A security protection method and system for Internet of Things devices based on big data

Abstract

The present invention discloses a security protection method for an Internet of Things device based on big data. The method comprises the following steps: screening the original data sent by the obtained Internet of Things device to determine the target data to be encrypted in the original data; matching the target data in a hash tree library based on the hash calculation value to obtain a target hash tree that matches the hash calculation value; splitting the target data to obtain multiple sub-data, and performing a modulus conversion on each sub-data to obtain a modulus result value of each sub-data; determining the encryption mode of the sub-data based on the total number of sub-data in the target data, and encrypting each sub-data based on the target hash tree, the modulus result value of each sub-data, and the encryption mode to obtain an encryption result of each sub-data; combining the encryption results of each sub-data to obtain an encryption result of the target data, and uploading the encryption result to cloud storage. The present invention increases the difficulty of cracking while improving the security protection capability of the Internet of Things device.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things device security protection technology, and in particular to a big data-based Internet of Things device security protection method and system. Background Art

[0002] With the rapid development of IoT technology, an increasing number of devices are connected to the internet, forming a vast IoT ecosystem. These devices, including smart home appliances, industrial sensors, and medical equipment, have brought significant convenience to people's lives and work. However, security issues with IoT devices are also becoming increasingly prominent. Because many IoT devices are designed for convenience and cost-effectiveness, security protection is often overlooked, making them easy targets for hackers. Therefore, developing effective security methods for IoT devices has become increasingly important.

[0003] At present, in the process of data transmission and storage, IoT devices generally transmit the data from the IoT devices to the server first, and then upload it to the cloud for storage. In the process of cloud storage of IoT data, since the data generated by IoT devices usually contains sensitive information, if it is not protected during the data transmission process, it is easy to cause the leakage of sensitive information. However, the current protection method generally adopts the method of encrypting the data transmitted by IoT devices. Due to the large amount of data transmitted by IoT devices, encrypting all the data in transmission requires a large amount of calculation and has poor efficiency. At the same time, the current encryption method is too simple and easy to be cracked, resulting in a low security risk. Summary of the Invention

[0004] The purpose of the present invention is to solve the problems in the prior art and to propose a security protection method and system for Internet of Things devices based on big data.

[0005] In order to achieve the above object, the present invention adopts the following technical solutions:

[0006] A method for protecting IoT devices based on big data, comprising the following steps:

[0007] Screening the original data sent by the IoT device to determine the target data to be encrypted in the original data;

[0008] Matching the target data in a hash tree library based on the hash calculation value to obtain a target hash tree that matches the hash calculation value;

[0009] Splitting the target data to obtain multiple sub-data, and performing a modulo conversion on each sub-data to obtain a modulo result value of each sub-data;

[0010] Determining an encryption mode for the sub-data based on the total number of sub-data in the target data, and encrypting each sub-data based on the target hash tree, a modulo result value of each sub-data, and the encryption mode to obtain an encryption result for each sub-data;

[0011] The encryption results of each sub-data are combined to obtain the encryption result of the target data, and the encryption result is uploaded to the cloud storage.

[0012] A big data-based IoT device security protection system, comprising:

[0013] Screening unit: used to screen the original data sent by the IoT device and determine the target data to be encrypted in the original data;

[0014] Matching unit: used to match the target data in the hash tree library based on the hash calculation value to obtain a target hash tree that matches the hash calculation value;

[0015] Splitting and conversion unit: used for splitting the target data to obtain multiple sub-data, and performing modulo conversion on each sub-data to obtain the modulo result value of each sub-data;

[0016] An encryption unit is configured to determine an encryption mode for the sub-data based on the total number of sub-data in the target data, and encrypt each sub-data based on the target hash tree, a modulo result value of each sub-data, and the encryption mode to obtain an encryption result for each sub-data;

[0017] Combined uploading unit: used to combine the encryption results of each sub-data to obtain the encryption result of the target data, and upload the encryption result to the cloud storage.

[0018] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the processor executes the program, the steps of the above-mentioned method for security protection of IoT devices based on big data are implemented.

[0019] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned method for security protection of Internet of Things devices based on big data are implemented.

[0020] Compared with the prior art, the present invention has the following advantages:

[0021] The present invention provides a big data-based Internet of Things device security protection method and system. The method screens original data sent by the Internet of Things device to determine target data that needs to be encrypted in the original data. When the data sent by the Internet of Things device is subsequently encrypted, the data can be targeted and encrypted according to encryption needs, thereby reducing the amount of encryption calculations and improving encryption efficiency. In addition, the target data is first hashed and then matched with a target hash tree for encryption in a hash tree. The target data is then split and modulo-converted to obtain a modulo result value of each sub-data. Based on the modulo result value, the sub-data is matched with a corresponding hash value in the target hash tree, thereby encrypting all sub-data. Finally, the encrypted sub-data are combined to obtain the encryption result of the target data. When the target data is encrypted, the encryption process is made more complex, the security and unpredictability of the encryption are enhanced, and the security protection capability of the Internet of Things device is improved while increasing the difficulty of cracking. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0023] Figure 1 A schematic diagram of the process flow of a method for protecting IoT devices based on big data provided by an embodiment of the present invention;

