A distributed data security protection system based on Internet of Things nodes

Abstract

The present invention relates to the field of network data security technology, and in particular to a distributed data security protection system based on Internet of Things nodes, comprising a security negotiation module, a dynamic encryption module, an identity authentication module, a data integrity detection module and an intrusion detection module; wherein: the security negotiation module is used to dynamically select an encryption algorithm, an authentication mechanism and a data transmission strategy; the dynamic encryption module is used to encrypt the transmitted data; the identity authentication module is used to perform identity authentication between nodes; the data integrity detection module is used to perform integrity verification on the data in transmission; the intrusion detection module is used to analyze and identify potential security threats in real time; the present invention improves the security of data transmission between Internet of Things nodes and the overall protection capability of the system by dynamically selecting an encryption algorithm, an authentication mechanism and a data transmission strategy, and combining real-time intrusion detection and threat identification.

Description

Technical Field

[0001] The present invention relates to the field of network data security technology, and in particular to a distributed data security protection system based on Internet of Things nodes. Background Art

[0002] With the rapid development of Internet of Things (IoT) technology, the number of IoT nodes and the scale of communication are constantly increasing, bringing about huge data exchange needs. However, the high distribution and heterogeneity of the IoT environment and the instability of device security make it difficult for traditional network security protection technologies to meet its security needs in the data transmission and communication process. IoT nodes transmit data through wireless networks, and face security threats such as data theft, malicious attacks, and illegal access during the transmission process. Especially in complex distributed environments, problems such as node authentication, data encryption, and data integrity assurance are more prominent. In addition, IoT nodes usually have limited computing and storage capabilities. How to ensure data confidentiality, integrity, and network availability while ensuring efficient performance has become a key issue that needs to be urgently addressed in the field of IoT security.

[0003] Although there are some security protection systems based on IoT nodes in the existing technology, these systems generally have the following problems: on the one hand, traditional encryption algorithms and authentication mechanisms are often based on fixed rules and configurations, which are difficult to adapt to the dynamically changing network environment and diverse needs of nodes in the IoT; on the other hand, existing systems usually adopt centralized or fixed configuration security policies and cannot flexibly adjust security measures, resulting in some nodes failing to receive timely and effective security protection in specific circumstances; in addition, there are also problems such as slow response speed and inaccurate threat identification in intrusion detection and abnormal traffic identification. Summary of the Invention

[0004] Based on the above objectives, the present invention provides a distributed data security protection system based on Internet of Things nodes.

[0005] A distributed data security protection system based on Internet of Things nodes, including a security negotiation module, a dynamic encryption module, an identity authentication module, a data integrity detection module, and an intrusion detection module; wherein:

[0006] Security negotiation module: This module is configured on each IoT node and is used to dynamically select encryption algorithms, authentication mechanisms, and data transmission strategies based on the node's real-time security status and network environment when establishing a communication connection between nodes, and to generate corresponding security configuration parameters.

[0007] Dynamic encryption module: connected to the security negotiation module, used to receive security configuration parameters and encrypt the transmitted data based on node feature information and current network status;

[0008] Identity authentication module: used to authenticate nodes, verify the legitimacy of nodes and determine node access rights, ensuring that only authorized nodes can participate in data exchange;

[0009] Data integrity detection module: used to perform integrity check on the data in transmission, and verify whether the data has been tampered with by generating the hash value and signature information of the data;

[0010] Intrusion detection module: used to monitor the communication traffic of IoT nodes, analyze and identify potential security threats in real time to prevent intrusion behaviors from affecting the system.

[0011] Optionally, the security negotiation module includes a security status monitoring unit, a network environment monitoring unit, a policy selection unit, and a configuration parameter generation unit; wherein:

[0012] Security status monitoring unit: used to monitor the security status of each IoT node in real time, including the node's authentication status and system load;

[0013] Network environment monitoring unit: used to monitor current network environment parameters, including network bandwidth, latency, and node connection quality;

[0014] Policy selection unit: Based on the data provided by the security status monitoring unit and the network environment analysis unit, it dynamically selects encryption algorithms, authentication mechanisms, and data transmission strategies to meet the security requirements between different nodes;

[0015] Configuration parameter generation unit: used to generate corresponding security configuration parameters according to the selection result of the policy selection unit, and pass the security configuration parameters to the dynamic encryption module and the identity authentication module.

