Intelligent building wireless module networking communication system and method for improving network security

Abstract

The invention belongs to the technical field of wireless network security, and particularly relates to an intelligent building wireless module networking communication system and method for improving network security. The invention discloses an intelligent building wireless module networking communication method for improving network security. The method comprises the following steps: S10, taking a secret key locally stored in a node corresponding to each MAC address in a communication network as a node secret key, and storing the node secret key and the MAC address locally in a central node; s20, the transmission node divides the transmission data into a plurality of data packets, the transmission node uses a local node key to encrypt the division mode and the division time of the data packets into first encrypted data, then generates a first secret key according to the division mode and the division time of the data packets, and uses the first secret key to encrypt the data packets into first encrypted packets; and S30, the transmission node adds the abstract of a transmission data bar into the transmission data bar according to the first encrypted data and the first encrypted packet as the transmission data bar, and adds a local MAC address behind the transmission data bar. According to the scheme, the problem of insufficient security of data transmission in communication networking is solved.

Description

Technical Field

[0001] The present invention belongs to the field of wireless network security technology, and specifically relates to an intelligent building wireless module networking communication system and method for improving network security. Background Art

[0002] In the communication network of smart buildings, data needs to be sent from each transmission node to the central node. Some transmission nodes are far away from the central node, so relay devices need to be added between the central node and the transmission node. However, as the number of relay devices in the communication network increases, the risk of data tampering in the communication network also increases, resulting in lower and lower security of data transmission in the communication network.

[0003] In order to prevent data from being maliciously tampered with during transmission, existing technologies usually use identity authentication to ensure that only legitimate transmission nodes and relay devices can participate in data transmission. That is, when each device accesses the communication network, it needs to provide a legitimate identity certificate to the central node or authentication server, and data transmission can only be carried out after passing the authentication. However, the authentication method based on device identification such as MAC address has security vulnerabilities. After an attacker forges a MAC address or other legitimate identification to join the communication network, other nodes in the communication network will treat him as a trusted device and transmit data to him, resulting in insufficient security of data transmission in the communication network. Summary of the invention

[0004] The purpose of this solution is to provide an intelligent building wireless module networking communication system and method for improving network security, so as to solve the problem of insufficient security of data transmission in communication networking.

[0005] In order to achieve the above object, this solution provides a smart building wireless module networking communication method for improving network security, comprising the following steps: S10: storing the secret key stored locally at the node corresponding to each MAC address in the communication network as the node secret key together with the MAC address locally at the central node; S20: The transmission node divides the transmission data into multiple data packets, and uses the local node key to encrypt the division method and division time of the data packet into first encrypted data, and then generates a first secret key according to the division method and division time of the data packet, and uses the first secret key to encrypt the data packet into a first encrypted packet; S30: The transmission node uses the first encrypted data and the first encrypted packet as a transmission data strip, adds a summary of the transmission data strip to the transmission data strip, appends a local MAC address to the transmission data strip, and sends the transmission data strip to multiple relay nodes; S40: After receiving the transmission data strip, the relay node uses the local node secret key to encrypt the transmission data strip into a first data strip, appends the local MAC address to the first data strip, and transmits the first data strip to other relay nodes or the central node; S50: After receiving the first data strip, the central node initializes the MAC address array arr, puts the MAC address attached to the first data strip into arr, searches for the corresponding node key according to the MAC address attached to the first data strip to decrypt the first data strip, until the first data strip does not contain the attached MAC address; if the node key cannot decrypt the first data strip, the node with the MAC address in arr is regarded as a dangerous node, and the communication connection between the dangerous node and the communication network is disconnected. And, a network security-enhancing intelligent building wireless module networking communication system using the above-mentioned network security-enhancing intelligent building wireless module networking communication method.

[0006] And, an intelligent building wireless module networking communication system for improving network security using an intelligent building wireless module networking communication method for improving network security.