[0024] Figure 2 Schematic diagram of the target hash tree in the big data-based IoT device security protection method provided by the embodiment of the present invention Figure 1 ;

[0025] Figure 3 Schematic diagram of the target hash tree in the big data-based IoT device security protection method provided by the embodiment of the present invention Figure 2 ;

[0026] Figure 4 A schematic diagram of the structure of a big data-based IoT device security protection system provided by an embodiment of the present invention;

[0027] Figure 5 This is a schematic structural diagram of the electronic device proposed by the present invention. DETAILED DESCRIPTION

[0028] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0029] The following combination Figure 1 - Figure 5 The present invention describes a big data-based Internet of Things device security protection method and system.

[0030] Figure 1 This is a flow chart of a method for protecting IoT devices based on big data provided by the present invention. Figure 1 As shown, the method includes:

[0031] Step 101: Filter the original data sent by the IoT device to determine the target data to be encrypted in the original data.

[0032] Specifically, when obtaining the original data sent by the IoT device, first clarify the specific type of the IoT device. After determining the type of the IoT device, match and identify the original data according to the database related to the corresponding IoT device, so as to achieve the effect of determining the target data to be encrypted in the original data.

[0033] Furthermore, to more quickly filter and judge the raw data sent by IoT devices, machine learning algorithms can be used to build classification models. By training on historical data and manually labeled data requiring encryption, the trained classification model can automatically determine which data is the target for encryption based on the incoming raw data. Ultimately, by filtering and determining the target data, we can avoid blanket processing of all raw data and focus on the data that truly requires encryption protection, avoiding unnecessary encryption computing overhead, improving overall processing efficiency, and rationalizing resource utilization. This can precisely protect the security of critical data, especially in IoT scenarios with massive data volumes.

[0034] Step 102: Match the target data's hash value in the hash tree library to obtain a target hash tree that matches the hash value.

[0035] Specifically, when performing hash calculation on the target data, first determine the type of the target data (such as numerical, textual, image, video, etc.). After determining the type of the target data, when the target data is numerical data, the division hash method or the multiplication hash method can be used; when the target data is textual data, the character encoding-based accumulation or bit operation and the Sim hash algorithm can be used; when the target data is image data, the average hash algorithm or the perceptual hash algorithm can be used.

[0036] Furthermore, taking the target data as text data as an example, a hash tree library is matched based on the hash calculation value of the target data to obtain a target hash tree that matches the hash calculation value, including: calculating the target data based on a first preset hash formula and a second preset hash formula to obtain a first hash value and a second hash value; calculating the similarity between the first hash value and the second hash value and the index of each hash tree in the hash tree library to obtain a first index sequence and a second index sequence sorted from high to low similarity; the index of the hash tree is the hash value corresponding to the root node; determining the target index based on the first index sequence and the second index sequence; and determining a target hash tree that matches the target index. By using two different preset hash formulas to calculate the hash value, feature extraction of the target data is performed from multiple perspectives, avoiding the limitations that may exist in a single hash method, making subsequent matching more comprehensive and accurate, and being able to more reliably locate the appropriate target hash tree in the hash tree library.

[0037] Furthermore, determining a target index based on the first index sequence and the second index sequence includes: comparing the first index sequence with the second index sequence to obtain a third index sequence common to the first index sequence and the second index sequence; adding the similarity between each index in the third index sequence and the first hash value, and the similarity between each index and the second hash value, to obtain a total similarity for each index; and determining the index corresponding to the maximum total similarity value in the third index sequence as the target index. In the process of obtaining the maximum total similarity, the indices in the third index sequence can also be sorted from high to low according to the total similarity, and the candidate indexes can be evaluated in an orderly manner. The index that best matches the target data in multiple dimensions is preferentially selected as the target index, making the final selection more reasonable and facilitating optimal decision-making when multiple similar indexes exist.

[0038] Step 103: split the target data to obtain multiple sub-data, and perform modulo conversion on each sub-data to obtain the modulo result value of each sub-data.

[0039] Specifically, when splitting the target data, it can be split according to the internal logical structure of the target data, or it can be split intelligently according to the data format. For example, for image data, it can be split according to the pixel area, color channel, etc. of the image; for text data, it can be split according to semantic paragraphs, sentence structures, etc. For example, in an intelligent transportation system, the traffic road condition image data captured by the camera can be split into sub-data according to the image areas corresponding to different lanes, so that the subsequent modulo conversion and encryption can be more in line with the actual application scenario of the data and improve the overall encryption effect.

