Distributed data security protection system based on Internet of Things nodes

Abstract

The invention relates to the technical field of network data security, in particular to a distributed data security protection system based on Internet of Things nodes, which comprises a security negotiation module, a dynamic encryption module, an identity authentication module, a data integrity detection module and an intrusion detection module, wherein the security negotiation module is used for dynamically selecting an encryption algorithm, an authentication mechanism and a data transmission strategy; the dynamic encryption module is used for encrypting the transmitted data; the identity authentication module is used for performing identity authentication among the nodes; the data integrity detection module is used for performing integrity verification on the data in transmission; the intrusion detection module is used for analyzing and identifying potential security threats in real time; according to the invention, the encryption algorithm, the authentication mechanism and the data transmission strategy are dynamically selected, and real-time intrusion detection and threat identification are combined, so that the security of data transmission between nodes of the Internet of Things and the overall protection capability of the system are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network data security, and in particular to a distributed data security protection system based on Internet of Things nodes. Background Art

[0002] With the rapid development of Internet of Things (IoT) technology, the number of IoT nodes and the scale of communication are increasing, bringing huge data exchange needs; however, the high distribution and heterogeneity of the IoT environment and the instability of device security make it difficult for traditional network security protection technologies to meet its security needs in the process of data transmission and communication; IoT nodes transmit data through wireless networks, and face security threats such as data theft, malicious attacks, and illegal access during the transmission process. Especially in complex distributed environments, problems such as node authentication, data encryption, and data integrity assurance are more prominent; in addition, IoT nodes usually have limitations in computing and storage capabilities. How to ensure data confidentiality, integrity, and network availability while ensuring efficient performance has become a key issue that needs to be urgently addressed in the field of IoT security.

[0003] Although there are some security protection systems based on IoT nodes in the existing technology, these systems generally have the following problems: on the one hand, traditional encryption algorithms and authentication mechanisms are often based on fixed rules and configurations, which are difficult to adapt to the dynamically changing network environment and diverse needs of nodes in the IoT; on the other hand, existing systems usually adopt centralized or fixed-configuration security strategies and cannot flexibly adjust security measures, resulting in some nodes failing to obtain timely and effective security protection under certain circumstances; in addition, there are also problems such as slow response speed and inaccurate threat identification in intrusion detection and abnormal traffic identification. Summary of the invention

[0004] Based on the above objectives, the present invention provides a distributed data security protection system based on Internet of Things nodes.

[0005] A distributed data security protection system based on Internet of Things nodes, including a security negotiation module, a dynamic encryption module, an identity authentication module, a data integrity detection module and an intrusion detection module; wherein:

[0006] Security negotiation module: It is configured on each IoT node and is used to dynamically select encryption algorithms, authentication mechanisms, and data transmission strategies based on the real-time security status of the nodes and the network environment when establishing a communication connection between nodes, and to generate corresponding security configuration parameters;

[0007] Dynamic encryption module: connected to the security negotiation module, used to receive security configuration parameters and encrypt the transmitted data according to the node feature information and the current network status;

[0008] Identity authentication module: used to authenticate identities between nodes, verify the legitimacy of nodes and determine the access rights of nodes, ensuring that only authorized nodes can participate in data exchange;

[0009] Data integrity detection module: used to perform integrity check on the data in transmission, and verify whether the data has been tampered with by generating the hash value and signature information of the data;

[0010] Intrusion detection module: used to monitor the communication traffic of IoT nodes, analyze and identify potential security threats in real time to prevent intrusion behaviors from affecting the system.

[0011] Optionally, the security negotiation module includes a security status monitoring unit, a network environment monitoring unit, a policy selection unit, and a configuration parameter generation unit; wherein:

[0012] Security status monitoring unit: used to monitor the security status of each IoT node in real time, including the node's authentication status and system load;

[0013] Network environment monitoring unit: used to monitor the current network environment parameters, including network bandwidth, latency, and node connection quality;

[0014] Strategy selection unit: Based on the data provided by the security status monitoring unit and the network environment analysis unit, it dynamically selects encryption algorithms, authentication mechanisms, and data transmission strategies to meet the security requirements between different nodes;

[0015] Configuration parameter generation unit: used to generate corresponding security configuration parameters according to the selection result of the policy selection unit, and pass the security configuration parameters to the dynamic encryption module and the identity authentication module.

