A communication data backup method and system based on Internet of Things security service

Abstract

The present invention discloses a communication data backup method and system based on Internet of Things security service, which relates to the technical field of communication data backup. The backup period is set for each type of communication data according to the importance evaluation of the communication data; the backup request of each type of communication data is triggered according to the backup period of each type of communication data, and the communication data triggering the backup request is preliminarily screened; the preliminarily screened communication data is processed in blocks, and then the backup is performed in sequence according to the backup requirement information of each data block; when the backup of the last data block is triggered, the backup data is integrity checked and risk predicted; the communication data is fully backed up according to the integrity check result; the risk of attack and the possibility of loss of the backup data are evaluated according to the risk prediction result, and then the backup strategy is adjusted. Efficient and accurate backup operation is achieved, and data security is enhanced through integrity check and risk prediction.

Description

Technical Field

[0001] The present invention relates to the technical field of communication data backup, and in particular to a communication data backup method and system based on Internet of Things security services. Background Art

[0002] With the rapid development of Internet of Things (IoT) technology, various smart devices, sensors and communication equipment have been widely used in smart homes, industrial automation, smart cities, medical health and other fields. These devices generate massive communication data in daily operations, including sensor data, control signals, environmental data, etc. These data are not only of great volume, but also involve the characteristics of real-time, dynamic and diversity. Some data need to be backed up and restored quickly in real time, especially in industrial control and medical applications, where data loss or delay may have serious consequences.

[0003] However, traditional data backup methods usually do not fully consider the differences in the importance of communication data, and are prone to adopting a unified backup cycle and strategy, resulting in insufficient backup of high-priority critical data, while low-priority data is frequently backed up, thereby wasting storage resources and bandwidth. In addition, in traditional backup systems, duplicate backups may occur, especially in IoT application scenarios with huge amounts of data. Repeated backup of the same data not only wastes storage space, but also increases time consumption and network load during the backup process. Traditional backup methods lack effective integrity verification and risk prediction after data backup, resulting in security risks or errors in backup data. At the same time, since the backup strategy is fixed, once set, it is difficult to adjust it according to actual conditions. In the IoT environment, communication data changes frequently, the threat situation is constantly changing, and there is a lack of dynamic adjustment of backup strategies.

[0004] Therefore, in response to the above problems, there is an urgent need for a communication data backup method and system based on IoT security services. Summary of the invention

[0005] In view of the deficiencies in the prior art, the present invention provides a communication data backup method and system based on Internet of Things security services, which solves the problems of low data backup efficiency and redundancy.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: a communication data backup method based on the Internet of Things security service, comprising the following steps: collecting communication data based on Internet of Things devices; evaluating the importance of communication data, and then classifying the communication data based on the importance evaluation of the communication data, and setting backup periods for each type of communication data; triggering backup requests for each type of communication data based on the backup period of each type of communication data, preliminarily screening the communication data that triggers the backup request, identifying the overlapping area between the communication data that triggers the backup request and the historical backup data, and then screening out the overlapping area; processing the preliminarily screened communication data in blocks, and then sorting each data block according to the backup requirement information of each data block, and backing up them in sequence according to the sorting results; when the backup of the last data block is triggered, performing integrity verification and risk prediction on the backup data; verifying the backup integrity of the communication data based on the integrity verification result, and fully backing up the communication data based on the integrity verification result; evaluating the risk of attack and the possibility of loss of the backup data based on the risk prediction result, and then adjusting the backup strategy.

[0007] Furthermore, the importance of the communication data is evaluated, and then the communication data is classified according to the importance evaluation of the communication data, and the specific analysis of setting backup periods for each type of communication data is as follows: the communication data includes communication content, communication metadata and communication protocol; the importance evaluation parameters of the communication data are obtained, and the importance evaluation parameters of the communication data include data sensitivity and data access frequency; the data sensitivity mean and data access frequency mean of the communication data are obtained, and then the data sensitivity and data access frequency of the communication data are compared with the data sensitivity mean and the data access frequency mean respectively; the communication data with a data sensitivity higher than the data sensitivity mean and a data access frequency higher than the data access frequency mean is classified as communication level 1 data, indicating that the communication data is of high importance. Data; Communication data with data sensitivity higher than the data sensitivity mean and data access frequency lower than or equal to the data access frequency mean is classified as communication level 2 data, indicating that such communication data is medium importance data; Communication data with data sensitivity lower than or equal to the data sensitivity mean and data access frequency higher than the data access frequency mean is classified as communication level 2 data, indicating that such communication data is medium importance data; Communication data with data sensitivity lower than the data sensitivity mean and data access frequency lower than the data access frequency mean is classified as communication level 3 data, indicating that such communication data is low importance data; Based on the importance of communication level 1 data, communication level 2 data and communication level 3 data, the backup periods of communication level 1 data, communication level 2 data and communication level 3 data are set respectively.

