Data transmission method and device for internet of things, electronic device and storage medium

Abstract

The application provides a data transmission method and device for Internet of Things, electronic equipment and storage medium, through a strict authentication mechanism of a data center module, only a user meeting an authorization strategy can access related data, unauthorized access and data leakage are effectively prevented. Meanwhile, a core network module intelligently monitors and combines service themes, ensures timely synchronization and update of policy information, reduces management overhead of the core network caused by increase of the service theme quantity, and prevents an attacker from initiating unauthorized access to a data center module with delayed policy. In addition, in order to resist an attacker from an internal network, two-way identity authentication and negotiation of a session key are performed on communication between any two nodes through a two-party authentication protocol between the nodes to encrypt the communication content, not only illegal access of an unregistered node is effectively identified and prevented, but also encryption protection of a data transmission process is realized, the confidentiality and integrity of the data are ensured, and the security of the data transmission process of the Internet of Things is significantly improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, and in particular to a data transmission method and device for Internet of Things, electronic equipment and storage medium. BACKGROUND

[0002] Mobile communication (e.g., B5G / 6G) technology brings significant advantages to the development of Internet of Things. Ultra-high bandwidth supports large-scale real-time data transmission of Internet of Things devices, and ultra-large connection capacity enables more devices to access the network at the same time, solving the problem of dense deployment of Internet of Things devices. Large-scale terminal devices and sensors support the landing of application scenarios such as smart cities, intelligent transportation and intelligent agriculture through a large amount of data transmission. In order to effectively utilize the massive data generated by Internet of Things, the construction of Internet of Things data center is becoming increasingly important. Internet of Things data center can integrate data from different terminal devices, realize standardized and centralized management of data. With the help of Internet of Things data center, trends can be predicted, potential problems can be identified, and reliable basis can be provided for intelligent decision-making, which helps to improve the efficiency and benefit of various application scenarios.

[0003] However, the complexity of application scenarios also brings more attack surfaces to malicious attackers. Therefore, how to effectively guarantee the security of the data transmission process of Internet of Things has become a problem to be solved at present. SUMMARY

[0004] Therefore, the purpose of the present application is to provide a data transmission method and device for Internet of Things, electronic equipment and storage medium, to solve the above technical problems.

[0005] To achieve the above purpose, the first aspect of the present application provides a data transmission method for Internet of Things, applied to a physical network-oriented data transmission system, the system comprising a core network module, a plurality of user devices, a plurality of data center modules and a plurality of Internet of Things device groups corresponding to each data center module, the method comprising:

[0006] Any data center module in the data center module is taken as a target data center module, and the target data center module collects physical network data generated by the corresponding plurality of Internet of Things device groups in the running process;

[0007] The user device in the plurality of user devices that initiates a service request is taken as a target user device, and the target user device sends a service request to the target data center module;

[0008] The target data center module receives authorization policy modification information of a service request of a user device, authenticates the authority of the target user device by using the authorization policy modification information, and in response to the authority of the target user device meeting the authorization policy modification information, sends Internet of Things data of a service subject corresponding to the service request to the target user device; or, in response to the authority of the target user device meeting the authorization policy modification information, terminates sending the Internet of Things data of the service subject corresponding to the service request to the target user device.

[0009] The core network module counts the total number of service subjects borne by all servers corresponding to the target data center module in the core network module during the authentication process, and in response to the total number of service subjects being greater than a preset total number threshold, performs merging processing on the service subjects borne by the servers by using a service subject merging algorithm to obtain merged service subjects, stores a preset policy synchronization message in the merged service subjects, and performs synchronization processing on the preset policy synchronization message stored in the merged service subjects by using a message synchronization processing algorithm, so as to synchronize the storage of corresponding authorization policy modification information by each data center module.

[0010] The target data center module performs identity authentication on two transmission nodes in communication by using the authentication root key generated in the registration stage during the authentication process, obtains an identity authentication result, and in response to the identity authentication result being that there is an unregistered node in the two transmission nodes, refuses access of the unregistered node; or, in response to the identity authentication result being that there is no unregistered node in the two transmission nodes, performs session key negotiation on the two transmission nodes in communication by using a certificateless identity-based encryption algorithm to obtain a negotiated session key, and encrypts the data transmission process between the two transmission nodes by using the negotiated session key.

[0011] Based on the same inventive concept, the second aspect of the present application provides a data transmission device for Internet of Things, which is arranged in a physical network-oriented data transmission system, the system comprising a core network module, a plurality of user devices, a plurality of data center modules and a plurality of Internet of Things device groups corresponding to each data center module, the device comprising:

[0012] The data center module is configured to take any data center module in the data center module as a target data center module, and the target data center module collects physical network data generated by a corresponding plurality of Internet of Things device groups in a running process; the target data center module receives authorization policy modification information of a requested service of a user device, authenticates the authority of the target user device by using the authorization policy modification information, and in response to the authority of the target user device meeting the authorization policy modification information, sends Internet of Things data of a service subject corresponding to the service request to the target user device; or, in response to the authority of the target user device meeting the authorization policy modification information, terminates sending the Internet of Things data of the service subject corresponding to the service request to the target user device; the target data center module uses an authentication root key generated in a registration stage to perform identity authentication on two transmission nodes in mutual communication in the authentication process, obtains an identity authentication result, and in response to the identity authentication result being that there is an unregistered node in the two transmission nodes, refuses access of the unregistered node; or, in response to the identity authentication result being that there is no unregistered node in the two transmission nodes, uses a certificateless identity-based encryption algorithm to perform session key negotiation on the two transmission nodes in mutual communication, obtains a negotiated session key, and uses the negotiated session key to encrypt a data transmission process between the two transmission nodes;

[0013] The user device is configured to take a user device initiating a service request in the plurality of user devices as a target user device, and the target user device sends a service request to the target data center module.

