Security reinforcement method, device and equipment for Internet of Things terminal firmware and medium

Abstract

The invention provides an Internet of Things terminal firmware security reinforcement method and device, equipment and a medium. The problems that in the prior art, security protection of Internet of Things terminal firmware is not comprehensive, not timely and not rapid are effectively solved. The method comprises the following steps: the SDK module identifies asset information of a plurality of Internet of Things terminals in the Internet of Things system, and monitors a real-time asset state generated by operation of the plurality of Internet of Things terminals in real time; the SDK module screens the real-time asset state to obtain an abnormal behavior so as to obtain a corresponding security disposal strategy based on the abnormal behavior; the SDK module obtains a plurality of stage disposal results, and dynamically adjusts the security disposal strategy based on the stage disposal results; and the emergency response module and the security module execute the dynamically adjusted security disposal strategy to obtain an optimal security disposal result so as to complete security reinforcement of the Internet of Things terminal firmware based on the optimal security disposal result.

Description

Technical Field

[0001] The present application relates to the field of Internet of Things security technology, and more specifically, to a method, device, equipment and medium for security reinforcement of Internet of Things terminal firmware. Background Art

[0002] In recent years, with the rapid development of the Internet of Things, IoT security incidents have occurred frequently. From the perspective of wired connections, IoT devices are usually connected to the network through Ethernet wires. These connection methods provide higher stability and security because they are not susceptible to wireless signal interference or external attacks. However, wired connections also have some limitations, such as high wiring costs and poor flexibility, which may not be applicable in some application scenarios. From the perspective of wireless connections, IoT devices widely use Wi-Fi, 4G and 5G technologies for wireless communication. 4G networks have been popularized worldwide, providing high data transmission rates and low latency, which are suitable for application scenarios that require real-time data transmission. 5G technology further improves network speed and connection density, supporting more IoT devices to be online at the same time, which is crucial for large-scale IoT applications such as smart cities and smart power. However, wireless connections also face security challenges, such as signal interference and device vulnerability. In addition, since 5G devices generally have lower computing and storage capabilities, they have certain limitations in security protection.

[0003] The current status of IoT terminal connection involves a variety of connection methods and technologies, each with its own advantages and disadvantages. With the development of technology, how to balance performance, security and cost will be an important issue for the future development of IoT. Existing technologies often rely on traditional firewalls, intrusion detection systems and other means for the security protection of IoT terminal (IOT terminal) firmware. Although these means can ensure the security of devices to a certain extent, they have the following shortcomings:

[0004] Incomplete asset identification: Existing technologies are often unable to proactively and comprehensively identify the assets of IoT terminals, resulting in security managers having an unclear understanding of the asset count and difficulty in conducting effective security management.

[0005] Untimely threat monitoring: Existing technologies often rely on static rule bases or signature bases for threat monitoring, which have limited monitoring capabilities for new or variant threats, resulting in untimely threat detection.

[0006] Slow emergency response: After abnormal behavior is discovered, the emergency response of existing technologies often relies on manual intervention, which is slow to respond and may cause greater safety risks due to improper operation of personnel. Summary of the invention

[0007] In view of this, the purpose of the present application is to provide a method, device, equipment and medium for security reinforcement of IoT terminal firmware. The method, device, equipment and medium for security reinforcement of IoT terminal firmware effectively solve the problems of incompleteness, untimeliness and slowness in the security protection of IoT terminal firmware in the prior art.

[0008] In a first aspect, an embodiment of the present application provides a method for security reinforcement of IoT terminal firmware, which is applied to an IoT system, wherein the IoT system includes an SDK module, an emergency response module, a security module, and multiple IoT terminals, and the method includes:

[0009] The SDK module identifies the asset information of multiple IoT terminals in the IoT system, and monitors the real-time asset status generated by the operation of multiple IoT terminals in real time; the asset information has multiple types;

[0010] The SDK module screens the real-time asset status based on multiple dimensions to obtain abnormal behaviors, so as to trigger the emergency response module based on the abnormal behaviors to obtain corresponding safety disposal strategies; different types of abnormal behaviors correspond to different safety disposal strategies;

[0011] Based on the security disposal strategy, the SDK module controls the emergency response module to link with the security module to jointly execute the corresponding security disposal strategy to obtain multiple stage disposal results, and dynamically adjusts the security disposal strategy based on the stage disposal results;

[0012] The emergency response module and the security module execute the dynamically adjusted security handling strategy to obtain the best security handling result, so as to complete the security reinforcement of the IoT terminal firmware based on the best security handling result.

[0013] In combination with the first aspect, an embodiment of the present application provides a first possible implementation of the first aspect, wherein the SDK module screens the real-time asset status based on multiple dimensions to obtain abnormal behavior, so as to trigger an emergency response mechanism based on the abnormal behavior to obtain a corresponding safety disposal strategy, including:

[0014] The SDK module determines whether the real-time asset status meets the preset dimensional abnormal conditions based on multiple dimensions to determine whether the IoT terminal has abnormal behavior;

[0015] If so, the SDK module controls the emergency response module to determine a corresponding safety handling strategy based on the dimension corresponding to the abnormal behavior.