[0016] Optionally, the strategy selection unit includes:

[0017] Encryption algorithm selection: If the network bandwidth is less than 10 Mbps and the node load is greater than 80%, the AES symmetric encryption algorithm with low computational complexity is preferred. If the network bandwidth is greater than 100 Mbps and the node load is less than 50%, the RSA asymmetric encryption algorithm with high encryption strength is preferred.

[0018] Authentication mechanism selection: If the node authentication status is normal and the system load is less than 50%, select the authentication mechanism based on public key infrastructure; if the node load is greater than 80%, select the authentication mechanism based on shared key;

[0019] Data transmission strategy selection: If the network delay is less than 50ms and the bandwidth is greater than 100Mbps, select a lossless transmission strategy and use the TCP protocol for data transmission. If the network delay is greater than 200ms or the bandwidth is less than 10Mbps, select a fault-tolerant transmission strategy and use the UDP protocol in combination with a retransmission mechanism.

[0020] Optionally, the dynamic encryption module includes an encryption algorithm selection unit, a key management unit, and a data encryption processing unit; wherein:

[0021] Encryption algorithm selection unit: selects encryption algorithms based on node feature information and current network status, including symmetric encryption algorithm AES and asymmetric encryption algorithm RSA;

[0022] Key management unit: used to generate the corresponding encryption key according to the selected encryption algorithm;

[0023] Data encryption processing unit: uses the encryption algorithm selected by the encryption algorithm selection unit and the key generated by the key management unit to encrypt the data to be transmitted to ensure the confidentiality and integrity of the data during transmission.

[0024] Optionally, the identity authentication module includes an identity authentication unit, a rights management unit, an access control unit, and a log recording unit; wherein:

[0025] Authentication unit: used to receive identity information from communication nodes and verify the legitimacy of communication nodes by comparing it with the pre-stored legal identity database, ensuring that only legal nodes can pass authentication;

[0026] The authority management unit is used to consult the authority database based on the verification result of the identity authentication unit, determine the access authority level of the communication node, and generate the corresponding authority control policy;

[0027] Access control unit: used to dynamically adjust the access rights of communication nodes according to the permission control policy generated by the permission management unit, ensuring that nodes can only access authorized resources and functions;

[0028] Logging unit: used to record all authentication and permission management operation logs, including node authentication requests, verification results, and permission allocation.

[0029] Optionally, the rights management unit includes:

[0030] Permission query: Based on the authentication results, the permission database is searched for permission data that matches the node identity, and the node's preset permission level and access resource scope are obtained;

[0031] Generation of permission control policy: If the node identity is legal and the permission level is administrator, a full access permission control policy is generated, allowing the node to access all system resources; if the node identity is legal and the permission level is user, a limited access permission control policy is generated, allowing the node to access only specified system resources; if the node identity authentication fails or the permission level is no permission, access is denied.

[0032] Optionally, the data integrity detection module includes a hash value generation unit, a signature generation unit, a data receiving unit, a hash value verification unit, a signature verification unit, and a tampering detection unit; wherein:

[0033] Hash value generation unit: used to receive the data to be transmitted and generate the hash value of the data using the SHA-256 hash algorithm;

[0034] Signature generation unit: used to sign the data using the generated hash value and pre-stored private key before data transmission to generate a digital signature of the data;

[0035] Data receiving unit: used to receive data transmitted from IoT nodes and their accompanying digital signatures. The received data includes the original data and the signature information generated by the signature generation unit.

[0036] Hash value verification unit: used to recalculate the hash value of the received data and compare it with the received hash value; if the comparison result is consistent, it means that the data has not been tampered with; if the comparison result is inconsistent, it means that the data has been tampered with;

[0037] Signature verification unit: uses the received data and its accompanying digital signature, combined with the stored public key to verify the signature to determine whether the data has been tampered with;

[0038] Tamper detection unit: Based on the results of the hash value verification unit and the signature verification unit, it is used to generate an alarm message and trigger a security response when it detects that the data has been tampered with, including preventing the data from being transmitted further or notifying the system administrator.

[0039] Optionally, the signature verification unit includes:

[0040] Use the SHA-256 hash algorithm to calculate the hash value of the received data. The formula is: H(P) = SHA-256(P), where H(P) is the hash value of data P.

