A method and system for protecting IoT edge gateway clients based on deployment environment information

Abstract

This invention relates to a method and system for protecting IoT edge gateway clients based on deployment environment information. Specifically, it includes: extracting first deployment environment information registered by the edge gateway at a designated location on the cloud via an IoT platform; constructing a first master key on the cloud based on this environment information and an encrypted initial key; encrypting core parameter information of the edge gateway device using the first master key to generate an encrypted configuration file; assembling this encrypted configuration file with an executable file to form a deployment package; receiving this package, the IoT edge gateway client restores the initial key in memory using a preset algorithm and generates a second master key by combining it with second deployment environment information; the initial key is stored in the client using a multi-iterative encryption and segmentation obfuscation strategy; if the first and second deployment environment information are consistent, the second master key is used to decrypt the configuration file and run the application. Therefore, this method prevents the IoT edge gateway client from being abused in unauthorized environments, thereby reducing the risk of attacks and improving security.

Description

Technical Field

[0001] This invention relates to the fields of edge computing, client security, Internet of Things (IoT), and cloud-edge collaboration, and specifically proposes a method and system for protecting IoT edge gateway clients based on deployment environment information. Background Technology

[0002] The Internet of Things (IoT) is an extension and application of communication networks and the Internet. Through information sensing devices such as radio frequency identification (RFID), sensors, cameras, locators, and laser scanners, any object can be connected to the Internet to achieve perception, identification, control, networking, and intelligent processing of objects. It enables interaction and seamless connection between people, objects, and information, and achieves the goal of real-time perception, precise management, and scientific decision-making of the physical world.

[0003] The IoT financial service platform adopts a cloud-edge collaborative architecture. Since some devices lack the ability to directly connect to the IoT platform, an IoT platform edge gateway needs to be built to host and proxy the interaction between these devices and the IoT platform. The edge gateway not only alleviates the computing pressure on the cloud but also plays a role in ensuring consistency, traffic isolation, and security isolation, thus guaranteeing the performance, stability, and security of the IoT platform's cloud system.

[0004] As a communication hub between devices and IoT platforms, edge gateways need to be deployed as clients in external environments to collect device information in real-world production scenarios. Their security is closely related to the cloud security of the IoT platform, making the security of the edge gateway client crucial. In existing solutions, because edge gateways are deployed in external environments, the exposure of plaintext configuration files poses a significant security risk, endangering the security of the cloud system. Therefore, encryption of configuration files is necessary. Common software-level key storage strategies typically employ encrypted storage, derived storage, segmented storage, and code obfuscation. However, these strategies only increase the difficulty of reverse engineering by attackers and do not fundamentally solve the key security problem.

[0005] Therefore, a more secure solution is urgently needed. Thus, a method and system for protecting IoT edge gateway clients based on deployment environment information is proposed. The aim is to prevent attackers from deciphering all the information needed to generate the key, thereby protecting the security of the edge gateway program key and the cloud security of the IoT platform. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention proposes a method and system for protecting IoT edge gateway clients based on deployment environment information.

[0007] To achieve the above objectives, the technical solution adopted by the present invention includes:

[0008] A method for protecting IoT edge gateway clients based on deployment environment information, characterized by comprising the following steps:

[0009] S1. The IoT platform cloud extracts the first deployment environment information, which is the deployment environment information registered by the edge gateway at a designated location on the IoT platform cloud;

[0010] S2. The IoT platform cloud constructs a first master key based on the first deployment environment information and the initial key, and the initial key is stored in the IoT platform cloud in an encrypted manner;

[0011] S3. Encrypt the core parameter information of the edge gateway device using the first master key, generate the encrypted configuration file required for operation, and automatically assemble it with the executable file into an edge gateway deployment package, which is then distributed to the external environment;

[0012] S4. After receiving the edge gateway deployment package, the IoT edge gateway client restores the initial key in memory using a preset algorithm and generates a second master key by combining it with the second deployment environment information of its operation. The initial key is stored in the IoT edge gateway client using a multi-iteration encryption and segmentation obfuscation strategy.