[0040] Furthermore, when performing modular calculations on each sub-data element, the modular parameters can be dynamically adjusted. Instead of fixing the modulus and other parameters in the modular operation, they can be dynamically adjusted based on factors such as the sub-data's characteristics, the current network security environment, and data transmission requirements. For example, in processing IoT financial transaction data, the modulus of the modular operation can be determined in real time based on factors such as the transaction amount and time. This makes the resulting modular value more random and secure, preventing attackers from deciphering encrypted data through fixed patterns.

[0041] Step 104 , determining the encryption mode of the sub-data based on the total number of sub-data in the target data, and encrypting each sub-data based on the target hash tree, the modulo result value of each sub-data and the encryption mode to obtain the encryption result of each sub-data.

[0042] Specifically, the encryption mode is determined according to the total number of sub-data, so that the encryption method can be flexibly adjusted according to the data size. Different encryption modes are used for different numbers of sub-data, which increases the difficulty for attackers to crack and improves the adaptability and security of encryption.

[0043] On the one hand, if the encryption mode is the first mode, the total number of sub-data represented is less than the total number of layers of the target hash tree. The matching relationship between the sub-data and the target hash value is: the sub-data at the nth position matches the n+1th layer in the target hash tree; n is an integer and n≥1, then each sub-data is encrypted based on the target hash tree, the modulo result value of each sub-data, and the encryption mode to obtain the encryption result of each sub-data, including: determining the first target position of each first target sub-data among the multiple sub-data; determining the first target layer that the first target sub-data matches in the target hash tree based on the first target position; matching the modulo result value of the first target sub-data with the number of each sub-node in the first target layer to obtain the first target sub-node in the target layer; and determining the encrypted hash value corresponding to the first target sub-node as the encryption result of the first target sub-data. The first target sub-data is any sub-data among the multiple sub-data, the first target layer is any layer in the target hash tree except the root node, and the first target sub-node is any node in each target layer.

[0044] Furthermore, when the encryption mode is the first mode (the total number of sub-data is less than the total number of layers of the target hash tree), the matching layer of the sub-data in the target hash tree is determined based on its position in the multiple sub-data. By matching the modulo result value of the sub-data with the sub-node number of the matching layer, the corresponding target sub-node is found, and the encrypted hash value of the sub-node is used as the encryption result of the sub-data. A clear and unambiguous correspondence between the sub-data position and the hash tree matching layer is established, making the encryption process easy to understand and implement, reducing the complexity of the encryption algorithm and improving encryption efficiency. By fully utilizing the hierarchical structure of the hash tree, each sub-data can be matched at different levels, increasing the diversity of the encryption results and improving the security of the encryption, because it is difficult for an attacker to infer the relationship between the sub-data and the encryption result through simple rules. The matching layer of the sub-data is dynamically determined according to its position. Sub-data at different positions have different encryption paths. Even if the sub-data themselves are similar, their encryption results will be different due to different matching layers, further enhancing the randomness and unpredictability of the encryption.

[0045] In addition, during the matching process, since the modulo result value of the first target sub-data may be greater than the number range of all sub-nodes in the first target layer, when the modulo result value of the first target sub-data is not within the number range of all sub-nodes in the first target layer, the modulo result value of the first target sub-data is converted in a preset conversion formula. After obtaining the conversion result value, the conversion result value is matched with the number of each sub-node in the first target layer, thereby obtaining the first target sub-node in the first target layer. When the modulo result value of the first target sub-data is within the number range of all sub-nodes in the first target layer, the modulo result value of the first target sub-data is directly matched with the number of each sub-node in the first target layer, thereby obtaining the first target sub-node in the first target layer. By using a preset conversion formula to handle the problem of the modulo result value being out of range, the entire matching process will not be interrupted or unable to proceed due to the value being out of range, and can adapt to more modulo result values ​​with different value situations, thereby improving the compatibility and adaptability of the encryption matching process to various types of data.

[0046] On the other hand, if the encryption mode is the second mode, the total number of sub-data is greater than or equal to the total number of layers of the target hash tree. The matching relationship between the sub-data and the target hash tree is: the sub-data at the mth position in each subset matches the m+1th layer in the target hash tree, where m ≥ 1 and is an integer; then, based on the target hash tree, the modulo result value of each sub-data, and the encryption mode, each sub-data is encrypted to obtain the encryption result of each sub-data, including:

[0047] Based on the total number of layers of the target hash tree, multiple sub-data are segmented to obtain multiple subsets; the number of sub-data in each subset is less than the total number of layers of the target hash tree; the second target position of each second target sub-data in the multiple sub-data in its corresponding subset is determined; based on the second target position, the second target layer that the second target sub-data matches in the target hash tree is determined; the modulo result value of the second target sub-data is matched with the number of each sub-node in the second target layer to obtain the second target sub-node in the second target layer; the encrypted hash value corresponding to the second target sub-node is determined as the encryption result of the second target sub-data. The second target sub-data is any sub-data in the subset. The second target layer is any layer in the target hash tree except the root node, and the second target sub-node is any node in each target layer.