[0014] The core network module is configured to count, in an authentication process, a total number of service subjects borne by all servers corresponding to the target data center module inside the core network module, in response to the total number of service subjects being greater than a preset total number threshold, perform merging processing on the service subjects borne by the servers by using a service subject merging algorithm to obtain merged service subjects, store a preset policy synchronization message in the merged service subjects, and perform synchronization processing on the preset policy synchronization message stored in the merged service subjects by using a message synchronization processing algorithm, so as to enable each data center module to synchronously store corresponding authorization policy modification information.

[0015] Based on the same inventive concept, the third aspect of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and running on the processor, and the processor implements the method of the first aspect when executing the computer program.

[0016] Based on the same inventive concept, the fourth aspect of the present application provides a non-transitory computer-readable storage medium storing computer instructions for causing a computer to execute the method of the first aspect above.

[0017] As can be seen from the above, the data transmission method and device for the Internet of Things, the electronic device and the storage medium provided by the present application ensure that only users meeting the authorization strategy can access related data through the strict authentication mechanism of the data center module, effectively preventing unauthorized access and data leakage. At the same time, the core network module intelligently monitors and merges service topics, ensuring timely synchronization and updating of policy information, reducing the management overhead brought by the increase of service topics to the core network, and preventing attackers from launching unauthorized access to the data center module with delayed policy. In addition, in order to resist attackers from the internal network, the two-way identity authentication and session key negotiation between any two nodes are performed through the two-party authentication protocol between the internal network nodes to encrypt the communication content, which not only effectively identifies and prevents illegal access of unregistered nodes, but also realizes encryption protection of the data transmission process, ensuring the confidentiality and integrity of the data. Under the joint action of a series of measures, the security of the data transmission process of the Internet of Things is significantly improved. BRIEF DESCRIPTION OF DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the present application or related art, the drawings needed to be used in the embodiments or related art description will be briefly introduced. Obviously, the drawings in the following description are only embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0019] Figure 1 The network model schematic diagram of the data transmission system for the physical network of the embodiment of the present application;

[0020] Figure 2 The Smart Network Object Middleware (NOS) architecture schematic diagram introduced and optimized in the data center of the embodiment of the present application;

[0021] Figure 3 The flowchart of the data transmission method for the Internet of Things of the embodiment of the present application;

[0022] Figure 4 The broker cluster topic management model schematic diagram of the embodiment of the present application;

[0023] Figure 5 The policy synchronization message schematic diagram of the embodiment of the present application;

[0024] Figure 6 a system initialization stage of an embodiment of the present application;

[0025] Figure 7 a key agreement stage of an embodiment of the present application;

[0026] Figure 8 a node authentication and key agreement stage of an embodiment of the present application;

[0027] Figure 9 a structure block diagram of an Internet of Things oriented data transmission device of an embodiment of the present application;

[0028] Figure 10 a schematic diagram of an electronic device of an embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0030] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should be understood as the common meanings understood by those with ordinary skills in the art to which the present application belongs. The terms “first”, “second” and similar terms used in the embodiments of the present application do not represent any order, number or importance, but are only used to distinguish different components. The terms “include” or “contain” and similar terms mean that the elements or objects before the terms cover the elements or objects listed after the terms and their equivalents, and do not exclude other elements or objects. The terms “connect” or “connected” and similar terms are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. The terms “up”, “down”, “left”, “right” and the like only represent relative positional relationships, and when the absolute positions of the described objects change, the relative positional relationships may also change accordingly.

[0031] It can be understood that, before using the technical solutions of the various embodiments of the present application, the user will be informed of the type, scope of use, use scenario and the like of the personal information involved by appropriate means, and the authorization of the user will be obtained.

[0032] For example, in response to receiving the user's active request, the user is sent a prompt message to explicitly prompt the user that the operation requested to be performed will require the acquisition and use of the user's personal information. Thus, the user can voluntarily choose whether to provide personal information to the electronic device, application program, server or storage medium and the like software or hardware that performs the operation of the technical solutions of the present application according to the prompt message.

[0033] As an optional but non-limiting implementation, in response to receiving the active request of the user, the manner of sending the prompt information to the user may be, for example, a pop-up window manner, in which the prompt information may be presented in the form of text. In addition, the pop-up window may also carry a selection control for the user to select "agree" or "disagree" to provide personal information to the electronic device.

[0034] It can be understood that the above notification and user authorization process is only illustrative and does not limit the implementation of the present application, and other methods that meet relevant laws and regulations can also be applied to the implementation of the present application.

