An internet of things device traffic obfuscation method based on server policy

Abstract

The application provides an Internet of Things device traffic obfuscation method based on server strategy, which effectively deals with passive attack threats by enhancing communication privacy and security. The method comprises: an Internet of Things device establishes an encrypted network communication connection with a server, and requests a traffic obfuscation strategy from the server; the server analyzes and counts the device traffic through data clustering, maps the instruction traffic to a fixed value, and generates an obfuscation strategy to return to the device; the Internet of Things device receives and executes the obfuscation strategy, and realizes specific packet length distribution communication through traffic shaping; and the server performs shaping communication on the returned data according to the obfuscation strategy. Under the premise of ensuring communication security, the application uses a separately developed obfuscation strategy to effectively prevent passive attacks; at the same time, the traffic characteristics of the device are used for mapping, the performance loss is reduced, the normal communication of both parties is ensured, the application has high security and high availability, and has important practical value.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of information security of Internet of Things devices, and relates to an Internet of Things device traffic obfuscation method, in particular, covers the strategy making and traffic obfuscation technology when establishing a communication connection between an Internet of Things device and a server and conducting data transmission. BACKGROUND

[0002] With the rapid development of Internet of Things technology, and the emergence of Internet of Things device smart home platforms of manufacturers such as Google, Amazon, Xiaomi, etc., the communication scale between devices has increased dramatically. While the Internet of Things devices are growing rapidly, the personal privacy and data security of users become particularly important. However, the network traffic generated thereby also brings new threats and challenges to network security. Internet of Things devices such as smart speakers interact with servers through messages to meet user needs and provide customized services. In order to protect user communication data privacy, the network interaction between Internet of Things devices and servers is mostly encrypted traffic. However, recent research shows that attackers can infer user privacy information from encrypted network messages. The reason is that user privacy activities will be reflected in the traffic data of the interaction between Internet of Things devices and servers, and the user activities are highly correlated with the statistical characteristics such as message length and time sequence of network traffic. Attackers can infer user behavior by analyzing the message characteristics in user activities, thereby obtaining user privacy information such as the opening and closing of smart locks and the playing content of smart speakers.

[0003] To address this challenge, existing research proposes to use traffic obfuscation technology to improve the security of Internet of Things devices. Current domestic and foreign research on obfuscation technology for smart Internet of Things devices mainly includes various methods, such as packet padding, traffic shaping, false traffic injection, and virtual users. Among them, packet padding is mainly aimed at attack methods that rely on packet size characteristics, while traffic shaping is aimed at the overall statistical characteristics of data flow, including the time sequence, period, and rate of traffic. The purpose of false traffic injection is to deceive attackers and simulate the traffic of real devices, including simulating traffic size, traffic type, and traffic pattern. Virtual users are an optimization method based on false traffic injection proposed in recent years, which constructs a logically complete and realistic user behavior pattern and projects it into home traffic to prevent attackers from spying on the privacy information of real users.

[0004] However, the above methods require Internet of Things users to configure specific traffic obfuscation parameters, such as the size of the data sent, the time interval distribution of message sending, etc. When configuring the above parameters, factors such as network bandwidth size and Internet of Things device performance need to be considered, which is a great challenge for ordinary users. Therefore, it is necessary to design an Internet of Things device traffic obfuscation method that can automatically determine parameters, without user participation in the execution process, and facilitate actual deployment and use.

[0005] The patent proposes a method for traffic obfuscation of Internet of Things devices based on server strategy formulation, which can realize automatic determination of traffic obfuscation parameters. Unlike existing methods, the traffic obfuscation strategy in the patent method is formulated by the server side. The server clusters the data volume generated by the Internet of Things device instructions, and maps the data volume in the same class to a fixed value. According to the network communication environment possessed by the Internet of Things device, the fixed value is decomposed into a specific packet length distribution, thereby realizing traffic obfuscation. The invention can realize automatic determination of obfuscation strategy, and can produce different obfuscation effects for different Internet of Things devices, thereby realizing high availability and high security protection. SUMMARY

[0006] The present invention aims to solve the privacy and security problems in the communication of Internet of Things devices, and aims to provide an innovative traffic obfuscation method for Internet of Things devices to defend against passive attacks in the field of Internet of Things.

