Intelligent building wireless module networking communication system and method for improving network security

Abstract

The scheme belongs to the technical field of wireless network security, and specifically relates to an intelligent building wireless module networking communication system and method for improving network security. The intelligent building wireless module networking communication method for improving network security comprises the following steps: S10: storing the secret key corresponding to each MAC address of a node in the communication networking as a node secret key in the local storage of a center node together with the MAC address; S20: a transmission node divides transmission data into multiple data packets, the transmission node uses the local node key to encrypt the division mode and division time of the data packets into first encrypted data, generates a first secret key according to the division mode and division time of the data packets, and uses the first secret key to encrypt the data packets into first encrypted packets; S30: the transmission node uses the first encrypted data and the first encrypted packets as transmission data, adds the digest of the transmission data to the transmission data, and appends the local MAC address after the transmission data. The scheme solves the problem of insufficient security of data transmission in the communication networking.

Description

Technical Field

[0001] This solution belongs to the field of wireless network security technology, specifically involving intelligent building wireless module networking communication systems and methods to enhance network security. Background Technology

[0002] In the communication network of intelligent buildings, data needs to be sent from various transmission nodes to the central node. Some transmission nodes are far from the central node, requiring the addition of relay devices between them. However, as the number of relay devices in the communication network increases, the risk of data tampering also increases, leading to increasingly lower data transmission security.

[0003] To prevent malicious data tampering during transmission, existing technologies typically employ authentication to ensure that only legitimate transmission nodes and relay devices can participate in data transmission. That is, each device, upon joining a communication network, must provide valid identity credentials to the central node or authentication server; data transmission is only permitted after successful authentication. However, authentication methods based on device identifiers such as MAC addresses have security vulnerabilities. If an attacker forges a MAC address or other legitimate identifier to join the communication network, other nodes within the network will treat them as a trusted device and transmit data to them, resulting in insufficient security for data transmission within the communication network. Summary of the Invention

[0004] The purpose of this solution is to provide a smart building wireless module networking communication system and method to enhance network security, thereby addressing the problem of insufficient data transmission security in communication networks.

[0005] To achieve the above objectives, this solution provides a method for intelligent building wireless module networking communication to enhance network security, including the following steps:

[0006] S10: Store the keys stored locally on the central node along with the MAC addresses of each MAC address in the communication network as node keys.

[0007] S20: The transmission node divides the transmission data into multiple data packets. The transmission node uses its local node key to encrypt the data packet division method and division time into the first encrypted data. Then, it generates the first key based on the data packet division method and division time, and uses the first key to encrypt the data packet into the first encrypted packet.

[0008] S30: The transmission node uses the first encrypted data and the first encrypted packet as the transmission data strip, adds a digest to the transmission data strip, appends the local MAC address to the transmission data strip, and sends the transmission data strip to multiple relay nodes.

[0009] S40: After receiving the transmitted data strip, the relay node uses its local node key to encrypt the transmitted data strip into a first data strip, appends its local MAC address to the first data strip, and then transmits the first data strip to other relay nodes or the central node.

[0010] S50: After receiving the first data strip, the central node initializes the MAC address array arr, puts the MAC address appended to the first data strip into arr, and searches for the corresponding node key based on the MAC address appended to the first data strip to decrypt the first data strip until the first data strip no longer contains any appended MAC address. If the node key cannot decrypt the first data strip, the node with the MAC address in arr is designated as a dangerous node, and the communication connection between the dangerous node and the communication network is disconnected. Furthermore, a smart building wireless module networking communication system that enhances network security using the above-described method for improving network security is also provided.

[0011] And, a smart building wireless module networking communication system that enhances network security by using a smart building wireless module networking communication method to improve network security.