[0035] Mobile communication (e.g., B5G / 6G) technology brings significant advantages to the development of the Internet of Things. Ultra-high bandwidth supports real-time transmission of large-scale data for Internet of Things devices, and ultra-large connection capacity enables more devices to access the network simultaneously, solving the problem of dense deployment of Internet of Things devices. Large-scale terminal devices and sensors support the landing of smart city, smart transportation, and intelligent agriculture application scenarios through massive data transmission. In order to effectively utilize the massive data generated by the Internet of Things, the construction of Internet of Things data centers is becoming increasingly important. The Internet of Things data center can integrate data from different terminal devices and realize standardized and centralized management of data. With the help of big data analysis, the Internet of Things data center can predict trends, identify potential problems, and provide reliable basis for intelligent decision-making, which helps to improve the efficiency and effectiveness of various application scenarios. At the same time, the Internet of Things is also pushing data centers to the network edge, and traditional centralized data centers cannot withstand the traffic pressure brought by massive data of the Internet of Things. Users far from the data center will also experience a large delay when using services. Therefore, future Internet of Things data centers will tend to be distributed and distributed in different network edges.

[0036] However, the complexity of application scenarios also brings more attack surfaces to malicious attackers. First, attackers outside the data center domain will try to access data outside their permission range when using data services. To this end, the administrator of the corresponding Internet of Things device group needs to configure authorization rules in the data center to prevent unauthorized access. When the administrator submits an authorization policy change to the data center close to its geographic location, if the changed authorization policy cannot be synchronized to the data center within the scope of the administrator in time, the attacker may launch unauthorized attacks on the rule-lagged data center, so an efficient, flexible, and secure policy synchronization method needs to be designed between data centers. Under the background of zero trust, attackers may also come from within the data center domain. Attackers may try to disguise as legitimate nodes within the domain to launch active attacks on other nodes, or hide themselves to launch eavesdropping attacks on internal network traffic. In order to resist attackers from the internal network, continuously and efficiently authenticating internal network nodes is an effective and cost-saving method.

[0037] In order to achieve efficient policy synchronization between data centers, the present application introduces and optimizes the smart network object middleware (NOS) architecture in the data center. NOS aims to manage heterogeneous data sources and assess the security and quality level of information to meet the requirements of users, and provide lightweight secure information exchange capabilities (the present application focuses on the exchange of authorization policies). The secure information exchange of NOS relies on the message queuing telemetry transport protocol (MQTT), which adopts the "publish-subscribe" communication model. The client can publish messages to a certain "topic" as a "publisher", or subscribe to a certain topic as a "subscriber" to receive related messages. This mode makes the client not communicate directly with each other, but through a central "broker" for message distribution, which can be deployed in the core network to provide information synchronization capabilities for data centers distributed in different geographical locations.

[0038] However, the traditional NOS architecture has the problem of topic explosion. A large number of Internet of Things devices will generate a large number of topics, and the explosion of topics will bring great pressure to the topic management of the broker cluster. If different organizations' authorization policies are transmitted on the same topic in order to reduce the number of topics, it will also bring the problem of authorization policy leakage. In addition, the NOS architecture does not define the specific content of the control field in the authorization policy synchronization message, which reduces the flexibility of policy synchronization. Therefore, the present application optimizes the authorization synchronization module of the NOS architecture and proposes a topic merging algorithm for the broker. Some topics in the broker cluster have small data processing capacity and cannot effectively utilize the bandwidth and storage resources of the running host. When the number of topics is too large, the merging algorithm filters the topics that have small resource utilization and meet the remaining resource requirements for merging, thereby reducing the number of topics while improving the resource utilization of the host. In order to enhance privacy, the present application also uses the kms service deployed in the core network to negotiate session keys to encrypt the policy synchronization message, so that the messages transmitted on the same topic will not leak private information. In addition, the present application embeds information such as timestamp, priority, and effective time in the authorization rule change message, which ensures that each NOS can check whether the users using the service within the rule change message propagation time still comply with the authorization rules, and also brings more flexibility to the rules of different NOS systems.

[0039] In order to efficiently authenticate the nodes in the data center, the application designs a two-party authentication protocol between the nodes in the internal network based on the formal identity-based encryption algorithm (Certificateless Identity based Encryption, CL-ABE) to perform two-way identity authentication between any two nodes and negotiate a session key to encrypt the communication content. Unlike the traditional identity-based encryption technology (Identity-Based Encryption, IBE) which requires a fully trusted key generation center (Key Generation Center, KGC), the KGC of the application only generates part of the key for each node, and the actual key is generated by the node itself. The KGC cannot derive the complete key generated by the user from the partial key. This makes the KGC unable to obtain the secret private key used by the user even if it is attacked by an attacker, ensuring that the attacker cannot break the key negotiated between the nodes through active attacks or obtain effective information from the data leakage of the KGC. In addition, the scheme separates the authentication key and the session key negotiation private key between the two nodes. The authentication root key between the two nodes is a symmetric key negotiated in the registration phase and is not saved in the KGC, which not only reduces the risk of the KGC being invaded and leaking the authentication key, but also reduces the computational overhead of the authentication protocol using symmetric keys. The session key used between the nodes is negotiated by an additional CL-ABE private key, and the key negotiation and authentication are isolated, which can enhance the anti-leakage and adaptation ability of the protocol. In addition, by setting different security contexts for each NOS domain, the attack cost of the attacker on different NOS domains is increased.