[0041] The extracted digital signature is decrypted using the public key to obtain the hash value used when signing, which is expressed as: H 签名 =decrypt(signature, public key);

[0042] Compare the calculated hash value H(P) with the decrypted hash value H签名 Whether it is consistent, the formula is:

[0043]

[0044] Tampering judgment: If the verification result is valid, it is confirmed that the data has not been tampered with, and the data is allowed to continue to be transmitted and processed; if the verification result is invalid, it is determined that the data has been tampered with, and the corresponding security response is triggered.

[0045] Optionally, the intrusion detection module includes a traffic monitoring unit, a feature extraction unit, a threat identification unit, and an alarm generation unit; wherein:

[0046] Traffic monitoring unit: used to continuously monitor the communication traffic between IoT nodes and collect metadata and content information of data packets, including source address, destination address, port number, protocol type, packet size and transmission rate;

[0047] Feature extraction unit: used to extract features from the monitored communication traffic and pass the extracted features to the threat identification unit;

[0048] Threat identification unit: uses decision tree algorithm to classify and analyze extracted feature vectors to identify potential security threats;

[0049] Alarm generation unit: When the threat identification unit detects a security threat, it generates and records security alarm information and sends an alarm notification to the system administrator.

[0050] Optionally, the threat identification unit includes:

[0051] Receiving feature vector: receiving the feature vector from the feature extraction unit and performing normalization processing;

[0052] Decision tree model application: The received feature vector is input into a pre-trained decision tree model, and layer-by-layer decisions are made based on the attribute values ​​in the feature vector to determine whether the data packet poses a security threat.

[0053] Classification decision step: The decision tree model is based on the attribute values ​​of the feature vector and follows predefined decision rules. Starting from the root node, it compares the feature values ​​with the node split values ​​in sequence, traversing down along the corresponding branch path until it reaches a leaf node, thereby classifying and determining whether the data packet is a potential security threat.

[0054] Threat type determination step: After reaching the leaf node, determine the specific threat type to which the data packet belongs based on the classification label of the leaf node.

[0055] Beneficial effects of the present invention:

[0056] The present invention, by combining multiple technical means such as dynamic security negotiation, encryption processing, identity authentication and intrusion detection, can flexibly adjust encryption algorithms, authentication mechanisms and data transmission strategies for different nodes and network states in the Internet of Things environment. This dynamic adaptability effectively solves the problems of fixed encryption configuration and inflexible authentication mechanism in traditional Internet of Things security systems. It can automatically select the most appropriate security configuration according to the real-time security status of the node and the network environment, ensuring the confidentiality and integrity of data during transmission.

[0057] The present invention continuously monitors the communication traffic of IoT nodes, analyzes data packet characteristics in real time, and identifies potential security threats. Combined with a decision tree algorithm, it can accurately classify various attack behaviors and generate corresponding security alarm information, effectively preventing malicious attacks or unauthorized access. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only for the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0059] Figure 1 Schematic diagram of a distributed data security protection system according to an embodiment of the present invention;

[0060] Figure 2 Schematic diagram of an intrusion detection module according to an embodiment of the present invention. DETAILED DESCRIPTION

[0061] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments. It is also noted that, to provide a more detailed description, the following embodiments are best and preferred embodiments, and those skilled in the art may employ alternative methods for implementing certain known technologies. Furthermore, the accompanying drawings are intended only to provide a more detailed description of the embodiments and are not intended to limit the present invention.

[0062] It should be noted that references in the specification to "one embodiment," "an embodiment," "an exemplary embodiment," "some embodiments," etc. indicate that the described embodiments may include specific features, structures, or characteristics, but not every embodiment necessarily includes such specific features, structures, or characteristics. In addition, when specific features, structures, or characteristics are described in conjunction with an embodiment, it is within the knowledge of persons skilled in the relevant art to implement such features, structures, or characteristics in conjunction with other embodiments (whether or not explicitly described).

[0063] In general, terms can be understood, at least in part, from their use in context. For example, depending at least in part on the context, the term "one or more" as used herein can be used to describe any feature, structure, or characteristic in the singular sense, or can be used to describe a combination of features, structures, or characteristics in the plural sense. Additionally, the term "based on" can be understood as not necessarily intended to convey an exclusive set of factors, but can instead, depending at least in part on the context, allow for the presence of other factors that are not necessarily explicitly described.