[0012] The principle and technical effects of this scheme are as follows: First, the MAC address and corresponding node key are stored locally on the central node. This establishes a close link between the node identity (MAC address) and the encryption key. By binding with the key, the central node can accurately identify each node and use the corresponding key for decryption. Second, after receiving the transmitted data, the relay node encrypts it and attaches its own MAC address before transmitting it. This ensures that the data is encrypted and protected at every stage of the relay link. Each relay node acts like a "security guard," encrypting the data and making it difficult for attackers to obtain and tamper with the data during the relay process. Moreover, the transmission of MAC addresses can construct a complete data transmission path, making it convenient for the central node to investigate potential security risks along the transmission path when problems occur.

[0013] Secondly, the encryption of the data segmentation method and segmentation time yields the first encrypted data. Encrypting this part of the information prevents attackers from understanding the data organization, increasing data confidentiality. By segmenting the data and generating a first key to encrypt the data packet into the first encrypted packet, even if an attacker obtains part of the encrypted packet, it is very difficult to recover the entire original data. This segmentation method not only prevents attackers from understanding the data organization, increasing data confidentiality, but also facilitates tracing when data problems occur, determining which part of the data may have been tampered with or experienced a transmission failure. Simultaneously, because the transmission node encrypts the data segmentation method and segmentation time, each transmission's data segmentation method and segmentation time are unique after encryption. The receiver can verify whether this information conforms to normal transmission logic by decryption, thus effectively resisting replay attacks.

[0014] In summary, this solution addresses the issue of insufficient data transmission security in communication networks.

[0015] Furthermore, the central node stores the optimal path length for each transmission node, that is, the number of relay nodes on the shortest or fastest path between the transmission node and the central node. The central node determines the length of the arr based on the optimal path length.

[0016] This helps guide data along a more secure path. Typically, the shortest or fastest path involves fewer intermediate steps, reducing the chance of data being exposed to potentially risky environments. Each relay node increases the risk of data attack, such as theft or tampering, so choosing a better path mitigates this risk to some extent. Furthermore, determining the ARR length based on the optimal path length (assuming the ARR is related to the encryption process) allows the encryption mechanism to be more adaptable to the data transmission path; this customized encryption enhances data confidentiality during transmission.

[0017] Furthermore, when the central node adds a MAC address to the ARR, if the ARR is full and there are still MAC addresses that have not been added to the ARR, the node with the MAC address in the ARR is regarded as a dangerous node, and the communication connection between the dangerous node and the communication network is disconnected.

[0018] This mechanism can mitigate MAC address spoofing attacks to some extent. Attackers may attempt to forge MAC addresses to gain network access or interfere with data transmission. When their forged MAC addresses cause the ARR (Access Registry) to exceed its capacity, it will be detected and isolated by the central node, preventing security threats such as data theft or tampering through MAC address spoofing. Simultaneously, by limiting the size of the ARR, the number of nodes within the network can be indirectly controlled. When the ARR is full, disconnecting some nodes allows network resources (such as bandwidth and storage) to be more concentratedly allocated to authorized nodes, thereby improving the data transmission efficiency of these nodes. For example, in situations with limited bandwidth, reducing the number of nodes can reduce the likelihood of network congestion, enabling the remaining nodes to better utilize bandwidth for data transmission.

[0019] Furthermore, the transmission nodes and the central node store multiple partitioning methods, each with a corresponding partitioning number. The transmission nodes select the partitioning method by randomly selecting the partitioning number. The transmission nodes encrypt the partitioning number and the partitioning time corresponding to the data packet into the first encrypted data.

[0020] By randomly selecting partition numbers to choose the partitioning method, attackers find it difficult to predict the data partitioning format. Encrypting both the partition number and the partitioning time together as the first encrypted data further enhances encryption security. The randomness of the partition number and the uniqueness of the partitioning time ensure that each generated first encrypted data is unique. Even if an attacker obtains partial encrypted information, it is difficult to deduce the original partitioning method and transmission time from this information, thus effectively protecting the security of the data during transmission.

[0021] Furthermore, the transmission nodes and the central node store multiple partitioning methods. The transmission nodes select the partitioning method based on the type of transmitted data or the congestion of data transmission in the current communication network. The transmission nodes and the central node store passwords corresponding to each partitioning method. The transmission center encrypts the password and the partitioning time corresponding to the data packet into the first encrypted data.

