A secure communication method for heterogeneous Internet of Things

Abstract

This invention relates to a secure communication method for heterogeneous Internet of Things (IoT), comprising: a control terminal establishing a covert channel according to a communication protocol with a controlled terminal; sending an encryption method and a random key to the controlled terminal via the covert channel; establishing a secure channel with the control terminal; encrypting user-input control commands to obtain ciphertext; transmitting the ciphertext to the controlled terminal via the established secure channel; decrypting the ciphertext using the acquired encryption method and random key to obtain a decryption command; converting the decryption command according to a protocol and forwarding it to a specified destination address via a corresponding port; the device at the destination address executing the corresponding operation according to the decryption command and returning the corresponding requested resource; encrypting the requested resource using the acquired encryption method and random key to obtain an encrypted request resource; converting the encrypted request resource according to a protocol and forwarding it to the control terminal via a corresponding port; the control terminal receiving the encrypted request resource returned by the controlled terminal; decrypting the encrypted request resource using the selected encryption method and random key to obtain the decrypted request resource; and printing the decrypted request resource on a command-line interface for display to the user. This invention improves the concealment of network communication.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of communication, in particular to a secure communication method for heterogeneous Internet of Things. BACKGROUND

[0002] The concept of Internet of Things is increasingly integrated into various industries, such as smart home, smart medical care, forest fire prevention, agricultural irrigation, geological survey, military, transportation, etc. The traces of Internet of Things can be seen in these fields. With the continuous progress of modern communication technology, the scale of Internet of Things will continue to expand, and it is possible to accommodate more terminals and transmit more data. At the same time, it brings the coexistence of multiple communication networks, including wireless local area network (WiFi), wireless personal area network (Bluetooth), mobile communication network (4G 5G), short-range wireless sensor network (ZigBee, Zwave), satellite network, Ethernet, etc. Formed a heterogeneous network.

[0003] In order to adapt to the increasingly dynamic and complex environment, the heterogeneous Internet of Things technology has different advantages and disadvantages in deployment and running environment, system size, communication range, required bandwidth, delay, reliability, security, etc. It has different functions and applications. However, there are a large number of devices and sensors in the heterogeneous Internet of Things, which may come from different manufacturers, use different communication protocols and data formats, resulting in incompatibility between different networks in interconnection and information exchange. The current research, the mainstream method is to build an Internet of Things gateway for specific devices and specific protocols, which is difficult to migrate to other Internet of Things environments, and the Internet of Things gateway is usually an additional physical device, which is very low in convenience and timeliness, and is not conducive to information acquisition in the face of more and more complex heterogeneous Internet of Things scenarios.

[0004] In the heterogeneous Internet of Things, there are a large number of devices and a large amount of data exchange between devices, which may contain a large amount of personal data and privacy information, and the security performance and data protection ability of different devices may differ. Lack of security and concealment in the communication process, may face various interference and attacks, such as network attack, data tampering or device impersonation, easy to cause privacy leakage, identity theft and other problems. Heterogeneous Internet of Things communication is mainly carried out in wireless network channel, and due to the openness of wireless network, attackers exist widely in open network, and communication eavesdropping and privacy data leakage problems may cause immeasurable hidden dangers and dangers. The upper encryption technology based on cryptography is the most important means to protect data security, but in the high dynamic heterogeneous network, it is difficult to distribute and manage keys. SUMMARY

[0005] In order to solve the problems in the background, the present application provides a secure communication method for heterogeneous Internet of Things, comprising:

[0006] S1: the control end builds a covert channel according to the communication protocol between the control end and the controlled end, and sends the encryption mode and the random secret key to the controlled end through the covert channel;

[0007] S2: the controlled end receives the encryption mode and the random secret key from the covert channel, and establishes a secure channel with the control end;

[0008] S3: the control end encrypts the control instruction input by the user to obtain instruction ciphertext, and transmits the specified ciphertext to the controlled end through the established secure channel;

[0009] S4: the controlled end decrypts the instruction ciphertext by obtaining the encryption mode and the random secret key to obtain the decrypted instruction, and forwards the decrypted instruction to the specified destination address through the corresponding port after protocol conversion;