[0064] like Figure 1-Figure 2 As shown, a distributed data security protection system based on IoT nodes includes a security negotiation module, a dynamic encryption module, an identity authentication module, a data integrity detection module, and an intrusion detection module; wherein:

[0065] Security negotiation module: This module is configured on each IoT node and is used to dynamically select encryption algorithms, authentication mechanisms, and data transmission strategies based on the node's real-time security status and network environment when establishing a communication connection between nodes, and to generate corresponding security configuration parameters.

[0066] Dynamic encryption module: Connected to the security negotiation module, it receives security configuration parameters and encrypts the transmitted data based on node feature information and the current network status. The encryption process includes selecting the appropriate encryption algorithm and key length.

[0067] Identity authentication module: used to authenticate nodes, verify the legitimacy of nodes and determine node access rights, ensuring that only authorized nodes can participate in data exchange;

[0068] Data integrity detection module: used to perform integrity check on the data in transmission, and verify whether the data has been tampered with by generating the hash value and signature information of the data;

[0069] Intrusion detection module: used to monitor the communication traffic of IoT nodes, analyze and identify potential security threats in real time to prevent intrusion behaviors from affecting the system.

[0070] The security negotiation module includes a security status monitoring unit, a network environment monitoring unit, a policy selection unit, and a configuration parameter generation unit; wherein:

[0071] Security status monitoring unit: used to monitor the security status of each IoT node in real time, including the node's authentication status and system load;

[0072] Network environment monitoring unit: used to monitor current network environment parameters, including network bandwidth, latency, and node connection quality;

[0073] Policy selection unit: Based on the data provided by the security status monitoring unit and the network environment analysis unit, it dynamically selects encryption algorithms, authentication mechanisms, and data transmission strategies to meet the security requirements between different nodes;

[0074] Configuration parameter generation unit: used to generate corresponding security configuration parameters based on the selection results of the policy selection unit, and pass the security configuration parameters to the dynamic encryption module and identity authentication module to guide the subsequent data encryption processing and identity authentication process; through the above design, the security negotiation module can dynamically select the appropriate encryption algorithm, authentication mechanism and data transmission strategy according to the real-time security status and network environment of the IoT node, and generate corresponding security configuration parameters. This dynamic adjustment mechanism ensures that the system can maintain efficient and secure data transmission in different environments, thereby improving the overall data protection capability.

[0075] The strategy selection unit includes:

[0076] Encryption algorithm selection: If the network bandwidth is less than 10 Mbps and the node load is greater than 80%, the AES symmetric encryption algorithm with low computational complexity is preferred. If the network bandwidth is greater than 100 Mbps and the node load is less than 50%, the RSA asymmetric encryption algorithm with high encryption strength is preferred.

[0077] Authentication mechanism selection: If the node authentication status is normal and the system load is less than 50%, select an authentication mechanism based on public key infrastructure (PKI); if the node load is greater than 80%, select an authentication mechanism based on a shared key, such as HMAC (Hash-based Message Authentication Code);

[0078] Data transmission strategy selection: If the network delay is less than 50ms and the bandwidth is greater than 100Mbps, select a lossless transmission strategy and use the TCP protocol for data transmission; if the network delay is greater than 200ms or the bandwidth is less than 10Mbps, select a fault-tolerant transmission strategy and use the UDP protocol in combination with a retransmission mechanism to ensure data reliability; through the above design, the strategy selection unit can intelligently select the appropriate encryption algorithm, authentication mechanism and data transmission strategy based on the real-time monitored network status, node load and security requirements; this dynamic adjustment mechanism ensures that the system can operate efficiently under different network conditions and load conditions, while providing strong data protection capabilities.

[0079] The dynamic encryption module includes an encryption algorithm selection unit, a key management unit, and a data encryption processing unit; wherein:

[0080] Encryption algorithm selection unit: selects encryption algorithms based on node feature information and current network status, including symmetric encryption algorithm AES (Advanced Encryption Standard) and asymmetric encryption algorithm RSA (Rivest–Shamir–Adleman);

[0081] Key management unit: used to generate the corresponding encryption key according to the selected encryption algorithm, and is responsible for the distribution, storage and regular update of the key to ensure the security and effectiveness of the key;

[0082] Data encryption processing unit: Use the encryption algorithm selected by the encryption algorithm selection unit and the key generated by the key management unit to encrypt the data to be transmitted, ensuring the confidentiality and integrity of the data during transmission; through the above design, the dynamic encryption module can intelligently select the most suitable encryption algorithm and effectively manage the encryption key based on the characteristic information and real-time network status of the IoT node, realizing efficient and secure data encryption processing.