[0013] S5. If the first deployment environment information is consistent with the second deployment environment information, the IoT edge gateway client decrypts the encrypted configuration file and runs it using the second master key.

[0014] Furthermore, step S5 also includes:

[0015] If the first deployment environment information is inconsistent with the second deployment environment information, the IoT edge gateway client will be unable to decrypt the encrypted configuration file using the second master key, and the IoT edge gateway client will stop running.

[0016] Furthermore, the storage of the initial key in the IoT edge gateway client in step S2 using a multi-iteration encryption and segmentation obfuscation strategy further includes:

[0017] The multiple iterations of encryption employ an asymmetric encryption algorithm to encrypt the initial key sequentially.

[0018] The segmentation and obfuscation strategy includes dividing the initial key into multiple parts and randomly distributing them across multiple storage nodes.

[0019] Furthermore, the core parameter information in step S3 specifically includes the unique identifier of the edge gateway device, configuration parameters, and communication protocol information.

[0020] Furthermore, step S5 also includes:

[0021] If the second deployment environment information is inconsistent with the first deployment environment information, a warning message is sent and detailed information about the inconsistency is recorded.

[0022] Furthermore, the preset algorithm in step S4 is a derived algorithm.

[0023] Furthermore, the present invention also relates to an IoT edge gateway client protection system based on deployment environment information, characterized in that it includes:

[0024] The cloud deployment environment information extraction unit module is used to extract the first deployment environment information, which is the deployment environment information registered by the edge gateway at a specified location on the cloud of the Internet of Things platform;

[0025] The master key construction module is used to construct a first master key based on the first deployment environment information and the initial key, wherein the initial key is stored in the cloud of the IoT platform in an encrypted manner.

[0026] The configuration file encryption module is used to encrypt the core parameter information of the edge gateway device using the first master key, generate the encrypted configuration file required for operation, and automatically assemble it with the executable file into an edge gateway deployment package, which is then distributed to the external environment.

[0027] An initial key restoration module is set in the IoT edge gateway client. It is used to restore the initial key in memory using a preset algorithm and generate a second master key by combining the second deployment environment information of its operation. The initial key is stored in the IoT edge gateway client using a multi-iteration encryption and segmentation obfuscation strategy.

[0028] The configuration file decryption module, located in the IoT edge gateway client, is used to decrypt and run the encrypted configuration file using the second master key if the first deployment environment information is consistent with the second deployment environment information.

[0029] Furthermore, the configuration file decryption module is also used for:

[0030] If the first deployment environment information is inconsistent with the second deployment environment information, the IoT edge gateway client will be unable to decrypt the encrypted configuration file using the second master key, and the IoT edge gateway client will stop running.

[0031] Furthermore, the present invention also relates to an electronic device, characterized in that it includes a processor and a memory;

[0032] The memory is used to store operation instructions;

[0033] The processor is configured to execute the above-described method by invoking the operation instructions.

[0034] Furthermore, the present invention also relates to a computer-readable storage medium, characterized in that the storage medium stores a computer program, which, when executed by a processor, implements the above-described method.

[0035] The solution provided in this application includes: extracting first deployment environment information registered by the edge gateway at a designated location in the cloud via an IoT platform; constructing a first master key in the cloud based on this environment information and an encrypted initial key; then, encrypting the core parameter information of the edge gateway device using the first master key, generating an encrypted configuration file, and assembling it with an executable file into a deployment package for distribution to the external environment; after receiving the deployment package, the IoT edge gateway client restores the initial key in memory using a preset algorithm and generates a second master key by combining it with second deployment environment information; the initial key is stored in the client using a multi-iterative encryption and segmentation obfuscation strategy; if the first and second deployment environment information are consistent, the client will use the second master key to decrypt the configuration file and run it. This method effectively prevents the abuse of the IoT edge gateway client in unauthorized environments by dynamically managing environment information and keys, thereby reducing the risk of attacks and avoiding the need to reverse engineer the code logic and variables in the executable file. Therefore, this solution not only improves the security of the IoT edge gateway client but also enhances the security of IoT devices in different deployment environments. Attached Figure Description

[0036] Figure 1 This is a schematic diagram illustrating the cloud-edge collaboration and edge gateway workflow of an existing IoT financial service platform.