[0010] S5: the device at the destination address executes the corresponding operation according to the decrypted instruction, and returns the corresponding request resource;

[0011] S6: the controlled end encrypts the request resource by obtaining the encryption mode and the random secret key to obtain the encrypted request resource, and forwards the encrypted request resource to the control end through the corresponding port after protocol conversion;

[0012] S7: the control end receives the encrypted request resource returned by the controlled end, decrypts the encrypted request resource by using the selected encryption mode and the random secret key to obtain the decrypted request resource, and prints the decrypted request resource on the command line interface to show the user.

[0013] The present application has at least the following beneficial effects

[0014] The present application is from the perspective of data security transmission of the Internet of Things, and is proposed in view of the problems of lack of interoperability, concealment, and difficulty in traditional encryption key exchange in the data communication of the heterogeneous Internet of Things scene. In the huge heterogeneous Internet of Things environment, a lightweight secure channel can be quickly provided for the control platform to directly communicate with the terminal node. The channel supports heterogeneous Internet of Things multi-protocol conversion, breaks the communication barrier between heterogeneous devices, enables interconnection and intercommunication between heterogeneous devices, reduces additional hardware overhead, and makes the network construction more flexible. Furthermore, the covert channel is built in the channel between the control end and the controlled end for symmetric encryption key distribution, which ensures the information transmission efficiency and solves the key exchange problem. BRIEF DESCRIPTION OF DRAWINGS

[0015] Figure 1 The application scenario diagram of the present application in the heterogeneous Internet of Things is shown;

[0016] Figure 2 The overall communication flowchart of the embodiment of the present application is shown;

[0017] Figure 3 Flow chart for protocol conversion function of the present application;

[0018] Figure 4 Example diagram for port forwarding across Bluetooth and WiFi of the present application. DETAILED DESCRIPTION

[0019] The present application is herein described, by way of example only, with reference to certain embodiments thereof. It is to be understood that variations and modifications of the present application can be made based on the description set forth herein, without departing from the scope and spirit of the application. It is also to be understood that features from one example embodiment can be incorporated into another example embodiment. Further, it is understood that the examples provided below are merely illustrative of the principles of the present application and are not intended to limit the scope of the application.

[0020] Referring to Figure 1 The present application provides a secure communication method for heterogeneous Internet of Things, comprising:

[0021] S1: a control terminal establishes a covert channel according to a communication protocol between the control terminal and a controlled terminal, and sends an encryption mode and a random secret key to the controlled terminal through the covert channel;

[0022] Preferably, the step S1 specifically comprises:

[0023] S11: after the control terminal is started, an encryption mode used for this time of communication is selected from a preset encryption algorithm list;

[0024] S12: according to the selected encryption mode, a secret key generation function in a corresponding encryption algorithm library is called to generate a random secret key;

[0025] S13: when a communication protocol pre-agreed between the control terminal and the controlled terminal is a Bluetooth protocol, a manufacturer specific data field in advertisement data is selected as the covert channel;

[0026] S14: when the communication protocol pre-agreed between the control terminal and the controlled terminal is a WIFI protocol, an empty field in an extra field of a control frame is selected as the covert channel;

[0027] S15: the control terminal sends a communication request message to a predetermined controlled terminal through a normal network communication protocol, and embeds the selected encryption mode and the generated random secret key into the covert channel after format processing.

[0028] Preferably, the format processing of the selected encryption mode and the generated random secret key comprises:

[0029] For a set of elements {A i | 0 < i < n}, all elements are stored in an array in a certain order. Array[0] = A1, Array[1] = A2,..., Array[n - 1] = A n , during one encoding process, the total number of elements in the array is n, and N bits of hidden information can be transmitted each time, where N = log2 n; define a mapping relationship f to achieve a one-to-one correspondence between bit sequences and elements; the mapping relationship f is defined as follows: for any variable x, 0 ≤ x < 2 N , let the binary representation of x be {b N-1 , b N-2 ,..., b0}2, that is, x = b0 + b1×2 + … + b N-2 ×2 N-2 + b N-1 ×2 N-1 , where b i ∈{0, 1}; through Array[x], it uniquely corresponds to A x+1 , thus achieving a unique correspondence between message bits and elements. Convert the selected encryption method and the generated random secret key into binary representation, and then perform formatting processing through the defined mapping relationship f.