[0016] Optionally, the strategy selection unit includes:

[0017] Encryption algorithm selection: If the network bandwidth is less than 10Mbps and the node load is greater than 80%, the AES symmetric encryption algorithm with low computational complexity is preferred; if the network bandwidth is greater than 100Mbps and the node load is less than 50%, the RSA asymmetric encryption algorithm with high encryption strength is preferred;

[0018] Authentication mechanism selection: If the node authentication status is normal and the system load is less than 50%, select the authentication mechanism based on the public key infrastructure; if the node load is greater than 80%, select the authentication mechanism based on the shared key;

[0019] Data transmission strategy selection: If the network delay is less than 50ms and the bandwidth is greater than 100Mbps, select a lossless transmission strategy and use the TCP protocol for data transmission; if the network delay is greater than 200ms or the bandwidth is less than 10Mbps, select a transmission strategy with strong fault tolerance and use the UDP protocol in combination with a retransmission mechanism.

[0020] Optionally, the dynamic encryption module includes an encryption algorithm selection unit, a key management unit and a data encryption processing unit; wherein:

[0021] Encryption algorithm selection unit: selects encryption algorithms according to node feature information and current network status, including symmetric encryption algorithm AES and asymmetric encryption algorithm RSA;

[0022] Key management unit: used to generate corresponding encryption keys according to the selected encryption algorithm;

[0023] Data encryption processing unit: uses the encryption algorithm selected by the encryption algorithm selection unit and the key generated by the key management unit to encrypt the data to be transmitted to ensure the confidentiality and integrity of the data during transmission.

[0024] Optionally, the identity authentication module includes an identity authentication unit, a rights management unit, an access control unit, and a log recording unit; wherein:

[0025] Authentication unit: used to receive identity information from the communication node and verify the legitimacy of the communication node by comparing it with the pre-stored legal identity database to ensure that only legal nodes can pass the identity authentication;

[0026] The authority management unit is used to consult the authority database according to the verification result of the identity authentication unit, determine the access authority level of the communication node, and generate a corresponding authority control policy;

[0027] Access control unit: used to dynamically adjust the access rights of communication nodes according to the permission control policy generated by the permission management unit to ensure that the nodes can only access the resources and functions they are authorized to.

[0028] Logging unit: used to record all authentication and permission management operation logs, including the node's authentication request, verification results, and permission allocation.

[0029] Optionally, the rights management unit includes:

[0030] Permission query: Based on the identity authentication result, the permission database is searched for permission data that matches the node identity, and the preset permission level and access resource scope of the node are obtained;

[0031] Generation of permission control policy: If the node identity is legal and the permission level is administrator, a full access permission control policy is generated to allow the node to access all system resources; if the node identity is legal and the permission level is user, a limited access permission control policy is generated to only allow the node to access specified system resources; if the node identity authentication fails or the permission level is no permission, access is denied.

[0032] Optionally, the data integrity detection module includes a hash value generation unit, a signature generation unit, a data receiving unit, a hash value verification unit, a signature verification unit and a tampering detection unit; wherein:

[0033] Hash value generation unit: used to receive data to be transmitted and generate a hash value of the data using the SHA-256 hash algorithm;

[0034] Signature generation unit: used to sign the data using the generated hash value and the pre-stored private key before data transmission to generate a digital signature of the data;

[0035] Data receiving unit: used to receive data transmitted from the IoT node and its accompanying digital signature, the received data includes the original data and the signature information generated by the signature generating unit;

[0036] Hash value verification unit: used to recalculate the hash value of the received data and compare it with the received hash value; if the comparison result is consistent, it means that the data has not been tampered with; if the comparison result is inconsistent, it means that the data has been tampered with;

[0037] Signature verification unit: uses the received data and its accompanying digital signature, combined with the stored public key to verify the signature to determine whether the data has been tampered with;

[0038] Tamper detection unit: Based on the results of the hash value verification unit and the signature verification unit, it is used to generate alarm information and trigger security responses when it detects that the data has been tampered with, including preventing the data from being transmitted further or notifying the system administrator.

[0039] Optionally, the signature verification unit includes:

[0040] Use the SHA-256 hash algorithm to calculate the hash value of the received data. The formula is: H(P) = SHA-256(P), where H(P) is the hash value of data P;

[0041] The extracted digital signature is decrypted using the public key to obtain the hash value used when signing, which is expressed as: 签名 =decrypt(signature, public key);

[0042] Compare the calculated hash value H(P) with the decrypted hash value H签名 Whether it is consistent, the formula is:

[0043]

[0044] Tampering judgment: If the verification result is valid, it is confirmed that the data has not been tampered with, and the data is allowed to continue to be transmitted and processed; if the verification result is invalid, it is determined that the data has been tampered with, and the corresponding security response is triggered.