[0040] For example, the related art network isolation and cross-network communication method based on cloud edge architecture includes the following steps: building a message pipeline; the edge gateway receives information; data is pushed to the internal network, and the software system architecture for solving the problem of network isolation and cross-network communication in the cloud edge architecture is provided by means of the computing and storage capacity of the edge gateway, which can realize data ferry and data synchronization between the external network and the internal network at the application layer, while ensuring the security isolation of the private network; the software system operation message queue is used to realize data enqueuing, storage and pushing; the Transmission Control Protocol (TCP) network attack is prevented by filtering the data packet format, and the network security is ensured; in addition, the user can configure the rule engine to realize the private network pushing of filtered information, thereby improving the data hierarchical governance capability of the cloud edge collaborative architecture. However, the architecture proposed by the related art does not consider the security authentication problem of the internal network and does not consider the security policy synchronization problem of different internal network domains.

[0041] A zero-trust-based decentralized network control strategy implementation method is also proposed in the related art. The control platform generates an access control strategy through calculation and pushes it to the cloud controller. After the terminal application (APP) is authenticated, the corresponding access control strategy is pulled according to the relevant conditions, and finally the business resources in the back-end are accessed through the access gateway. The request initiated by the access subject is matched with the strategy locally. If the strategy is hit, the data packet is released, otherwise it is intercepted. The access object only needs to do a small amount of centralized strategy matching, which can reduce the access pressure and avoid malicious access requests such as Distributed Denial of Service (DDoS). Thus, the problems caused by the centralized network control are solved. However, the strategy synchronization of this method needs to be pulled to the center server, which is less real-time, flexible and efficient than the synchronization using the MQTT protocol.

[0042] In the distributed Internet of Things data center architecture of the existing scheme, there are problems of low efficiency, poor privacy, and lack of flexibility in the authorization policy synchronization method. First, some existing schemes use a method of pulling authorization policies from distributed nodes to the center server to realize the synchronization of authorization policies. This method is not real-time and will also bring a lot of pressure to the center server, which does not meet the original intention of edge computing. Although the existing NOS architecture realizes the real-time synchronization of policies between nodes by means of the MQTT protocol, it also has the problem of topic explosion managed by the broker cluster, which may cause low resource utilization of the broker cluster and excessive topic management overhead, and may also leak the privacy information of authorization policies that do not belong to its jurisdiction. In addition, the existing scheme does not define the specific control flow and algorithm of policy synchronization information, which reduces the flexibility of policy synchronization.

[0043] In addition, the architecture of the existing scheme lacks a domain security authentication mechanism. Once an attacker intrudes into the domain, it will cause a large degree of damage to the internal network. The existing security policy based on public key certificates such as Hypertext Transfer Protocol Secure (HTTPS) is not suitable in the internal network environment, and the overhead of issuing and managing certificates in the private network environment is relatively large. Some existing authentication schemes use identity-based encryption as the password basis of the system. Such schemes need to deploy a trusted security center in the internal network to generate keys, and the key center can master the secret private keys of all nodes. Once the key table is leaked, it will cause a great loss.

[0044] The application optimizes the existing NOS architecture, refines the responsibility boundary in the Internet of Things (IoT) data center, and provides a synchronization of user authorization policies for data services between different data centers. In addition, the application proposes a topic merging algorithm to optimize the number of topics and improve resource utilization, defines the control field of the authorization policy synchronization message, and encrypts the privacy information of the synchronization message, ensuring the flexibility, privacy, and efficiency of the authorization policy synchronization control. In addition, the application also designs a two-party authentication protocol between internal network nodes based on a certificateless attribute-based key agreement algorithm. The protocol does not rely on the completely secure assumption of the key management center and can ensure the one-way consistency, confidentiality, and forward security of the authentication parties in the case of key center security information leakage.

[0045] The application relates to the design of an identity authentication protocol between nodes in the internal network domain of an Internet of Things (IoT) data center and the research of a user authorization policy synchronization method between data center domains distributed in different geographical locations. The purpose of the application is to perform efficient and continuous two-way identity authentication for nodes communicating with each other in the IoT data center internal network to resist malicious attackers from the internal network in the zero-trust context. Another purpose of the application is to enable system administrators to efficiently submit policy modifications close to their own data centers and to enable efficient, flexible, and secure synchronization of policy modifications to other data centers to prevent unauthorized access by attackers to policy-lagged data centers. The advantage of the application is that the authentication protocol is designed based on a certificateless key agreement algorithm under an elliptic curve, which enables the protocol to resist security problems caused by key table leakage of traditional key management centers. Another advantage of the application is that the existing network intelligent object middleware system for policy synchronization is optimized and the control flow of the policy synchronization message and the corresponding control algorithm are defined, thereby realizing efficient and flexible authorization policy synchronization between different data centers.