[0007] To solve the above technical problems, the present invention proposes a method for traffic obfuscation of Internet of Things devices based on server strategy formulation, which includes the following steps:

[0008] (1) Establish a communication connection: the Internet of Things device establishes an encrypted network communication connection with the server;

[0009] (2) Request to issue obfuscation strategy: the Internet of Things device sends a request to the server to request to obtain the traffic obfuscation strategy;

[0010] (3) Server obfuscation strategy formulation: the server maps the data volume generated by the instructions to a fixed value through data clustering. The server confirms the request of the Internet of Things device. The server analyzes the statistical characteristics of the traffic interaction of the Internet of Things device, and returns the traffic distribution to the Internet of Things device as the obfuscation strategy;

[0011] (4) The Internet of Things device accepts the obfuscation strategy and performs traffic obfuscation. The Internet of Things device shapes the data into a specific packet length distribution according to the packet size and format determined by the obfuscation strategy for communication;

[0012] (5) Server returns data traffic obfuscation. The server shapes the data into a specific packet length distribution according to the traffic characteristics determined by the obfuscation strategy to send back the data.

[0013] The step (1) specifically includes the following steps:

[0014] (1-1) The Internet of Things device starts and attempts to establish a network connection with the server;

[0015] (1-2) IoT devices and servers handshake through encrypted transmission protocols, such as Transport Layer Security (TLS), to negotiate encryption algorithms and session keys and establish an encrypted communication channel.

[0016] In step (2), after the IoT device starts up and establishes a connection with the server, it sends a request to obtain a traffic obfuscation policy. Taking a common IoT communication protocol such as MQTT (Message Queuing Telemetry Transport) as an example, after the IoT device connects to the MQTT broker server, the device subscribes to a specific topic such as "confusion_policy_request". The IoT device publishes a message to this topic, indicating a request to obtain a traffic obfuscation policy. After receiving the message, the server performs subsequent obfuscation operations based on the device's identifier and context information.

[0017] Step (3) specifically includes the following steps:

[0018] (3-1) The server retrieves traffic data from all stored device commands;

[0019] (3-2) The server confirms the request from the IoT device;

[0020] (3-3) The server maps the amount of data generated by the instructions to a fixed value through data clustering;

[0021] (3-4) The server formulates an obfuscation strategy for this communication interaction based on the characteristics of the IoT device messages;

[0022] (3-5) The server sends an obfuscation policy to the IoT device for use in this communication.

[0023] In step (3-1), the server collects and stores all server-sent and returned data from all device instructions, forming a set D1 = {d 11 , d 12 , …, d 1n} and D2 = {d 21 , d 22 , …, d 2n}, where d 1i d represents the amount of traffic data sent by the IoT device in the i-th instruction. 2i This indicates the amount of traffic data returned by the server for the i-th instruction.

[0024] In step (3-2), the server receives an interaction request from an IoT device, begins the data clustering and obfuscation strategy formulation process on the server side, and returns confirmation information.

[0025] In step (3-3), the data clustering algorithm adopts the K-means algorithm, and the specific process is as follows:

[0026] (3-3-1): The server uses the K-means algorithm to perform clustering analysis on the sets D1 and D2. First, the elbow method is used to determine the optimal clustering numbers k1 and k2.

[0027] (3-3-2): The total variation WSS (Within Sum of Squares) under different k values is calculated to generate the best clustering result.

[0028] (3-3-3): The k value that makes WSS(k) sharply decrease and start to tend to be flat is selected as the optimal clustering number.

[0029] (3-3-4): According to the optimal clustering numbers k1 and k2, the set D1 is clustered into k1 clusters: {S1, S2, …, S k1}, and the set D2 is clustered into k2 clusters: {R1, R2, …, R k2}, where S i and R i represent the clustering results of the sending and return traffic data volumes, respectively. The server maps the maximum value of each cluster as a fixed value according to the clustering results.

[0030] In step (3-4), the server analyzes the statistical characteristics of the traffic of the Internet of Things device and extracts the traffic data volume distribution that meets the data volume size to construct the sets Send[] and Return[]. For the type of the current requested Internet of Things device, the server will count the average sending and return traffic data volumes, and according to the average data size, the clusters that meet the data volume range of this type are divided. Define the average data size of the sending message as l, the average data size of the return message as h, and the fixed value of the cluster as max(S i ) or max(R i ). The server will divide the clusters corresponding to the sending and return traffic data volume clustering into a certain number of specific message lengths {l1, l2, …, l p} and {h1, h2, …, h q}. As shown in formulas (1) and (2), the sum of these lengths is approximately equal to max(S i ) or max(R i ).