[0007] The principle and technical effect of this solution are as follows: first, the MAC address and the corresponding node key are stored locally in the central node. This method establishes a close connection between the node identity (MAC address) and the encryption key. By binding with the key, the central node can accurately identify each node and use the corresponding key for decryption operations; and, after receiving the transmission data strip, the relay node encrypts it and attaches its own MAC address before transmitting it, so that the data is encrypted and protected at every link in the relay link. Each relay node is like a "security guard" that encrypts the data, making it difficult for attackers to obtain and tamper with the data during the relay process; moreover, the transmission of MAC addresses can build a complete data transmission path, which is convenient for the central node to check for possible security risks along the transmission path when problems arise.

[0008] Secondly, the encryption division method and division time are used to obtain the first encrypted data. The encryption of this part of information can prevent attackers from understanding the organization of the data and increase the confidentiality of the data. By dividing the data and generating the first key to encrypt the data packet into the first encrypted packet, even if the attacker obtains part of the encrypted packet, it is difficult to restore the entire original data. This division method not only prevents attackers from understanding the organization of the data and increases the confidentiality of the data, but also facilitates tracing when problems occur in the data to determine which part of the data may have been tampered with or a transmission failure has occurred. At the same time, since the transmission node encrypts the data division method and division time, the data division method and division time and other information of each transmission are unique after encryption. The receiver can verify whether this information conforms to the normal transmission logic through decryption, thereby effectively resisting replay attacks.

[0009] In summary, this solution solves the problem of insufficient security of data transmission in communication networking.

[0010] Furthermore, the central node stores the optimal path length corresponding to each transmission node, that is, the number of relay nodes on the shortest or fastest path between the transmission node and the central node, and the central node determines the length of arr based on the optimal path length.

[0011] This helps guide data transmission along a safer path. Usually, the shortest path or the fastest path may pass through fewer intermediate links, reducing the chance of data being exposed to potentially risky environments. Because each relay node increases the risk of data being attacked, such as the risk of data being stolen or tampered with, choosing a better path reduces this risk to a certain extent. At the same time, determining the length of arr based on the optimal path length (assuming that arr is related to the encryption process) can make the encryption mechanism more adaptable to the data transmission path. This customized encryption can make data more confidential during transmission.

[0012] Furthermore, when the central node adds MAC addresses to arr, if arr is full and there are MAC addresses not stored in arr, the node with the MAC address in arr is regarded as a dangerous node, and the communication connection between the dangerous node and the communication network is disconnected.

[0013] This mechanism can resist MAC address spoofing attacks to a certain extent. Attackers may try to forge MAC addresses to gain network access rights or interfere with data transmission. When their forged MAC addresses cause arr to exceed capacity, they will be detected and isolated by the central node, avoiding security threats such as data theft or tampering through MAC address spoofing. At the same time, by limiting the size of arr, the number of nodes in the network can be indirectly controlled. When arr is full and some nodes are disconnected, network resources (such as bandwidth, storage, etc.) can be more centrally allocated to recognized legitimate nodes, thereby improving the data transmission efficiency of these nodes. For example, in the case of limited bandwidth, reducing the number of nodes can reduce the possibility of network congestion and enable the remaining nodes to better utilize bandwidth for data transmission.

[0014] Furthermore, the transmission node and the central node store a plurality of division methods, each division method has a corresponding division number, and the transmission node selects the division method by randomly selecting the division number; the transmission node encrypts the division number and the division time corresponding to the data packet into the first encrypted data.

[0015] By randomly selecting a partitioning number to select a partitioning method, it is difficult for an attacker to predict the partitioning form of the data. The partitioning number and the partitioning time are encrypted together as the first encrypted data. The combination of these two elements further enhances the security of encryption. The randomness of the partitioning number and the uniqueness of the partitioning time make the first encrypted data generated each time unique. Even if an attacker obtains part of the encrypted information, it is difficult to infer the original partitioning method and transmission time of the data based on this information, thereby effectively protecting the security of the data during transmission.