[0022] First, the transmission nodes select the partitioning method based on the type of data being transmitted or network congestion, allowing data partitioning to adapt to different security requirements and transmission environments. Furthermore, choosing an appropriate partitioning method during network congestion helps ensure secure data transmission and prevents data loss or tampering. Second, the password serves as an additional security factor; only the recipient (such as the central node) with the correct password can decrypt the first encrypted data. Encrypting the first encrypted data using the password corresponding to the partitioning method and the partitioning time significantly improves data confidentiality.

[0023] Furthermore, when the central node decrypts the first data strip, it uses the first data strip containing the digest as the transmission data strip. It verifies whether the first encrypted data or the first encrypted packet has been tampered with by verifying the digest of the transmission data strip. If the first encrypted data or the first encrypted packet has been tampered with, the node with the MAC address in the ARR is identified as a dangerous node. The communication connection between the dangerous node and the communication network is disconnected, and the partitioning method stored on the transmission node and the central node is changed or the password corresponding to the partitioning method is changed.

[0024] Verifying the integrity of the first encrypted data and the first encrypted packet by analyzing the digest of the transmitted data is a highly effective data integrity check method. This method ensures the integrity of data transmission and prevents malicious attackers from modifying the data content during transmission. Furthermore, when data tampering is detected, the central node records relevant information, such as the MAC address of the data sending node (after verifying the data content), the time of the tampering, and the characteristics of the tampered data. This information is invaluable to network administrators, helping them quickly pinpoint the problem—whether it's a network link issue, a node attack, or another security vulnerability that led to the data tampering—and thus implement targeted remediation and security hardening measures.

[0025] Furthermore, a fixed update cycle is set within the central node. During each update cycle, the central node updates the node public key, partitioning method, and the password or number corresponding to the partitioning method stored in the central node and the transmission node once or multiple times.

[0026] Furthermore, when the central node changes the node public key, partitioning method, and the password or number corresponding to the partitioning method, it only changes a portion or all of them each time.

[0027] First, timely updates prevent data transmission security issues caused by node public key leaks or the cracking of old partitioning methods. Once a potential security risk is detected or after a certain time period, the update mechanism takes effect, ensuring that new security policies promptly replace potentially risky old policies, effectively preventing malicious attackers from exploiting known security vulnerabilities to obtain transmitted data. Second, this update mechanism allows the network to better adapt to constantly changing security environments and application requirements. Furthermore, the ability to choose between partial or full updates during the update process helps promote compatibility and interoperability between different devices (transmission nodes and central nodes) within the network. When new devices join the network or older devices undergo software upgrades, a reasonable update strategy allows these devices to gradually adapt to new security and transmission requirements, ensuring that all devices in the communication network can work collaboratively and improving overall network performance. Attached Figure Description

[0028] Figure 1This is a flowchart illustrating the network communication method for intelligent building wireless modules to enhance network security in this embodiment of the invention.

[0029] Figure 2 This is a flowchart of step S50 in an embodiment of the present invention. Detailed Implementation

[0030] The following will describe the concept and technical effects of the present invention clearly and completely with reference to embodiments, so as to fully understand the purpose, features and effects of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are all within the scope of protection of the present invention.

[0031] like Figure 1 As shown, a smart building wireless module networking communication method for improving network security is characterized by including the following steps:

[0032] S10: Store the keys stored locally on the central node along with the MAC addresses of each MAC address in the communication network as node keys.

[0033] S20: The transmission node divides the transmission data into multiple data packets. The transmission node uses its local node key to encrypt the data packet division method and division time into the first encrypted data. Then, it generates the first key based on the data packet division method and division time, and uses the first key to encrypt the data packet into the first encrypted packet.

[0034] S30: The transmission node uses the first encrypted data and the first encrypted packet as the transmission data strip, adds a digest to the transmission data strip, appends the local MAC address to the transmission data strip, and sends the transmission data strip to multiple relay nodes.