[0008] Furthermore, the communication data that triggers the backup request is initially screened to identify the overlapping area between the communication data that triggers the backup request and the historical backup data, and then the specific analysis of screening out the overlapping area is as follows: preprocessing the communication data that triggers the backup request, the preprocessing includes missing value and outlier processing, and duplicate data processing; retrieving the historical backup communication data in the backup system, and then comparing the identifiers of the preprocessed communication data with the historical backup communication data to identify whether the preprocessed communication data has the same identifier data in the historical backup communication data, and then marking the same identifier data as the overlapping area; packaging and formatting the remaining communication data after screening out the overlapping area, generating a backup request, and determining the specific path of the overlapping area in the historical backup communication data based on the storage records of the historical backup communication data, and then adding the backup path of the overlapping area in the historical backup communication data to the backup request.

[0009] Furthermore, the communication data after the initial screening is divided into blocks, and then the data blocks are sorted according to the backup requirement information of each data block, and the specific analysis is as follows: the communication data after the initial screening is divided into blocks according to the timestamp, and the backup requirement information of each data block is obtained respectively; the backup requirement information includes the data modification frequency and the data capacity size; the data modification frequency and the data capacity size of each data block are formatted and then the priority score of each data block is obtained according to the data modification frequency and the data capacity size of each data block; each data block is sorted according to the priority score of the data block, and then the backup is triggered in sequence according to the priority score size.

[0010] Furthermore, the backup integrity of the communication data is verified according to the integrity check result, and the specific analysis of performing a full backup of the communication data according to the integrity check result is as follows: setting a first hash function, a second hash function, and a third hash function; performing hash calculations on the communication data according to the first hash function, the second hash function, and the third hash function, respectively, to obtain a first hash value, a second hash value, and a third hash value of the communication data, and then concatenating the first hash value, the second hash value, and the third hash value of the communication data to obtain a unique hash identifier for the communication data; using the first hash function, the second hash function, and the third hash function to calculate the data after the communication data is backed up, respectively, to obtain a first hash value, a second hash value, and a third hash value of the backup data, and then concatenating the first hash value, the second hash value, and the third hash value of the backup data Splicing to obtain the unique hash identifier of the backup data; compare the unique hash identifier of the communication data with the unique hash identifier of the backup data to identify whether the unique hash identifiers of the communication data and the backup data are the same. If the unique hash identifiers of the communication data and the backup data are the same, the communication data backup is complete. If the unique hash identifiers of the communication data and the backup data are different, a secondary backup request is triggered to perform a secondary backup of the communication data; obtain the unique hash identifier of the secondary backup data to identify whether the unique hash identifiers of the communication data and the secondary backup data are the same. If the unique hash identifiers of the communication data and the secondary backup data are different, a backup abnormality warning is triggered, and the backup abnormality warning is used to prompt the IoT security operation and maintenance personnel to check the backup abnormality until the unique hash identifiers of the communication data and the backup data are the same.

[0011] Furthermore, the risk of backup data being attacked and the possibility of being lost are evaluated based on the risk prediction results, and the specific analysis for adjusting the backup strategy is as follows: identifying whether a backup abnormality alert is triggered, if a backup abnormality alert is triggered, the backup abnormality value is recorded as "1", if the backup abnormality alert is not triggered, the backup abnormality value is recorded as "0"; obtaining risk assessment parameters for the backup data, the risk assessment parameters for the backup data specifically include a vulnerability threat score and a recovery capability score; obtaining a risk prediction value for the backup data based on the backup abnormality value, vulnerability threat score and recovery capability score of the backup data; comparing the risk prediction value of the backup data with the risk threshold, and when the risk prediction value of the backup data exceeds the risk threshold, marking the backup data as high-risk data, prompting the IoT security operation and maintenance personnel to adjust the backup strategy, and the specific adjustments include backup cycle adjustment and backup storage location adjustment.

[0012] A communication data backup system based on Internet of Things security service, using the above-mentioned communication data backup method based on Internet of Things security service, comprises: a data collection module, used for collecting communication data based on Internet of Things devices; a data classification module, used for evaluating the importance of communication data, and then classifying the communication data according to the evaluation of the importance of communication data, and setting backup periods for various types of communication data; a backup initial screening module, used for triggering backup requests for various types of communication data according to the backup periods of various types of communication data, initial screening of the communication data triggering the backup request, identifying the overlapping area between the communication data triggering the backup request and the historical backup data, and then screening out the overlapping area; a backup control module, used for processing the communication data after initial screening in blocks, and then sorting the data blocks according to the backup requirement information of each data block, and backing up them in sequence according to the sorting result; a verification and detection module, used for performing integrity verification and risk prediction on the backup data after the backup of the last data block is triggered; a backup integrity assurance module, used for verifying the backup integrity of the communication data according to the integrity verification result, and fully backing up the communication data according to the integrity verification result; a risk adjustment module, used for evaluating the risk of attack and the possibility of loss of the backup data according to the risk prediction result, and then adjusting the backup strategy.