[0045] Optionally, the intrusion detection module includes a traffic monitoring unit, a feature extraction unit, a threat identification unit and an alarm generation unit; wherein:

[0046] Traffic monitoring unit: used to continuously monitor the communication traffic between IoT nodes and collect metadata and content information of data packets, including source address, destination address, port number, protocol type, data packet size and transmission rate;

[0047] Feature extraction unit: used to extract features from the monitored communication traffic and transmit the extracted features to the threat identification unit;

[0048] Threat identification unit: uses decision tree algorithm to classify and analyze extracted feature vectors to identify potential security threats;

[0049] Alarm generation unit: When the threat identification unit detects a security threat, it generates and records security alarm information and sends an alarm notification to the system administrator.

[0050] Optionally, the threat identification unit includes:

[0051] Receiving feature vector: receiving the feature vector from the feature extraction unit and performing normalization processing;

[0052] Application of decision tree model: The received feature vector is input into the pre-trained decision tree model, and decisions are made layer by layer based on the attribute values ​​in the feature vector to determine whether the data packet poses a security threat.

[0053] Classification decision step: The decision tree model is based on the attribute value of the feature vector. According to the predefined decision rules, starting from the root node, the feature value and the node segmentation value are compared in sequence, and the corresponding branch path is traversed downward until the leaf node is reached, thereby classifying and judging whether the data packet is a potential security threat;

[0054] Threat type determination step: After reaching a leaf node, determine the specific threat type to which the data packet belongs based on the classification label of the leaf node.

[0055] Beneficial effects of the present invention:

[0056] The present invention, by combining multiple technical means such as dynamic security negotiation, encryption processing, identity authentication and intrusion detection, can flexibly adjust encryption algorithms, authentication mechanisms and data transmission strategies for different nodes and network states in the Internet of Things environment; this dynamic adaptability effectively solves the problems of fixed encryption configuration and inflexible authentication mechanism in traditional Internet of Things security systems, and can automatically select the most appropriate security configuration according to the real-time security status of the node and the network environment, ensuring the confidentiality and integrity of data during transmission.

[0057] The present invention continuously monitors the communication traffic of IoT nodes, analyzes data packet characteristics in real time and identifies potential security threats. Combined with the decision tree algorithm, it can accurately classify various attack behaviors and generate corresponding security alarm information, effectively preventing malicious attacks or unauthorized access behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only for the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0059] Figure 1 A schematic diagram of a distributed data security protection system according to an embodiment of the present invention;

[0060] Figure 2 Schematic diagram of an intrusion detection module according to an embodiment of the present invention. DETAILED DESCRIPTION

[0061] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. At the same time, it is explained here that in order to make the embodiments more detailed, the following embodiments are the best and preferred embodiments, and those skilled in the art may also adopt other alternatives to implement some known technologies; and the accompanying drawings are only for more specific description of the embodiments, and are not intended to specifically limit the present invention.

[0062] It should be noted that the references to "one embodiment", "an embodiment", "an exemplary embodiment", "some embodiments" and the like in the specification indicate that the embodiments described may include specific features, structures or characteristics, but not every embodiment may include the specific features, structures or characteristics. In addition, when a specific feature, structure or characteristic is described in conjunction with an embodiment, it should be within the knowledge of a person skilled in the art to implement such feature, structure or characteristic in conjunction with other embodiments (whether or not explicitly described).

[0063] In general, a term can be understood, at least in part, from its use in context. For example, depending, at least in part, on the context, the term "one or more" as used herein can be used to describe any feature, structure, or characteristic in the singular sense, or can be used to describe a combination of features, structures, or characteristics in the plural sense. Additionally, the term "based on" can be understood as not necessarily intended to convey an exclusive set of factors, but can instead, depending, at least in part, on the context, allow for the presence of other factors that are not necessarily explicitly described.