[0037] Figure 2 This is a schematic diagram of a plaintext configuration file for an edge gateway in existing technology.

[0038] Figure 3 A schematic diagram illustrating edge gateway configuration file encryption provided in this application embodiment;

[0039] Figure 4 A flowchart illustrating an IoT edge gateway client protection method based on deployment environment information, provided in an embodiment of this application;

[0040] Figure 5 A schematic diagram of the structure of an IoT edge gateway client protection system based on deployment environment information provided in this application embodiment;

[0041] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0042] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting the invention.

[0043] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. The terms “first,” “second,” etc., are merely for clarification of the subject matter and do not limit the subject matter itself. Of course, the subjects defined by “first” and “second” may be the same terminal, device, and user, or the same type of terminal, device, and user. It should be further understood that the term “comprising” as used in this application means the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof. The term “and / or” as used herein includes all or any unit and all combinations of one or more associated listed items.

[0044] The technical solutions of this application and how the technical solutions of this application solve the above-mentioned technical problems are described in detail below with specific embodiments. The following embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0045] To more clearly illustrate the technical solutions of this application, the following describes some concepts, terms, or devices that may be involved in the embodiments below, in order to help understand the implementation scheme disclosed in this application:

[0046] The Internet of Things (IoT) is an extension and application of communication networks and the Internet. Through information sensing devices such as radio frequency identification (RFID), sensors, cameras, locators, and laser scanners, any object can be connected to the Internet to achieve perception, identification, control, networking, and intelligent processing of objects. It enables interaction and seamless connection between people, objects, and information, and achieves the goal of real-time perception, precise management, and scientific decision-making of the physical world.

[0047] The main functions of an IoT platform edge gateway can be divided into three modules: First, the communication service module between the IoT platform and the cloud gateway, including login authentication, connection maintenance, topic subscription, and traffic control; second, the adaptation of IoT devices, which can be divided into three different device adaptation methods: SDK adaptation, communication protocol adaptation, and third-party platform adaptation. Each type of IoT device has its own adapter, belonging to one of the above three methods; third, the link module inside the edge gateway, which connects the cloud communication module and the device adaptation module to realize a complete functional process such as function calls and information reporting for IoT devices.

[0048] Its complete workflow is as follows Figure 1 As shown, the enabling layer sends execution commands to the edge gateway via the IoT platform cloud using MQTT communication. These commands then pass through the encoding layer and bus, are distributed to the corresponding device adapters for execution, and the execution results are returned to the IoT cloud and enabling layer via bus -> decoding layer (message conversion layer) -> MQTT communication layer. IoT devices can also proactively report messages to the IoT cloud and enabling layer via the bus -> decoding layer -> MQTT communication layer link.

[0049] As a communication hub between devices and IoT platforms, edge gateways need to be deployed in the external environment as clients to collect device information in actual production scenarios. Their security is closely related to the cloud security of the IoT platform, so the security of edge gateway clients is of paramount importance.

[0050] Since the edge gateway is deployed in an external environment, such as Figure 2 Exposing the configuration file in plaintext poses a significant security risk and compromises the security of the cloud system. Therefore, encryption of the configuration file is necessary, making the secure storage of the encryption key a critical step. Common software-level key storage security strategies include the following:

[0051] 1. Encrypted storage: This generally involves encrypting the key and storing the resulting ciphertext in project constants or configuration files. Encrypted storage is the most widely used key storage strategy.