[0031]

[0032]

[0033] Where p and q represent the number of segments that the maximum value in the corresponding cluster divides, respectively, and are determined based on the actual situation and the average data sizes l and h. The server generates the message length distribution based on the decomposition results. After generating the clustering results in step (3-3), cluster S i R i The selection is based on the instruction set of the device stored on the server. The data size of the instruction set should be included within the cluster, max(S) i ) or max(R i The maximum value of the selected cluster is used as a fixed value for obfuscation. The server uses the IoT device's instruction set (commands) and the fixed value (max(S)) as a reference. i ) and the distribution of message lengths sent by the device {l1, l2, …, l p} Load the set Send[], which contains the instruction set commands and the fixed value max(R) i The length distribution of the messages sent by the server {h1, h2, …, h} q} Load the collection Return[].

[0034] In steps (3-5), the server converts the Send[] and Return[] collections into JSON format data, as shown below:

[0035] Send[] = {

[0036] "commands": ["cmd1", "cmd2", …, "cmd n "]

[0037] max(S i ) "

[0038] "distribution": ["l1", "l2", …, "l p "]

[0039] }

[0040] Return[] = {

[0041] "commands": ["cmd1", "cmd2", …, "cmd n "]

[0042] "max(R) "

[0043] "distribution": ["h1", "h2", …, "h q "]

[0044] }

[0045] The server issues Send[] as the obfuscation strategy to the Internet of Things device.

[0046] The step (4) specifically comprises the following steps:

[0047] (4-1) The Internet of Things device receives and stores the obfuscation strategy issued by the server;

[0048] (4-2) The Internet of Things device performs traffic shaping on the sending data according to the specific packet length distribution;

[0049] (4-3) The Internet of Things device performs data sending.

[0050] In step (4-2), when the Internet of Things device triggers the user instruction and communicates with the server, the obfuscation strategy issued by the server needs to be adopted. The specific operation is as follows: the device maps the data required for this communication into the packet length distribution {l1, l2, …, ln} in the set Send[], and according to the data volume, the data from l1 to ln (n≤p) is intercepted to meet the requirement of packet length. In addition, according to the packet length distribution, the data packet for this transmission is divided into multiple parts. The size of the sent data packet is equal to the packet length distribution {l1, l2, …, ln}, and the sending is completed, thereby forming a specific packet length distribution. p n n

[0051] In step (4-3), the Internet of Things device performs traffic shaping on the traffic corresponding to the user instruction, and sends the data packet according to the preset packet length distribution. When the Internet of Things device receives the user instruction, forms a specific packet length distribution, and sends the data packet according to the length {l1, l2, …, ln} in turn. When the nth data packet is sent, the device checks the size of the data part, and performs data packet padding on the packet, and fills the blank content at the tail of the packet to the corresponding length ln. n n

[0052] The step (5) specifically comprises the following steps:

[0053] (5-1) The server performs traffic shaping on the sending data according to the specific packet length distribution;

[0054] (5-2) The server performs data sending.

[0055] In step (5-1), when the server receives the traffic of the Internet of Things device after obfuscation, the predetermined obfuscation strategy needs to be adopted when the data is sent back. The server maps the data volume required for this communication into the packet length distribution {h1, h2, …, hn} in the set Return[], and according to the data volume, the data from h1 to hn (n≤p) is intercepted to meet the requirement of packet length. In addition, according to the packet length distribution, the data packet for this transmission is divided into multiple parts. The size of the sent data packet is equal to the packet length distribution {h1, h2, …, hn}, and the sending is completed, thereby forming a specific packet length distribution.​​​​​q} according to the communication data volume, and the data is intercepted according to the data volume distribution {h1, h2, …, hp} (m≤p) to meet the requirement of the message length. In addition, according to the message length distribution, the data packet of this transmission is divided into multiple parts. The size of the transmitted data packet is equal to the message length distribution {h1, h2, …, hp} until the transmission is completed, thereby forming a specific message length distribution. m m} until the transmission is completed, thereby forming a specific message length distribution.