[0064] like Figure 1-Figure 2 As shown, a distributed data security protection system based on Internet of Things nodes includes a security negotiation module, a dynamic encryption module, an identity authentication module, a data integrity detection module and an intrusion detection module; wherein:

[0065] Security negotiation module: It is configured on each IoT node and is used to dynamically select encryption algorithms, authentication mechanisms, and data transmission strategies based on the real-time security status of the nodes and the network environment when establishing a communication connection between nodes, and to generate corresponding security configuration parameters;

[0066] Dynamic encryption module: connected to the security negotiation module, used to receive security configuration parameters and encrypt the transmitted data according to the node feature information and the current network status. The encryption process includes selecting the appropriate encryption algorithm and key length.

[0067] Identity authentication module: used to authenticate identities between nodes, verify the legitimacy of nodes and determine the access rights of nodes, ensuring that only authorized nodes can participate in data exchange;

[0068] Data integrity detection module: used to perform integrity check on the data in transmission, and verify whether the data has been tampered with by generating the hash value and signature information of the data;

[0069] Intrusion detection module: used to monitor the communication traffic of IoT nodes, analyze and identify potential security threats in real time to prevent intrusion behaviors from affecting the system.

[0070] The security negotiation module includes a security status monitoring unit, a network environment monitoring unit, a policy selection unit, and a configuration parameter generation unit; wherein:

[0071] Security status monitoring unit: used to monitor the security status of each IoT node in real time, including the node's authentication status and system load;

[0072] Network environment monitoring unit: used to monitor the current network environment parameters, including network bandwidth, latency, and node connection quality;

[0073] Strategy selection unit: Based on the data provided by the security status monitoring unit and the network environment analysis unit, it dynamically selects encryption algorithms, authentication mechanisms, and data transmission strategies to meet the security requirements between different nodes;

[0074] Configuration parameter generation unit: used to generate corresponding security configuration parameters according to the selection result of the policy selection unit, and pass the security configuration parameters to the dynamic encryption module and identity authentication module to guide the subsequent data encryption processing and identity authentication process; through the above design, the security negotiation module can dynamically select the appropriate encryption algorithm, authentication mechanism and data transmission strategy according to the real-time security status and network environment of the IoT node, and generate corresponding security configuration parameters. This dynamic adjustment mechanism ensures that the system can maintain efficient and secure data transmission in different environments, thereby improving the overall data protection capability.

[0075] The strategy selection unit includes:

[0076] Encryption algorithm selection: If the network bandwidth is less than 10Mbps and the node load is greater than 80%, the AES symmetric encryption algorithm with low computational complexity is preferred; if the network bandwidth is greater than 100Mbps and the node load is less than 50%, the RSA asymmetric encryption algorithm with high encryption strength is preferred;

[0077] Authentication mechanism selection: If the node authentication status is normal and the system load is less than 50%, select an authentication mechanism based on public key infrastructure (PKI); if the node load is greater than 80%, select an authentication mechanism based on a shared key, such as HMAC (hash-based message authentication code);

[0078] Data transmission strategy selection: If the network delay is less than 50ms and the bandwidth is greater than 100Mbps, select a lossless transmission strategy and use the TCP protocol for data transmission; if the network delay is greater than 200ms or the bandwidth is less than 10Mbps, select a transmission strategy with strong fault tolerance and use the UDP protocol in combination with a retransmission mechanism to ensure data reliability; through the above design, the strategy selection unit can intelligently select the appropriate encryption algorithm, authentication mechanism and data transmission strategy based on the real-time monitored network status, node load and security requirements; this dynamic adjustment mechanism ensures that the system can operate efficiently under different network conditions and loads, while providing strong data protection capabilities.

[0079] The dynamic encryption module includes an encryption algorithm selection unit, a key management unit, and a data encryption processing unit; wherein:

[0080] Encryption algorithm selection unit: selects encryption algorithms according to node feature information and current network status, including symmetric encryption algorithm AES (Advanced Encryption Standard) and asymmetric encryption algorithm RSA (Rivest–Shamir–Adleman);

[0081] Key management unit: used to generate the corresponding encryption key according to the selected encryption algorithm, and is responsible for the distribution, storage and regular update of the key to ensure the security and effectiveness of the key;

[0082] Data encryption processing unit: Use the encryption algorithm selected by the encryption algorithm selection unit and the key generated by the key management unit to encrypt the data to be transmitted, ensuring the confidentiality and integrity of the data during transmission; through the above design, the dynamic encryption module can intelligently select the most suitable encryption algorithm and effectively manage the encryption key according to the characteristic information and real-time network status of the IoT node, thereby realizing efficient and secure data encryption processing.