[0013] The present invention has the following beneficial effects:

[0014] The communication data backup method and system based on the Internet of Things security service can set different backup cycles according to the importance of the data by evaluating and classifying the communication data, avoiding frequent backup of unimportant or infrequently changing data, thereby improving backup efficiency and reducing redundancy and resource waste; by identifying and screening out areas that overlap with historical backup data, duplicate backup is avoided, thereby saving storage space and backup resources and further improving efficiency; by processing the communication data in blocks, a large amount of data can be divided into multiple small blocks for backup, effectively reducing the pressure of each backup; in addition, by sorting the data blocks according to the backup demand information, key data can be backed up first according to the importance of the data blocks, ensuring that the most important data can be backed up first; through the final integrity check, it can be ensured that the backup data is transmitted and The data is not damaged or lost during the storage process. When it is found that the data backup is incomplete, a full backup is performed to ensure that the integrity of the data is fully protected. By predicting the risks of backup data and assessing the risk of attack and the possibility of loss of backup data, it can provide early warning of potential security issues and help formulate response measures. It is helpful to adjust the backup strategy in time when potential threats are discovered to enhance data security. According to the risk prediction results, the backup strategy can be flexibly adjusted, such as strengthening the encryption and backup frequency of key data to improve the data's ability to resist attacks. IoT devices usually generate large amounts of real-time and diverse communication data. In view of this feature, classified backup and flexible cycle settings can ensure that important data in massive data is protected in a timely and efficient manner, thereby ensuring the long-term availability of backup and security services. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is a flow chart of a communication data backup method based on Internet of Things security service of the present invention.

[0016] Figure 2 This is a structural diagram of a communication data backup system based on Internet of Things security services in the present invention. DETAILED DESCRIPTION

[0017] The embodiment of the present application realizes efficient and accurate backup operations through a communication data backup method and system based on IoT security services, and enhances data security through integrity verification and risk prediction.

[0018] The overall idea of ​​the embodiment of the present application is: based on the communication data generated by the Internet of Things devices, by evaluating the importance and classifying the data, setting different backup cycles, and performing efficient backup through block processing and screening out duplicate data, and finally performing integrity verification and risk prediction to ensure the security of the data and the reliability of the backup.

[0019] See also Figure 1The embodiment of the present invention provides a technical solution: a communication data backup method based on an Internet of Things security service, comprising the following steps: collecting communication data based on an Internet of Things device; evaluating the importance of the communication data, and then classifying the communication data according to the evaluation of the importance of the communication data, and setting backup periods for each type of communication data; triggering backup requests for each type of communication data according to the backup periods of each type of communication data, preliminarily screening the communication data that triggers the backup request, identifying the overlapping area between the communication data that triggers the backup request and the historical backup data, and then screening out the overlapping area; processing the preliminarily screened communication data in blocks, and then sorting each data block according to the backup requirement information of each data block, and backing up in sequence according to the sorting result; when the backup of the last data block is triggered, performing integrity verification and risk prediction on the backup data; verifying the backup integrity of the communication data according to the integrity verification result, and fully backing up the communication data according to the integrity verification result; evaluating the risk of attack and the possibility of loss of the backup data according to the risk prediction result, and then adjusting the backup strategy.

[0020] Specifically, the importance of communication data is evaluated, and then the communication data is classified according to the importance evaluation of the communication data, and the backup period is set for each type of communication data. The specific analysis is as follows: communication data includes communication content, communication metadata and communication protocol; importance evaluation parameters of communication data are obtained, and the importance evaluation parameters of communication data include data sensitivity and data access frequency; the mean data sensitivity and the mean data access frequency of communication data are obtained, and then the data sensitivity and data access frequency of communication data are compared with the mean data sensitivity and the mean data access frequency respectively; communication data with data sensitivity higher than the mean data sensitivity and data access frequency higher than the mean data access frequency is classified as first-level communication data, indicating that this type of communication data is high-importance data ; Communication data with data sensitivity higher than the data sensitivity mean and data access frequency lower than or equal to the data access frequency mean is classified as communication level 2 data, indicating that such communication data is medium importance data; Communication data with data sensitivity lower than or equal to the data sensitivity mean and data access frequency higher than the data access frequency mean is classified as communication level 2 data, indicating that such communication data is medium importance data; Communication data with data sensitivity lower than the data sensitivity mean and data access frequency lower than the data access frequency mean is classified as communication level 3 data, indicating that such communication data is low importance data; Based on the importance of communication level 1 data, communication level 2 data and communication level 3 data, the backup periods of communication level 1 data, communication level 2 data and communication level 3 data are set respectively.