[0016] In combination with the first aspect, an embodiment of the present application provides a second possible implementation of the first aspect, wherein the SDK module controls the emergency response module to determine a corresponding security disposal strategy based on the dimension corresponding to the abnormal behavior, including:

[0017] The SDK module generates a trigger instruction based on the abnormal behavior to trigger the emergency response module; the trigger instruction includes the dimension of the abnormal behavior;

[0018] The emergency response module generates an optimal safety handling strategy based on the abnormal behavior and the dimension of the abnormal behavior.

[0019] In combination with the first aspect, an embodiment of the present application provides a third possible implementation of the first aspect, wherein the SDK module controls the emergency response module to link with the security module to jointly execute the corresponding security disposal strategy based on the security disposal strategy to obtain multiple stage disposal results, and dynamically adjusts the security disposal strategy based on the stage disposal results, including:

[0020] The emergency response module links with the security module to execute the security disposal strategy in stages to obtain the stage disposal result corresponding to each stage;

[0021] The SDK module controls the emergency response module to dynamically adjust the safety handling strategy based on the stage handling result.

[0022] In combination with the first aspect, the embodiment of the present application provides a fourth possible implementation of the first aspect, wherein the SDK module controls the emergency response module to dynamically adjust the security handling strategy based on the stage handling result, including:

[0023] The SDK module determines whether the real-time asset status corresponding to the stage disposal result meets the expected result;

[0024] If not, the SDK module generates a policy adjustment instruction to enable the emergency response module to respond to the policy adjustment instruction.

[0025] In combination with the first aspect, the embodiment of the present application provides a fifth possible implementation of the first aspect, wherein the SDK module identifies the asset information of multiple IoT terminals in the IoT system and monitors the real-time asset status generated by the operation of the multiple IoT terminals in real time, including:

[0026] The IoT terminal downloads the corresponding SDK data package based on the terminal type, and performs configuration to obtain the configuration result;

[0027] A corresponding security disposal strategy is configured based on the configuration result and the asset information of the Internet of Things terminal where the SDK module is located to complete the configuration of the SDK module.

[0028] In combination with the first aspect, the embodiment of the present application provides a sixth possible implementation of the first aspect, wherein the SDK module includes a log unit;

[0029] After the emergency response module and the security module execute the dynamically adjusted security handling strategy to obtain the best security handling result, and complete the security reinforcement of the IoT terminal firmware based on the best security handling result, the method includes:

[0030] The SDK module generates a recording instruction based on the optimal security disposal result, and sends the recording instruction to the log unit;

[0031] The log unit responds to the recording instruction and generates log data corresponding to the security reinforcement process.

[0032] In a second aspect, an embodiment of the present application provides a security reinforcement device for an IoT terminal firmware, which is applied to an IoT system. The IoT system includes an SDK module, an emergency response module, a security module, and multiple IoT terminals. The device includes:

[0033] An identification module, used for the SDK module to identify the asset information of multiple IoT terminals in the IoT system, and to monitor the real-time asset status generated by the operation of multiple IoT terminals in real time; the asset information may be of multiple types;

[0034] A screening module, used for the SDK module to screen the real-time asset status based on multiple dimensions to obtain abnormal behaviors, so as to trigger the emergency response module based on the abnormal behaviors to obtain corresponding safety disposal strategies; different types of abnormal behaviors correspond to different safety disposal strategies;

[0035] A control module, which is used for the SDK module to control the emergency response module to link with the security module to jointly execute the corresponding security disposal strategy based on the security disposal strategy to obtain multiple stage disposal results, and dynamically adjust the security disposal strategy based on the stage disposal results;

[0036] The reinforcement module is used for the emergency response module and the security module to execute the dynamically adjusted security disposal strategy to obtain the best security disposal result, so as to complete the security reinforcement of the IoT terminal firmware based on the best security disposal result.

[0037] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, any step of a method for security reinforcement of IoT terminal firmware is performed.

[0038] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of any one of the methods for security reinforcement of IoT terminal firmware are executed.