[0052] 2. Derived storage refers to storing an initial key in the project. During program runtime, an algorithm is used to calculate the actual encryption / decryption key using this initial key. This significantly improves key concealment compared to direct encrypted storage methods, reducing the risk of exposing the true key.

[0053] 3. Segmented storage: The key is divided into multiple parts and stored in different locations. The complete key can only be recovered when all fragments are combined. The security of this method depends on the security of the key fragments and the distributed storage.

[0054] 4. Code obfuscation: By complicating the code and adding interfering logic, the core code becomes more concealed, increasing the difficulty for attackers to reverse engineer it.

[0055] In summary, as Figure 4 As shown, this application embodiment provides an IoT edge gateway client protection method based on deployment environment information, which specifically includes:

[0056] S1. The IoT platform cloud extracts the first deployment environment information, which is the deployment environment information registered by the edge gateway at a designated location on the IoT platform cloud. Specifically, the deployment environment information may be MAC address, IP address, port number, etc.

[0057] S2. The IoT platform cloud constructs a first master key based on the first deployment environment information and the initial key, and the initial key is stored in the IoT platform cloud in an encrypted manner;

[0058] S3. Encrypt the core parameter information of the edge gateway device using the first master key, such as... Figure 3 As shown, the required encrypted configuration file is generated and automatically assembled with the executable file into an edge gateway deployment package, which is then distributed to the external environment.

[0059] Specifically, core parameter information may include the edge gateway device's unique identifier (such as device serial number, device ID, International Mobile Equipment Identity Code, etc.), configuration parameters (such as IP address, subnet mask, default gateway, DNS server, and other network configuration parameters), and communication protocol information (such as MQTT, CoAP, HTTP, HTTPS protocols). The configuration file not only includes core parameter information but also firmware information (such as the current firmware version and the URL of the firmware update server) and operation parameters (such as the device's startup parameters and operating mode settings).

[0060] S4. After receiving the edge gateway deployment package, the IoT edge gateway client restores the initial key in memory using a preset algorithm, and generates a second master key by combining it with the second deployment environment information of its operation. The initial key is stored in the IoT edge gateway client using a multi-iteration encryption and segmentation obfuscation strategy.

[0061] S5. If the first deployment environment information is consistent with the second deployment environment information, the IoT edge gateway client decrypts the encrypted configuration file and runs it using the second master key.

[0062] Furthermore, step S5 also includes:

[0063] If the first deployment environment information is inconsistent with the second deployment environment information, the IoT edge gateway client will be unable to decrypt the encrypted configuration file using the second master key, and the IoT edge gateway client will stop running.

[0064] Furthermore, the storage of the initial key in the IoT edge gateway client in step S2 using a multi-iteration encryption and segmentation obfuscation strategy further includes:

[0065] The multiple iterations of encryption employ an asymmetric encryption algorithm to encrypt the initial key sequentially.

[0066] The segmentation and obfuscation strategy includes dividing the initial key into multiple parts and randomly distributing them across multiple storage nodes.

[0067] Furthermore, step S5 also includes:

[0068] If the second deployment environment information is inconsistent with the first deployment environment information, a warning message is sent and detailed information about the inconsistency is recorded.

[0069] Furthermore, the preset algorithm in step S4 is a derived algorithm.

[0070] The solution provided in this application involves the IoT platform extracting the first deployment environment information registered by the edge gateway at a designated location in the cloud. Based on this environment information and the encrypted initial key, a first master key is constructed in the cloud. Then, the core parameter information of the edge gateway device is encrypted using the first master key to generate an encrypted configuration file, which is then assembled with an executable file into a deployment package and sent to the external environment. After receiving the deployment package, the IoT edge gateway client restores the initial key in memory using a preset algorithm and generates a second master key by combining it with the second deployment environment information. The initial key is stored in the client using a multi-iterative encryption and segmentation obfuscation strategy. If the first and second deployment environment information are consistent, the client will use the second master key to decrypt the configuration file and run it. This method effectively prevents the abuse of the IoT edge gateway client in unauthorized environments by dynamically managing environment information and keys, thereby reducing the risk of attacks and avoiding the need to reverse engineer the code logic and variables in the executable file. Therefore, this solution not only improves the security of the IoT edge gateway client but also enhances the security of IoT devices in different deployment environments.