[0016] Furthermore, a plurality of division methods are stored in the transmission node and the central node. The transmission node selects a division method according to the type of transmission data or the congestion of data transmission in the current communication network. The transmission node and the central node store passwords corresponding to each division method. The transmission center encrypts the password and the division time corresponding to the data packet into the first encrypted data.

[0017] First, the transmission node selects the partitioning method according to the type of data to be transmitted or the network congestion situation, which enables data partitioning to adapt to different security requirements and transmission environments; and when the network is congested, selecting an appropriate partitioning method also helps to ensure the secure transmission of data and avoid data loss or tampering. Secondly, the password is used as an additional security factor. Only the recipient (such as the central node) who knows the correct password can decrypt the first encrypted data and encrypt it into the first encrypted data using the password and partition time corresponding to the partitioning method, which greatly improves the confidentiality of the data.

[0018] Furthermore, when the central node decrypts the first data strip, it uses the first data strip containing the summary as the transmission data strip, and verifies whether the first encrypted data or the first encrypted package has been tampered with through the summary of the transmission data strip. If the first encrypted data or the first encrypted package has been tampered with, the node at the MAC address in arr is regarded as a dangerous node, the communication connection between the dangerous node and the communication network is disconnected, and the division method stored on the transmission node and the central node is replaced, or the password corresponding to the division method is replaced.

[0019] Verifying whether the first encrypted data and the first encrypted package have been tampered with by transmitting the summary of the data strip is a very effective data integrity check method. This method ensures the integrity of data transmission and prevents malicious attackers from modifying the data content during transmission. In addition, when it is found that the data has been tampered with, the central node records relevant information, such as the MAC address of the data sending node (after verifying the data content), the time when the tampering occurred, the characteristics of the tampered data, etc. This information is very valuable for network administrators, and can help them quickly locate the problem, whether it is a network link problem, a node attack, or other security vulnerabilities that cause data tampering, so as to carry out targeted repairs and security reinforcement measures.

[0020] Furthermore, a fixed update cycle is set in the central node, and the central node updates the node public keys, division methods, and passwords or numbers corresponding to the division methods stored in the central node and the transmission nodes once or more in each update cycle.

[0021] Furthermore, when the central node changes the node public key, the division method, and the password or number corresponding to the division method, only a part or all of them are changed each time.

[0022] First, timely updates can prevent data transmission security issues caused by the leakage of node public keys or the cracking of old division methods. Once a potential security risk is discovered or after a certain period of time, the update mechanism will take effect to ensure that the new security policy can replace the old policy that may have risks in a timely manner, effectively preventing malicious attackers from exploiting known security vulnerabilities to obtain transmission data. Secondly, this update mechanism enables the network to better adapt to the ever-changing security environment and application requirements. In addition, during the update process, since partial or full updates can be selected, this helps promote compatibility and interoperability between different devices (transmission nodes and central nodes) in the network. When new devices join the network or old devices are upgraded, through a reasonable update strategy, these devices can gradually adapt to new security and transmission requirements, ensuring that the devices of the entire communication network can work together and improve the overall performance of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 The present invention is a flowchart of a method for improving network security using a wireless module network in an intelligent building according to an embodiment of the present invention.

[0024] Figure 2 4 is a flow chart related to step S50 in an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The following will clearly and completely describe the concept and technical effects of the present invention in combination with the embodiments, so as to fully understand the purpose, features and effects of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, other embodiments obtained by those skilled in the art without creative work are all within the scope of protection of the present invention: like Figure 1 As shown, the intelligent building wireless module networking communication method for improving network security is characterized by comprising the following steps: S10: storing the secret key stored locally at the node corresponding to each MAC address in the communication network as the node secret key together with the MAC address locally at the central node; S20: The transmission node divides the transmission data into multiple data packets, and uses the local node key to encrypt the division method and division time of the data packet into first encrypted data, and then generates a first secret key according to the division method and division time of the data packet, and uses the first secret key to encrypt the data packet into a first encrypted packet; S30: The transmission node uses the first encrypted data and the first encrypted packet as a transmission data strip, adds a summary of the transmission data strip to the transmission data strip, appends a local MAC address to the transmission data strip, and sends the transmission data strip to multiple relay nodes; S40: After receiving the transmission data strip, the relay node uses the local node secret key to encrypt the transmission data strip into a first data strip, appends the local MAC address to the first data strip, and transmits the first data strip to other relay nodes or the central node; S50: Figure 2 As shown, after the central node receives the first data strip, it initializes the MAC address array arr, puts the MAC address attached to the first data strip into arr, searches for the corresponding node key according to the MAC address attached to the first data strip to decrypt the first data strip until the first data strip does not contain the attached MAC address; if the node key cannot decrypt the first data strip, the node with the MAC address in arr is regarded as a dangerous node, and the communication connection between the dangerous node and the communication network is disconnected.