[0030] S2: The controlled end receives the encryption method and the random secret key from the hidden channel and establishes a secure channel with the control end;

[0031] Preferably, the establishment of the secure channel includes: the controlled end analyzes the communication request message according to the communication protocol with the control end, identifies the normal communication request message, and identifies the encryption method and the random secret key in the hidden channel according to the rules pre-agreed with the control end, and confirms whether it has the ability to perform secure communication according to this information. If so, it sends an agreed communication response packet to the control end through the normal network communication channel.至此, the control end and the controlled end establish a secure channel.

[0032] Preferably, the identification of the encryption method and the random secret key in the hidden channel according to the rules pre-agreed with the control end includes: the controlled end obtains the formatted encryption method and the random secret key from the hidden channel, finds the position in the array through the mapping relationship f to restore the original binary sequence with a length of N bits, and converts the binary sequence into characters to obtain the encryption method and the random secret key.

[0033] S3: The control end encrypts the control instruction input by the user to obtain the instruction ciphertext, and transmits the specified ciphertext to the controlled end through the established secure channel;

[0034] S4: The controlled end decrypts the instruction ciphertext by the acquired encryption mode and random key to obtain a decrypted instruction, and forwards the decrypted instruction to a specified destination address after protocol conversion through a corresponding port;

[0035] S5: The device at the destination address executes corresponding operations according to the decrypted instruction, and returns corresponding requested resources;

[0036] S6: The controlled end encrypts the requested resources by the acquired encryption mode and random key to obtain encrypted requested resources, and forwards the encrypted requested resources to the control end after protocol conversion through a corresponding port;

[0037] Preferably, the controlled end listens to the communication connection of the controlled end in real time through a wireless circulating thread, when the controlled end receives a data packet, first analyzes the received data packet according to the communication protocol between the sending end and the controlled end, extracts the valid field in the data packet, and then re-encapsulates the valid field data based on the communication protocol between the controlled end and the receiving end, and sends it to the receiving end through a corresponding port, completing the protocol conversion of the data.

[0038] S7: The control end receives the encrypted requested resources returned by the controlled end, decrypts the encrypted requested resources by the selected encryption mode and random key to obtain decrypted requested resources, and prints the decrypted requested resources on the command line interface to show the user.

[0039] Preferably, the controlled end is running silently in the loT device, when the controlled end receives the self-destruction instruction of the control end, the controlled end performs the following operations: disconnects the connection with the control end, and destroys the communication data by multiple overwriting; according to the operating system of the controlled end, the application program is ended and deleted; the network connection of the controlled end is closed.

[0040] In order to describe the above-mentioned scheme in more detail, the following specific embodiments are provided in this paper:

[0041] In the embodiment, the control end and the controlled end are deployed in a double-end mode at two ends. The controlled end is a lightweight heterogeneous Internet of Things middleware. It does not need a fixed gateway device, can be implanted into an existing Internet of Things device and run silently. The control end can run in a PC or a Linux terminal as a command sending and data receiving center, can access the heterogeneous Internet of Things device without sensing, and the two ends are specifically composed of four modules. The control end includes a communication module, an encryption and decryption module, a parameter analysis module and a data storage module. The controlled end includes a communication module, an encryption and decryption module, a parameter analysis module and a self-destruction module. The communication module has the functions of heterogeneous Internet of Things protocol conversion, data exchange, sensing network, secret key exchange and the like. The encryption and decryption module includes TwoFish, RC4, AES, SM4 and other symmetric encryption algorithms and hash value calculation functions. The parameter analysis module is mainly used for processing and interpreting various parameter information. The data storage module is used to save the returned content of communication to the local. The self-destruction module is used for self-destruction after communication to complete the non-sensing access.