[0021] In this implementation scheme, data sensitivity refers to the degree of sensitive information contained in the data. High-sensitivity data contains important content such as personal information and commercial secrets, and its loss or leakage will have serious consequences. The specific data sensitivity is represented by a numerical value or level (such as 1-5 levels). The larger the numerical value, the higher the sensitivity. Data access frequency refers to the frequency with which data is accessed or used. Data with a high access frequency is usually data that is frequently retrieved, modified or shared. It is generally measured by the number of accesses, the number of accesses in a time period (such as per hour, per day), and can also be represented by the access frequency level.

[0022] The specific method of obtaining data sensitivity is: analyze the communication content through automated data classification tools, identify sensitive information (such as personal data, sensitive protocols, etc.), and assign sensitivity scores to the data according to its sensitivity level. For data that is difficult to identify through automated tools in specific business scenarios, manual review of the data content is required to assign points. Data sensitivity can also be automatically assigned or evaluated based on industry standards and requirements.

[0023] The specific method of obtaining data access frequency is: by analyzing access logs (such as communication logs, user request logs, etc.), counting the access frequency of each communication data, and using real-time monitoring tools to track the access status of communication data, and dynamically adjust the access frequency according to actual conditions.

[0024] Examples of specific backup cycle settings are as follows: for communications level 1 data (high-importance data), since these data are very important and frequently accessed, the backup cycle should be shorter, perhaps backed up every day or every few hours; for communications level 2 data (medium-importance data), the backup cycle can be appropriately extended, such as backing up every week or month; for communications level 3 data (low-importance data), the backup cycle can be longer, such as backing up every quarter or every six months.

[0025] By classifying the importance of communication data, differentiated backup strategies can be implemented. Communication data of different importance can have different backup cycles. For example, the backup cycle of important data can be shorter to ensure timely recovery, while unimportant data can have a longer backup cycle to reduce the waste of storage resources. This can not only ensure the security of critical data, but also reduce excessive consumption of resources, thereby improving the efficiency of the backup system and helping managers to rationally allocate storage, bandwidth and computing resources.

[0026] Specifically, the communication data that triggers the backup request is initially screened to identify the overlapping area between the communication data that triggers the backup request and the historical backup data, and then the specific analysis of screening out the overlapping area is as follows: preprocessing the communication data that triggers the backup request, the preprocessing includes missing value and outlier processing, and duplicate data processing; retrieving the historical backup communication data in the backup system, and then comparing the identifiers of the preprocessed communication data with the historical backup communication data to identify whether the preprocessed communication data has the same identifier data in the historical backup communication data, and then marking the same identifier data as the overlapping area; packaging and formatting the remaining communication data after screening out the overlapping area, generating a backup request, and determining the specific path of the overlapping area in the historical backup communication data based on the storage records of the historical backup communication data, and then adding the backup path of the overlapping area in the historical backup communication data to the backup request.

[0027] In this implementation scheme, the specific logical steps of identifier comparison are: extract key identifiers (such as data packet ID, timestamp, data hash value, etc.) from the communication data that triggers the backup request and the historical backup data, and perform necessary preprocessing on the communication data that triggers the backup request, including removing missing values ​​and outliers, processing duplicate data, etc., to ensure the quality of the data to be compared; compare the identifiers of the preprocessed communication data with the identifiers in the historical backup data one by one, usually using hash matching, string comparison and other methods; identify whether the same identifier exists, and if data with the same identifier exists, mark it as an overlapping area.

[0028] Data packaging needs to be organized according to a predetermined format, such as splitting into blocks of appropriate size, or encoding according to a specific data structure (such as JSON, XML or binary format), and encapsulating the formatted data packaging result into a backup request. The backup request contains: the identifier, size, type and other information of the newly added data; the corresponding backup path; metadata such as the backup timestamp and version number; and backup path information of the overlapping area.

[0029] By identifying the overlapping areas between the communication data that triggers the backup request and the historical backup data, repeated backup of the same data is avoided, which reduces the waste of storage space and the time and computing resources required for backup. Especially when the amount of data is large, the efficiency of the backup process can be significantly improved; by screening out the overlapping areas, the backed up data is excluded from the current backup to ensure that only the newly added and unbacked up data is backed up, saving storage space to the greatest extent; the backup paths of the overlapping areas are accurately identified and recorded to ensure that the integrity and consistency of the new backup request and the historical backup data are maintained, thereby avoiding data inconsistency problems caused by repeated backup; through the automated overlapping area identification and path adding mechanism, the need for human intervention is reduced, and backup tasks can be managed more intelligently, improving the automation level of the backup system.