[0039] A security reinforcement method for an Internet of Things terminal firmware provided in an embodiment of the present application is applied to an Internet of Things system, wherein the Internet of Things system includes an SDK module, an emergency response module, a security module, and multiple Internet of Things terminals. The method first identifies the asset information of multiple Internet of Things terminals in the Internet of Things system through the SDK module, and monitors the real-time asset status generated by the operation of multiple Internet of Things terminals in real time; there are multiple types of the asset information; secondly, the SDK module screens the real-time asset status based on multiple dimensions to obtain abnormal behaviors, so as to trigger the emergency response module based on the abnormal behaviors to obtain corresponding security disposal strategies; different types of abnormal behaviors correspond to different security disposal strategies; then the SDK module controls the linkage of the emergency response module based on the security disposal strategy. The security modules jointly execute the corresponding security disposal strategies to obtain multi-stage disposal results, and dynamically adjust the security disposal strategies based on the stage disposal results; finally, the emergency response module and the security module execute the dynamically adjusted security disposal strategies to obtain the best security disposal results, so as to complete the security reinforcement of the IoT terminal firmware based on the best security disposal results, thereby solving the problems of incomplete, untimely and slow security protection of IoT terminal firmware in the prior art, and realizing comprehensive, timely and fast security protection effects based on the emergency response module and SDK module, which can timely discover and handle security vulnerabilities and threats, ensure the stable operation of the entire IoT system, and greatly improve the security of multiple IoT terminal firmware in the IoT system. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0041] Figure 1 A schematic diagram of a process for a first method for strengthening the security of IoT terminal firmware provided by an embodiment of the present application is shown;

[0042] Figure 2 A schematic diagram of the structure of the Internet of Things system provided by an embodiment of the present application is shown;

[0043] Figure 3 A schematic diagram of the process of configuring the SDK module provided in an embodiment of the present application is shown;

[0044] Figure 4 A schematic diagram of the structure of a first security reinforcement device for IoT terminal firmware provided by an embodiment of the present application is shown;

[0045] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0046] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0047] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0048] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0049] Existing technologies often rely on traditional firewalls, intrusion detection systems and other means for the security protection of IoT terminal firmware. Although these means can ensure the security of equipment to a certain extent, they have the following shortcomings: incomplete asset identification, untimely threat monitoring, and slow emergency response, which results in the IoT terminal firmware being unable to play a more obvious security protection role.

[0050] Based on this, the embodiments of the present application provide a method, device, equipment and medium for security reinforcement of IoT terminal firmware, which is described below through embodiments.

[0051] Example 1

[0052] To facilitate understanding of this embodiment, a security reinforcement method for an IoT terminal firmware disclosed in an embodiment of this application is first introduced in detail. Figure 1 The flowchart of a method for security reinforcement of an Internet of Things terminal firmware shown in the figure, a method for security reinforcement of an Internet of Things terminal firmware provided by the present application, is applied to an Internet of Things system, the Internet of Things system includes an SDK module, an emergency response module, a security module and multiple Internet of Things terminals, the method includes:

[0053] S101, the SDK module identifies the asset information of multiple IoT terminals in the IoT system, and monitors the real-time asset status generated by the operation of the multiple IoT terminals in real time; the asset information has multiple types;

[0054] S102, the SDK module screens the real-time asset status based on multiple dimensions to obtain abnormal behaviors, so as to trigger the emergency response module based on the abnormal behaviors to obtain corresponding safety disposal strategies; different types of abnormal behaviors correspond to different safety disposal strategies;

[0055] S103, the SDK module controls the emergency response module to link with the security module to jointly execute the corresponding security disposal strategy based on the security disposal strategy to obtain multiple stage disposal results, and dynamically adjusts the security disposal strategy based on the stage disposal results;

[0056] S104: The emergency response module and the security module execute the dynamically adjusted security handling strategy to obtain the best security handling result, so as to complete the security reinforcement of the IoT terminal firmware based on the best security handling result.

[0057] In this application, the IoT terminal firmware refers to the software stored in the hardware electronic device within the IoT terminal. It is responsible for providing basic operating instructions and functions for the device. The firmware is the first part to run when the device is powered on. It can run without going through an API, operating system or device driver, thereby providing the device with the required instructions and instructions to communicate with other devices or perform basic tasks and functions as expected.

[0058] In step S101, the SDK module is an important component of the Internet of Things system. Figure 2 As shown, it realizes the comprehensive collection, transmission and reporting of asset information through the MQTT interface, so that developers can interact with the Internet of Things system more conveniently. The Internet of Things terminal refers to various devices in the Internet of Things system, such as sensors, smart home appliances, smart security equipment, etc. The specific Internet of Things terminal is determined according to the actual use scenario. The SDK module identifies the asset information of multiple Internet of Things terminals in the Internet of Things system based on the configured functions or interfaces. The asset information refers to the relevant data of these Internet of Things terminals, including but not limited to the model, manufacturer, serial number, installation location, number of the Internet of Things system to which the device belongs, etc. There are many types of asset information, that is, different Internet of Things terminals have different asset information. For example, a smart security camera may have information about its resolution, viewing angle, storage capacity, etc., while a smart light bulb may have information about its brightness, color temperature, power consumption, etc., and monitor the real-time asset status generated by the operation of multiple Internet of Things terminals in real time. The real-time asset status includes basic information such as operation status, network connection status, sensor readings, device switch status, energy consumption, etc., as well as process information, network card status, firewall status, open ports, resource overlimit, etc., so that security management personnel can fully and accurately grasp the asset base and provide strong support for subsequent security management.