[0026] The central node stores the optimal path length corresponding to each transmission node, that is, the number of relay nodes on the shortest or fastest path between the transmission node and the central node. The central node determines the length of arr based on the optimal path length.

[0027] Among them, when the central node adds MAC addresses to arr, if arr is full and there are MAC addresses not stored in arr, the node with the MAC address in arr is regarded as a dangerous node, and the communication connection between the dangerous node and the communication network is disconnected.

[0028] Among them, the transmission nodes and the central nodes store a variety of division methods (for example: dividing data packets according to fixed size, dividing data packets according to data type, dividing data packets according to data priority, dividing data packets according to data transmission speed in the communication network, etc.), each division method has a corresponding division number, and the transmission node uses a random selection of division numbers to select the division method; the transmission node encrypts the division number and the division time corresponding to the data packet into the first encrypted data.

[0029] Among them, multiple division methods are stored in the transmission node and the central node. The transmission node selects the division method according to the type of transmission data or the congestion of data transmission in the current communication network. The transmission node and the central node store passwords corresponding to each division method. The transmission center encrypts the password and the division time corresponding to the data packet into the first encrypted data.

[0030] Among them, when the central node decrypts the first data strip, it uses the first data strip containing the summary as the transmission data strip, and verifies whether the first encrypted data or the first encrypted package has been tampered with through the summary of the transmission data strip. If the first encrypted data or the first encrypted package has been tampered with, the node on the MAC address in arr is regarded as a dangerous node, the communication connection between the dangerous node and the communication network is disconnected, and the division method stored on the transmission node and the central node, and the password or number corresponding to the division method are replaced.

[0031] Among them, a fixed update cycle is set in the central node (generally one week, which can be set by the administrator). The central node updates the node public key, division method and password or number corresponding to the division method stored in the central node and the transmission node once or more times (generally once, and the number of times needs to be specified by the administrator) in each update cycle.

[0032] When the central node changes the node public key, the division method, and the password or number corresponding to the division method, only a part or all of them are changed each time.

[0033] This embodiment also uses an intelligent building wireless module networking communication method for improving network security and an intelligent building wireless module networking communication system for improving network security.

[0034] When implementing A residential building is equipped with 5 cameras, 9 relay devices and a monitoring center. The 5 cameras are all transmission nodes, the 9 relay devices are all relay nodes, and the monitoring center is the central node. The 9 relay devices, 5 cameras and the monitoring center form a communication network. The monitoring center associates and records the MAC addresses corresponding to the 5 cameras and relay devices with the keys stored locally. Each camera and relay device also stores its corresponding key locally. After the 5 cameras collect image data, they send the image data as transmission data to the monitoring center through the relay device. Among them, the default fixed cycle of the monitoring center is once a week. The division methods stored in the monitoring center and the 5 cameras include: dividing data packets according to fixed size (1024KB or the size specified by the administrator), dividing data packets according to data priority (different cameras have different priorities, or the camera automatically recognizes the image data and sets the data priority for the image data), and dividing data packets according to the data transmission speed in the communication network.