[0046] Embodiments of the application provide a data transmission method for the Internet of Things, which is applied to a physical network-oriented data transmission system. The system includes a core network module, multiple user devices, multiple data center modules, and multiple Internet of Things device groups corresponding to each data center module. The network model of the application is as follows: Figure 1The network involves five types of entities: data sources (i.e., groups of Internet of Things devices), device group administrators, data centers (i.e., data center modules), core networks (i.e., core network modules), and data users (i.e., user devices). The data source Internet of Things groups are composed of Internet of Things devices from different organizations, and the Internet of Things devices from different organizations are identified by different device groups. Device groups belonging to the same organization may run in Internet of Things groups located in different geographic locations, and the data generated by the device groups have the same data access policy in the data center (a special device group may customize the policy). The device group administrator of an organization submits a modification of the authorization policy to the data center close to its geographic location, and the authorization policy needs to be synchronized to the data center that manages the data of the Internet of Things devices of the organization in a timely manner, while remaining invisible to data centers that do not manage the data of the Internet of Things devices of the organization. The data center collects the data generated by the Internet of Things groups it manages and stores it in a database, and then analyzes the runtime data by means of AI or big data analysis methods and provides data services to users who use the data. When a user uses the runtime data generated by a device group, the user is authenticated according to the authorization policy specified by the device group administrator. The core network is a public service center responsible for running the broker cluster required by the MQTT protocol and providing the Key Management Service (kms) for the data center to manage encryption keys.

[0047] The present application considers attackers from outside and inside the domain. Attackers from outside the domain may have the authority of a certain legal user to request data services, but may maliciously request data beyond their authority. The device group administrator submits a modification of the authorization policy to the data center close to its geographic location, and if the authorization policy cannot be synchronized to other data centers that manage the devices of the organization in a timely manner, the attacker may launch a malicious request to the data center with a lagging policy, so an efficient and flexible authorization policy synchronization mechanism is needed between data centers. In addition, for privacy considerations, the data center should not be aware of the policy change message of the device group that does not belong to its jurisdiction, in order to prevent the leakage of authorization policies. In the context of "zero trust", the attacker may also come from the internal network. The attacker may disguise as a legal node in the internal network to launch an active attack on the network, or may eavesdrop on internal network data to infringe on the privacy information of the internal network. In order to prevent active attacks by attackers, strict identity verification of communication nodes is needed to prevent access by unregistered users. In order to defend against passive attacks by attackers, session keys need to be negotiated for communication between internal network nodes to encrypt communication content.

[0048] As Figure 2As shown, the data center of the present application introduces a smart network object middleware (NOS) architecture to optimize the authorization policy synchronization process of the data center. The NOS aims to manage heterogeneous data sources and assess the security and quality level of information to meet the requirements of users, and provide lightweight security information exchange capabilities (the present application focuses on the exchange of authorization policies). There are Internet of Things devices from multiple organizations in a data source, and the devices of each organization are identified by a device group, and each device group has a corresponding administrator. The NOS collects runtime data generated by the Internet of Things devices through a southbound interface and stores them in a raw data database. The raw data is stored as standardized data after standardized processing by the background. During this process, the data parsing unit analyzes the security and data quality of the data, and if the data does not meet the standard, it will be discarded. The device group administrator configures data source information and data access authorization rules through the southbound interface, and the authorization rules are stored in an authorization library. Users subscribe to processed data as MQTT protocol clients. MQTT uses a "publish-subscribe" communication model. Clients can act as "publishers" to publish messages to a certain "topic", or as "subscribers" to subscribe to a certain topic to receive related messages. Different NOSs synchronize authorization policies through a southbound interface, and the synchronization also uses the MQTT protocol. After the device group administrator modifies the policy, the modified content will be synchronized to the corresponding policy synchronization topic of the device group through the southbound interface.

[0049] The NOS clearly defines the responsibility boundaries between the various functional nodes within the data center, and can analyze the data generated by the Internet of Things devices in real time or offline to filter out data that does not meet the quality requirements or has security risks. The NOS also provides rich management interfaces for system administrators, allowing administrators to easily control configuration information within the data center. The NOS also provides a northbound MQTT interface for data transmission with NOSs distributed in different geographic locations, allowing different NOSs to efficiently synchronize information.

[0050] However, the original NOS architecture does not define the security policy for communication between nodes within the domain, and attackers from within the domain can pretend to be legitimate nodes to launch malicious attacks. To address this, the present application further optimizes the original NOS architecture by introducing a key management unit within the domain. The key management unit is responsible for generating security parameters for the security domain, and for generating pre-keys for the identity-based private keys of nodes within the domain, and also serves as an intermediary for key agreement authentication between nodes. After obtaining the key through the key management unit, nodes can achieve mutual authentication and negotiate session keys to encrypt session content. The specific authentication protocol is described in detail below.

[0051] In addition, in the original NOS architecture, the authorization policy synchronization topic granularity between NOS nodes is not clear enough. The policy change messages of multiple device groups may be transmitted on an unencrypted topic, which not only makes the NOS need to process change messages that do not belong to itself, reducing efficiency, but also makes the NOS perceive policy change messages that do not belong to its jurisdiction, causing privacy leakage. Ideally, each device group should have its own policy synchronization topic to ensure that the NOS only needs to subscribe to the topics of the device groups within its jurisdiction and will not leak authorization policies. However, in a massive Internet of Things scenario, there may be a large number of Internet of Things device groups. If each device group is assigned a separate topic, it will cause an explosion in the number of topics, and thus bring huge topic management pressure to the broker cluster of the core network. Therefore, the present application optimizes the topic subscription strategy of the NOS architecture. When the total number of topics is small, a separate topic is allocated to each device group. When the number of topics exceeds a threshold, the broker cluster runs a topic merging algorithm to merge topics based on resource consumption to reduce the number of topics and improve the resource utilization of the broker cluster. The present application also generates a session key based on the kms service provided by the core network to encrypt the policy synchronization messages of several device groups sharing the merged topic, so that when the NOS architecture receives policy synchronization messages of device groups that do not belong to its jurisdiction, it can only discard them and cannot perceive their content.