[0059] The comprehensive collection, transmission and reporting of asset information through the MQTT interface can not only sort out and archive the basic information of IoT terminals, but also monitor the online connection status of each node in real time and comprehensively evaluate the safety score of assets. Once the terminal is found to be offline or behaves abnormally, the system can immediately issue an early warning, which greatly improves the efficiency and security of asset management. Other communication protocols can also be used, such as CoAP (Constrained Application Protocol) or AMQP (Advanced Message Queuing Protocol), which also support data reporting and processing of IoT devices.

[0060] In the specific implementation process of step S101, there is an embodiment: Figure 3As shown, the SDK module identifies the asset information of multiple IoT terminals in the IoT system and monitors the real-time asset status generated by the operation of multiple IoT terminals in real time, including:

[0061] S1011, the IoT terminal downloads the corresponding SDK data package based on the terminal type, and performs configuration to obtain a configuration result;

[0062] S1012. Configure a corresponding security disposal strategy based on the configuration result and the asset information of the Internet of Things terminal where the SDK module is located to complete the configuration of the SDK module.

[0063] In steps S1011-S1012, the IoT terminal has multiple types, and different types correspond to different SDK data packets. The type of the IoT terminal is pre-determined to determine the download of the corresponding SDK data packet and install it, such as installing the IoT Node.js SDK data packet through the npm command, or installing the IoT Python SDK data packet through the pip3 command. After the download is complete, a configuration object is created to store the SDK initialization information. This information usually includes AccessKeyID, AccessKey Secret, regional ID, etc. For example, in the Java IoT platform SDK, a Config object can be created to store this information, and configuration is performed to obtain the configuration result. The configuration aspects include configuring the interface, configuring the protocol, configuring the environment variables, setting the compiler and building tools, configuring the communication parameters, etc., wherein the communication parameters include the IoT terminal ID, key, server address, and after the configuration is completed, the compiler and building tools are used to compile and build the terminal code to ensure that the code can correctly generate an executable file; the SDK data packet usually includes some sample code or test projects. Running these sample codes can check whether the SDK works properly and whether the configuration is correct, that is, use the methods provided by the SDK to initialize the IoT terminal instance, for example, you can call the iot.NewClient(config) method to load the configuration information and create a client instance; use the configured communication parameters to test whether the communication between the terminal and the IoT system is normal, which can be verified by sending and receiving data packets; if the configuration result fails, take corresponding measures according to the cause of the failure to ensure that the configuration result is successful. When the configuration result is successful, set the corresponding security disposal policy for the SDK. The security disposal policy includes measures such as encrypted data transmission, implementation of access control, and disabling of unnecessary services and ports. However, the security disposal policy corresponds to the asset information of the IoT terminal, that is, it is highly targeted in terms of security, and is set specifically according to the actual situation. In addition, the device can be regularly updated and maintained to ensure security, thereby completing the configuration of the SDK module.

[0064] In step S102, the SDK module screens the real-time asset status based on multiple dimensions to obtain abnormal behaviors, including denial of service attacks DOS, man-in-the-middle attacks MiTM, buffer overflow attacks, scanning detection and spoofing hijacking, botnet activities, abnormal domain name requests and illegal IP access, sensitive command execution and high-risk API calls, RAT remote control Trojans and new vulnerability exploits. The real-time asset status is judged based on the above dimensions. If one of the above conditions is met, it is determined that there is abnormal behavior in the real-time asset status. The SDK module triggers the emergency response module based on the abnormal behavior. The emergency response module obtains a corresponding security disposal strategy based on the type of abnormal behavior. The security disposal strategy can eliminate the existence of abnormal behavior, and different types of abnormal behaviors correspond to different security disposal strategies; the security of the Internet of Things terminal is further guaranteed, the security protection is improved, and the identified abnormal behavior is traced for threats, the source of the threat is determined, and early warning information is issued to security management personnel in a timely manner.

[0065] Among them, Denial of Service (DOS) attack refers to an attack that aims to make the target device or network resources unable to work properly through a large amount of traffic or requests, resulting in legitimate users being unable to access services; Man-in-the-Middle (MiTM) attack refers to an attacker intercepting and tampering with data between communicating parties to steal sensitive information or perform malicious operations; Buffer Overflow attack refers to an attacker sending data exceeding the capacity of the program's buffer, causing the program to crash or execute malicious code; Scanning detection and deception hijacking refer to attackers scanning the network to find vulnerable devices and use these devices to carry out further attacks, such as DDoS attacks; Botnet activity refers to attackers controlling a large number of infected IoT terminals to form a botnet and use it to It is used to launch large-scale DDoS attacks or other malicious activities; abnormal domain name requests and illegal IP access refer to IoT terminals trying to access known malicious domain names or illegal IP addresses, which may be malware trying to contact its command and control server; sensitive command execution and high-risk API calls refer to IoT terminals executing unsafe commands or calling high-risk APIs, which may lead to data leakage or further control of the IoT system; RAT remote control Trojan refers to attackers implanting malicious programs with remote access tool functions through malicious samples to achieve remote control of target devices; new vulnerability exploits refer to the fact that due to the increasing security vulnerabilities of IoT devices, attackers can use these vulnerabilities to invade and control.

