0053] Furthermore, in terms of cloud storage, a distributed storage architecture can be used to store the encryption results on multiple storage nodes in different geographical locations. At the same time, redundant storage technology can be used, such as using error correction code technology such as Reed-Solomon coding to redundantly encode the encryption results and store them, so that data can be restored when some storage nodes fail. For example, the encryption results are divided into multiple data blocks, and then redundant data blocks are generated according to the Reed-Solomon coding algorithm, and the original data blocks and redundant data blocks are stored on different storage nodes.

[0054] The present invention relates to the field of security protection of Internet of Things devices, and proposes a security protection method for Internet of Things devices based on big data. In the present invention, the security protection method proposed can perform targeted encryption processing on the data sent by the Internet of Things device according to the encryption requirements when subsequently encrypting the data, thereby reducing the amount of encryption calculation and improving the encryption efficiency; at the same time, by combining the encrypted sub-data to obtain the encryption result of the target data, the encryption process is made more complicated when the target data is encrypted, the security and unpredictability of the encryption are enhanced, and the security protection capability of the Internet of Things device is improved while increasing the difficulty of cracking.

[0055] Step 102, such as Figure 2As shown, in the process of constructing the hash tree library, each hash tree in the hash tree library is first randomly constructed, and the root node of each hash tree after construction is used as the index of the hash tree. Under the condition that the total number of leaf layers of the hash tree is determined, the layer where the root node is located is used as the first layer, and the layer below the first layer is used as the second layer, so as to realize the sequential setting of the layers, and construct an automatic update mechanism for the hash tree library. When a new IoT device is connected to the server or a new data type appears, the hash tree structure and related parameters in the hash tree library are updated. In one embodiment, when a new medical sensor is connected to the IoT medical system, the corresponding hash tree is reconstructed according to the characteristics of the data sent by the medical sensor and added to the hash tree library.

[0056] Further, in one embodiment, when the text type target data is hashed using the first preset hash formula and the second preset hash formula, the first preset hash formula is as follows:

[0057]

[0058] Wherein, H1 represents the first hash value, M represents a predefined prime number, such as M=100008; c represents the number corresponding to each character in the sequence C; C=[c1, c2, ..., c n ] represents a digital sequence, which is a digital sequence obtained by converting each character in the text target data according to its value in the ASCII code table; q represents the number of characters in the text target data, that is, the length of the sequence C. Therefore, when calculating the first hash value, the target data is first converted into a corresponding digital sequence.

[0059] The second preset hash formula is as follows:

[0060]

[0061] Wherein, H2 represents the second hash value, k represents the number of different character types in the text target data; a l Represents the lth word w in the word sequence W l length; P represents a predefined prime number, like M; W = [w1, w2, ..., w l ] represents the word sequence obtained by segmenting the text target data into words; l represents the position index of the word in the target data. Therefore, when calculating the second hash value, the target data is first segmented into the corresponding word sequence.

[0062] By calculating the hash value through two different algorithms, it can be compared and matched with the hash tree in the hash tree library from different angles.

[0063] Furthermore, when the first hash value and the second hash value are matched with the index of each hash tree in the hash tree library for similarity, the Euclidean distance is introduced for calculation, as follows:

[0064]

[0065] The first hash value is represented by a vector h1=(h 11 ,h 12 ,…,h 1n ); the second hash value is represented by vector h2=(h 21 ,h 22 ,…,h 2n ), the hash tree index is represented by a vector z = (z1, z2, ..., z n )(where n represents the dimension of the vector, that is, the number of spatial dimensions corresponding to the hash value and the index after processing. The determination of the dimension can be determined according to the specific hash value encoding method, such as splitting the binary representation of the hash value into multiple dimensions by bit, etc.); S1(h1, z) represents the similarity value between the first hash value and the index in the hash tree, d1(h1, z) represents the Euclidean distance between the first hash value and the index in the hash tree, S2(h2, z) represents the similarity value between the second hash value and the index in the hash tree, and d2(h2, z) represents the Euclidean distance between the second hash value and the index in the hash tree.