[0056] In step (5-2), the server performs traffic shaping on the traffic corresponding to the user instruction, and transmits the data packet according to the preset message length distribution. When the server receives the request of the Internet of Things device, forms a specific message length distribution, and then transmits the data packet according to the length {h1, h2, …, hp} in turn. When the mth data packet is transmitted, the device checks the size of the data part, and performs data packet padding on the message, and fills the blank content at the tail of the message to the corresponding length h m m . BRIEF DESCRIPTION OF DRAWINGS

[0057] Figure 1 The core idea of the patent is given.

[0058] Figure 2 The data clustering method is given.

[0059] Figure 3 The clustering result mapping diagram is given.

[0060] Figure 4 The data packet padding structure diagram is given.

[0061] Figure 5 The obfuscated traffic diagram is given. DETAILED DESCRIPTION

[0062] As shown in Figure 1 , the Internet of Things device starts and attempts to establish an initial connection with the server. The two parties perform a handshake through the Transport Layer Security (TLS) protocol, negotiate encryption algorithms and session keys, and establish an encrypted communication channel. In this process, the Internet of Things device sends a list of supported TLS versions and encryption algorithm suites to the server, and the server selects the highest security TLS version and the appropriate encryption algorithm as a response to the Internet of Things device. The Internet of Things device verifies the validity and legality of the digital certificate provided by the server to ensure that the communication partner is a legal server entity. The device and the server negotiate to generate a symmetric encryption key for the communication session, establishing a secure encrypted communication channel.

[0063] ​​Once the encrypted communication channel is established, the IoT device sends a request to the server to obtain the obfuscation strategy formulated by the server according to the communication characteristics of the device. After receiving the request of the IoT device, the server first confirms the request of the IoT device, and then clusters the stored traffic data. Figure 2 , Figure 3 The elbow method is used to determine the optimal number of clusters and the clustering result in the clustering process using the captured Xiaomi smart speaker dataset.

[0064] The server extracts the traffic data of all device instructions stored. Through the data clustering algorithm K-means algorithm, the server clusters the data amount set D1 generated by the instructions and the return data amount set D2, and determines the optimal number of clusters using the elbow method. As shown in Figure 2 , by calculating the total internal square sum WSS of the set D1, the value of k that makes WSS(k) sharply decrease and start to flatten is selected as the optimal number of clusters. In this dataset, the optimal number of clusters is 4, so the data set D1 is clustered into 4 clusters {S0, S1, S2, S3}. Each cluster S i represents the clustering result of the data amount sent, and the server maps the maximum value of each cluster as a fixed value according to the clustering result. As shown in Figure 3 , in the dataset used this time, the cluster corresponding to the data amount generated by the device is S2, and the fixed value max(S2) is 880. Let the p value be 5, then the packet length distribution {l1, l2, l3, l4, l5} = {176, 176, 176, 176, 176} is loaded into the set Send[], and then the json file is downloaded to the IoT device, with the format:

[0065] Send[] = {

[0066] "commands": ["cmd1", "cmd2", …, "cmd n " ]

[0067] "max(S2) "

[0068] "distribution": ["176", "176", "176", "176", "176"]

[0069] }. Where cmd i represents the set of all user instructions of the device, max(S2) represents the fixed value 880, and distribution represents the packet length distribution.

[0070] After the Internet of Things device receives the obfuscation strategy issued by the server, it starts to execute traffic obfuscation on the sending data. When the user interacts with the Internet of Things device to generate instruction A, the device maps the data amount m corresponding to instruction A to the packet length distribution. Let m = 700, the device intercepts the packet length distribution {l1, l2, …, l n}. That is {176, 176, 176, 176}. The Internet of Things device performs traffic shaping on the traffic corresponding to the user instruction according to the generated packet length distribution, fills 4 bytes of white data at the tail of the 4th packet, and ensures that the data packet is sent according to the preset packet length distribution. The traffic graph after shaping is shown as Figure 5 , and Figure 5 It can be seen that the len value of the obfuscated traffic is 176, which meets the obfuscation strategy. After the server receives the data packet sent by the Internet of Things device, it generates the obfuscation strategy Return[] according to the clustering result in the same way. The packet length distribution is generated, traffic shaping is performed, and the return data packet is sent.

[0071] In the above traffic obfuscation process, it is shown how the server and the Internet of Things device realize data traffic obfuscation in the communication process through the obfuscation strategy to ensure the security of the communication and the impact on the performance.