[0066] In the specific implementation process of step S102, there is an embodiment in which the SDK module screens the real-time asset status based on multiple dimensions to obtain abnormal behavior, so as to trigger an emergency response mechanism based on the abnormal behavior to obtain a corresponding safety disposal strategy, including:

[0067] S1021, the SDK module determines whether the real-time asset status meets the preset dimensional abnormal conditions based on multiple dimensions to determine whether the IoT terminal has abnormal behavior;

[0068] S1022. If yes, the SDK module controls the emergency response module to determine a corresponding security handling strategy based on the dimension corresponding to the abnormal behavior.

[0069] In steps S1021-S1022, the SDK module determines whether the real-time asset status meets the preset dimension abnormal conditions based on multiple dimensions, that is, different preset dimension abnormal conditions are set for different dimensions, such as the preset dimension abnormal conditions corresponding to the denial of service attack DOS dimension is whether a large amount of traffic or request occurs so that the Internet of Things terminal or network resources cannot work normally, such as the preset dimension abnormal conditions corresponding to the man-in-the-middle attack MiTM dimension is whether interception and tampering of data occurs on the Internet of Things terminal, thereby stealing sensitive information or performing malicious operations; if the SDK module determines that the real-time asset status meets the preset dimension abnormal conditions corresponding to at least one dimension, it is determined that the Internet of Things terminal has abnormal behavior, and the SDK module controls the emergency response module to start based on the dimension corresponding to the abnormal behavior, and the emergency response module generates a corresponding security disposal strategy based on the dimension corresponding to the abnormal behavior, and the security disposal strategy includes the priority of the processing dimension and the corresponding security strategy, risk assessment, resource allocation, etc. If the SDK module determines that the real-time asset status does not meet the preset dimension abnormal conditions corresponding to any dimension, the SDK module continues to monitor the real-time asset status of the Internet of Things terminal.

[0070] In the specific implementation process of step S1022, there is an embodiment in which the SDK module controls the emergency response module to determine a corresponding security handling strategy based on the dimension corresponding to the abnormal behavior, including:

[0071] S10221. The SDK module generates a trigger instruction based on the abnormal behavior to trigger the emergency response module; the trigger instruction includes the dimension of the abnormal behavior;

[0072] S10222. The emergency response module generates an optimal safety handling strategy based on the abnormal behavior and the dimension of the abnormal behavior.

[0073] In steps S10221-S10222, the SDK module encodes this information into a specific instruction format based on the abnormal behavior and the dimensions corresponding to the abnormal behavior through preset instruction generation rules, so that the emergency response module can accurately identify and process the generated trigger instruction, and the trigger instruction also includes the abnormal behavior, the dimensions corresponding to the abnormal behavior, the time when the abnormal behavior occurs, the IoT terminal ID, the severity, etc., to trigger the emergency response module; after receiving the trigger instruction, the emergency response module reads the abnormal behavior and the dimensions of the abnormal behavior in the trigger instruction to generate the best security disposal strategy. The emergency response module has built-in multiple security disposal strategies, which are optimized and processed for different abnormal behavior types and scenarios. The security disposal strategy is pre-generated manually or automatically, and the automatic method is to automatically generate a security disposal strategy based on the abnormal behavior and the dimensions of the abnormal behavior through a trained neural network.

[0074] In S103, after the emergency response module generates the security disposal strategy, the SDK module generates a control instruction based on the security disposal strategy and sends it to the emergency response module. The control instruction includes the security disposal strategy, and the security disposal strategy includes blocking IP addresses, terminating malicious processes, blocking illegal external connections and other operations to achieve automated blocking disposal. After receiving the control instruction, the emergency response module links the security module to jointly execute the corresponding type of security disposal strategy based on the read security disposal strategy to obtain multiple stage disposal results, that is, a close linkage mechanism is established between the emergency response module and the security module, thereby achieving the effect of linkage blocking disposal to ensure rapid response when abnormal behavior is detected. The security module includes a firewall, an intrusion detection system (IDS), and a data encryption module, and dynamically adjusts the security disposal strategy based on the stage disposal results. The dynamic adjustment may involve changing the type, priority or parameters of the disposal strategy, etc., to further ensure the security protection effect of the Internet of Things terminal.

[0075] The security module can also be replaced with a more independent firmware solution with built-in intelligent linkage and disposal mechanisms, which can directly communicate and collaborate with other IoT devices or security systems.

[0076] In the specific implementation process of step S103, there is an embodiment in which the SDK module controls the emergency response module to link with the security module to jointly execute the corresponding security disposal strategy based on the security disposal strategy to obtain multiple stage disposal results, and dynamically adjusts the security disposal strategy based on the stage disposal results, including:

[0077] S1031, the emergency response module links with the security module to execute the security disposal strategy in stages to obtain the stage disposal result corresponding to each stage;

[0078] S1032: The SDK module controls the emergency response module to dynamically adjust the security handling strategy based on the stage handling result.