[0066] Through the above calculation method, when d1(h1, z) is 0, S1(h1, z) = 1, indicating complete similarity. As the Euclidean distance increases, S1(h1, z) will gradually approach 0, indicating that the similarity decreases. S2(h2, z) is the same as S1(h1, z). After obtaining the similarity value with each index, the first hash value and the second hash value are sorted with the similarity values ​​obtained from the index of each hash tree in the hash tree library, thereby obtaining the first index sequence and the second index sequence. In the sorting process, the size of the similarity value is mainly considered, that is, the index with a large similarity value is arranged at the beginning of the sequence.

[0067] It should be noted that after obtaining the preliminary similarity results, the sorting can be fine-tuned based on additional factors such as the usage frequency and update time of each hash tree in the hash tree library. For example, for hash trees that are frequently matched and updated recently, their weight in the sorting can be appropriately increased to make them more likely to be ranked at the top. This can better adapt to the dynamic changes in data and give priority to matching the hash trees that are more closely related to the current target data and are the latest.

[0068] After completing the sorting of the first index sequence and the second index sequence, search for the indexes that appear in common in the two sequences, and all the common indexes form a new sequence, namely the third index sequence. At this time, each common index has a similarity S1 with the first hash value and a similarity S2 with the second hash value. The total similarity of each index is obtained by adding S1+S2 to each common index. The total similarity of all indexes is sorted again to obtain the index with the largest total similarity, and this index is determined as the target index. Ensure that the final target index is the most accurate and reliable to avoid errors in the subsequent use of the target hash tree due to fuzzy matching. After determining the target index, index it according to the root node of each hash tree, so that the target hash tree can be found quickly.

[0069] Step 103, in one embodiment, uses text data to perform modulo calculation, and the specific process is as follows:

[0070] Each target data is split based on the target data and the punctuation marks in each target data to obtain multiple split sub-data; each split sub-data is split based on the multiple split sub-data and the grammatical structure in each split sub-data to obtain multiple sub-data; the grammatical structure includes subject, predicate, object, attributive, adverbial and complement, etc.; each Chinese character and letter in each sub-data is encoded and converted to obtain multiple encoding values; each number in the multiple encoding values ​​is added to obtain the sum of the numbers; the sum of the numbers is modulo operated based on a preset modulo formula to obtain the modulo result value of each sub-data.

[0071] Specifically, for each Chinese character and letter, ASCII code can be used so that each character corresponds to a unique 7-bit or 8-bit integer. For example, in ASCII code, the decimal number corresponding to character A is 65, and the decimal number corresponding to a is 97. For a set of text data, each character can be converted into the corresponding ASCII code value. For example, for the text Hello, the converted ASCII code value sequence is [72, 101, 108, 108, 111].

[0072] At the same time, since there may be multiple Chinese characters or letters in each sub-data, after the Chinese characters and letters in each sub-data are encoded and converted, each number after the encoding conversion needs to be added to obtain the sum of the numbers that can represent the sub-data, and then the sum of the numbers is calculated modulo to obtain the modulo result value of each sub-data.

[0073] Accordingly, the preset modulus formula is:

[0074] result=S%N, where result represents the modulo result value, S represents the sum of the numbers, result∈[0, N-1], % represents the modulo calculation, and N represents the preset threshold value N>3 and is an integer.

[0075] According to the setting of N, the value of N can be adjusted based on demand, thereby limiting the final modulo result value to within the required range, avoiding the modulo result value being too large, which is not conducive to subsequent encryption operations.

[0076] Step 104, the preset conversion formula is:

[0077]

[0078] Where μ represents the conversion result value; min represents the minimum value of all sub-node numbers in the target layer; max represents the maximum value of all sub-node numbers in the target layer; % represents the modulo operation; Indicates the modulo result value of the target sub-data

[0079] If the encryption mode is the first mode, then in one embodiment:

[0080] The target hash tree is set to a binary hash tree, such as Figure 2 As shown, Figure 2 The numbers in the numbering are numbered from left to right in each layer, but it does not mean that this method is the only way to number. Each node corresponds to a hash value, and the root node is determined as the first layer. The layers are named from top to bottom. The total number of layers of the target hash tree is 4. After the target data is split, there are 3 sub-data. N is set to 20, and the modulo results of the three sub-data are 3, 10, and 15 respectively.