[0042] The main steps of the method are as follows. The controlled end B runs silently in the IoT device and does not display any content or prompt on the user interface, including hiding program icons, running in the background and the like. The control end A performs broadcast exploration and sensing to find all surviving devices in the range. The control end A selects an encryption algorithm and generates a corresponding random key, sends a communication request in a normal channel, and transmits the key of the encryption algorithm used for subsequent communication in the constructed storage type hidden channel. After receiving the connection request and the key, the controlled end B returns the agreed communication request and confirms the key in the hidden channel. Thus, the control end A and the controlled end B establish a secure channel. The control end A sends the data to be obtained in the heterogeneous Internet of Things scene to the controlled end B in the form of a command and encrypts it. The controlled end B decrypts the command, analyzes and parses each parameter in the parameter analysis module, transmits the analysis result to the corresponding module, converts it into a specific system action, performs port forwarding access to the corresponding device, the different devices may use different protocols, the communication module performs different protocol conversion, and the obtained data is encrypted and returned according to the original path. After the communication is completed, the control end A sends a self-destruction command, the control end A and the controlled end B are disconnected, and the controlled end B is self-destroyed to complete the whole process of non-sensing communication.

[0043] Please refer to Figure 1A security channel construction method for heterogeneous Internet of Things, in a complex heterogeneous Internet of Things scene, the controlled end can be implanted in Android or PC, and runs in the background, without pop-up windows and icons and other obvious prompts; the control end runs in the PC end in the form of command line. The controlled end provides communication conversion capability of heterogeneous Internet of Things protocol, supports Bluetooth / hotspot to WiFi / Bluetooth / ZigBee / 5G cellular network / satellite, the implementation principle is that the controlled end can realize the communication protocol of different perception network layers can be well accessed and corresponding mapping processing; can implement unified processing on the data collected on the perception network, and can also distinguish and convert the commands issued to each perception network node, so as to meet the standard control command of the perception network. Please refer to Figure 3 , specifically:

[0044] 1) Protocol adaptation layer, as a two-way channel, it can ensure that various homogeneous communication network protocols of heterogeneous perception layer network can parse specific effective information through this layer. On the one hand, it needs to gather various heterogeneous sensor network data to obtain effective data information, on the other hand, it also needs to parse and recombine the command data from the upper layer into the data format conforming to the sensor network transmission.

[0045] 2) Information conversion layer, which organizes the data of the adaptation layer into a unified data format, and is also a two-way interactive conversion layer, which extracts, compresses and realizes related mapping processing on the adaptation layer data, and converts it into a unified data format, and on the other hand, it parses and recombines the command data from the upper layer to conform to the data format that can be correctly understood in the protocol adaptation layer. Effective data information extraction mainly completes the extraction of destination address, source address, node address, network number, data information, data length, data protocol and other information. Related information mapping processing completes the mapping of different network numbers to the upper layer port and the unified mapping of heterogeneous perception network addressing.

[0046] 3) Standard information construction layer, according to the standard protocol stack, on the one hand, it converts the unified information format into information as data encapsulated in the standard protocol, and transmits it through the established communication port, on the other hand, it can also accept and process standard information from external network. The protocol encapsulation process is automatically completed by the gateway protocol stack, you only need to place the data in the corresponding protocol stack data position, and the encapsulation is completed automatically, finally the encapsulated standard data format is sent to the external network.

[0047] Please refer to Figure 2 , the control end will first execute the-scan command to scan the living controlled end in the network range, and return the hostname and Bluetooth address and IP address of the controlled end;

[0048] Bluetooth scanning: mainly used to discover and identify nearby Bluetooth devices. Bluetooth devices will broadcast their Bluetooth addresses and other related information such as device names, services, etc. when they are turned on and set to discoverable state. The scanning device will listen to these broadcasts and record the discovered Bluetooth devices and their information. Bluetooth scanning technology is performed by calling Bluetooth adapter devices.