[0079] In steps S1031-S1032, the emergency response module reads the content of the security disposal strategy. If the content contains a part that the security module needs to execute together, the emergency response module generates a linkage instruction and outputs the linkage instruction to the security module. The linkage instruction includes the part of the security disposal strategy that the security module needs to execute. The SDK module segments the security disposal strategy to achieve a more obvious security protection effect. The security module responds to the linkage instruction to cooperate with the emergency response module to execute the segmented security disposal strategy. In addition to the form of linkage instructions, the SDK will instruct the security module through the API interface or SSH command line. The specific linkage can be determined according to the actual situation, and each stage has specific goals and tasks. For example, in the first stage, attempts may be made to isolate the IoT terminal where the abnormal behavior is located to prevent it from further spreading; in the second stage, an intrusion detection system may be activated to identify potential attackers; in the third stage, data encryption may be strengthened to protect sensitive data, and after jointly executing the segmented security disposal strategy, the corresponding stage disposal results of each stage are obtained, and the security disposal strategy of the next stage is dynamically adjusted based on the disposal results of each stage until the security disposal strategy is completed, thereby achieving the purpose of being able to respond quickly and effectively when facing abnormal behavior to ensure the security protection effect.

[0080] In the specific implementation process of step S1032, there is an embodiment in which the SDK module controls the emergency response module to dynamically adjust the security handling strategy based on the stage handling result, including:

[0081] S10321. The SDK module determines whether the real-time asset status corresponding to the stage disposal result meets the expected result;

[0082] S10322. If not, the SDK module generates a policy adjustment instruction to enable the emergency response module to respond to the policy adjustment instruction.

[0083] In steps S10321-S10322, the SDK module collects the real-time asset status of the Internet of Things terminal in real time after obtaining the stage disposal results of each stage, and determines whether the real-time asset status corresponding to the stage disposal results meets the expected results. The expected effect is that the real-time asset status does not satisfy the preset dimensional abnormal conditions satisfied by the corresponding abnormal behavior. If not, that is, the stage disposal results generated after executing the first stage of the security disposal strategy are not obvious or even worse, then the SDK module generates a policy adjustment instruction at this time, and sends the policy adjustment instruction to the emergency response module. The emergency response module responds to the policy adjustment instruction and dynamically adjusts the security disposal strategy to enable the emergency response module and the security module to execute the next stage of the security disposal strategy, thereby obtaining a more obvious stage disposal result. Otherwise, the security disposal strategy continues to be executed. The emergency response module also updates the preset security disposal strategy based on the policy adjustment instruction to achieve a faster security disposal effect in the next similar security protection process.

[0084] The entire handling process is carried out in real time, and the SDK module will feed back the security handling results to the security operation center to ensure closed-loop management of attacks and responses. This can improve the efficiency of coordinated response and ensure that the source of attack is effectively located and handled. The IoT system can dynamically adjust security policies based on real-time situation analysis and threat intelligence to respond to new threats. This dynamic protection mechanism ensures that IoT devices can maintain efficient security protection capabilities when facing ever-changing security threats.

[0085] In step S104, the emergency response module and the security module execute the security handling strategies of all stages to obtain the best security handling result. The security handling strategies of all stages include unadjusted security handling strategies and dynamically adjusted security handling strategies, that is, the best security handling result is obtained through the security handling strategy corresponding to each stage, and the best security handling result is the result obtained when the abnormal behavior is handled and the security protection effect is achieved, so as to complete the security reinforcement of the IoT terminal firmware based on the best security handling result, that is, when the IoT terminal reaches a stable state at this time, that is, the abnormal behavior is effectively controlled and no longer poses a threat to system security, it can be considered that the best security handling result has been obtained, and the dynamically adjusted security handling strategy is executed on the IoT terminal, thereby achieving security reinforcement of the firmware, and can also be based on machine learning predictive updates. This mechanism can predict which IoT terminals may face specific security threats and push corresponding firmware updates in advance. Firmware security reinforcement can be achieved by adopting specific security reinforcement technologies, such as process, network, and file relationship protection models, or by introducing other types of security reinforcement technologies, such as behavior-based intrusion detection systems (IDS) or deep packet inspection (DPI) technology, which can also enhance the security of IoT devices.

[0086] In the specific implementation process of step S104, there is an embodiment in which: the SDK module includes a log unit;

[0087] After the emergency response module and the security module execute the dynamically adjusted security handling strategy to obtain the best security handling result, and complete the security reinforcement of the IoT terminal firmware based on the best security handling result, the method includes:

[0088] S1041, the SDK module generates a recording instruction based on the optimal security disposal result, and sends the recording instruction to the log unit;

[0089] S1042: The log unit responds to the recording instruction and generates log data corresponding to the security reinforcement process.