[0081] For the first sub-data, its modulo result value is 3, and a number matching is performed in the second layer of the target hash tree, and the leaf node with a value of 3 is matched to obtain the encrypted hash value corresponding to the leaf node; for the second sub-data (the second sub-data), its modulo result value is 10. Due to the matching relationship, it is known that the modulo result value of the second sub-data is numbered and matched in the third layer of the target hash value, and since the modulo result value 10 is not within the numbering range of the third layer, the preset conversion is used for calculation at this time, and μ1=1+|(10+1)%(8-1+1)-(8-1)| is obtained. The conversion result value is calculated to be 4, and 4 is numbered and matched in the third layer of the target hash value, so as to match the leaf node with a leaf node number of 4 in the third layer, and obtain the encrypted hash value of the second sub-data; for the third sub-data (i.e., the third sub-data), its modulo result value is 15, and it is matched in the fourth layer of the target hash tree. Since 15 is within the numbering range of the fourth layer, the modulo result value 15 is directly matched on the leaf node with a value of 15 at this time, and the encrypted hash value of the third sub-data is obtained, and finally the encryption results of all sub-data are determined.

[0082] If the encryption mode is the second mode, then in one embodiment:

[0083] The target hash tree is a ternary hash tree, such as Figure 3 As shown, Figure 3 The numbers in are the sequential labels of each layer from left to right. Each node corresponds to a hash value. The target data is split into 10 sub-data, N is set to 50, and their modulo result values ​​are 5, 8, 12, 15, 20, 25, 16, 19, 7, and 2. Since the total number of sub-data 10 is greater than the total number of layers of the target hash tree 4, the set of these 10 modulo result values ​​is segmented, and in order to make the number of sub-data in the segmented subset less than the total number of layers of the target hash tree 4, it is divided into 4 segments here, each containing 3 sub-data, the first segment is: {5, 8, 12}; the second segment is: {15, 20, 25}; the third segment is: {16, 19, 7}; the fourth segment is {2}.

[0084] For the first subset: the first modulus value 5 is matched in the leaf nodes in the second layer of the target hash tree. Since the first modulus value 5 is not within the second layer numbering range, the first modulus value 5 is calculated using the preset conversion to obtain μ2=1+|(5+1)%(3-1+1)-(3-1)|. The calculated conversion result value is 2, which is within the second layer numbering range. Therefore, the conversion result value 2 is matched with the leaf node numbered 2 in the second layer, and the hash value of the leaf node is obtained as the first encrypted hash value. For the second modulus value 8, the numbering is matched in the third layer of the target hash tree. Since 8 is within the numbering range, the second modulus value 8 is directly matched to the leaf node numbered 8, and the hash value of the leaf node is the second encrypted hash value. For the third modulus value 12, a number match is performed in the fourth layer of the target hash tree. Since 12 is within the number range, the third modulus value 12 is directly matched to the leaf node numbered 12, and the hash value of the leaf node is the third encrypted hash value. Similarly, the same operation is performed on the second subset, the third subset, and the fourth subset modulus result value set to obtain the encrypted hash value set of each subset, and finally the encryption result of all sub-data is obtained.

[0085] Step 105: In one embodiment, if the encryption result combination function is ∈(E1, E2, ..., E β )(where E δ is the sub-data encryption result), and the encryption result E of the target data is obtained T =∈(E1,E2,…,E β ), construct the packaging structure θ=(H I , E T ), where H I Header information, including target data identifier I D , total number of sub-data β, encryption algorithm identifier A I , hash tree identifier T I etc., i.e. H I =(I D , β, A I , T I ). During transmission, the package structure θ is uploaded to the cloud storage.

[0086] Figure 4 Schematic diagram of a security protection system for IoT devices based on big data provided by the present invention. Figure 4As shown, the system includes: a screening unit 10: used to screen the original data sent by the IoT device, and determine the target data to be encrypted in the original data; a matching unit 20: used to match in the hash tree library based on the hash calculation value of the target data, and obtain a target hash tree that matches the hash calculation value; a splitting and transformation unit 30: used to split the target data to obtain multiple sub-data, and perform a modulus transformation on each sub-data to obtain a modulus result value of each sub-data; an encryption unit 40: used to determine the encryption mode of the sub-data based on the total number of sub-data in the target data, and encrypt each sub-data based on the target hash tree, the modulus result value of each sub-data and the encryption mode to obtain the encryption result of each sub-data; a combined upload unit 50: used to combine the encryption results of each sub-data to obtain the encryption result of the target data, and upload the encrypted result to the cloud storage.