[0035] S40: After receiving the transmitted data strip, the relay node uses its local node key to encrypt the transmitted data strip into a first data strip, appends its local MAC address to the first data strip, and then transmits the first data strip to other relay nodes or the central node.

[0036] S50: such as Figure 2 As shown, after receiving the first data strip, the central node initializes the MAC address array arr, puts the MAC address appended to the first data strip into arr, and searches for the corresponding node key based on the MAC address appended to the first data strip to decrypt the first data strip until the first data strip no longer contains an appended MAC address; if the node key cannot decrypt the first data strip, the node with the MAC address in arr is regarded as a dangerous node, and the communication connection between the dangerous node and the communication network is disconnected.

[0037] The central node stores the optimal path length for each transmission node, which is the number of relay nodes on the shortest or fastest path between the transmission node and the central node. The central node determines the length of the arr based on the optimal path length.

[0038] When the central node adds a MAC address to the ARR, if the ARR is full and there are still MAC addresses that have not been added to the ARR, the node with the MAC address in the ARR is regarded as a dangerous node and the communication connection between the dangerous node and the communication network is disconnected.

[0039] The transmission nodes and the central node store multiple partitioning methods (e.g., partitioning data packets according to fixed size, data packet type, data packet priority, data packet speed in the communication network, etc.). Each partitioning method has a corresponding partitioning number. The transmission nodes select the partitioning method by randomly selecting the partitioning number. The transmission nodes encrypt the partitioning number and the partitioning time corresponding to the data packet into the first encrypted data.

[0040] The transmission nodes and the central node store multiple partitioning methods. The transmission nodes select the partitioning method based on the type of transmitted data or the congestion of data transmission in the current communication network. The transmission nodes and the central node store passwords corresponding to each partitioning method. The transmission center encrypts the password and the partitioning time corresponding to the data packet into the first encrypted data.

[0041] When the central node decrypts the first data strip, it uses the first data strip containing the digest as the transmission data strip. It verifies whether the first encrypted data or the first encrypted packet has been tampered with by using the digest of the transmission data strip. If the first encrypted data or the first encrypted packet has been tampered with, the node with the MAC address in the arr is identified as a dangerous node. The communication connection between the dangerous node and the communication network is disconnected, and the partitioning method and the password or number corresponding to the partitioning method stored on the transmission node and the central node are changed.

[0042] A fixed update cycle (usually one week, but can be set by the administrator) is set within the central node. In each update cycle, the central node updates the node public key, partitioning method, and password or number corresponding to the partitioning method stored in the central node and the transmission node once or more (usually once, and the number of times needs to be specified by the administrator).

[0043] When the central node changes its public key, partitioning method, and the password or number corresponding to the partitioning method, it may change only a portion or all of them each time.

[0044] This embodiment also uses a smart building wireless module networking communication system that enhances network security through a smart building wireless module networking communication method.

[0045] In practice

[0046] A residential building houses 5 cameras, 9 relay devices, and a monitoring center. The 5 cameras act as transmission nodes, the 9 relay devices as relay nodes, and the monitoring center as the central node. These nine devices, along with the monitoring center, form a communication network. The monitoring center associates the MAC addresses of each camera and relay device with locally stored keys. Each camera and relay device also stores its corresponding key locally. After capturing image data, the 5 cameras transmit this data to the monitoring center via the relay devices. The monitoring center transmits data once a week by default. The data packet partitioning methods used by the monitoring center and the 5 cameras include: partitioning data packets according to a fixed size (1024KB or a size specified by the administrator), partitioning data packets according to data priority (different cameras have different priorities, or the cameras automatically identify and assign data priorities to image data), and partitioning data packets according to the data transmission speed within the communication network.