[0035] After camera 1 collects a frame of image data, it selects a division method based on the current network transmission status and data characteristics. At this time, the network is relatively congested, and camera 1 chooses to divide the data packet according to the data transmission speed in the communication network (its division number is 3). Then, the locally stored key is used to encrypt the data packet division method (number 3) and division time (accurate to milliseconds) to generate the first encrypted data. Next, a first secret key is generated based on the division method and division time, and the image data packet is encrypted into a first encrypted packet using the first secret key.

[0036] Camera 1 combines the first encrypted data and the first encrypted packet into a transmission data strip, calculates the summary of the transmission data strip and adds it, and finally appends its own MAC address at the end of the transmission data strip, and then sends the generated transmission data strip to the relay devices (relay device A, relay device E, and relay device E) that are closest and have better signal strength.

[0037] After receiving the transmission data strip from camera 1, relay device A uses its locally stored node secret key to encrypt the transmission data strip again to generate the first data strip, and appends its own MAC address to the first data strip. Relay device A determines the next appropriate relay device (relay device B) based on the pre-set network topology information and routing strategy. Relay device B repeats the above (corresponding to relay device A) receiving, encrypting, and forwarding process, and then sends the data to relay device C. Relay device C repeats the above (corresponding to relay device A) operation and then sends the data to the monitoring center.

[0038] After the monitoring center receives the first data strip from the relay device (sent by relay device C), it initializes the array arr, puts the MAC address (of relay device C) attached to the first data strip into arr, and then searches for the corresponding node key (of relay device C) according to the MAC address of relay device C to decrypt the first data strip. The second first data strip and the MAC address of relay device B are obtained, so the node public key of relay device B is found using the MAC address of relay device B, and the node public key of relay device B is used to decrypt the second first data strip, obtaining the third first data strip and the MAC address of relay device A. After repeating the above decryption operation, the four first data strips obtained contain digests, so the fourth first data strip is used as the transmission data strip. The monitoring center uses the summary verification of the transmitted data strip to confirm that the first encrypted data and the first encrypted package have not been tampered with, and then uses the node public key obtained once, that is, the node public key of camera 1 to decrypt the first encrypted data, and obtain the division method (number 3) and division time, and obtain the first secret key through the division method (number 3) and division time, and decrypt the first encrypted package with the first secret key to obtain the data packet.

[0039] After relay device E receives the first data strip, the first data strip is transmitted to the monitoring center through relay device F. When the monitoring center decrypts it, it finds that the public key found by the MAC address of relay device F cannot decrypt the first data. Therefore, relay device F is regarded as a dangerous node (at this time, only the MAC address of relay device F is included in arr), and its communication connection with the communication network is immediately disconnected. At the same time, the monitoring center will change the partitioning method stored in itself and all cameras, and the password or number corresponding to the partitioning method to prevent similar security issues from happening again.

[0040] The monitoring center stores the optimal path length (2-3) corresponding to camera 1, that is, the number of relay nodes on the path with the shortest (number of nodes is 2) or fastest transmission speed (number of nodes is 3) between the transmission node and the central node. The central node determines the length of arr1 (4, and one is the MAC address of camera 1) based on the optimal path length. The image data of camera 1 is transmitted to the monitoring center through relay devices G, H, and I. When the monitoring center decrypts, arr1 is found to be full (4) when it is ready to load the MAC address of camera 1. Therefore, the node with the MAC address in arr1 is regarded as a dangerous node, and the communication connection between the dangerous node and the communication network is disconnected.

[0041] Every Wednesday, the monitoring center operates according to the set update mechanism. It chooses to update only some node public keys, division methods and password numbers, such as updating only the relevant information of cameras with lower priority, or updating all. After the update, the monitoring center will send the new information to each camera synchronously to ensure that the security policy of the entire communication network is dynamically updated to cope with various possible security threats and changes in the network environment.

[0042] The above is only an embodiment of the present invention, and the common knowledge such as the known specific structure and characteristics in the scheme is not described in detail here. It should be pointed out that for those skilled in the art, several deformations and improvements can be made without departing from the structure of the present invention, which should also be regarded as the protection scope of the present invention, and these will not affect the effect of the implementation of the present invention and the practicality of the patent. The scope of protection required by this application shall be based on the content of its claims, and the specific implementation methods and other records in the specification can be used to interpret the content of the claims.