[0090] In steps S1041-S1042, the SDK module is also configured with a log recording function, that is, the log recording function is realized through the log unit, which can be configured together with other configurations of the SDK module. The SDK records operation logs, exception logs and login logs based on the log management function of the log unit for post-audit or traceability purposes. When the SDK module obtains the best security disposal result, a recording instruction is generated and sent to the log unit; the log unit receives the recording instruction and responds to the recording instruction. The recording instruction can also be sent to the log unit when abnormal behavior is identified, so that the log unit records the log data corresponding to the entire security reinforcement process, and the log data includes asset identification results, threat monitoring results, emergency response records, etc., and generates a security report for security management personnel to review.

[0091] Example 2

[0092] The present application also provides a security reinforcement device for IoT terminal firmware, such as Figure 4 The block diagram of a security reinforcement device for an IoT terminal firmware is shown. The functions implemented by the security reinforcement device for an IoT terminal firmware correspond to the steps of executing a security reinforcement method for an IoT terminal firmware on a terminal device. The device can be understood as a component of a server including a processor, which is applied to an IoT system. The IoT system includes an SDK module, an emergency response module, a security module, and multiple IoT terminals. The device includes:

[0093] The identification module 401 is used for the SDK module to identify the asset information of multiple IoT terminals in the IoT system and monitor the real-time asset status generated by the operation of multiple IoT terminals in real time; the asset information may be of various types;

[0094] A screening module 402 is used for the SDK module to screen the real-time asset status based on multiple dimensions to obtain abnormal behaviors, so as to trigger the emergency response module based on the abnormal behaviors to obtain corresponding safety disposal strategies; different types of abnormal behaviors correspond to different safety disposal strategies;

[0095] The control module 403 is used for the SDK module to control the emergency response module to link with the security module to jointly execute the corresponding security disposal strategy based on the security disposal strategy to obtain multiple stage disposal results, and dynamically adjust the security disposal strategy based on the stage disposal results;

[0096] The reinforcement module 404 is used for the emergency response module and the security module to execute the dynamically adjusted security handling strategy to obtain the best security handling result, so as to complete the security reinforcement of the IoT terminal firmware based on the best security handling result.

[0097] In a feasible implementation, the screening module includes:

[0098] A first judgment module, used for the SDK module to judge whether the real-time asset status meets the preset dimensional abnormal conditions based on multiple dimensions to determine whether the IoT terminal has abnormal behavior;

[0099] The first control module is used to control the emergency response module to determine a corresponding security handling strategy based on the dimension corresponding to the abnormal behavior by the SDK module.

[0100] In a feasible implementation manner, the screening module further includes:

[0101] A trigger control module, used for the SDK module to generate a trigger instruction based on the abnormal behavior to trigger the emergency response module; the trigger instruction includes the dimension of the abnormal behavior;

[0102] A generation module is used for the emergency response module to generate an optimal safety handling strategy based on the abnormal behavior and the dimension of the abnormal behavior.

[0103] In a feasible implementation manner, the control module includes:

[0104] An execution module, used for the emergency response module to link with the security module to execute the security disposal strategy in stages to obtain a stage disposal result corresponding to each stage;

[0105] The adjustment module is used for the SDK module to control the emergency response module to dynamically adjust the security disposal strategy based on the stage disposal result.

[0106] In a feasible implementation manner, the control module further includes:

[0107] The second judgment module is used for the SDK module to judge whether the real-time asset status corresponding to the stage disposal result meets the expected result;

[0108] The response module is used to, if not, generate a policy adjustment instruction by the SDK module, so that the emergency response module responds to the policy adjustment instruction.

[0109] In a feasible implementation, the identification module includes:

[0110] A download module, used for the IoT terminal to download the corresponding SDK data package based on the terminal type, and configure it to obtain the configuration result;

[0111] A configuration module is used to configure a corresponding security disposal strategy based on the configuration result and the asset information of the Internet of Things terminal where the SDK module is located, so as to complete the configuration of the SDK module.

[0112] In a feasible implementation, the reinforcement module includes:

[0113] A sending module, used for the SDK module to generate a recording instruction based on the optimal security disposal result, and send the recording instruction to the log unit;

[0114] The generating module is used for the log unit to respond to the recording instruction and generate log data corresponding to the security reinforcement process.

[0115] Example 3

[0116] The present application also provides an electronic device, such as Figure 5 As shown, it includes: a processor 501, a memory 502 and a bus 503, the memory 502 stores machine-readable instructions executable by the processor 501, when the electronic device is running, the processor 501 communicates with the memory 502 through the bus 503, and when the machine-readable instructions are executed by the processor 501, any one of the steps of the security reinforcement method for the firmware of an Internet of Things terminal is executed.

[0117] Example 4

[0118] The present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of any one of the methods for security reinforcement of IoT terminal firmware are executed.