[0083] The identity authentication module includes an identity authentication unit, a rights management unit, an access control unit, and a log recording unit; wherein:

[0084] Authentication unit: used to receive identity information from communication nodes and verify the legitimacy of communication nodes by comparing it with the pre-stored legal identity database, ensuring that only legal nodes can pass authentication;

[0085] The authority management unit is used to consult the authority database based on the verification result of the identity authentication unit, determine the access authority level of the communication node, and generate the corresponding authority control policy;

[0086] Access control unit: used to dynamically adjust the access rights of communication nodes according to the permission control policy generated by the permission management unit, ensuring that nodes can only access authorized resources and functions;

[0087] Logging unit: used to record all authentication and permission management operation logs, including the node's authentication request, verification results and permission allocation, to facilitate subsequent auditing and tracing.

[0088] The permission management unit includes:

[0089] Permission query: Based on the authentication results, the permission database is searched for permission data that matches the node identity, and the node's preset permission level and access resource scope are obtained;

[0090] Generation of permission control policy: If the node identity is legal and the permission level is administrator, a full access permission control policy is generated, allowing the node to access all system resources; if the node identity is legal and the permission level is user, a limited access permission control policy is generated, allowing the node to access only specified system resources; if the node identity authentication fails or the permission level is no permission, access is denied; through the above design, the permission management unit can generate flexible and dynamic permission control policies based on the node's authentication results, data in the permission database, and real-time network conditions. This policy generation mechanism ensures that nodes can obtain appropriate access rights according to actual needs in different scenarios, effectively controlling the node's access to system resources.

[0091] The data integrity detection module includes a hash value generation unit, a signature generation unit, a data receiving unit, a hash value verification unit, a signature verification unit, and a tamper detection unit; wherein:

[0092] Hash value generation unit: used to receive the data to be transmitted and generate the hash value of the data using the SHA-256 hash algorithm; the hash value is the only representation of the data, and any slight change in the data will cause a change in the hash value, ensuring the integrity of the data;

[0093] Signature generation unit: used to sign the data using the generated hash value and pre-stored private key before data transmission to generate a digital signature of the data; this signature can be used to verify the integrity of the data and ensure that the data has not been tampered with;

[0094] Data receiving unit: used to receive data transmitted from IoT nodes and their accompanying digital signatures. The received data includes the original data and the signature information generated by the signature generation unit.

[0095] Hash value verification unit: used to recalculate the hash value of the received data and compare it with the received hash value; if the comparison result is consistent, it means that the data has not been tampered with; if the comparison result is inconsistent, it means that the data has been tampered with;

[0096] Signature verification unit: uses the received data and its accompanying digital signature, combined with the stored public key to verify the signature to determine whether the data has been tampered with;

[0097] Tamper detection unit: Based on the results of the hash value verification unit and the signature verification unit, it is used to generate an alarm message and trigger a security response when it detects that the data has been tampered with, including preventing the data from being transmitted or notifying the system administrator. Through the above design, the data integrity detection module implements strict verification of the integrity of the transmitted data through hash value and digital signature technology to ensure that the data has not been tampered with during the transmission process. The hash value generation unit and the signature generation unit provide an effective data verification mechanism, while the hash value verification unit and the signature verification unit ensure the legitimacy and integrity of the data. This mechanism can promptly detect data tampering and trigger a corresponding security response, effectively ensuring the security and reliability of data in the Internet of Things system.

[0098] The signature verification unit includes:

[0099] Use the SHA-256 hash algorithm to calculate the hash value of the received data. The formula is: H(P) = SHA-256(P), where H(P) is the hash value of data P.

[0100] Use the public key to decrypt the extracted digital signature and get the hash value used when signing. The expression is: H 签名 =decrypt(signature, public key);

[0101] Compare the calculated hash value H(P) with the decrypted hash value H 签名 Whether it is consistent, the formula is:

[0102]

[0103] Tampering judgment: If the verification result is valid, it is confirmed that the data has not been tampered with, and the data is allowed to continue to be transmitted and processed; if the verification result is invalid, it is determined that the data has been tampered with, and a corresponding security response is triggered; through the above design, the policy selection unit can effectively use the received data and its accompanying digital signature, combined with the stored public key to perform strict signature verification, so as to accurately determine whether the data has been tampered with during transmission. This mechanism ensures the integrity of the data and the credibility of the source, and prevents malicious tampering from affecting the system.