[0030] Specifically, the communication data after the initial screening is divided into blocks, and then the data blocks are sorted according to the backup requirement information of each data block, and the data blocks are backed up in sequence according to the sorting results. The specific analysis is as follows: the communication data after the initial screening is divided into blocks according to the timestamp, and the backup requirement information of each data block is obtained respectively; the backup requirement information includes the data modification frequency and the data capacity size; the data modification frequency and the data capacity size of each data block are format-normalized, and then the priority score of each data block is obtained according to the data modification frequency and the data capacity size of each data block. The specific priority score acquisition expression example is: ps=dmr*α1+dcs*α2, where ps represents the priority score, dmr represents the data modification frequency, dcs represents the data capacity size, α1 represents the weight value of the data modification frequency, and α2 represents the weight value of the data capacity size; each data block is sorted according to the priority score of the data block, and then the backup is triggered in sequence according to the priority score size.

[0031] In this implementation scheme, the weight values ​​of data modification frequency and data capacity size are set as follows: if the system believes that data with a high modification frequency is critical to business continuity, a higher weight can be given; for data blocks with larger capacity, certain weights can be set to ensure that their backups are not ignored, and they can also be adjusted according to actual application scenarios to flexibly balance the impact of the two, or the importance of data modification frequency and data capacity size can be analyzed and set based on the importance of professionals in related fields, ultimately ensuring that the sum of the weight values ​​of data modification frequency and data capacity size is 1.

[0032] The timestamp indicates the collection time of the communication data, and is used to process the data in blocks according to time to ensure that the data can be processed and backed up in the correct time sequence. This is done by extracting time information from the data source or generating a timestamp within the system. The data block represents a single data segment of the communication data after initial screening that is segmented by the timestamp. Each data block contains multiple data records, and each data block is generated on demand by segmenting the timestamp of the original communication data.

[0033] The data modification frequency is obtained by analyzing the modification time interval in the data block or through the system log; the data capacity size is obtained according to the size of the data block (such as the number of bytes, the number of records, etc.).

[0034] Sorting backups according to the priority of data blocks helps prioritize the backup of data blocks with higher modification frequency and larger capacity, ensuring that important data will not be lost or damaged due to backup delays, thereby improving the overall performance of the system; dynamically adjusting backup strategies by obtaining data modification frequency and capacity in real time can adapt to different data changes and avoid excessive or insufficient backup; reasonably arranging the order of backups based on backup demand information can avoid resource competition and performance bottlenecks caused by the system backing up a large amount of data at the same time.

[0035] Specifically, the backup integrity of the communication data is verified according to the integrity check result, and the specific analysis of fully backing up the communication data according to the integrity check result is as follows: setting a first hash function, a second hash function, and a third hash function; performing hash calculations on the communication data according to the first hash function, the second hash function, and the third hash function, respectively, to obtain a first hash value, a second hash value, and a third hash value of the communication data, and then concatenating the first hash value, the second hash value, and the third hash value of the communication data to obtain a unique hash identifier for the communication data; using the first hash function, the second hash function, and the third hash function to calculate the data after the communication data is backed up, respectively, to obtain a first hash value, a second hash value, and a third hash value of the backup data, and then concatenating the first hash value, the second hash value, and the third hash value of the backup data Then, obtain the unique hash identifier of the backup data; compare the unique hash identifier of the communication data with the unique hash identifier of the backup data to identify whether the unique hash identifiers of the communication data and the backup data are the same. If the unique hash identifiers of the communication data and the backup data are the same, the communication data backup is complete. If the unique hash identifiers of the communication data and the backup data are different, a secondary backup request is triggered to perform a secondary backup of the communication data; obtain the unique hash identifier of the secondary backup data to identify whether the unique hash identifiers of the communication data and the secondary backup data are the same. If the unique hash identifiers of the communication data and the secondary backup data are different, a backup abnormality warning is triggered, and the backup abnormality warning is used to prompt the IoT security operation and maintenance personnel to check the backup abnormality until the unique hash identifiers of the communication data and the backup data are the same.

[0036] In this embodiment, the expression examples calculated by using the first hash function, the second hash function and the third hash function are as follows: the first hash value of the communication data D: H1(D)=hash1(D), the second hash value of the communication data D: H2(D)=hash2(D), the third hash value of the communication data D: H3(D)=hash3(D), hash (1,2,3)() represents a specific hash function. In order to ensure that conflicts are unlikely to occur between different hash functions, the selection of the first hash function, the second hash function and the third hash function needs to meet the following conditions: an example of the first hash function is MD5 or SHA-256, which is used to quickly generate hash values ​​​​of data; an example of the second hash function is SHA-1 or SHA-512, which increases diversity; an example of the third hash function is HMAC (key-based hashing) to provide additional security.

[0037] An example of a specific expression for obtaining a unique hash identifier is: uhid = H1(D)H2(D)H3(D), where uhid is a unique hash identifier, and ‖ represents the concatenation operation of the hash value.