[0083] The identity authentication module includes an identity authentication unit, a permission management unit, an access control unit, and a log recording unit; wherein:

[0084] Authentication unit: used to receive identity information from the communication node and verify the legitimacy of the communication node by comparing it with the pre-stored legal identity database to ensure that only legal nodes can pass the identity authentication;

[0085] The authority management unit is used to consult the authority database according to the verification result of the identity authentication unit, determine the access authority level of the communication node, and generate a corresponding authority control policy;

[0086] Access control unit: used to dynamically adjust the access rights of communication nodes according to the permission control policy generated by the permission management unit to ensure that the nodes can only access the resources and functions they are authorized to.

[0087] Logging unit: used to record all authentication and permission management operation logs, including the node's authentication request, verification results, and permission allocation, to facilitate subsequent auditing and tracing.

[0088] The permission management unit includes:

[0089] Permission query: Based on the identity authentication result, the permission database is searched for permission data that matches the node identity, and the preset permission level and access resource scope of the node are obtained;

[0090] Generation of permission control policy: If the node identity is legal and the permission level is administrator, a full access permission control policy is generated to allow the node to access all system resources; if the node identity is legal and the permission level is user, a limited access permission control policy is generated to only allow the node to access specified system resources; if the node identity authentication fails or the permission level is unauthorized, access is denied; through the above design, the permission management unit can generate flexible and dynamic permission control policies based on the node's identity authentication results, data in the permission database, and real-time network conditions. This policy generation mechanism ensures that nodes can obtain appropriate access permissions according to actual needs in different scenarios, effectively controlling the node's access to system resources.

[0091] The data integrity detection module includes a hash value generation unit, a signature generation unit, a data receiving unit, a hash value verification unit, a signature verification unit and a tampering detection unit; wherein:

[0092] Hash value generation unit: used to receive the data to be transmitted and generate the hash value of the data using the SHA-256 hash algorithm; the hash value is the only representation of the data, and any slight change in the data will cause a change in the hash value, ensuring the integrity of the data;

[0093] Signature generation unit: used to sign the data using the generated hash value and the pre-stored private key before data transmission to generate a digital signature of the data; the signature can be used to verify the integrity of the data and ensure that the data has not been tampered with;

[0094] Data receiving unit: used to receive data transmitted from the IoT node and its accompanying digital signature, the received data includes the original data and the signature information generated by the signature generating unit;

[0095] Hash value verification unit: used to recalculate the hash value of the received data and compare it with the received hash value; if the comparison result is consistent, it means that the data has not been tampered with; if the comparison result is inconsistent, it means that the data has been tampered with;

[0096] Signature verification unit: uses the received data and its accompanying digital signature, combined with the stored public key to verify the signature to determine whether the data has been tampered with;

[0097] Tamper detection unit: based on the results of the hash value verification unit and the signature verification unit, it is used to generate alarm information and trigger a security response when it detects that the data has been tampered with, including preventing the data from being transmitted further or notifying the system administrator; through the above design, the data integrity detection module implements strict verification of the integrity of the transmitted data through hash value and digital signature technology to ensure that the data has not been tampered with during the transmission process; the hash value generation unit and the signature generation unit provide an effective data verification mechanism, while the hash value verification unit and the signature verification unit ensure the legitimacy and integrity of the data; this mechanism can promptly detect data tampering and trigger corresponding security responses, effectively ensuring the security and reliability of data in the Internet of Things system.

[0098] The signature verification unit includes:

[0099] Use the SHA-256 hash algorithm to calculate the hash value of the received data. The formula is: H(P) = SHA-256(P), where H(P) is the hash value of data P;

[0100] Use the public key to decrypt the extracted digital signature and get the hash value used when signing. The expression is: H 签名 =decrypt(signature, public key);

[0101] Compare the calculated hash value H(P) with the decrypted hash value H 签名 Whether it is consistent, the formula is:

[0102]

[0103] Tampering judgment: If the verification result is valid, it is confirmed that the data has not been tampered with, and the data is allowed to continue to be transmitted and processed; if the verification result is invalid, it is determined that the data has been tampered with, and the corresponding security response is triggered; through the above design, the policy selection unit can effectively use the received data and its accompanying digital signature, combined with the stored public key to perform strict signature verification, so as to accurately determine whether the data has been tampered with during the transmission process. This mechanism ensures the integrity of the data and the credibility of the source, and prevents malicious tampering from affecting the system.