[0087] Figure 5 is a schematic diagram of the structure of the electronic device provided by the present invention, such as Figure 5 As shown, the electronic device may include: a processor 510, a communication interface 520, a memory 530 and a communication bus 540, wherein the processor 510, the communication interface 520 and the memory 530 communicate with each other through the communication bus 540. The processor 510 may call the logic instructions in the memory 530 to execute a security protection method for IoT devices based on big data, the method comprising: screening the original data sent by the acquired IoT device to determine the target data to be encrypted in the original data; matching in the hash tree library based on the hash calculation value of the target data to obtain a target hash tree matching the hash calculation value; splitting the target data to obtain multiple sub-data, and performing a modulus conversion on each sub-data to obtain the modulus result value of each sub-data; determining the encryption mode of the sub-data based on the total number of sub-data in the target data, and encrypting each sub-data based on the target hash tree, the modulus result value of each sub-data and the encryption mode to obtain the encryption result of each sub-data; combining the encryption results of each sub-data to obtain the encryption result of the target data, and uploading the encryption result to the cloud storage.

[0088] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0089] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute a security protection method for an Internet of Things device based on big data provided by the above methods, and the method includes: screening the original data sent by the acquired Internet of Things device to determine the target data to be encrypted in the original data; matching in a hash tree library based on the hash calculation value of the target data to obtain a target hash tree matching the hash calculation value; splitting the target data to obtain multiple sub-data, and performing a modulus conversion on each sub-data to obtain a modulus result value of each sub-data; determining the encryption mode of the sub-data based on the total number of sub-data in the target data, and encrypting each sub-data based on the target hash tree, the modulus result value of each sub-data and the encryption mode to obtain an encryption result of each sub-data; combining the encryption results of each sub-data to obtain the encryption result of the target data, and uploading the encryption result to cloud storage.

[0090] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the above-mentioned method for security protection of an Internet of Things device based on big data, the method comprising: screening the original data sent by the acquired Internet of Things device to determine the target data to be encrypted in the original data; matching in a hash tree library based on the hash calculation value of the target data to obtain a target hash tree matching the hash calculation value; splitting the target data to obtain multiple sub-data, and performing a modulus conversion on each sub-data to obtain a modulus result value of each sub-data; determining an encryption mode of the sub-data based on the total number of sub-data in the target data, and encrypting each sub-data based on the target hash tree, the modulus result value of each sub-data and the encryption mode to obtain an encryption result of each sub-data; combining the encryption results of each sub-data to obtain an encryption result of the target data, and uploading the encryption result to cloud storage.

[0091] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0092] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0093] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A security protection method for Internet of Things devices based on big data, characterized in that: The following steps are involved: Screening the original data sent by the IoT device to determine the target data to be encrypted in the original data; Matching in a hash tree library based on the hash calculation value of the target data to obtain a target hash tree matching the hash calculation value; The target data is split to obtain a plurality of sub-data, and each sub-data is subjected to a modulus conversion to obtain a modulus result value of each sub-data; Determine the encryption mode of the sub-data based on the total number of sub-data in the target data, and encrypt each sub-data based on the target hash tree, the modulus result value of each sub-data and the encryption mode to obtain an encryption result of each sub-data; The encryption results of each sub-data are combined to obtain the encryption result of the target data, and the encryption result is uploaded to the cloud storage.

2. The method for protecting the security of IoT devices based on big data according to claim 1 is characterized in that: The hash calculation value based on the target data is matched in a hash tree library to obtain a target hash tree matching the hash calculation value, including: Based on a first preset hash formula and a second preset hash formula, respectively calculating the target data to obtain a first hash value and a second hash value; Calculate the similarity between the first hash value and the second hash value and the index of each hash tree in the hash tree library, respectively, to obtain a first index sequence and a second index sequence sorted from high to low in similarity; the index of the hash tree is the hash value corresponding to the root node; Determine a target index based on the first index sequence and the second index sequence; A target hash tree matching the target index is determined.

3. The method for protecting the security of IoT devices based on big data according to claim 2 is characterized in that: The determining a target index based on the first index sequence and the second index sequence includes: Compare the first index sequence with the second index sequence to obtain a third index sequence common to the first index sequence and the second index sequence; Adding a similarity value between each index in the third index sequence and the first Hash value and a similarity value between each index in the third index sequence and the second Hash value to obtain a total similarity value of each index in the third index sequence; The index corresponding to the maximum total similarity value in the third index sequence is determined as the target index.