[0052] As shown in Figure 3 The method of the present embodiment includes:

[0053] Step 301, any data center module in the data center module is taken as a target data center module, and the target data center module collects physical network data generated by a corresponding plurality of Internet of Things device groups in a running process.

[0054] In this step, the data center module refers to a system or component responsible for data storage, processing, or forwarding. Data center modules are usually deployed in large data centers to support the data needs of various applications and services.

[0055] The Internet of Things device group refers to devices that can connect to the Internet and exchange data with other devices or systems. The Internet of Things device group mentioned here may refer to a group of Internet of Things devices that are related to each other or perform similar functions. For example, an Internet of Things device group may include multiple temperature sensors for monitoring the temperature of a specific area.

[0056] The Internet of Things device will continuously generate data during operation, i.e. Internet of Things data generated during operation, which reflects the device state, environmental parameters, user behavior, etc. The corresponding data center module is responsible for collecting data generated by the Internet of Things device group. This process is usually used for data collection, monitoring, analysis or further data processing.

[0057] Step 302, the user device initiating the service request in the plurality of user devices is taken as a target user device, and the target user device sends a service request to the target data center module.

[0058] In this step, user devices refer to a plurality of devices connected in the network, which can be smartphones, computers, tablets or other terminal devices that can access the network. These devices are used by different users to initiate various service requests.

[0059] Service requests can be accessing a website, downloading data, conducting online transactions, or any operation that requires server response.

[0060] The user device initiating the service request is specially identified as the target user device. In the subsequent processing flow, the system will pay special attention to this device because it is the object that needs to be served.

[0061] The target data center module is a server or a component of a server cluster responsible for processing specific service requests. In a distributed system, different data center modules may be responsible for processing requests in different jurisdictions or providing different services. The target data center module is determined according to the request type or target resource location of the target user device.

[0062] Once the target user device and the target data center module are determined, the target user device sends a specific service request to the target data center module. This request contains all the necessary information to perform the required service, such as request type, user authentication information, requested resource location, etc.

[0063] Step 303, the target data center module receives authorization policy modification information for the requested service of the user device, uses the authorization policy modification information to authenticate the permissions of the target user device, and in response to the permissions of the target user device meeting the authorization policy modification information, sends Internet of Things data of a service topic corresponding to the service request to the target user device; or, in response to the permissions of the target user device meeting the authorization policy modification information, terminate sending Internet of Things data of a service topic corresponding to the service request to the target user device.

[0064] In this step, the target data center module receives authorization policy modification information regarding the user device's request for service. This information may include the upgrade, downgrade, or grant / revoke of specific permissions for the user's rights, aiming to adjust the user device's access to specific IoT data.

[0065] Using the received authorization policy modification information, the target data center module authenticates the target user device's permissions. This process involves verifying whether the user device currently possesses the necessary data permissions to access the requested service.

[0066] If the target user device's permissions meet the requirements in the authorization policy modification information, i.e., the user device is authorized to access the IoT data related to the requested service topic, the target data center module will send the IoT data corresponding to the service request to the target user device.

[0067] Conversely, if the target user device's permissions still do not meet the data requirements for accessing the requested service (e.g., permissions are revoked or downgraded) despite the modification of the authorization policy, the target data center module will terminate the sending of relevant IoT data to the user device.

[0068] This process embodies the importance of data security and access control, ensuring that only appropriately authorized devices can access specific IoT data, thereby protecting the confidentiality and integrity of the data. By dynamically adjusting the authorization policy, the system can flexibly adapt to different security needs and usage scenarios.

[0069] Step 304, the core network module counts the total number of service topics carried by all servers corresponding to the target data center module in the core network module during the authentication process. In response to the total number of service topics being greater than a preset total number threshold, the core network module performs merging processing on the service topics carried by the servers using a service topic merging algorithm, obtains merged service topics, stores the preset policy synchronization message in the merged service topics, and performs synchronization processing on the preset policy synchronization message stored in the merged service topics using a message synchronization processing algorithm, so as to synchronize the storage of corresponding authorization policy modification information by each data center module.

[0070] In this step, during the authentication process, the core network module counts the total number of service topics carried by all servers associated with the target data center module within the core network module. Here, the service topic can be understood as a different service or application running on the server, each of which has a corresponding topic.

[0071] Next, the core network module checks whether this total number exceeds a preset total number threshold. This threshold is a pre-set standard for determining whether to merge service topics to reduce the number or optimize resource usage.

[0072] If the total number of service topics exceeds the threshold, the core network module triggers a merging process for the service topics.