[0049] ARP scanning: within the same LAN, ARP requests can be used to find the mapping between IP addresses and MAC addresses. The principle is to send an ARP request to inquire the MAC address corresponding to the target IP address. If the target host is online, it will reply with an ARP response.

[0050] The control end sends a request communication message to the specified controlled end, and selects an encryption method (one of TwoFish, RC4, AES, and SM4) and generates a corresponding random secret key K through the encryption module, and sends them together through the establishment of a storage type covert channel. The construction of the covert channel is as follows:

[0051] 1) Construction of a covert channel based on the Bluetooth protocol. The low-power Bluetooth broadcast data packet includes advertising data (device name, service data, manufacturer-specific data), scanning response data, and non-standard fields. Because the content to be transmitted requires less storage space, the three fields in the data packet can be used to construct a covert channel. The present application selects the manufacturer-specific data field in the advertising data for information embedding. This field allows the device manufacturer to include custom data, making it more difficult to detect hidden data.

[0052] 2) Construction of a covert channel based on a WiFi hotspot. Wi-Fi networks are mainly composed of the following three frame types: management frames, control frames, and data frames. Data frames include frame control fields, additional fields for management frames and control frames, additional fields for data frames, and data payloads. The additional fields of data frames describe the types and lengths of upper-layer protocols and data, and because the information contained is different, some empty fields are reserved to handle different data scenarios. Therefore, this field is a good storage type covert channel carrier.

[0053] 3) Covert information encoding algorithm. For a set of elements {A i |0<i<n} is stored in an array in a certain order, Array[0]=A1, Array[1]=A2,..., Array[n-1]=A nIn one encoding process, the total number of arrays is n, and N bits of covert information can be transmitted each time, where N = log2 n. Another key of the algorithm is to define a mapping relationship f to achieve one-to-one correspondence between the bit sequence and the element. For this purpose, this paper finds a mapping relationship f, which is defined as follows: for any variable x, 0 ≤ x < 2 N , let the binary representation of x be {b N-1 , b N-2 , …, b0}, that is, x = b0 + b1 × 2 + … + b N-2 × 2 N-2 +b N-1 × 2 N-1 , b i ∈ {0, 1}. Through Array[x], A x+1 is uniquely corresponded to, so as to realize the unique correspondence between the message bits and the element.

[0054] The controlled end receives the request message and obtains the encryption method and secret key K in the covert channel, returns an agreement communication response packet, and thus the two ends establish a connection channel;

[0055] The control end inputs the expected parameters {control end, controlled end, command, destination address, forwarding protocol, encryption method} in the command line, such as Console.exe 00:1A:7D:DA:71:11-tcp-get 192.168.200.3 / test-wifi-aes. The control end instruction set is shown in Table 1.

[0056] Table 1 Control end instruction set

[0057]

[0058]

[0059] In the encryption module, the command body part is converted into binary and printed in the control end command line, and according to the identified encryption algorithm, the binary is encrypted, and the encrypted result is returned and printed in the control end command line; at the same time, the binary is calculated for hash value;

[0060] The encrypted result and hash value are transmitted to the controlled end through the channel constructed by S4; the control end receives the ciphertext, decrypts it through the encryption method and secret key K, calculates the hash value of the decrypted content and compares it with the transmitted hash value to ensure the integrity of the message;

[0061] The controlled end performs protocol conversion to convert the Bluetooth protocol content into WiFi protocol and performs port forwarding to the specified destination address. Please refer to Figure 4The example forwards the instruction of accessing the C host to the router, and the router forwards to the C host; the C host returns the corresponding requested resource; the controlled terminal receives the resource of the C host, converts the resource into binary and performs protocol conversion, converts the content in the WiFi protocol format into the content corresponding to the Bluetooth protocol; according to the obtained encryption mode and the secret key K, the binary content is encrypted, and the hash value of the binary content is calculated; the encrypted result and the hash value are transmitted to the control terminal through the constructed secure channel; the control terminal performs decryption and hash value calculation for comparison, and guarantees the integrity of the resource acquisition; the control terminal prints the corresponding content on the command line; the control terminal enters the-download instruction on the command line, calls the data storage module to generate a local file and save the recently returned resource; the control terminal enters the-delete instruction on the command line, and sends the instruction to the controlled terminal through the above process; the controlled terminal starts the self-destruction module, disconnects the control terminal, ends the running and the program self-destruction.