4. The method for protecting the security of IoT devices based on big data according to claim 1 is characterized in that: The encryption mode includes a first mode, wherein the first mode indicates that the total number of sub-data is less than the total number of layers of the target hash tree; the matching relationship between the sub-data and the target hash value is: the sub-data at the nth position matches the n+1th layer in the target hash tree; The step of encrypting each sub-data based on the target hash tree, the modulus result value of each sub-data, and the encryption mode to obtain an encryption result of each sub-data includes: Determine a first target position of each first target sub-data in the plurality of sub-data; Determine a first target layer matching the first target sub-data in the target hash tree based on the first target position; Matching the modulo result value of the first target sub-data with the number of each sub-node in the first target layer to obtain the first target sub-node in the target layer; The encrypted hash value corresponding to the first target sub-node is determined as the encryption result of the first target sub-data.

5. The method for protecting the security of IoT devices based on big data according to claim 1 is characterized in that: The encryption mode includes a second mode, wherein the second mode indicates that the total number of sub-data is greater than or equal to the total number of layers of the target hash tree; the matching relationship between the sub-data and the target hash tree is: the sub-data at the mth position in each subset matches the m+1th layer in the target hash tree; The step of encrypting each sub-data based on the target hash tree, the modulus result value of each sub-data, and the encryption mode to obtain an encryption result of each sub-data includes: Segmenting the plurality of sub-data based on the total number of layers of the target hash tree to obtain a plurality of segment subsets; the number of sub-data in each segment subset is less than the total number of layers of the target hash tree; Determine a second target position of each second target sub-data in the plurality of sub-data in its corresponding subset; Determine a second target layer matching the second target sub-data in the target hash tree based on the second target position; Matching the modulo result value of the second target sub-data with the number of each sub-node in the second target layer to obtain the second target sub-node in the second target layer; The encrypted hash value corresponding to the second target sub-node is determined as the encryption result of the second target sub-data.

6. The method for protecting the security of IoT devices based on big data according to any one of claim 5, characterized in that: The step of matching the modulo result value of the second target sub-data with the serial number of each sub-node in the second target layer to obtain the second target sub-node in the second target layer includes: If the modulo result value of the second target sub-data is not within the number range of all sub-nodes in the second target layer, the modulo result value of the second target sub-data is converted in a preset conversion formula to obtain a conversion result value, and the conversion result value is matched with the number of each sub-node in the second target layer to obtain the second target sub-node in the second target layer; If the modulo result value of the second target sub-data is within the number range of all child nodes in the second target layer, the modulo result value of the second target sub-data is directly matched with the number of each child node in the second target layer to obtain the second target sub-node in the second target layer.

7. The method for protecting the security of IoT devices based on big data according to claim 6 is characterized in that: The preset conversion formula is: μ=min+|(θ+min)%(max-min+1)-(max-min)|; Where μ represents the conversion result value; min represents the minimum value of all child node numbers in the target layer; max represents the maximum value of all child node numbers in the target layer; % represents the modulo operation; θ represents the modulo result value of the target child data.

8. A security protection system for IoT devices based on big data, characterized in that: Applied to the IoT device security protection method based on big data as described in any one of claims 1 to 7; the IoT device security protection system based on big data comprises: Screening unit: used to screen the original data sent by the IoT device and determine the target data to be encrypted in the original data; Matching unit: used for matching in a hash tree library based on the hash calculation value of the target data to obtain a target hash tree matching the hash calculation value; Splitting and conversion unit: used for splitting the target data to obtain multiple sub-data, and performing modulus conversion on each sub-data to obtain the modulus result value of each sub-data; Encryption unit: used to determine the encryption mode of the sub-data based on the total number of sub-data in the target data, and encrypt each sub-data based on the target hash tree, the modulus result value of each sub-data and the encryption mode to obtain the encryption result of each sub-data; Combined upload unit: used to combine the encryption results of each sub-data to obtain the encryption result of the target data, and upload the encryption result to the cloud storage.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of a security protection method for Internet of Things devices based on big data as described in any one of claims 1 to 7 are implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of a security protection method for Internet of Things devices based on big data as described in any one of claims 1 to 7 are implemented.

Images