[0071] Furthermore, another aspect involves an IoT edge gateway client protection system based on deployment environment information, the structure of which is as follows: Figure 5 As shown, it includes:

[0072] The cloud deployment environment information extraction unit module 501 is used to extract the first deployment environment information, which is the deployment environment information registered by the edge gateway at a specified location on the cloud of the Internet of Things platform. Specifically, the deployment environment information may be information such as MAC address, IP address, and port number.

[0073] The master key construction module 502 is used to construct a first master key based on the first deployment environment information and the initial key, wherein the initial key is stored in the cloud of the IoT platform in an encrypted manner.

[0074] Specifically, the multiple iterations of encryption employ an asymmetric encryption algorithm to encrypt the initial key sequentially; the segmentation and obfuscation strategy includes dividing the initial key into multiple parts and randomly distributing them across multiple storage nodes.

[0075] The configuration file encryption module 503 is used to encrypt the core parameter information of the edge gateway device using the first master key, generate the encrypted configuration file required for operation, and automatically assemble it with the executable file into an edge gateway deployment package, which is then distributed to the external environment.

[0076] Specifically, core parameter information may include the edge gateway device's unique identifier (such as device serial number, device ID, International Mobile Equipment Identity Code, etc.), configuration parameters (such as IP address, subnet mask, default gateway, DNS server, and other network configuration parameters), and communication protocol information (such as MQTT, CoAP, HTTP, HTTPS protocols). The configuration file not only includes core parameter information but also firmware information (such as the current firmware version and the URL of the firmware update server) and operation parameters (such as the device's startup parameters and operating mode settings).

[0077] The initial key restoration module 504 is set in the IoT edge gateway client and is used to restore the initial key in memory through a preset algorithm and generate a second master key in combination with the second deployment environment information of its operation. The initial key is stored in the IoT edge gateway client with a multi-iteration encryption and segmentation obfuscation strategy. The preset algorithm is a derived algorithm.

[0078] The configuration file decryption module 505 is located in the IoT edge gateway client and is used to decrypt and run the encrypted configuration file using the second master key if the first deployment environment information is consistent with the second deployment environment information.

[0079] Furthermore, the configuration file decryption module 505 is also used for:

[0080] If the first deployment environment information is inconsistent with the second deployment environment information, a warning message is sent and detailed information about the inconsistency is recorded. The IoT edge gateway client will be unable to decrypt the encrypted configuration file using the second master key, and the IoT edge gateway client will stop running.

[0081] By using this system, the above methods can be executed and the corresponding technical effects can be achieved.

[0082] Embodiments of the present invention also provide an electronic device for performing the above-described method, which, as an implementation apparatus for the method, includes a processor and a memory;

[0083] Memory, used to store operation instructions;

[0084] The processor is used to execute the IoT edge gateway client protection method based on deployment environment information provided in any embodiment of this application by invoking operation instructions.

[0085] As an example, Figure 6 This diagram illustrates the structure of an electronic device to which this application applies. The electronic device 600 includes a processor 601 and a memory 603. The processor 601 and the memory 603 are connected, for example, via a bus 602. Optionally, the electronic device 600 may also include a transceiver 604. It should be noted that in practical applications, the transceiver 604 is not limited to one. It is understood that the structure illustrated in this embodiment does not constitute a specific limitation on the specific structure of the electronic device 600. In other embodiments of this application, the electronic device 600 may include more or fewer components than illustrated, or combine some components, or split some components, or arrange different components. The illustrated components may be implemented as hardware, software, or a combination of software and hardware. Optionally, the electronic device may also include a display screen 605 for displaying images or receiving user operation commands when needed.