[0062] Specifically: when the Internet of Things device completes the communication task, the self-destruction module of the controlled terminal will perform a series of operations, such as destroying communication data, ending the application program, deleting the application program, closing the network connection, and so on, until reaching the irreversible destruction at the physical layer.

[0063] Preferably: overwriting is a commonly used technical means in computer data destruction and erasure. By using the format defined by the budget, meaningless and irregular information is used to overwrite the originally stored data in the disk, so that the data is replaced by the overwritten data after erasure, and recovery is not achieved. This is because the disk data is saved in binary form, and after the data is overwritten, it cannot be determined whether the original data saved is "0" or "1". Although one overwriting will cause the data stored in the disk to be unable to be recovered by computer technology, the "disk magnifying glass" can recover the overwritten data in the disk by physical method, so in order to guarantee the reliability of data destruction, multiple overwriting is usually required, the more the number of overwriting, the better the effect of data destruction, and the present application is overwriting for 3 times.

[0064] The controlled end is usually alive in Windows, Linux, Android, and the Windows end program self-destruction first creates a batch file (.bat), in the batch file, the taskkill command is used to end the process of the current program; then, the del command is used to delete the file of the specified program; finally, the del %0 command is used to self-delete after executing the above operations, wherein %0 represents the path of the batch file itself. The Linux program self-destruction idea is consistent with the above-mentioned Windows program self-destruction, first a Shell script file (.sh) is created, in the script, the kill command is used to end the process of the current program; then, the rm command is used to delete the file of the specified program; finally, the rm $0 command is used to execute the above operations and self-delete, wherein $0 represents the path of the script file itself. The Android program self-destruction needs the device to be rooted, and the deletePackage method is called to delete the application. It should be noted that, in addition to the above examples of the present application, the present application also includes the functions of silently opening / closing Bluetooth, WiFi, 5G data link, etc.

[0065] In the embodiment, the encryption mode and the random secret key in the hidden channel are identified according to the rules agreed with the control end in advance, and the key is confirmed to include:

[0066] 1) The encryption and decryption module of the controlled end obtains the embedded information from the storage type hidden channel of WiFi or Bluetooth, restores the original N-bit binary sequence {bN-1, bN-2, …, b0} by looking up the position (i.e. index x) in the array according to the mapping relationship, converts the binary sequence into characters to obtain the encryption mode and the secret key, and stores them in the DECRYPTIC_WAY and DECRYPTIC_KEY parameters respectively. N-1 ,b N-2 ,…,b0} respectively.

[0067] 2) The controlled end uses the DECRYPTIC_WAY encryption mode and the DECRYPTIC_KEY key to encrypt "agree to communicate" and embed it into the hidden channel of the data packet agreeing to communicate.

[0068] 3) The encryption and decryption module of the controlled end of the control end obtains the embedded information from the storage type hidden channel of WiFi or Bluetooth, decrypts the information using the previously selected encryption mode and the generated key to obtain the plaintext, and compares whether the plaintext is "agree to communicate". If the comparison is successful, the key distribution is completed.

[0069] The controlled end forwards the data related to the instruction to the specified destination address includes:

[0070] 1) The communication module of the controlled end starts two infinite loop threads, the tcp_handle_connections() thread function is used to listen to TCP connection requests, and the bluetooth_handle_connections() thread function is used to accept Bluetooth connection requests.

[0071] 2) After receiving the data, the hamc_comp() function is used to compare two hmac values to verify data integrity, and the process_data() function is called to decrypt the encrypted information using the DECRYPTIC_WAY and DECRYPTIC_KEY parameters to obtain the executed command, the forwarded protocol and the forwarded content, which are stored in the dwFunc, dwProto_C and dwContent variables respectively.