[0104] The intrusion detection module includes a traffic monitoring unit, a feature extraction unit, a threat identification unit, and an alarm generation unit; wherein:

[0105] Traffic monitoring unit: used to continuously monitor the communication traffic between IoT nodes and collect metadata and content information of data packets, including source address, destination address, port number, protocol type, packet size and transmission rate;

[0106] Feature extraction unit: used to extract features from the monitored communication traffic, such as the transmission rate and size of data packets, the frequency of packets and their changing trends, and pass the extracted features to the threat identification unit;

[0107] Threat identification unit: uses decision tree algorithm to classify and analyze extracted feature vectors to identify potential security threats;

[0108] Alarm generation unit: When the threat identification unit detects a security threat, it generates and records security alarm information and sends an alarm notification to the system administrator. Through the above design, the intrusion detection module can comprehensively monitor and analyze the communication traffic between IoT nodes, and use the decision tree algorithm to accurately identify potential security threats. Once a threat is detected, the alarm generation unit can generate and record alarm information in a timely manner and notify the system administrator to take corresponding measures, thereby effectively preventing and responding to intrusion behaviors and improving the overall security protection capabilities of the system.

[0109] The Threat Identification Unit includes:

[0110] Receiving feature vector: receiving the feature vector from the feature extraction unit and performing normalization processing;

[0111] Decision tree model application: The received feature vector is input into a pre-trained decision tree model, and layer-by-layer decisions are made based on the attribute values ​​in the feature vector to determine whether the data packet poses a security threat.

[0112] Classification decision step: The decision tree model is based on the attribute values ​​of the feature vector and follows predefined decision rules. Starting from the root node, it compares the feature values ​​with the node split values ​​in sequence, traversing down along the corresponding branch path until it reaches a leaf node, thereby classifying and determining whether the data packet is a potential security threat.

[0113] The predefined decision rules include:

[0114] Rule 1: If the source address of a data packet is an IP address in the blacklist and the transmission rate exceeds 1000 packets / second, the data packet is classified as a "Denial of Service (DoS) attack";

[0115] Rule 2: If the protocol type of the data packet is an abnormal protocol (non-standard protocol) and the port number is a high-risk port (such as 8080), then the data packet is classified as "malware propagation";

[0116] Rule 3: If the packet size of a data packet is less than 50 bytes and the transmission rate increases suddenly, the packet is classified as an "information leakage attempt";

[0117] Rule 4: If the source and destination addresses of a packet change frequently and the system load is higher than 80%, the packet is classified as a "man-in-the-middle attack";

[0118] Rule 5: If the source and destination addresses of a packet are both internal network addresses, but the protocol type is an external suspicious protocol, the packet is classified as an "internal threat";

[0119] Rule 6: If the transmission rate of a packet exceeds twice the normal level and the packet size fluctuates continuously, the packet is classified as an "abnormal traffic pattern";

[0120] Rule 7: If the source address of a data packet comes from an unauthorized geographic area and the protocol type is a high-risk protocol, the data packet is classified as a "geographically abnormal attack";

[0121] Rule 8: If the source address of the data packet is a known malicious IP and the protocol type is a standard protocol, then the data packet is classified as "known malicious activity";

[0122] Rule 9: If the packet size of a data packet continues to increase and the transmission rate remains stable, the packet is classified as a "packet inflation attack";

[0123] Rule 10: If the source address and destination address of a data packet match a specific attack pattern (such as a scanning attack), the data packet is classified as a "scanning attack";

[0124] Threat type determination step: After reaching the leaf node, determine the specific threat type to which the data packet belongs based on the classification label of the leaf node.

[0125] The application steps of the above decision tree model include:

[0126] Step 1: Based on the attribute values ​​in the feature vector, predefined decision rules (rules 1 to 10) are applied one by one to determine whether the data packet meets the characteristic conditions of a specific threat type;

[0127] Step 2: Once a packet meets the conditions of a rule, it is classified as the corresponding threat type and further rule matching stops;

[0128] In step 3, if the data packet meets the conditions of multiple rules at the same time, the most serious threat type is selected for classification according to the predetermined priority order; through this design, the threat identification unit can achieve efficient and accurate security threat monitoring and identification in the IoT environment, significantly improving the overall data security protection level and ensuring the reliable operation of the IoT system.