[0086] In this embodiment, processor 601 is used to implement the method shown in the above method embodiment. Transceiver 604 may include a receiver and a transmitter. Transceiver 604 is used in this embodiment to enable the electronic device of this embodiment to communicate with other devices during execution.

[0087] Processor 601 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 601 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0088] Processor 601 may also include one or more processing units, such as: application processor (AP), modem processor, graphics processing unit (GPU), image signal processor (ISP), controller, memory, video codec, digital signal processor (DSP), baseband processor, and / or neural network processing unit (NPU). Different processing units can be independent devices or integrated into one or more processors. The controller can be the nerve center and command center of electronic device 600. The controller can generate operation control signals based on instruction opcodes and timing signals to control instruction fetching and execution. Processor 601 may also include memory for storing instructions and data. In some embodiments, the memory in processor 601 is a cache memory. This memory can store instructions or data that processor 601 has recently used or is recurring.

[0089] The processor 601 can run the IoT edge gateway client protection method based on deployment environment information provided in the embodiments of this application. The processor 601 may include different devices, such as when integrating a CPU and a GPU, the CPU and GPU can cooperate to execute the IoT edge gateway client protection method based on deployment environment information provided in the embodiments of this application. Some algorithms are executed by the CPU and other algorithms are executed by the GPU to obtain faster processing efficiency.

[0090] Bus 602 may include a pathway for transmitting information between the aforementioned components. Bus 602 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Bus 602 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 6 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0091] The memory 603 may be ROM (Read Only Memory) or other types of static storage devices capable of storing static information and instructions, RAM (Random Access Memory) or other types of dynamic storage devices capable of storing information and instructions, or EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory), or high-speed random access memory. It may also include non-volatile memory, such as at least one disk storage device, flash memory device, universal flash storage (UFS), or other optical disc storage, optical disk storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto.

[0092] Optionally, the memory 603 is used to store application code that executes the scheme of this application, and the execution is controlled by the processor 601. The processor 601 is used to execute the application code stored in the memory 603 to implement the IoT edge gateway client protection method based on deployment environment information provided in any embodiment of this application.

[0093] The memory 603 can be used to store computer executable program code, which includes instructions. The processor 601 executes various functional applications and data processing of the electronic device 600 by running the instructions stored in the memory 603. The memory 603 may include a program storage area and a data storage area. The program storage area can store the operating system, application code, etc. The data storage area can store data created during the use of the electronic device 600 (such as images and videos captured by a camera application).

[0094] The memory 603 may also store one or more computer programs corresponding to the IoT edge gateway client protection method based on deployment environment information provided in the embodiments of this application. These one or more computer programs are stored in the memory 603 and configured to be executed by the one or more processors 601. The one or more computer programs include instructions that can be used to perform the various steps in the corresponding embodiments described above.

[0095] Of course, the code for the IoT edge gateway client protection method based on deployment environment information provided in this application embodiment can also be stored in external storage.

[0096] The display screen 605 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), a minimized display, a microLED, a quantum dot light-emitting diode (QLED), etc. In some embodiments, the electronic device 600 may include one or N displays 605, where N is a positive integer greater than 1. The display screen 605 can be used to display information input by the user or information provided to the user, as well as various graphical user interfaces (GUIs). For example, the display screen 605 can display photos, videos, web pages, or documents.

[0097] The electronic device provided in this application is applicable to any of the above-described methods. Therefore, the beneficial effects it can achieve can be referred to the beneficial effects in the corresponding methods provided above, and will not be repeated here.

[0098] Embodiments of the present invention also provide a computer-readable storage medium capable of implementing all the steps of the methods in the above embodiments, wherein the computer-readable storage medium stores a computer program that, when executed by a processor, implements all the steps of the methods in the above embodiments.

[0099] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0100] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A system that specifies functions in one or more boxes.