[0104] The intrusion detection module includes a traffic monitoring unit, a feature extraction unit, a threat identification unit, and an alarm generation unit; wherein:

[0105] Traffic monitoring unit: used to continuously monitor the communication traffic between IoT nodes and collect metadata and content information of data packets, including source address, destination address, port number, protocol type, data packet size and transmission rate;

[0106] Feature extraction unit: used to extract features from the monitored communication traffic, such as the transmission rate and size of data packets, the frequency of packets and their changing trends, and pass the extracted features to the threat identification unit;

[0107] Threat identification unit: uses decision tree algorithm to classify and analyze extracted feature vectors to identify potential security threats;

[0108] Alarm generation unit: When the threat identification unit detects a security threat, it generates and records security alarm information and sends an alarm notification to the system administrator. Through the above design, the intrusion detection module can comprehensively monitor and analyze the communication traffic between IoT nodes, and use the decision tree algorithm to accurately identify potential security threats. Once a threat is detected, the alarm generation unit can generate and record alarm information in a timely manner, and notify the system administrator to take corresponding measures, thereby effectively preventing and responding to intrusions and improving the overall security protection capabilities of the system.

[0109] The Threat Identification Unit includes:

[0110] Receiving feature vector: receiving the feature vector from the feature extraction unit and performing normalization processing;

[0111] Application of decision tree model: The received feature vector is input into the pre-trained decision tree model, and decisions are made layer by layer based on the attribute values ​​in the feature vector to determine whether the data packet poses a security threat.

[0112] Classification decision step: The decision tree model is based on the attribute value of the feature vector. According to the predefined decision rules, starting from the root node, the feature value and the node segmentation value are compared in sequence, and the corresponding branch path is traversed downward until the leaf node is reached, thereby classifying and judging whether the data packet is a potential security threat;

[0113] The predefined decision rules include:

[0114] Rule 1: If the source address of a data packet is an IP address in the blacklist and the transmission rate exceeds 1000 packets / second, the data packet is classified as a "Denial of Service Attack (DoS)";

[0115] Rule 2: If the protocol type of the data packet is an abnormal protocol (non-standard protocol) and the port number is a high-risk port (such as 8080), the data packet is classified as "malware propagation";

[0116] Rule 3: If the packet size of a data packet is less than 50 bytes and the transmission rate increases suddenly, the packet is classified as an “information leakage attempt”;

[0117] Rule 4: If the source and destination addresses of a data packet change frequently and the system load is higher than 80%, the data packet is classified as a "man-in-the-middle attack";

[0118] Rule 5: If the source address and destination address of a data packet are both internal network addresses, but the protocol type is an external suspicious protocol, the data packet is classified as an "internal threat";

[0119] Rule 6: If the transmission rate of a packet exceeds twice the normal level and the packet size continues to fluctuate, the packet is classified as "abnormal traffic pattern";

[0120] Rule 7: If the source address of a data packet comes from an unauthorized geographic area and the protocol type is a high-risk protocol, the data packet is classified as a "geographic location anomaly attack";

[0121] Rule 8: If the source address of the data packet is a known malicious IP and the protocol type is a standard protocol, the data packet is classified as "known malicious activity";

[0122] Rule 9: If the packet size of a packet continues to increase and the transmission rate remains stable, the packet is classified as a "packet inflation attack";

[0123] Rule 10: If the source address and destination address of a data packet match a specific attack pattern (such as a scanning attack), the data packet is classified as a "scanning attack";

[0124] Threat type determination step: After reaching a leaf node, determine the specific threat type to which the data packet belongs based on the classification label of the leaf node.

[0125] The above decision tree model application steps include:

[0126] Step 1: According to the attribute values ​​in the feature vector, the predefined decision rules (rule 1 to rule 10) are applied one by one to determine whether the data packet meets the characteristic conditions of a specific threat type;

[0127] Step 2: Once a packet meets the conditions of a rule, it is classified into the corresponding threat type and further rule matching is stopped;

[0128] Step 3: If the data packet meets the conditions of multiple rules at the same time, the most serious threat type is selected for classification according to the predetermined priority order; through this design, the threat identification unit can achieve efficient and accurate security threat monitoring and identification in the IoT environment, significantly improve the overall data security protection level, and ensure the reliable operation of the IoT system.