[0129] The present invention encompasses any alternatives, modifications, equivalents, and solutions that fall within the spirit and scope of the present invention. To provide a thorough understanding of the present invention, specific details are described in detail below in connection with the preferred embodiments of the present invention, but those skilled in the art will be able to fully understand the present invention without these detailed descriptions. Furthermore, to avoid unnecessary confusion regarding the essence of the present invention, well-known methods, processes, procedures, components, and circuits have not been described in detail.

[0130] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A distributed data security protection system based on Internet of Things nodes, characterized in that: It includes a security negotiation module, a dynamic encryption module, an identity authentication module, a data integrity detection module, and an intrusion detection module; among which: Security negotiation module: This module is configured on each IoT node and is used to dynamically select encryption algorithms, authentication mechanisms, and data transmission strategies based on the node's real-time security status and network environment when establishing a communication connection between nodes, and to generate corresponding security configuration parameters. The security negotiation module includes a security status monitoring unit, a network environment monitoring unit, a policy selection unit, and a configuration parameter generation unit; wherein: Security status monitoring unit: used to monitor the security status of each IoT node in real time, including the node's authentication status and system load; Network environment monitoring unit: used to monitor current network environment parameters, including network bandwidth, latency, and node connection quality; Policy selection unit: Based on the data provided by the security status monitoring unit and the network environment analysis unit, it dynamically selects encryption algorithms, authentication mechanisms, and data transmission strategies to meet the security requirements between different nodes; Configuration parameter generation unit: used to generate corresponding security configuration parameters according to the selection result of the policy selection unit, and pass the security configuration parameters to the dynamic encryption module and the identity authentication module; The strategy selection unit includes: Encryption algorithm selection: If the network bandwidth is less than 10 Mbps and the node load is greater than 80%, the AES symmetric encryption algorithm with low computational complexity is preferred. If the network bandwidth is greater than 100 Mbps and the node load is less than 50%, the RSA asymmetric encryption algorithm with high encryption strength is preferred. Authentication mechanism selection: If the node authentication status is normal and the system load is less than 50%, select the authentication mechanism based on public key infrastructure; if the node load is greater than 80%, select the authentication mechanism based on shared key; Data transmission strategy selection: If the network delay is less than 50ms and the bandwidth is greater than 100Mbps, select a lossless transmission strategy and use the TCP protocol for data transmission. If the network delay is greater than 200ms or the bandwidth is less than 10Mbps, select a fault-tolerant transmission strategy and use the UDP protocol in combination with a retransmission mechanism. Dynamic encryption module: connected to the security negotiation module, used to receive security configuration parameters and encrypt the transmitted data based on node feature information and current network status; Identity authentication module: used to authenticate nodes, verify the legitimacy of nodes and determine node access rights, ensuring that only authorized nodes can participate in data exchange; Data integrity detection module: used to perform integrity check on the data in transmission, and verify whether the data has been tampered with by generating the hash value and signature information of the data; The data integrity detection module includes a hash value generation unit, a signature generation unit, a data receiving unit, a hash value verification unit, a signature verification unit, and a tampering detection unit; wherein: Hash value generation unit: used to receive the data to be transmitted and generate the hash value of the data using the SHA-256 hash algorithm; Signature generation unit: used to sign the data using the generated hash value and pre-stored private key before data transmission to generate a digital signature of the data; Data receiving unit: used to receive data transmitted from IoT nodes and their accompanying digital signatures. The received data includes the original data and the signature information generated by the signature generation unit. Hash value verification unit: used to recalculate the hash value of the received data and compare it with the received hash value; if the comparison result is consistent, it means that the data has not been tampered with; if the comparison result is inconsistent, it means that the data has been tampered with; Signature verification unit: uses the received data and its accompanying digital signature, combined with the stored public key to verify the signature to determine whether the data has been tampered with; Tamper detection unit: Based on the results of the hash value verification unit and the signature verification unit, it is used to generate an alarm message and trigger a security response when it detects that the data has been tampered with, including blocking the further transmission of the data or notifying the system administrator; Intrusion detection module: used to monitor the communication traffic of IoT nodes, analyze and identify potential security threats in real time to prevent intrusion behaviors from affecting the system.