[0048] In the second mode (the total number of sub-data is greater than or equal to the total number of layers of the target hash tree), the numerous sub-data are first segmented according to the total number of layers of the target hash tree to obtain multiple segment subsets. Then, for each second target sub-data in each segment subset, the second target layer that matches in the target hash tree is determined based on its position in the subset, and the second target sub-node is found by matching the modulo result value of the sub-data with the sub-node number of the matching layer, and finally the encrypted hash value corresponding to the sub-node is used as the encryption result of the sub-data. For the situation where the number of sub-data far exceeds the total number of layers of the hash tree, the segmentation strategy can properly handle the situation where the total number of sub-data far exceeds the total number of layers of the target hash tree, so that a large amount of sub-data can be encrypted in an orderly manner in the hash tree structure, avoiding confusion or inability to perform the encryption process due to excessive data volume, thereby improving the efficiency of large-scale data encryption. The sub-data is divided into multiple subsets, and each subset can be encrypted independently. This independence facilitates parallel computing, error recovery, and data management in practical applications. For example, when a problem occurs in the encryption of a certain subset, it can be checked and processed separately without affecting the encryption process of other subsets, thereby improving the flexibility and maintainability of the encryption system.

[0049] In the second mode, if the modulo result value of the second target sub-data is not within the number range of all child nodes in the second target layer, the modulo result value of the second target sub-data is converted in a preset conversion formula to obtain a conversion result value, and the conversion result value is matched with the number of each child node in the second target layer to obtain the second target child node in the second target layer;

[0050] If the modulo result value of the second target sub-data is within the number range of all child nodes in the second target layer, the modulo result value of the second target sub-data is directly matched with the number of each child node in the second target layer to obtain the second target sub-node in the second target layer.

[0051] Step 105: Combine the encryption results of each sub-data to obtain the encryption result of the target data, and upload the encryption result to the cloud storage.

[0052] Specifically, when combining the encryption results of sub-data, a structured encapsulation method is adopted. For example, a package structure containing header information and a data body is constructed. The header information includes the identifier of the target data, the total number of sub-data, the encryption algorithm identifier, and the hash tree identifier, etc. The data body stores the encryption results of the sub-data in sequence. When uploading to cloud storage, the optimal transmission path and protocol are selected based on the network conditions and the cloud server load. If the network is congested, a transmission protocol with a congestion control mechanism (such as TCP) is preferred, and the encryption results are distributed to different network paths for transmission through multi-path transmission technology.

[0053] Furthermore, in terms of cloud storage, a distributed storage architecture can be adopted, storing the encryption results on multiple storage nodes in different geographical locations. At the same time, redundant storage technology can be used, such as using error-correcting code technologies such as Reed-Solomon coding to redundantly encode the encryption results before storage, so that data can be recovered in the event of a failure of some storage nodes. For example, the encryption result can be divided into multiple data blocks, and then redundant data blocks are generated using the Reed-Solomon coding algorithm. The original data blocks and redundant data blocks are stored on different storage nodes.

[0054] The present invention relates to the field of security protection for Internet of Things (IoT) devices and proposes a security protection method for IoT devices based on big data. The present invention proposes a security protection method that, when subsequently encrypting data sent by IoT devices, can perform targeted encryption processing on the data according to encryption requirements, thereby reducing the amount of encryption computation and improving encryption efficiency. Furthermore, by combining encrypted sub-data to obtain the encryption result of target data, the encryption process is made more complex, enhancing the security and unpredictability of the encryption, and improving the security protection capabilities of IoT devices while increasing the difficulty of cracking.

[0055] Step 102, as Figure 2As shown, in the process of constructing a hash tree library, each hash tree in the hash tree library is first randomly constructed, and the root node of each constructed hash tree is used as the index of the hash tree. Under the condition that the total number of leaf layers of the hash tree is determined, the layer where the root node is located is used as the first layer, and the layer below the first layer is used as the second layer, so as to achieve the sequential setting of the layers. In addition, an automatic update mechanism for the hash tree library is constructed. When a new IoT device is connected to the server or a new data type appears, the hash tree structure and related parameters in the hash tree library are updated. For example, in one embodiment, when a new medical sensor is connected to the IoT medical system, the corresponding hash tree is reconstructed based on the characteristics of the data sent by the medical sensor and added to the hash tree library.

[0056] Furthermore, in one embodiment, when hash calculation is performed on text-type target data using a first preset hash formula and a second preset hash formula, the first preset hash formula is as follows:

[0057]

[0058] Wherein, H1 represents the first hash value, M represents a predefined prime number, such as M=100008; c represents the number corresponding to each character in the sequence C; C=[c1, c2, ..., c n ] represents a digital sequence, which is a digital sequence obtained by converting each character in the text target data according to its value in the ASCII code table; q represents the number of characters in the text target data, that is, the length of sequence C. Therefore, when calculating the first hash value, the target data is first converted into a corresponding digital sequence.