[0072] It should be noted that the content and specific embodiments of the present application are intended to prove the practical application of the technical solutions provided by the present application, and should not be interpreted as a limitation on the scope of protection of the present application. Those skilled in the art can make various modifications, equivalent replacements, or improvements under the inspiration of the spirit and principles of the present application. However, these changes or modifications are within the scope of protection of the application.

Claims

1. A method for obfuscating IoT device traffic based on server policy, characterized in that, The method comprises the following steps: Step 1, establishing a communication connection: the Internet of Things device establishes an encrypted network communication connection with the server; Step 2, request to issue a confusion strategy: the Internet of Things device sends a request to the server to request traffic confusion strategy; Step 3, server confusion strategy making: the server collects and stores all device instruction server sending and returning data to form sets D1 and D2; the data clustering algorithm adopts K-means algorithm to perform clustering analysis on sets D1 and D2, first, the elbow method is used to determine the optimal clustering numbers k1 and k2; according to the optimal clustering numbers k1 and k2, set D1 is clustered into k1 clusters: {S1, S2, …, S k1}, and set D2 is clustered into k2 clusters: {R1, R2, …, R k2}, wherein S i , R i represent the clustering results of the sending and returning traffic data amounts respectively; the server maps the maximum value of each cluster as a fixed value according to the clustering results; The server analyzes the statistical characteristics of the traffic of the Internet of Things device, extracts the traffic data volume distribution that meets the data volume size, and constructs sets Send[] and Return[]; for the type of the current requested Internet of Things device, the server will count the average sending and returning traffic data volume, and according to the average data size, the cluster that meets the type of data volume range is segmented, the average data size of the sending message is defined as l, the average data size of the returning message is defined as h, and the fixed value of the cluster is max(S i ) or max(R i ), the server will segment the cluster corresponding to the sending and returning traffic data volume into a plurality of specific message lengths {l1, l2, …, l p} and {h1, h2, …, h q}; wherein, the values of p and q respectively represent the number of the maximum value in the corresponding cluster, which is determined according to the actual situation and the average data size l and h; the server will load the instruction set commands of the Internet of Things device, the fixed value max(S i ) and the device sending message length distribution {l1, l2, …, l p} into the set Send[], and load the instruction set commands, the fixed value max(R i ) and the server sending message length distribution {h1, h2, …, h q} into the set Return[]; the server sends Send[] to the Internet of Things device as the confusion strategy. Step 4, the Internet of Things device accepts the confusion strategy and performs traffic confusion: the Internet of Things device shapes the data into a specific packet length distribution according to the packet size and format determined by the confusion strategy Send[] for communication; Step 5, the server returns the traffic confusion data: the server shapes the data into a specific packet length distribution according to the traffic characteristics determined by the confusion strategy Return[] to send back the data.

2. The method of claim 1, wherein, The step 1 comprises the following steps: Step 1-1, the Internet of Things device starts and attempts to establish a network connection with the server; Step 1-2, the Internet of Things device and the server perform handshake through an encrypted transmission protocol, negotiate encryption algorithm and session key, establish an encrypted communication channel, and the encrypted transmission protocol is TLS protocol.

3. The method of claim 1, wherein, The step 4 comprises the following steps: Step 4-1, the Internet of Things device receives and stores the confusion strategy issued by the server; Step 4-2, the Internet of Things device performs traffic shaping on the sending data according to a specific packet length distribution; Step 4-3, the Internet of Things device sends data.

4. The method of claim 1, wherein, The step 5 comprises the following steps: Step 5-1, the server performs traffic shaping on the sending data according to a specific packet length distribution; Step 5-2, the server sends data.

5. The method of claim 1, wherein, The server maps the maximum value of each cluster as a fixed value according to the clustering result, comprising: Step 3-3-1, the server uses K-means algorithm to perform clustering analysis on the set D1, D2, first, determines the optimal clustering number k1, k2 by using elbow method; Step 3-3-2, calculate the total variation WSS(Within Sum of Squares) under different k values, in order to generate the best clustering result; Step 3-3-3, select the k value that makes WSS(k) sharply decrease and start to tend to be flat as the best clustering number; Step 3-3-4, according to the optimal cluster number k1, k2, the set D1 is clustered into k1 clusters: {S1, S2, …, S k1} and the set D2 is clustered into k2 clusters: {R1, R2, …, R k2}, where S i , R i represent the clustering results of the sending and return traffic data respectively; the server maps the maximum value of each cluster as a fixed value according to the clustering results.

Images