[0038] Through multiple hash calculations and comparisons, the integrity and consistency of the original communication data and the backup data during transmission and storage can be ensured; using multiple hash functions (first, second, and third hash functions) for calculation increases the redundancy of verification, helps prevent the risk of hash conflicts, and improves the reliability of data verification; once a hash identifier mismatch is found, the system will automatically trigger a secondary backup request and perform an inspection to promptly discover and resolve backup anomalies; through precise hash identifier verification, it can effectively avoid backup failures due to data tampering or transmission errors, reducing the security risks of IoT devices and communication data; the backup anomaly warning function helps IoT security operation and maintenance personnel to promptly discover potential problems and take measures, reducing the need for human intervention.

[0039] Specifically, the risk of backup data being attacked and the possibility of loss are evaluated based on the risk prediction results, and the specific analysis of adjusting the backup strategy is as follows: identify whether the backup abnormality warning is triggered. If the backup abnormality warning is triggered, the backup abnormality value is recorded as "1", and if the backup abnormality warning is not triggered, the backup abnormality value is recorded as "0"; obtain the risk assessment parameters of the backup data, and the risk assessment parameters of the backup data specifically include the vulnerability threat score and the recovery capability score; obtain the risk prediction value of the backup data based on the backup abnormality value, vulnerability threat score and recovery capability score of the backup data. The specific risk prediction value acquisition expression example is: Wherein, RPV represents the risk prediction value, BAV represents the backup abnormal value, VTS represents the vulnerability threat score, and RCS represents the recovery capability score. The risk prediction value of the backup data is compared with the risk threshold. When the risk prediction value of the backup data exceeds the risk threshold, the backup data is marked as high-risk data, prompting the IoT security operation and maintenance personnel to adjust the backup strategy. The specific adjustments include backup cycle adjustment and backup storage location adjustment.

[0040] In this implementation scheme, the vulnerability threat score indicates the severity of the security vulnerability threat currently faced by the backup data or backup system. Specific considerations include: the type of vulnerability that exists (such as system vulnerabilities, software vulnerabilities, etc.), the severity and potential impact of the vulnerability (such as whether it can be exploited by attackers, whether it can cause data leakage or tampering), and whether the vulnerability has been repaired or mitigated (such as whether there are patches, reinforcements, etc.). The vulnerability threat score is obtained based on the degree of harm caused by the vulnerability by detecting known vulnerabilities in the backup system through automated security scanning tools (such as vulnerability scanners).

[0041] The recovery capability score indicates the ability of backup data to recover after an attack or failure. Specific considerations include: the speed and completeness of data recovery, the availability during the recovery process (such as whether the backup is easy to access, whether the recovery process requires manual intervention, etc.), and the redundancy of the backup (such as whether the backup exists in multiple locations, whether there are multiple backup versions). The recovery capability score is evaluated by testing the recovery process of the backup data, or is calculated based on the backup strategy (such as backup frequency, storage method, etc.).

[0042] The specific method of obtaining the risk threshold is: by analyzing the security events of historical backup data, a more conservative threshold is set to ensure that timely measures can be taken when potential risks are discovered. The threshold can also be dynamically adjusted according to changes in the overall security status of the backup system, vulnerability threat score, and recovery capability score.

[0043] Through a risk assessment-based approach, the security of backup data is monitored and evaluated in real time to ensure that potential risks in the backup process can be discovered in a timely manner, which helps to take measures in advance to avoid data loss or attacks; by triggering the backup abnormality warning mechanism, when an abnormality is found in the backup, the expansion of data risks can be identified and prevented in advance. If the risk prediction value exceeds the set threshold, the operation and maintenance personnel are promptly prompted to adjust the backup strategy; based on the comparison results of the risk prediction value and the risk threshold, the backup strategy is adjusted for different risk levels, such as adjusting the backup cycle and backup storage location, thereby improving the security of data backup; not only pay attention to the abnormalities of backup data, but also combine vulnerability threat scores and recovery capability scores for multi-dimensional risk analysis, making backup risk assessment more comprehensive and accurate.

[0044] A communication data backup system based on Internet of Things security service, using the above-mentioned communication data backup method based on Internet of Things security service, comprises: a data collection module, used for collecting communication data based on Internet of Things devices; a data classification module, used for evaluating the importance of communication data, and then classifying the communication data according to the evaluation of the importance of communication data, and setting backup periods for various types of communication data; a backup initial screening module, used for triggering backup requests for various types of communication data according to the backup periods of various types of communication data, initial screening of the communication data triggering the backup request, identifying the overlapping area between the communication data triggering the backup request and the historical backup data, and then screening out the overlapping area; a backup control module, used for processing the communication data after initial screening in blocks, and then sorting the data blocks according to the backup requirement information of each data block, and backing up them in sequence according to the sorting result; a verification and detection module, used for performing integrity verification and risk prediction on the backup data after the backup of the last data block is triggered; a backup integrity assurance module, used for verifying the backup integrity of the communication data according to the integrity verification result, and fully backing up the communication data according to the integrity verification result; a risk adjustment module, used for evaluating the risk of attack and the possibility of loss of the backup data according to the risk prediction result, and then adjusting the backup strategy.