[0119] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, and will not be repeated in this application. In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0120] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0121] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0122] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a platform server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0123] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for strengthening the security of IoT terminal firmware, characterized in that: Applied to an Internet of Things system, the Internet of Things system includes an SDK module, an emergency response module, a security module and multiple Internet of Things terminals, and the method includes: The SDK module identifies the asset information of multiple IoT terminals in the IoT system, and monitors the real-time asset status generated by the operation of multiple IoT terminals in real time; the asset information has multiple types; The SDK module screens the real-time asset status based on multiple dimensions to obtain abnormal behaviors, so as to trigger the emergency response module based on the abnormal behaviors to obtain corresponding safety disposal strategies; different types of abnormal behaviors correspond to different safety disposal strategies; Based on the security disposal strategy, the SDK module controls the emergency response module to link with the security module to jointly execute the corresponding security disposal strategy to obtain multiple stage disposal results, and dynamically adjusts the security disposal strategy based on the stage disposal results; The emergency response module and the security module execute the dynamically adjusted security handling strategy to obtain the best security handling result, so as to complete the security reinforcement of the IoT terminal firmware based on the best security handling result.

2. The method according to claim 1, characterized in that The SDK module screens the real-time asset status based on multiple dimensions to obtain abnormal behaviors, so as to trigger an emergency response mechanism based on the abnormal behaviors to obtain corresponding safety disposal strategies, including: The SDK module determines whether the real-time asset status meets the preset dimensional abnormal conditions based on multiple dimensions to determine whether the IoT terminal has abnormal behavior; If so, the SDK module controls the emergency response module to determine a corresponding safety handling strategy based on the dimension corresponding to the abnormal behavior.

3. The method according to claim 2, characterized in that The SDK module controls the emergency response module to determine a corresponding security handling strategy based on the dimension corresponding to the abnormal behavior, including: The SDK module generates a trigger instruction based on the abnormal behavior to trigger the emergency response module; the trigger instruction includes the dimension of the abnormal behavior; The emergency response module generates an optimal safety handling strategy based on the abnormal behavior and the dimension of the abnormal behavior.

4. The method according to claim 1, characterized in that: The SDK module controls the emergency response module to link with the security module to jointly execute the corresponding security disposal strategy based on the security disposal strategy to obtain multiple stage disposal results, and dynamically adjusts the security disposal strategy based on the stage disposal results, including: The emergency response module links with the security module to execute the security disposal strategy in stages to obtain the stage disposal result corresponding to each stage; The SDK module controls the emergency response module to dynamically adjust the safety handling strategy based on the stage handling result.

5. The method according to claim 4, characterized in that The SDK module controls the emergency response module to dynamically adjust the security handling strategy based on the stage handling result, including: The SDK module determines whether the real-time asset status corresponding to the stage disposal result meets the expected result; If not, the SDK module generates a policy adjustment instruction to enable the emergency response module to respond to the policy adjustment instruction.

6. The method according to claim 1, characterized in that The SDK module identifies the asset information of multiple IoT terminals in the IoT system and monitors the real-time asset status generated by the operation of multiple IoT terminals in real time, including: The IoT terminal downloads the corresponding SDK data package based on the terminal type, and performs configuration to obtain the configuration result; A corresponding security disposal strategy is configured based on the configuration result and the asset information of the Internet of Things terminal where the SDK module is located to complete the configuration of the SDK module.

7. The method according to claim 1, characterized in that The SDK module includes a log unit; After the emergency response module and the security module execute the dynamically adjusted security handling strategy to obtain the best security handling result, and complete the security reinforcement of the IoT terminal firmware based on the best security handling result, the method includes: The SDK module generates a recording instruction based on the optimal security disposal result, and sends the recording instruction to the log unit; The log unit responds to the recording instruction and generates log data corresponding to the security reinforcement process.

8. A security reinforcement device for IoT terminal firmware, characterized in that: Applied to an Internet of Things system, the Internet of Things system includes an SDK module, an emergency response module, a security module and multiple Internet of Things terminals, and the device includes: An identification module, used for the SDK module to identify the asset information of multiple IoT terminals in the IoT system, and to monitor the real-time asset status generated by the operation of multiple IoT terminals in real time; the asset information may be of multiple types; A screening module, used for the SDK module to screen the real-time asset status based on multiple dimensions to obtain abnormal behaviors, so as to trigger the emergency response module based on the abnormal behaviors to obtain corresponding safety disposal strategies; different types of abnormal behaviors correspond to different safety disposal strategies; A control module, which is used for the SDK module to control the emergency response module to link with the security module to jointly execute the corresponding security disposal strategy based on the security disposal strategy to obtain multiple stage disposal results, and dynamically adjust the security disposal strategy based on the stage disposal results; The reinforcement module is used for the emergency response module and the security module to execute the dynamically adjusted security disposal strategy to obtain the best security disposal result, so as to complete the security reinforcement of the IoT terminal firmware based on the best security disposal result.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the steps of a security reinforcement method for an Internet of Things terminal firmware as described in any one of claims 1 to 7 are performed.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, executes the steps of a method for security reinforcement of an Internet of Things terminal firmware as described in any one of claims 1 to 7.

Images