[0129] The present invention covers any substitution, modification, equivalent method and scheme made on the essence and scope of the present invention. In order to make the public have a thorough understanding of the present invention, specific details are described in detail in the following preferred embodiments of the present invention, but those skilled in the art can fully understand the present invention without the description of these details. In addition, in order to avoid unnecessary confusion about the essence of the present invention, well-known methods, processes, procedures, components and circuits are not described in detail.

[0130] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A distributed data security protection system based on Internet of Things nodes, characterized in that: It includes a security negotiation module, a dynamic encryption module, an identity authentication module, a data integrity detection module and an intrusion detection module; among which: Security negotiation module: It is configured on each IoT node and is used to dynamically select encryption algorithms, authentication mechanisms, and data transmission strategies based on the real-time security status of the nodes and the network environment when establishing a communication connection between nodes, and to generate corresponding security configuration parameters; Dynamic encryption module: connected to the security negotiation module, used to receive security configuration parameters and encrypt the transmitted data according to the node feature information and the current network status; Identity authentication module: used to authenticate identities between nodes, verify the legitimacy of nodes and determine the access rights of nodes, ensuring that only authorized nodes can participate in data exchange; Data integrity detection module: used to perform integrity check on the data in transmission, and verify whether the data has been tampered with by generating the hash value and signature information of the data; Intrusion detection module: used to monitor the communication traffic of IoT nodes, analyze and identify potential security threats in real time to prevent intrusion behaviors from affecting the system.

2. According to claim 1, a distributed data security protection system based on Internet of Things nodes is characterized in that: The security negotiation module includes a security status monitoring unit, a network environment monitoring unit, a policy selection unit and a configuration parameter generation unit; wherein: Security status monitoring unit: used to monitor the security status of each IoT node in real time, including the node's authentication status and system load; Network environment monitoring unit: used to monitor the current network environment parameters, including network bandwidth, latency, and node connection quality; Strategy selection unit: Based on the data provided by the security status monitoring unit and the network environment analysis unit, it dynamically selects encryption algorithms, authentication mechanisms, and data transmission strategies to meet the security requirements between different nodes; Configuration parameter generation unit: used to generate corresponding security configuration parameters according to the selection result of the policy selection unit, and pass the security configuration parameters to the dynamic encryption module and the identity authentication module.

3. According to claim 2, a distributed data security protection system based on Internet of Things nodes is characterized in that: The strategy selection unit comprises: Encryption algorithm selection: If the network bandwidth is less than 10Mbps and the node load is greater than 80%, the AES symmetric encryption algorithm with low computational complexity is preferred; if the network bandwidth is greater than 100Mbps and the node load is less than 50%, the RSA asymmetric encryption algorithm with high encryption strength is preferred; Authentication mechanism selection: If the node authentication status is normal and the system load is less than 50%, select the authentication mechanism based on the public key infrastructure; if the node load is greater than 80%, select the authentication mechanism based on the shared key; Data transmission strategy selection: If the network delay is less than 50ms and the bandwidth is greater than 100Mbps, select a lossless transmission strategy and use the TCP protocol for data transmission; if the network delay is greater than 200ms or the bandwidth is less than 10Mbps, select a transmission strategy with strong fault tolerance and use the UDP protocol in combination with a retransmission mechanism.

4. According to claim 1, a distributed data security protection system based on Internet of Things nodes is characterized in that: The dynamic encryption module includes an encryption algorithm selection unit, a key management unit and a data encryption processing unit; wherein: Encryption algorithm selection unit: selects encryption algorithms according to node feature information and current network status, including symmetric encryption algorithm AES and asymmetric encryption algorithm RSA; Key management unit: used to generate corresponding encryption keys according to the selected encryption algorithm; Data encryption processing unit: uses the encryption algorithm selected by the encryption algorithm selection unit and the key generated by the key management unit to encrypt the data to be transmitted to ensure the confidentiality and integrity of the data during transmission.

5. According to claim 1, a distributed data security protection system based on Internet of Things nodes is characterized in that: The identity authentication module includes an identity authentication unit, a permission management unit, an access control unit and a log recording unit; wherein: Authentication unit: used to receive identity information from the communication node and verify the legitimacy of the communication node by comparing it with the pre-stored legal identity database to ensure that only legal nodes can pass the identity authentication; The authority management unit is used to consult the authority database according to the verification result of the identity authentication unit, determine the access authority level of the communication node, and generate a corresponding authority control policy; Access control unit: used to dynamically adjust the access rights of communication nodes according to the permission control policy generated by the permission management unit to ensure that the nodes can only access the resources and functions they are authorized to. Logging unit: used to record all authentication and permission management operation logs, including the node's authentication request, verification results, and permission allocation.