[0059] The second preset hash formula is as follows:

[0060]

[0061] Wherein, H2 represents the second hash value, k represents the number of different character types in the text target data; a l Represents the lth word w in the word sequence W l The length of; P represents a predefined prime number, like M; W = [w1, w2, ..., w l ] represents the word sequence obtained by segmenting the target text data into words; l represents the position index of the word in the target data. Therefore, when calculating the second hash value, the target data is first segmented into the corresponding word sequence.

[0062] By calculating the hash value through two different algorithms, it can be compared and matched with the hash tree in the hash tree library from different angles.

[0063] Furthermore, when the first hash value and the second hash value are similarly matched with the index of each hash tree in the hash tree library, the Euclidean distance is introduced for calculation, as follows:

[0064]

[0065] The first hash value is represented by a vector h1=(h 11 , h 12 ,…,h 1n ); The second hash value is represented by vector h2=(h 21 , h 22 ,…,h 2n ), the hash tree index is represented by a vector z = (z1, z2, ..., z n )(where n represents the dimension of the vector, that is, the number of spatial dimensions corresponding to the hash value and the index after processing. The determination of the dimension can be determined according to the specific hash value encoding method, such as splitting the binary representation of the hash value into multiple dimensions by bit); S1(h1, z) represents the similarity value between the first hash value and the index in the hash tree, d1(h1, z) represents the Euclidean distance between the first hash value and the index in the hash tree, S2(h2, z) represents the similarity value between the second hash value and the index in the hash tree, and d2(h2, z) represents the Euclidean distance between the second hash value and the index in the hash tree.

[0066] According to the above calculation method, when d1(h1, z) is 0, S1(h1, z) = 1, indicating complete similarity. As the Euclidean distance increases, S1(h1, z) will gradually approach 0, indicating a decrease in similarity. S2(h2, z) is the same as S1(h1, z). After obtaining the similarity value with each index, the first hash value and the second hash value are sorted with the similarity values ​​obtained from the index of each hash tree in the hash tree library, thereby obtaining a first index sequence and a second index sequence. In the sorting process, the size of the similarity value is mainly considered, that is, the index with the largest similarity value is sorted at the beginning of the sequence.

[0067] It should be noted that after obtaining the preliminary similarity results, the sorting can be fine-tuned based on additional factors such as the usage frequency and update time of each hash tree in the hash tree library. For example, for hash trees that have been frequently matched and updated recently, their weight in the sorting can be appropriately increased to make them more likely to be ranked at the top. This can better adapt to the dynamic changes in data and give priority to matching the latest hash trees that are more closely related to the current target data.

[0068] After sorting the first and second index sequences, we search for common indices in the two sequences, and all common indices form a new sequence, namely the third index sequence. At this time, each common index has a similarity S1 with the first hash value and a similarity S2 with the second hash value. S1+S2 of each common index is added to obtain the total similarity of each index. We sort all indexes again based on the total similarity to obtain the index with the greatest total similarity, and determine this index as the target index. This ensures that the final target index is the most accurate and reliable, avoiding errors in the subsequent use of the target hash tree due to fuzzy matching. After determining the target index, we index each hash tree based on its root node, so that we can quickly find the target hash tree.

[0069] In step 103, in one embodiment, the text data is used to perform a modulo calculation, and the specific process is as follows:

[0070] Each target data is split based on the target data and the punctuation marks in each target data to obtain multiple split sub-data; each split sub-data is split based on the multiple split sub-data and the grammatical structure in each split sub-data to obtain multiple sub-data; the grammatical structure includes subject, predicate, object, attributive, adverbial and complement, etc.; each Chinese character and letter in each sub-data is encoded and converted to obtain multiple encoding values; each number in the multiple encoding values ​​is added to obtain the total number; the total number is modulo operated based on a preset modulo formula to obtain the modulo result value of each sub-data.

[0071] Specifically, ASCII codes can be used for each Chinese character and letter, so that each character corresponds to a unique 7-bit or 8-bit integer. For example, in ASCII code, the decimal value corresponding to the character A is 65, and the decimal value corresponding to "a" is 97. For a set of text data, each character can be converted to its corresponding ASCII code value. For example, for the text "Hello", the converted ASCII code value sequence is [72, 101, 108, 108, 111].

[0072] At the same time, since there may be multiple Chinese characters or letters in each sub-data, after the Chinese characters and letters in each sub-data are encoded and converted, each number after the encoding conversion needs to be added to obtain the sum of the numbers that can represent the sub-data, and then the sum of the numbers is modulo calculated to obtain the modulo result value of each sub-data.

[0073] Accordingly, the preset modulo formula is:

[0074] result=S%N, where result represents the modulo result value, S represents the sum of the digits, result∈[0, N-1], % represents the modulo calculation, and N represents the preset threshold value N>3 and is an integer.

[0075] According to the setting of N, the value of N can be adjusted based on demand, thereby limiting the final modulo result value to the required range, avoiding the modulo result value being too large, which is not conducive to subsequent encryption operations.