[0073] Using the service topic merging algorithm, the core network module performs merging processing on these service topics. The specific way of merging may involve integrating service topics with similar or related functions together to reduce the overall number or optimize the service structure. It can also be based on load conditions for merging.

[0074] After merging processing, the merged service topics are obtained, and the number of these service topics will be less than before merging or the structure will be more optimized.

[0075] In the merged service topics, the core network module stores preset policy synchronization messages. These messages may contain information about authorized policy modifications, which are used to ensure that each data center module can synchronize updates to its authorization policy.

[0076] Finally, the core network module uses the message synchronization processing algorithm to synchronize the preset policy synchronization messages stored in the merged service topics. The purpose of this step is to ensure that these policy synchronization messages can be effectively distributed to each data center module, so that they can synchronize the storage and update of corresponding authorization policy modification information.

[0077] In summary, this process involves counting service topics in the core network module authentication process, merging if the number is too large, and storing and synchronizing policy modification information in the merged service topics to ensure that each data center module can synchronize updates to its authorization policy, ensuring timely synchronization and update of policy information, preventing attackers from launching unauthorized access to policy-lagged data center modules. This process helps optimize resource usage and improve the overall efficiency of the system.

[0078] Step 305, the target data center module uses the authentication root key generated in the registration stage during the authentication process to perform identity authentication on the two transmission nodes communicating with each other, obtains an identity authentication result, and in response to the identity authentication result that there is an unregistered node among the two transmission nodes, denies access to the unregistered node; or, in response to the identity authentication result that there is no unregistered node among the two transmission nodes, performs session key negotiation between the two transmission nodes using a certificateless identity-based encryption algorithm, obtains a negotiated session key, and uses the negotiated session key to encrypt the data transmission process between the two transmission nodes.

[0079] In this step, it is confirmed whether the two transmission nodes (which can be regarded as data senders and receivers) communicating with each other are both registered and legal nodes.

[0080] Identity authentication is performed using the authentication root key pair generated during the registration phase. The authentication root key pair here can refer to an asymmetric key pair, such as a public key and a private key, where the private key is held by the node and the public key is recorded or verified by the data center module during registration.

[0081] If the identity authentication result shows that there is an unregistered node among the two transmission nodes (i.e., a node whose identity cannot be verified by the authentication root key pair), the access request of the unregistered node is denied, preventing unauthorized nodes from accessing the system.

[0082] If both transmission nodes pass the identity authentication (i.e., they are both registered and legitimate nodes), the next step of session key negotiation is performed.

[0083] The purpose of the session key negotiation phase is to generate a temporary, session-level key for the two legitimate nodes communicating with each other, which is used to encrypt data transmission between them, ensuring the security of data transmission.

[0084] Certificateless Identity-based Encryption (CL-ABE) is used for session key negotiation. IBE is a public key encryption algorithm that allows direct use of user identity information (such as email address, username, etc.) as a public key without binding the public key and identity information through a certificate. This mechanism simplifies key management and avoids the complexity of certificate issuance and management.

[0085] Through the certificateless identity-based encryption algorithm, the two legitimate nodes can negotiate a common session key (negotiated session key). This key is temporary and only valid for this session, enhancing the security of data transmission.

[0086] The negotiated session key is used to encrypt the data transmission process between the two transmission nodes. In this way, even if the data is intercepted during transmission, attackers cannot decrypt the data content because the session key is unknown and only valid for this session.

[0087] Through the two steps of identity authentication and session key negotiation, the target data center module ensures that only registered and legitimate nodes can access the system, and uses a secure encryption mechanism in the data transmission process between them, effectively protecting the confidentiality and integrity of the data.

[0088] In summary, the two-way identity authentication of the communication between any two nodes is performed by the two-party authentication protocol between the nodes in the intranet, and the session key is negotiated to encrypt the communication content, which not only effectively identifies and prevents illegal access of unregistered nodes, but also realizes encryption protection of the data transmission process, and ensures the confidentiality and integrity of the data. Under the joint action of a series of measures, the security of the data transmission process of the Internet of Things is significantly improved.

[0089] Through the above scheme, through the strict authentication mechanism of the data center module, it is ensured that only users meeting the authorization strategy can access related data, effectively preventing unauthorized access and data leakage. At the same time, the core network module intelligently monitors and merges service topics, ensuring timely synchronization and updating of policy information, and reducing the management overhead brought by the increase of service topic quantity to the core network, preventing attackers from launching unauthorized access to the data center module with delayed policy. In addition, in order to resist attackers from the intranet, the two-way identity authentication of the communication between any two nodes is performed by the two-party authentication protocol between the nodes in the intranet, and the session key is negotiated to encrypt the communication content, which not only effectively identifies and prevents illegal access of unregistered nodes, but also realizes encryption protection of the data transmission process, and ensures the confidentiality and integrity of the data. Under the joint action of a series of measures, the security of the data transmission process of the Internet of Things is significantly improved.

[0090] In some embodiments, in step 304, the service topic merging algorithm is used to merge the service topics carried by the servers to obtain merged service topics, including:

[0091] Step A1, the core network module divides all servers into multiple association groups according to a preset server quantity.

[0092] Step A2, the core network module determines the number of Internet of Things device groups currently accommodated by each association group of servers, and screens a target association group from each association group, in which the number of Internet of Things device groups currently accommodated is greater than the maximum number of Internet of Things device groups allowed to be transmitted simultaneously.