Claims

1. A method for improving network security of a smart building wireless module network communication, characterized in that: The following steps are involved: S10: storing the secret key stored locally at the node corresponding to each MAC address in the communication network as the node secret key together with the MAC address locally at the central node; S20: The transmission node divides the transmission data into multiple data packets, and uses the local node key to encrypt the division method and division time of the data packet into first encrypted data, and then generates a first secret key according to the division method and division time of the data packet, and uses the first secret key to encrypt the data packet into a first encrypted packet; S30: The transmission node uses the first encrypted data and the first encrypted packet as a transmission data strip, adds a summary of the transmission data strip to the transmission data strip, appends a local MAC address to the transmission data strip, and sends the transmission data strip to multiple relay nodes; S40: After receiving the transmission data strip, the relay node uses the local node secret key to encrypt the transmission data strip into a first data strip, appends the local MAC address to the first data strip, and transmits the first data strip to other relay nodes or the central node; S50: After receiving the first data strip, the central node initializes the MAC address array arr, puts the MAC address attached to the first data strip into arr, searches for the corresponding node key according to the MAC address attached to the first data strip to decrypt the first data strip until the first data strip does not contain the attached MAC address; if the node key cannot decrypt the first data strip, the node with the MAC address in arr is regarded as a dangerous node, and the communication connection between the dangerous node and the communication network is disconnected.

2. The method for intelligent building wireless module networking communication for improving network security according to claim 1, characterized in that: The central node stores the optimal path length corresponding to each transmission node, that is, the number of relay nodes on the shortest or fastest path between the transmission node and the central node. The central node determines the length of arr based on the optimal path length.

3. The method for intelligent building wireless module networking communication for improving network security according to claim 2, characterized in that: When the central node adds MAC addresses to arr, if arr is full and there are MAC addresses not stored in arr, the node with the MAC address in arr is regarded as a dangerous node, and the communication connection between the dangerous node and the communication network is disconnected.

4. The method for intelligent building wireless module networking communication for improving network security according to claim 3 is characterized in that: The transmission node and the central node store a plurality of division methods, each of which has a corresponding division number. The transmission node selects the division method by randomly selecting the division number. The transmission node encrypts the division number and the division time corresponding to the data packet into the first encrypted data.

5. The method for intelligent building wireless module networking communication for improving network security according to claim 3 is characterized in that: A variety of division methods are stored in the transmission node and the central node. The transmission node selects a division method based on the type of transmission data or the congestion of data transmission in the current communication network. The transmission node and the central node store passwords corresponding to each division method. The transmission center encrypts the password and the division time corresponding to the data packet into the first encrypted data.

6. The intelligent building wireless module networking communication method for improving network security according to claim 5 or claim 4, characterized in that: When the central node decrypts the first data strip, it uses the first data strip containing the summary as the transmission data strip, and verifies whether the first encrypted data or the first encrypted package has been tampered with through the summary of the transmission data strip. If the first encrypted data or the first encrypted package has been tampered with, the node at the MAC address in arr is regarded as a dangerous node, the communication connection between the dangerous node and the communication network is disconnected, and the division method stored on the transmission node and the central node, and the password or number corresponding to the division method are replaced.

7. The method for intelligent building wireless module networking communication for improving network security according to claim 6, characterized in that: A fixed update cycle is set in the central node, and the central node updates the node public key, the division method, and the password or number corresponding to the division method stored in the central node and the transmission node once or more in each update cycle.

8. The method for intelligent building wireless module networking communication for improving network security according to claim 7, characterized in that: When the central node changes the node public key, the division method, and the password or number corresponding to the division method, only a part or all of them are changed each time.

9. An intelligent building wireless module networking communication system for improving network security, characterized in that: The intelligent building wireless module networking communication method for improving network security is used as described in any one of claims 1-8.

Images