2. A distributed data security protection system based on Internet of Things nodes according to claim 1, characterized in that: The dynamic encryption module includes an encryption algorithm selection unit, a key management unit, and a data encryption processing unit; wherein: Encryption algorithm selection unit: selects encryption algorithms based on node feature information and current network status, including symmetric encryption algorithm AES and asymmetric encryption algorithm RSA; Key management unit: used to generate the corresponding encryption key according to the selected encryption algorithm; Data encryption processing unit: uses the encryption algorithm selected by the encryption algorithm selection unit and the key generated by the key management unit to encrypt the data to be transmitted to ensure the confidentiality and integrity of the data during transmission.

3. A distributed data security protection system based on Internet of Things nodes according to claim 1, characterized in that: The identity authentication module includes an identity authentication unit, a rights management unit, an access control unit, and a log recording unit; wherein: Authentication unit: used to receive identity information from communication nodes and verify the legitimacy of communication nodes by comparing it with the pre-stored legal identity database, ensuring that only legal nodes can pass authentication; The authority management unit is used to consult the authority database based on the verification result of the identity authentication unit, determine the access authority level of the communication node, and generate the corresponding authority control policy; Access control unit: used to dynamically adjust the access rights of communication nodes according to the permission control policy generated by the permission management unit, ensuring that nodes can only access authorized resources and functions; Logging unit: used to record all authentication and permission management operation logs, including node authentication requests, verification results, and permission allocation.

4. A distributed data security protection system based on Internet of Things nodes according to claim 3, characterized in that: The rights management unit includes: Permission query: Based on the authentication results, the permission database is searched for permission data that matches the node identity, and the node's preset permission level and access resource scope are obtained; Generation of permission control policy: If the node identity is legal and the permission level is administrator, a full access permission control policy is generated, allowing the node to access all system resources; if the node identity is legal and the permission level is user, a limited access permission control policy is generated, allowing the node to access only specified system resources; if the node identity authentication fails or the permission level is no permission, access is denied.

5. A distributed data security protection system based on Internet of Things nodes according to claim 1, characterized in that: The signature verification unit includes: Use the SHA-256 hash algorithm to calculate the hash value of the received data. The formula is: H(P) = SHA-256(P), where H(P) is the hash value of data P. The extracted digital signature is decrypted using the public key to obtain the hash value used when signing, which is expressed as: H 签名 =decrypt(signature, public key); Compare the calculated hash value H(P) with the decrypted hash value H 签名 Whether it is consistent, the formula is: Tampering judgment: If the verification result is valid, it is confirmed that the data has not been tampered with, and the data is allowed to continue to be transmitted and processed; if the verification result is invalid, it is determined that the data has been tampered with, and the corresponding security response is triggered.

6. A distributed data security protection system based on Internet of Things nodes according to claim 1, characterized in that: The intrusion detection module includes a traffic monitoring unit, a feature extraction unit, a threat identification unit, and an alarm generation unit; wherein: Traffic monitoring unit: used to continuously monitor the communication traffic between IoT nodes and collect metadata and content information of data packets, including source address, destination address, port number, protocol type, packet size and transmission rate; Feature extraction unit: used to extract features from the monitored communication traffic and pass the extracted features to the threat identification unit; Threat identification unit: uses decision tree algorithm to classify and analyze extracted feature vectors to identify potential security threats; Alarm generation unit: When the threat identification unit detects a security threat, it generates and records security alarm information and sends an alarm notification to the system administrator.

7. A distributed data security protection system based on Internet of Things nodes according to claim 6, characterized in that: The threat identification unit includes: Receiving feature vector: receiving the feature vector from the feature extraction unit and performing normalization processing; Decision tree model application: The received feature vector is input into a pre-trained decision tree model, and layer-by-layer decisions are made based on the attribute values ​​in the feature vector to determine whether the data packet poses a security threat. Classification decision step: The decision tree model is based on the attribute values ​​of the feature vector and follows predefined decision rules. Starting from the root node, it compares the feature values ​​with the node split values ​​in sequence, traversing down along the corresponding branch path until it reaches a leaf node, thereby classifying and determining whether the data packet is a potential security threat. Threat type determination step: After reaching the leaf node, determine the specific threat type to which the data packet belongs based on the classification label of the leaf node.

Images