[0045] In summary, this application has at least the following effects:

[0046] By evaluating and classifying the importance of communication data and setting different backup cycles for each type of data, backup resources can be allocated more reasonably to avoid wasting resources or insufficient backup of key data due to treating all data equally; identifying and screening out overlapping areas in the initial screening step avoids duplicate backups and further improves backup efficiency; the block processing and sorting backup strategy can optimize the backup order based on the backup requirement information of the data blocks to ensure that high-priority or important data is given priority; the integrity verification step ensures the accuracy of the backup data and avoids backup failures caused by data corruption or transmission errors; risk prediction can assess the risk of backup data being attacked and the possibility of loss, so as to adjust the backup strategy in time, such as increasing the backup frequency, adopting a safer storage method, etc., to deal with potential security threats; the full backup strategy as a response to the integrity verification results can ensure that all data can be quickly restored when data corruption or loss is found, reducing the risk of data loss.

[0047] It should be understood by those skilled in the art that the embodiments of the present invention may be provided as methods and systems. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0048] The present invention is described with reference to the flowcharts and structure diagrams of the methods and systems according to the embodiments of the present invention. It should be understood that each process and combination of modules in the flowcharts and structure diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts. Figure 1 process or multiple processes and structures Figure 1 A device that specifies functionality in a module or modules.

[0049] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 process or multiple processes and structures Figure 1 A function specified in a module or multiple modules.

[0050] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 process or multiple processes and structures Figure 1 Steps to specify functionality in a module or multiple modules.

[0051] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0052] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A communication data backup method based on Internet of Things security service, characterized in that: The following steps are involved: Collect communication data based on IoT devices; Evaluate the importance of communication data, classify the communication data according to the importance evaluation, and set backup cycles for each type of communication data; Trigger backup requests for various communication data according to the backup cycles of various communication data, preliminarily screen the communication data that triggers the backup request, identify the overlapping areas between the communication data that triggers the backup request and the historical backup data, and then screen out the overlapping areas; The communication data after the initial screening is processed in blocks, and then the data blocks are sorted according to the backup requirement information of each data block, and the data blocks are backed up in sequence according to the sorting results; When the backup of the last data block is completed, the backup data is checked for integrity and risk. Verify the backup integrity of the communication data based on the integrity check result, and perform a full backup of the communication data based on the integrity check result; Assess the risk of backup data being attacked and the possibility of loss based on the risk prediction results, and adjust the backup strategy accordingly.

2. A communication data backup method based on Internet of Things security service according to claim 1, characterized in that: The importance of communication data is evaluated, and then the communication data is classified according to the importance evaluation of the communication data. The specific analysis of setting backup cycles for each type of communication data is as follows: The communication data includes communication content, communication metadata and communication protocol; Acquiring importance assessment parameters of the communication data, wherein the importance assessment parameters of the communication data include data sensitivity and data access frequency; Obtaining a data sensitivity mean value and a data access frequency mean value of the communication data, and then comparing the data sensitivity and the data access frequency of the communication data with the data sensitivity mean value and the data access frequency mean value respectively; Classify the communication data whose data sensitivity is higher than the average data sensitivity and whose data access frequency is higher than the average data access frequency as first-level communication data, indicating that such communication data is of high importance; Classify communication data with a data sensitivity higher than the average data sensitivity and a data access frequency lower than or equal to the average data access frequency as secondary communication data, indicating that such communication data is of medium importance; Classify the communication data whose data sensitivity is lower than or equal to the mean data sensitivity and whose data access frequency is higher than the mean data access frequency as secondary communication data, indicating that such communication data is of medium importance; The communication data whose data sensitivity is lower than the average data sensitivity and whose data access frequency is lower than the average data access frequency is classified as Class III communication data, indicating that such communication data is low-importance data; The backup periods of the first-level communication data, the second-level communication data and the third-level communication data are set respectively based on the importance of the first-level communication data, the second-level communication data and the third-level communication data.

3. The communication data backup method based on the Internet of Things security service according to claim 1 is characterized in that: The communication data that triggers the backup request is initially screened to identify the overlapping area between the communication data that triggers the backup request and the historical backup data, and then the specific analysis of screening out the overlapping area is as follows: Preprocess the communication data that triggers the backup request, including missing value and abnormal value processing, as well as duplicate data processing; Retrieving historical backup communication data in the backup system, and then comparing the identifiers of the preprocessed communication data with the historical backup communication data, identifying whether the preprocessed communication data has the same identifier data in the historical backup communication data, and then marking the same identifier data as an overlapping area; The remaining communication data after filtering out the overlapping areas is packaged and formatted to generate a backup request. Based on the storage records of the historical backup communication data, the specific path of the overlapping areas in the historical backup communication data is determined, and then the backup path of the overlapping areas in the historical backup communication data is added to the backup request.