[0047] After camera 1 acquires a frame of image data, it selects a segmentation method based on the current network transmission status and data characteristics. At this time, the network is relatively congested, so camera 1 selects a segmentation method based on the data transmission speed in the communication network (segmentation number 3). Then, it uses a locally stored key to encrypt the data packet segmentation method (number 3) and segmentation time (accurate to milliseconds) to generate the first encrypted data. Next, it generates a first key based on this segmentation method and segmentation time, and uses this first key to encrypt the image data packet into a first encrypted packet.

[0048] Camera 1 combines the first encrypted data and the first encrypted packet into a transmission data strip, calculates the digest of the transmission data strip and adds it, and finally appends its own MAC address to the end of the transmission data strip. Then, it sends the generated transmission data strip to the nearest relay device (relay device A, relay device E and relay device E).

[0049] After receiving the data strip from camera 1, relay device A encrypts the data strip again using its locally stored node key, generating the first data strip, and appends its own MAC address to the first data strip. Based on pre-defined network topology information and routing policies, relay device A determines the next suitable relay device (relay device B). Relay device B repeats the above (corresponding to relay device A) receiving, encryption, and forwarding process before sending the data to relay device C. Relay device C repeats the above (corresponding to relay device A) operations before sending the data to the monitoring center.

[0050] After receiving the first data packet (sent by relay device C) from the relay device, the monitoring center initializes the array `arr`, adds the MAC address (of relay device C) appended to the first data packet to `arr`, and then looks up the corresponding node key (of relay device C) based on the MAC address of relay device C to decrypt the first data packet. This yields the second first data packet and the MAC address of relay device B. Using the MAC address of relay device B, the center finds its node public key and uses it to decrypt the second first data packet, obtaining the third first data packet and the MAC address of relay device A. Repeating this decryption process, the resulting four first data packets contain a digest, and the fourth first data packet is then used as the transmission data packet. After verifying the digest of the transmitted data strip, the monitoring center confirmed that the first encrypted data and the first encrypted packet had not been tampered with. Then, it used the node public key obtained once, namely the node public key of camera 1, to decrypt the first encrypted data, obtain the partitioning method (number 3) and partitioning time, and obtain the first key through the partitioning method (number 3) and partitioning time. The first key was then used to decrypt the first encrypted packet to obtain the data packet.

[0051] After relay device E receives the first data packet, it is transmitted to the monitoring center via relay device F. During decryption, the monitoring center discovers that the public key obtained by looking up the MAC address of relay device F cannot decrypt the first data packet. Therefore, relay device F is identified as a dangerous node (at this point, only the MAC address of relay device F is stored in the ARR file), and its communication connection with the communication network is immediately disconnected. Simultaneously, the monitoring center will change the partitioning method and the corresponding password or number stored in itself and all cameras to prevent similar security issues from recurring.

[0052] The monitoring center stores the optimal path length (2-3) for camera 1, which is the number of relay nodes on the shortest path (2 nodes) or the fastest path (3 nodes) between the transmission node and the central node. The central node determines the length of arr1 (4, plus the MAC address of camera 1) based on the optimal path length. Image data from camera 1 is transmitted to the monitoring center via relay devices G, H, and I. When the monitoring center decrypts the data, it finds that arr1 is full (already containing 4 MAC addresses) before storing the MAC address of camera 1. Therefore, it identifies the nodes with MAC addresses in arr1 as dangerous nodes and disconnects their communication connection from the communication network.

[0053] Every Wednesday, the monitoring center operates according to the set update mechanism. It can choose to update only the public keys, partitioning methods, and password numbers of some nodes, such as updating only the information of lower-priority cameras, or updating all of them. After the update, the monitoring center synchronously sends the new information to each camera, ensuring that the security policy of the entire communication network remains dynamically updated to cope with various potential security threats and changes in the network environment.

[0054] The above descriptions are merely embodiments of the present invention, and common knowledge regarding specific structures and characteristics is not elaborated upon here. It should be noted that those skilled in the art can make various modifications and improvements without departing from the structure of the present invention, and these should also be considered within the scope of protection of the present invention. These modifications and improvements will not affect the effectiveness of the present invention or the practicality of the patent. The scope of protection claimed in this application should be determined by the content of its claims, and the specific embodiments described in the specification can be used to interpret the content of the claims.