[0072] 3) If dwFunc is GET, protocol conversion operation is performed, for example, from WiFi to zigbee, using the tcp_handle_connections() thread function and dwProto_C = zigbee, the controlled end will call the zigbee_process() function to repack the dwContent data according to the zigbee message format, and send it to the zigbee module through the serial port. The data is broadcast to the target device through the Zigbee module, and the zigbee node is controlled.

[0073] 4) After the host C receives the message of the control end A through the Zigbee module, it can send the information back to the control end A through the zigbee-to-WiFi reverse transmission of the controlled end B. The program of the controlled end B reads the data from the Zigbee in the serial port, parses the valid data from the physical layer to the application layer, and then calls the encrypted_date() function to encrypt the data using the DECRYPTIC_WAY and DECRYPTIC_KEY parameters, and encapsulates the encrypted information into the message format of TCP / IP. Finally, it is handed over to the hardware that conforms to the IEEE802.3 Ethernet communication protocol for processing, so as to realize the transmission of Zigbee data to the external WiFi after encryption.

[0074] The control end receives the returned encrypted data, which includes:

[0075] 1) The control end receives data similar to the controlled end, and starts the communication module to listen to the already constructed secure channel. After receiving the data, the hamc_comp() function is used to compare two hmac values to verify data integrity, and the process_data() function is called to decrypt the plaintext using the previously selected encryption method and the generated key, and the print__data() function is called to print to the console.

[0076] 2) Control end input download command, data storage module will call save_data() function using ">>" redirection command to append the decrypted return information to the local file result.txt.

[0077] The controlled end responds to the self-destruction instruction sent by the control end, and calls the uninstallDataAPPBySilent() function to perform the following operations:

[0078] 1) Disconnect the connection with the control end, and destroy the communication data by multiple overwriting.

[0079] 2) According to the operating system of the controlled end, end the application program, delete the application program. For example, the Windows end program self-destruction first creates a batch file (.bat), in the batch file, uses the taskkill command to end the process of the current program; then, uses the del command to delete the file of the specified program; finally, uses the del%0 command to self-delete after executing the above operations, wherein%0 represents the path of the batch file itself. The idea of Linux program self-destruction is consistent with the above-mentioned Windows program self-destruction, first a Shell script file (.sh) is created, in the script, the kill command is used to end the process of the current program; then, the rm command is used to delete the file of the specified program; finally, the rm$0 command is used to execute the above operations and self-delete, wherein $0 represents the path of the script file itself. Android program self-destruction needs to be rooted, and the deletePackage method is called to delete the application.

[0080] 3) Close the network connection of the controlled end, such as WiFi, Bluetooth, 5G data, etc.

[0081] In summary, the present application is from the perspective of Internet of Things data security transmission, aiming at the problems of lack of interoperability, concealment, and difficulty in traditional encryption key exchange in the data communication of heterogeneous Internet of Things scene, the scheme is proposed, in the huge heterogeneous Internet of Things environment, a lightweight security channel can be quickly provided for the control platform to directly communicate with the terminal node, the channel supports heterogeneous Internet of Things multi-protocol conversion, breaks the communication barrier between heterogeneous devices, enables heterogeneous devices to interconnect and interoperate, and reduces the additional hardware overhead, making the network construction more flexible. Furthermore, a concealed channel is constructed in the channel between the control end and the controlled end for symmetric encryption key distribution, ensuring information transmission efficiency while solving the key exchange problem.

[0082] Finally, it is to be explained that the above embodiments are only used to illustrate the technical solutions of the present application but not to limit the present application. Although the present application is described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solutions of the present application can be modified or equivalently replaced without departing from the purpose and scope of the technical solutions, and all should be covered in the scope of the claims of the present application.