[0101] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including an instruction set implemented in a process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0102] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1The steps of the functions specified in one or more boxes. Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the invention.

[0103] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for protecting IoT edge gateway clients based on deployment environment information, characterized in that, Includes the following steps: S1. The IoT platform cloud extracts the first deployment environment information, which is the deployment environment information registered by the edge gateway at a designated location on the IoT platform cloud; S2. The IoT platform cloud constructs a first master key based on the first deployment environment information and the initial key, and the initial key is stored in the IoT platform cloud in an encrypted manner; S3. Encrypt the core parameter information of the edge gateway device using the first master key, generate the encrypted configuration file required for operation, and automatically assemble it with the executable file into an edge gateway deployment package, which is then distributed to the external environment; S4. After receiving the edge gateway deployment package, the IoT edge gateway client restores the initial key in memory using a preset algorithm, and generates a second master key by combining it with the second deployment environment information of its operation. The initial key is stored in the IoT edge gateway client using a multi-iteration encryption and segmentation obfuscation strategy. S5. If the first deployment environment information is consistent with the second deployment environment information, the IoT edge gateway client decrypts the encrypted configuration file and runs it using the second master key; Specifically, the core parameter information in step S3 includes the unique identifier of the edge gateway device, configuration parameters, and communication protocol information.

2. The method according to claim 1, characterized in that, Step S5 further includes: If the first deployment environment information is inconsistent with the second deployment environment information, the IoT edge gateway client will be unable to decrypt the encrypted configuration file using the second master key, and the IoT edge gateway client will stop running.

3. The method according to claim 1, characterized in that, The initial key in step S2, which is stored in the IoT edge gateway client using a multi-iteration encryption and segmentation obfuscation strategy, further includes: The multiple iterations of encryption employ an asymmetric encryption algorithm to encrypt the initial key sequentially. The segmentation and obfuscation strategy includes dividing the initial key into multiple parts and randomly distributing them across multiple storage nodes.

4. The method according to claim 2, characterized in that, Step S5 further includes: If the second deployment environment information is inconsistent with the first deployment environment information, a warning message is sent and detailed information about the inconsistency is recorded.

5. The method according to claim 1, characterized in that, The preset algorithm in step S4 is a derived algorithm.

6. An IoT edge gateway client protection system based on deployment environment information, characterized in that, include: The cloud deployment environment information extraction unit module is used to extract the first deployment environment information, which is the deployment environment information registered by the edge gateway at a specified location on the cloud of the Internet of Things platform; The master key construction module is used to construct a first master key based on the first deployment environment information and the initial key, wherein the initial key is stored in the cloud of the IoT platform in an encrypted manner. The configuration file encryption module is used to encrypt the core parameter information of the edge gateway device using the first master key, generate the encrypted configuration file required for operation, and automatically assemble it with the executable file into an edge gateway deployment package, which is then distributed to the external environment. An initial key restoration module is set in the IoT edge gateway client. It is used to restore the initial key in memory using a preset algorithm and generate a second master key by combining the second deployment environment information of its operation. The initial key is stored in the IoT edge gateway client using a multi-iteration encryption and segmentation obfuscation strategy. The configuration file decryption module is located in the IoT edge gateway client and is used to decrypt and run the encrypted configuration file using the second master key if the first deployment environment information is consistent with the second deployment environment information. Specifically, the core parameter information in step S3 includes the unique identifier of the edge gateway device, configuration parameters, and communication protocol information.

7. The system according to claim 6, characterized in that, The configuration file decryption module is also used for: If the first deployment environment information is inconsistent with the second deployment environment information, the IoT edge gateway client will be unable to decrypt the encrypted configuration file using the second master key, and the IoT edge gateway client will stop running.

8. An electronic device, characterized in that, Including processor and memory; The memory is used to store operation instructions; The processor is configured to execute the method of any one of claims 1-5 by invoking the operation instructions.

9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the method of any one of claims 1-5.

Images