Claims

1. A method for networking and communicating wireless modules in intelligent buildings to enhance network security, characterized in that, Includes the following steps: S10: Store the keys stored locally on the central node along with the MAC addresses of each MAC address in the communication network as node keys. S20: The transmission node divides the transmission data into multiple data packets. The transmission node uses its local node key to encrypt the data packet division method and division time into the first encrypted data. Then, it generates the first key based on the data packet division method and division time, and uses the first key to encrypt the data packet into the first encrypted packet. S30: The transmission node uses the first encrypted data and the first encrypted packet as the transmission data strip, adds a digest to the transmission data strip, appends the local MAC address to the transmission data strip, and sends the transmission data strip to multiple relay nodes. S40: After receiving the transmitted data strip, the relay node uses its local node key to encrypt the transmitted data strip into a first data strip, appends its local MAC address to the first data strip, and then transmits the first data strip to other relay nodes or the central node. S50: After receiving the first data strip, the central node initializes the array arr of MAC addresses, puts the MAC address appended to the first data strip into arr, and searches for the corresponding node key based on the MAC address appended to the first data strip to decrypt the first data strip until the first data strip no longer contains an appended MAC address; if the node key cannot decrypt the first data strip, the node with the MAC address in arr is regarded as a dangerous node, and the communication connection between the dangerous node and the communication network is disconnected.

2. The intelligent building wireless module networking communication method for improving network security according to claim 1, characterized in that: The central node stores the optimal path length for each transmission node. The optimal path length is the number of relay nodes on the shortest or fastest path between the transmission node and the central node. The central node determines the length of the arr based on the optimal path length.

3. The intelligent building wireless module networking communication method for improving network security according to claim 2, characterized in that: When the central node adds a MAC address to the ARR, if the ARR is full and there are still MAC addresses that have not been added to the ARR, the node with the MAC address in the ARR is regarded as a dangerous node, and the communication connection between the dangerous node and the communication network is disconnected.

4. The intelligent building wireless module networking communication method for improving network security according to claim 3, characterized in that: The transmission node and the central node store multiple partitioning methods, each with a corresponding partitioning number. The transmission node selects the partitioning method by randomly selecting the partitioning number. The transmission node encrypts the partitioning number and the partitioning time corresponding to the data packet into the first encrypted data.

5. The intelligent building wireless module networking communication method for improving network security according to claim 3, characterized in that: The transmission nodes and the central node store multiple partitioning methods. The transmission nodes select the partitioning method based on the type of transmitted data or the congestion of data transmission in the current communication network. The transmission nodes and the central node store passwords corresponding to each partitioning method. The transmission center encrypts the password and the partitioning time corresponding to the data packet into the first encrypted data.

6. The intelligent building wireless module networking communication method for improving network security according to claim 5 or claim 4, characterized in that: When the central node decrypts the first data strip, it uses the first data strip containing the digest as the transmission data strip. It verifies whether the first encrypted data or the first encrypted packet has been tampered with by using the digest of the transmission data strip. If the first encrypted data or the first encrypted packet has been tampered with, the node with the MAC address in the ARR is designated as a dangerous node. The communication connection between the dangerous node and the communication network is disconnected, and the partitioning method and the password or number corresponding to the partitioning method stored on the transmission node and the central node are changed.

7. The intelligent building wireless module networking communication method for improving network security according to claim 6, characterized in that: A fixed update cycle is set within the central node. During each update cycle, the central node updates the node public key, partitioning method, and the password or number corresponding to the partitioning method stored in the central node and the transmission node once or multiple times.

8. The intelligent building wireless module networking communication method for improving network security according to claim 7, characterized in that: When the central node changes its public key, partitioning method, and the password or number corresponding to the partitioning method, it may change only a portion or all of them at a time.

Images