[0076] Step 104: The preset conversion formula is:

[0077]

[0078] Where μ represents the conversion result value; min represents the minimum value of all child node numbers in the target layer; max represents the maximum value of all child node numbers in the target layer; % represents the modulo operation; Indicates the modulo result value of the target sub-data

[0079] If the encryption mode is the first mode, then in one embodiment:

[0080] The target hash tree is set to a binary hash tree, such as Figure 2 As shown, Figure 2 The numbers in the tree are numbered from left to right in each layer, but this does not mean that only this method can be used for numbering. Each node has a corresponding hash value, and the root node is determined as the first layer. The layers are named from top to bottom. The total number of layers in the target hash tree is 4. After the target data is split, there are 3 sub-data. If N is set to 20, the modulo results of the three sub-data are 3, 10, and 15 respectively.

[0081] For the first sub-data, its modulo result value is 3. A number matching is performed in the second layer of the target hash tree, and the leaf node with a value of 3 is matched to obtain the encrypted hash value corresponding to the leaf node. For the second sub-data (second sub-data), its modulo result value is 10. Due to the matching relationship, it is known that the modulo result value of the second sub-data is numbered and matched in the third layer of the target hash value. Moreover, since the modulo result value 10 is not within the numbering range of the third layer, a preset conversion is used for calculation to obtain μ1=1+|(10+1)%(8-1+1)-(8-1)|. The calculated conversion result value is 4. 4 is numbered and matched in the third layer of the target hash value, thereby matching the leaf node with a leaf node number of 4 in the third layer, and obtaining the encrypted hash value of the second sub-data. For the third sub-data (i.e., the third sub-data), its modulo result value is 15. It is matched in the fourth layer of the target hash tree. Since 15 is within the numbering range of the fourth layer, the modulo result value 15 is directly matched on the leaf node with a value of 15 to obtain the encrypted hash value of the third sub-data. Finally, the encryption results of all sub-data are determined.

[0082] If the encryption mode is the second mode, then in one embodiment:

[0083] The target hash tree is a ternary hash tree, such as Figure 3 As shown, Figure 3 The numbers in the table are the sequential labels of each layer from left to right. Each node corresponds to a hash value. The target data is split into 10 sub-data, N is set to 50, and their modulo values ​​are 5, 8, 12, 15, 20, 25, 16, 19, 7, and 2 respectively. Since the total number of sub-data, 10, is greater than the total number of layers in the target hash tree, 4, the set containing these 10 modulo values ​​is segmented. In order to make the number of sub-data in the segmented subsets smaller than the total number of layers in the target hash tree, 4, it is divided into 4 segments, each containing 3 sub-data. The first segment is: {5, 8, 12}; the second segment is: {15, 20, 25}; the third segment is: {16, 19, 7}; and the fourth segment is {2}.

[0084] For the first subset of segments: the first modulus value 5 is matched against the leaf nodes in the second layer of the target hash tree. Since the first modulus value 5 is not within the second layer numbering range, the first modulus value 5 is calculated using a preset transformation, resulting in μ2 = 1 + |(5+1)%(3-1+1)-(3-1)|. The resulting transformation value is 2, which is within the second layer numbering range. Therefore, the transformation result value 2 is matched against the leaf node numbered 2 in the second layer, and the hash value of the leaf node is obtained as the first encrypted hash value. For the second modulus value 8, a number matching is performed in the third layer of the target hash tree. Since 8 is within the numbering range, the second modulus value 8 is directly matched against the leaf node numbered 8, resulting in the hash value of the leaf node being the second encrypted hash value. For the third modulus value 12, a number match is performed in the fourth layer of the target hash tree. Since 12 is within the number range, the third modulus value 12 is directly matched to the leaf node numbered 12, and the hash value of the leaf node is the third encrypted hash value. Similarly, the same operation is performed on the second, third, and fourth segment subsets. The encrypted hash value set of each subset is obtained, and finally the encryption result of all sub-data is obtained.

[0085] Step 105: In one embodiment, if the encryption result combination function is ∈(E1, E2, ..., E β )(where E δ is the sub-data encryption result), and the encryption result E of the target data is obtained T =∈(E1,E2,…,E β ), construct the packaging structure θ=(H I , E T ), where H I Header information, including target data identifier I D , total number of sub-data β, encryption algorithm identifier A I , hash tree identifier T I etc., i.e. H I =(I D , β, A I 、T I ). During transmission, the package structure θ is uploaded to the cloud storage.

[0086] Figure 4 This is a schematic diagram of the structure of a big data-based IoT device security protection system provided by the present invention. Figure 4As shown, the system includes: a screening unit 10: used to screen the original data sent by the obtained IoT device, and determine the target data to be encrypted in the original data; a matching unit 20: used to match in the hash tree library based on the hash calculation value of the target data, and obtain a target hash tree that matches the hash calculation value; a splitting and transformation unit 30: used to split the target data to obtain multiple sub-data, and perform modulus transformation on each sub-data to obtain the modulus result value of each sub-data; an encryption unit 40: used to determine the encryption mode of the sub-data based on the total number of sub-data in the target data, and encrypt each sub-data based on the target hash tree, the modulus result value of each sub-data and the encryption mode to obtain the encryption result of each sub-data; a combined upload unit 50: used to combine the encryption results of each sub-data to obtain the encryption result of the target data, and upload the encrypted result to the cloud storage.