4. The communication data backup method based on the Internet of Things security service according to claim 1 is characterized in that: The communication data after the initial screening is divided into blocks, and then the data blocks are sorted according to the backup requirement information of each data block. The specific analysis of backing up in sequence according to the sorting results is as follows: The communication data after the initial screening is divided into blocks according to the timestamp, and the backup requirement information of each data block is obtained respectively; The backup requirement information includes data modification frequency and data capacity; The data modification frequency and data capacity of each data block are formatted and normalized, and then the priority score of each data block is obtained according to the data modification frequency and data capacity of each data block; The data blocks are sorted according to their priority scores, and the backup is triggered in sequence according to the priority scores.

5. The communication data backup method based on the Internet of Things security service according to claim 1 is characterized in that: The backup integrity of the communication data is verified based on the integrity check results, and the specific analysis of the full backup of the communication data based on the integrity check results is as follows: Setting a first hash function, a second hash function, and a third hash function; Performing hash calculations on the communication data according to the first hash function, the second hash function, and the third hash function, respectively, to obtain a first hash value, a second hash value, and a third hash value of the communication data, and then concatenating the first hash value, the second hash value, and the third hash value of the communication data to obtain a unique hash identifier of the communication data; Using the first hash function, the second hash function and the third hash function to calculate the data after the communication data is backed up, respectively, to obtain the first hash value, the second hash value and the third hash value of the backup data, and then concatenating the first hash value, the second hash value and the third hash value of the backup data to obtain a unique hash identifier of the backup data; Compare the unique hash identifier of the communication data with the unique hash identifier of the backup data to identify whether the unique hash identifiers of the communication data and the backup data are the same. If the unique hash identifiers of the communication data and the backup data are the same, the backup of the communication data is complete. If the unique hash identifiers of the communication data and the backup data are different, a secondary backup request is triggered to perform a secondary backup of the communication data. Obtain the unique hash identifier of the secondary backup data, identify whether the unique hash identifier of the communication data is the same as that of the secondary backup data, and if the unique hash identifier of the communication data is different from that of the secondary backup data, trigger a backup anomaly alert. Use the backup anomaly alert to prompt IoT security operation and maintenance personnel to check the backup anomaly until the unique hash identifier of the communication data is the same as that of the backup data.

6. A communication data backup method based on Internet of Things security service according to claim 5, characterized in that: The specific analysis of assessing the risk of backup data being attacked and the possibility of loss based on the risk prediction results and adjusting the backup strategy is as follows: Identify whether a backup abnormality warning is triggered. If a backup abnormality warning is triggered, the backup abnormality value is recorded as "1". If a backup abnormality warning is not triggered, the backup abnormality value is recorded as "0". Obtaining risk assessment parameters of the backup data, wherein the risk assessment parameters of the backup data specifically include a vulnerability threat score and a recovery capability score; The risk prediction value of the backup data is obtained based on the backup anomaly value, vulnerability threat score and recovery capability score of the backup data; The risk prediction value of the backup data is compared with the risk threshold. When the risk prediction value of the backup data exceeds the risk threshold, the backup data is marked as high-risk data, prompting the IoT security operation and maintenance personnel to adjust the backup strategy. Specific adjustments include backup cycle adjustment and backup storage location adjustment.

7. A communication data backup system based on Internet of Things security service, applying the communication data backup method based on Internet of Things security service according to any one of claims 1 to 6, characterized in that: include: A data collection module, used to collect communication data based on IoT devices; A data classification module is used to evaluate the importance of communication data, and then classify the communication data according to the importance evaluation of the communication data, and set a backup period for each type of communication data; A backup initial screening module is used to trigger backup requests for various communication data according to the backup cycles of various communication data, perform initial screening on the communication data that triggers the backup request, identify the overlapping areas between the communication data that triggers the backup request and the historical backup data, and then screen out the overlapping areas; The backup control module is used to process the communication data after the initial screening into blocks, and then sort the data blocks according to the backup requirement information of each data block, and back up them in sequence according to the sorting results; The verification and detection module is used to perform integrity verification and risk prediction on the backup data after the backup of the last data block is completed; A backup integrity assurance module is used to verify the backup integrity of the communication data based on the integrity check result, and to perform a full backup of the communication data based on the integrity check result; The risk adjustment module is used to evaluate the risk of attack and the possibility of loss of backup data based on the risk prediction results, and then adjust the backup strategy.

Images