Claims

1. A secure communication method for a heterogeneous Internet of Things, characterized in that, The method comprises the following steps: S1: the control end establishes a hidden channel according to the communication protocol between the control end and the controlled end, and sends an encryption mode and a random secret key to the controlled end through the hidden channel; S2: the controlled end receives the encryption mode and the random secret key from the hidden channel, and establishes a secure channel with the control end; S3: the control end encrypts the control instruction input by the user to obtain instruction ciphertext, and transmits the specified ciphertext to the controlled end through the established secure channel; S4: the controlled end decrypts the instruction ciphertext by using the obtained encryption mode and the random secret key to obtain decrypted instructions, and forwards the decrypted instructions to the specified destination address through the corresponding port after protocol conversion; S5: the device at the destination address executes corresponding operations according to the decrypted instructions, and returns corresponding request resources; S6: the controlled end encrypts the request resources by using the obtained encryption mode and the random secret key to obtain encrypted request resources, and forwards the encrypted request resources to the control end through the corresponding port after protocol conversion; S7: the control end receives the encrypted request resources returned by the controlled end, decrypts the encrypted request resources by using the selected encryption mode and the random secret key to obtain decrypted request resources, and prints the decrypted request resources on the command line interface to display to the user.

2. The secure communication method for heterogeneous Internet of Things according to claim 1, wherein, The step S1 specifically comprises: S11: after the control end is started, an encryption mode used in this communication is selected from a preset encryption algorithm list; S12: according to the selected encryption mode, a secret key generation function in a corresponding encryption algorithm library is called to generate a random secret key; S13: when the communication protocol agreed in advance between the control end and the controlled end is a Bluetooth protocol, a manufacturer specific data field in advertisement data is selected as the hidden channel; S14: the control end sends a communication request message to the predetermined controlled end through a normal network communication protocol, and embeds the selected encryption mode and the generated random secret key in the hidden channel after format processing and sends them to the controlled end.

3. The secure communication method for heterogeneous Internet of Things according to claim 2, wherein, The establishment of the secure channel comprises: the controlled end parses the communication request message according to the communication protocol between the control end and the controlled end, identifies the normal communication request message, identifies the encryption mode and the random secret key in the hidden channel according to the rules agreed in advance with the control end, confirms whether the controlled end has the ability to perform secure communication according to the information, and if so, sends an agreement communication response packet to the control end through the normal network communication channel, and thus the control end and the controlled end establish the secure channel.

4. The secure communication method for heterogeneous Internet of Things according to claim 3, wherein, The format processing of the selected encryption mode and the generated random secret key comprises: For a set of elements of a certain type All elements of the set are stored in an array in a certain order, In a coding process, the total number of the array is n, and each time N bits of covert information can be transmitted, where Define a mapping relationship To achieve a one-to-one correspondence between the bit sequence and the element; the mapping relationship Is defined as follows: for any variable Let The binary representation of 2, that is , where Through Corresponds to , so as to realize the unique correspondence between the message bits and the elements, and convert the selected encryption mode and the generated random secret key into binary representation, and then perform format processing through the defined mapping relationship .

5. The secure communication method for heterogeneous Internet of Things according to claim 4, wherein, The method comprises the following steps: the controlled terminal obtains the encrypted mode and the random secret key formatted in the hidden channel, and obtains the encrypted mode and the random secret key through the mapping relationship Finding the position in the array to restore the original Bit-long binary sequence, and converting the binary sequence into characters to obtain the encrypted mode and the random secret key.

6. The secure communication method for heterogeneous Internet of Things according to claim 4, wherein, The controlled end listens to the communication connection of the controlled end in real time through a wireless circulating thread, when the controlled end receives a data packet, first parses the received data packet according to the communication protocol between the sending end and the controlled end, extracts the valid field in the data packet, re-encapsulates the valid field data based on the communication protocol between the controlled end and the receiving end, and sends the data to the receiving end through the corresponding port to complete the protocol conversion of the data.

7. The secure communication method for heterogeneous Internet of Things according to claim 4, wherein, The controlled end is silently running in the loT device, when the controlled end receives the self-destruction instruction of the control end, the controlled end performs the following operations: disconnects the connection with the control end, and destroys the communication data through multiple rewriting. According to the operating system of the controlled terminal, end the application program and delete the application program; and close the network connection of the controlled terminal. According to the operating system of the controlled terminal, end the application program and delete the application program;

Images