[0087] Figure 5 Schematic diagram of the structure of the electronic device provided by the present invention, such as Figure 5 As shown, the electronic device may include: a processor 510, a communication interface 520, a memory 530 and a communication bus 540, wherein the processor 510, the communication interface 520 and the memory 530 communicate with each other via the communication bus 540. The processor 510 may call the logic instructions in the memory 530 to execute a security protection method for an IoT device based on big data, the method comprising: screening the original data sent by the IoT device to determine the target data to be encrypted in the original data; matching the target data in the hash tree library based on the hash calculation value to obtain a target hash tree that matches the hash calculation value; splitting the target data to obtain multiple sub-data, and performing a modulus conversion on each sub-data to obtain a modulus result value of each sub-data; determining the encryption mode of the sub-data based on the total number of sub-data in the target data, and encrypting each sub-data based on the target hash tree, the modulus result value of each sub-data and the encryption mode to obtain an encryption result of each sub-data; combining the encryption results of each sub-data to obtain an encryption result of the target data, and uploading the encryption result to cloud storage.

[0088] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0089] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute a big data-based Internet of Things device security protection method provided by the above methods, the method including: screening the original data sent by the obtained Internet of Things device to determine the target data to be encrypted in the original data; matching in the hash tree library based on the hash calculation value of the target data to obtain a target hash tree matching the hash calculation value; splitting the target data to obtain multiple sub-data, and performing modulo conversion on each sub-data to obtain the modulo result value of each sub-data; determining the encryption mode of the sub-data based on the total number of sub-data in the target data, and encrypting each sub-data based on the target hash tree, the modulo result value of each sub-data and the encryption mode to obtain the encryption result of each sub-data; combining the encryption results of each sub-data to obtain the encryption result of the target data, and uploading the encryption result to cloud storage.

[0090] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the above-mentioned method for security protection of Internet of Things devices based on big data, the method comprising: screening the original data sent by the obtained Internet of Things device to determine the target data to be encrypted in the original data; matching in a hash tree library based on the hash calculation value of the target data to obtain a target hash tree matching the hash calculation value; splitting the target data to obtain multiple sub-data, and performing a modulus conversion on each sub-data to obtain a modulus result value of each sub-data; determining the encryption mode of the sub-data based on the total number of sub-data in the target data, and encrypting each sub-data based on the target hash tree, the modulus result value of each sub-data and the encryption mode to obtain an encryption result of each sub-data; combining the encryption results of each sub-data to obtain the encryption result of the target data, and uploading the encryption result to cloud storage.

[0091] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units. That is, they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0092] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0093] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with the technical field, within the technical scope disclosed by the present invention, who makes equivalent replacements or changes based on the technical solution and inventive concept of the present invention, should be covered by the scope of protection of the present invention.

Claims

1. A security protection method for Internet of Things devices based on big data, characterized in that: The following steps are involved: Screening the original data sent by the IoT device to determine the target data to be encrypted in the original data; Matching the target data in a hash tree library based on the hash calculation value to obtain a target hash tree that matches the hash calculation value; Splitting the target data to obtain multiple sub-data, and performing a modulo conversion on each sub-data to obtain a modulo result value of each sub-data; Determining an encryption mode for the sub-data based on the total number of sub-data in the target data, and encrypting each sub-data based on the target hash tree, a modulo result value of each sub-data, and the encryption mode to obtain an encryption result for each sub-data; Combining the encryption results of each sub-data to obtain the encryption result of the target data, and uploading the encryption result to cloud storage; The step of matching the target data's hash value in a hash tree library to obtain a target hash tree that matches the target data's hash value includes: Based on a first preset hash formula and a second preset hash formula, respectively, the target data is calculated to obtain a first hash value and a second hash value; Calculate similarity between the first hash value and the second hash value and the index of each hash tree in the hash tree library, respectively, to obtain a first index sequence and a second index sequence sorted from high to low similarity; the index of the hash tree is the hash value corresponding to the root node; Determining a target index based on the first index sequence and the second index sequence; Determining a target hash tree that matches the target index; The determining a target index based on the first index sequence and the second index sequence includes: Comparing the first index sequence with the second index sequence to obtain a third index sequence common to the first index sequence and the second index sequence; Adding a similarity value of each index in the third index sequence with the first Hash value and a similarity value with the second Hash value to obtain a total similarity value of each index in the third index sequence; The index corresponding to the maximum total similarity value in the third index sequence is determined as the target index.