6. A distributed data security protection system based on Internet of Things nodes according to claim 5, characterized in that: The rights management unit includes: Permission query: Based on the identity authentication result, the permission database is searched for permission data that matches the node identity, and the preset permission level and access resource scope of the node are obtained; Generation of permission control policy: If the node identity is legal and the permission level is administrator, a full access permission control policy is generated to allow the node to access all system resources; if the node identity is legal and the permission level is user, a limited access permission control policy is generated to only allow the node to access specified system resources; if the node identity authentication fails or the permission level is no permission, access is denied.

7. A distributed data security protection system based on Internet of Things nodes according to claim 1, characterized in that: The data integrity detection module includes a hash value generation unit, a signature generation unit, a data receiving unit, a hash value verification unit, a signature verification unit and a tampering detection unit; wherein: Hash value generation unit: used to receive data to be transmitted and generate a hash value of the data using the SHA-256 hash algorithm; Signature generation unit: used to sign the data using the generated hash value and the pre-stored private key before data transmission to generate a digital signature of the data; Data receiving unit: used to receive data transmitted from the IoT node and its accompanying digital signature, the received data includes the original data and the signature information generated by the signature generating unit; Hash value verification unit: used to recalculate the hash value of the received data and compare it with the received hash value; if the comparison result is consistent, it means that the data has not been tampered with; if the comparison result is inconsistent, it means that the data has been tampered with; Signature verification unit: uses the received data and its accompanying digital signature, combined with the stored public key to verify the signature to determine whether the data has been tampered with; Tamper detection unit: Based on the results of the hash value verification unit and the signature verification unit, it is used to generate alarm information and trigger security responses when it detects that the data has been tampered with, including preventing the data from being transmitted further or notifying the system administrator.

8. A distributed data security protection system based on Internet of Things nodes according to claim 7, characterized in that: The signature verification unit comprises: Use the SHA-256 hash algorithm to calculate the hash value of the received data. The formula is: H(P) = SHA-256(P), where H(P) is the hash value of data P; The extracted digital signature is decrypted using the public key to obtain the hash value used when signing, which is expressed as: 签名 =decrypt(signature, public key); Compare the calculated hash value H(P) with the decrypted hash value H 签名 Whether it is consistent, the formula is: Tampering judgment: If the verification result is valid, it is confirmed that the data has not been tampered with, and the data is allowed to continue to be transmitted and processed; if the verification result is invalid, it is determined that the data has been tampered with, and the corresponding security response is triggered.

9. A distributed data security protection system based on Internet of Things nodes according to claim 1, characterized in that: The intrusion detection module includes a flow monitoring unit, a feature extraction unit, a threat identification unit and an alarm generation unit; wherein: Traffic monitoring unit: used to continuously monitor the communication traffic between IoT nodes and collect metadata and content information of data packets, including source address, destination address, port number, protocol type, data packet size and transmission rate; Feature extraction unit: used to extract features from the monitored communication traffic and transmit the extracted features to the threat identification unit; Threat identification unit: uses decision tree algorithm to classify and analyze extracted feature vectors to identify potential security threats; Alarm generation unit: When the threat identification unit detects a security threat, it generates and records security alarm information and sends an alarm notification to the system administrator.

10. A distributed data security protection system based on Internet of Things nodes according to claim 9, characterized in that: The threat identification unit comprises: Receiving feature vector: receiving the feature vector from the feature extraction unit and performing normalization processing; Application of decision tree model: The received feature vector is input into the pre-trained decision tree model, and decisions are made layer by layer based on the attribute values ​​in the feature vector to determine whether the data packet poses a security threat. Classification decision step: The decision tree model is based on the attribute value of the feature vector. According to the predefined decision rules, starting from the root node, the feature value and the node segmentation value are compared in sequence, and the corresponding branch path is traversed downward until the leaf node is reached, thereby classifying and judging whether the data packet is a potential security threat; Threat type determination step: After reaching a leaf node, determine the specific threat type to which the data packet belongs based on the classification label of the leaf node.

Images