2. The method for protecting the security of IoT devices based on big data according to claim 1, characterized in that: The encryption mode includes a first mode, wherein the first mode indicates that the total number of sub-data is less than the total number of layers of the target hash tree; the matching relationship between the sub-data and the target hash value is: the sub-data at the nth position matches the n+1th layer in the target hash tree; The step of encrypting each sub-data based on the target hash tree, the modulo result value of each sub-data, and the encryption mode to obtain an encryption result of each sub-data includes: determining a first target position of each first target sub-data in the plurality of sub-data; determining a first target layer matching the first target sub-data in the target hash tree based on the first target position; Matching the modulo result value of the first target sub-data with the number of each sub-node in the first target layer to obtain the first target sub-node in the target layer; The encrypted hash value corresponding to the first target sub-node is determined as the encryption result of the first target sub-data.

3. The method for protecting the security of IoT devices based on big data according to claim 1, characterized in that: The encryption mode includes a second mode, wherein the second mode indicates that the total number of sub-data is greater than or equal to the total number of layers of the target hash tree; the matching relationship between the sub-data and the target hash tree is: the sub-data at the mth position in each subset matches the m+1th layer in the target hash tree; The step of encrypting each sub-data based on the target hash tree, the modulo result value of each sub-data, and the encryption mode to obtain an encryption result of each sub-data includes: Segmenting the plurality of sub-data based on the total number of layers of the target hash tree to obtain a plurality of segment subsets; the number of sub-data in each segment subset is less than the total number of layers of the target hash tree; Determine a second target position of each second target sub-data in the plurality of sub-data in its corresponding subset; determining a second target layer matching the second target sub-data in the target hash tree based on the second target position; Matching the modulo result value of the second target sub-data with the number of each sub-node in the second target layer to obtain the second target sub-node in the second target layer; The encrypted hash value corresponding to the second target sub-node is determined as the encryption result of the second target sub-data.

4. The method for protecting the security of IoT devices based on big data according to claim 3, characterized in that: The matching of the modulo result value of the second target sub-data with the number of each sub-node in the second target layer to obtain the second target sub-node in the second target layer includes: If the modulo result value of the second target sub-data is not within the number range of all child nodes in the second target layer, the modulo result value of the second target sub-data is converted using a preset conversion formula to obtain a conversion result value, and the conversion result value is matched with the number of each child node in the second target layer to obtain the second target child node in the second target layer; If the modulo result value of the second target sub-data is within the number range of all child nodes in the second target layer, the modulo result value of the second target sub-data is directly matched with the number of each child node in the second target layer to obtain the second target sub-node in the second target layer.

5. The method for protecting the security of IoT devices based on big data according to claim 4, characterized in that: The preset conversion formula is: ； in Indicates the conversion result value; Indicates the minimum value of all child node numbers in the target layer; Indicates the maximum value of all child node numbers in the target layer; Represents the modulo operation; Indicates the modulo result value of the target sub-data.

6. A big data-based IoT device security protection system, characterized in that: The method for protecting the security of an Internet of Things device based on big data according to any one of claims 1 to 5 is applied; the security protection system for an Internet of Things device based on big data comprises: Screening unit: used to screen the original data sent by the IoT device and determine the target data to be encrypted in the original data; Matching unit: used for matching the target data in the hash tree library based on the hash calculation value to obtain a target hash tree that matches the hash calculation value; Splitting and conversion unit: used for splitting the target data to obtain multiple sub-data, and performing modulo conversion on each sub-data to obtain the modulo result value of each sub-data; An encryption unit is configured to determine an encryption mode for the sub-data based on the total number of sub-data in the target data, and encrypt each sub-data based on the target hash tree, a modulo result value of each sub-data, and the encryption mode to obtain an encryption result for each sub-data; Combination upload unit: used to combine the encryption results of each sub-data to obtain the encryption result of the target data, and upload the encryption result to the cloud storage; The hash calculation value based on the target data is matched in a hash tree library to obtain a target hash tree that matches the hash calculation value, including: Based on a first preset hash formula and a second preset hash formula, respectively, the target data is calculated to obtain a first hash value and a second hash value; Calculate similarity between the first hash value and the second hash value and the index of each hash tree in the hash tree library, respectively, to obtain a first index sequence and a second index sequence sorted from high to low similarity; the index of the hash tree is the hash value corresponding to the root node; Determining a target index based on the first index sequence and the second index sequence; Determining a target hash tree that matches the target index; The determining a target index based on the first index sequence and the second index sequence includes: Comparing the first index sequence with the second index sequence to obtain a third index sequence common to the first index sequence and the second index sequence; Adding a similarity value of each index in the third index sequence with the first Hash value and a similarity value with the second Hash value to obtain a total similarity value of each index in the third index sequence; The index corresponding to the maximum total similarity value in the third index sequence is determined as the target index.

7. An electronic device, characterized in that: It includes a memory and a processor, the memory stores a computer program that can be run on the processor, and when the processor executes the program, it implements the steps of a big data-based Internet of Things device security protection method as described in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium, characterized in that A computer program is stored thereon, which, when executed by a processor, implements the steps of a big data-based IoT device security protection method as described in any one of claims 1 to 5.

Images