[0093] Step A3, the core network module determines the idle degree index of each other association group except the target association group in each association group.

[0094] Step A4, the core network module finds multiple target other association groups from the idle degree indexes of each other association group, in which the idle degree index is greater than a preset migration threshold.

[0095] Step A5, the core network module determines a final target other association group from multiple target other association groups with the largest idle degree index and the total load of all servers corresponding to the final target other association group being greater than or equal to the total load of the target association group, and merges service topics carried by servers corresponding to the target association group into service topics carried by servers corresponding to the final target other association group, to obtain merged service topics.

[0096] In the above scheme, the core network module divides all servers into multiple association groups according to a preset number of servers. Each association group contains a certain number of servers, which will be processed as a whole in subsequent steps to connect and transmit data of Internet of Things devices.

[0097] Next, the core network module checks the number of groups of Internet of Things devices currently connected in each association group.

[0098] If the number of groups of Internet of Things devices in a certain association group exceeds the maximum number of groups of Internet of Things devices allowed to be transmitted simultaneously in the association group, the association group is regarded as a target association group. This means that the target association group is currently in an overloaded or near-overloaded state, and measures need to be taken to reduce its load.

[0099] For other association groups that are not target association groups, the core network module calculates their idle degree indexes. The idle degree index is an index that measures the current remaining processing capacity of an association group, which can be calculated based on multiple factors such as the central processing unit (CPU) usage rate, memory occupancy rate, network bandwidth, etc.

[0100] After calculating the idle degree indexes of all other association groups, the core network module selects those association groups with idle degree indexes greater than a preset migration threshold as target other association groups. These target other association groups have sufficient processing capacity to accommodate Internet of Things devices or services migrated from target association groups.

[0101] Among multiple target other association groups, the core network module further selects an association group with the largest idle degree index and the total load of all servers corresponding to the association group being greater than or equal to the total load of the target association group as a final target other association group.

[0102] Once the final target other association group is determined, the core network module merges service topics (which may refer to data transmission tasks or service applications of Internet of Things devices) carried by servers in the target association group to servers corresponding to the final target other association group. In this way, the load of the originally overloaded target association group is dispersed to the final target other association group with higher processing capacity.

[0103] After the migration process, the core network module obtains an updated service topic distribution, where the service topics originally carried by the target association group are now carried by the final target other association group, thereby achieving load balancing and optimization of service quality.

[0104] Overall, this process ensures efficient data transmission and service continuity for IoT devices by dynamically adjusting server resource allocation.

[0105] For example, different regional NOSs synchronize authorization policies through the MQTT protocol. When the total number of topics does not exceed the threshold, each device group has its own independent topic for policy synchronization, and there is no privacy leakage problem at this time. When the total number of topics exceeds the threshold, the broker cluster merges topics based on cluster resource usage, and multiple device groups share a topic after merging. Each device group needs to obtain a root key from the KMS service provided by the core network and generate a session key to encrypt its own policy synchronization information, in order to ensure the privacy of messages.

[0106] First, introduce the topic management strategy and topic merging algorithm of the core network broker cluster. As shown in Figure 4 The upper limit of topics that a broker cluster can manage is set to T, which is limited by the physical resources of the broker cluster. In addition, to prevent the failure of a server hosting a topic, the cluster needs to store an additional copy for each topic, and the number of copies for each topic is R. Each association group consists of R servers, and the primary partition of each topic (marked in yellow in the figure) is deployed on one of the servers in the association group, and the replica (marked in green in the figure) is deployed on the remaining R-1 servers. The design of the association group allows the primary partitions of several topics on a server to be merged with the remaining replica partitions on the same machine, thereby reducing cross-machine synchronization and merging of topics to improve efficiency. When a new topic is added, it is dynamically allocated based on the load of each association group and the machines in the association group, so that the topic is evenly distributed to each machine as much as possible. When the number of topics reaches the upper limit, the broker cluster will use the topic merging algorithm to merge, which preferentially selects topics within the association group for merging. If the load of the association group is low and the resource utilization is low, cross-association group topic merging will be performed. The specific parameters and process are as follows.

[0107] 1) Server related:

[0108] S i : the i-th server.

[0109] Server S i The maximum load (resource limit bandwidth and storage resource) of the server.

[0110] Server S i The current total load.

[0111] α: The server load safety factor, i.e. the proportion of the maximum load that the server is allowed to bear, this parameter reserves certain resources for the server to cope with burst traffic, α∈(0, 1).

[0112] 2) Topic correlation:

[0113] T k : The kth topic.

[0114] topicT k The load of the primary partition.

[0115] topicT k The load of the replica.

[0116] topicT k The maximum number of device groups allowed to be transmitted simultaneously, the upper limit of the merged topic after merging of multiple device groups, to prevent a topic from being excessively merged.

[0117] P k : topicT k The current number of device groups accommodated.

[0118] T: The maximum number of topics that the broker cluster can bear.

[0119] λ: The replica load reduction factor (usually λ∈(0, 1)), the load of the primary partition of a topic is greater than that of the replica, because the replica only needs to synchronize the messages of the primary partition and does not need to provide services, so a load factor needs to be multiplied when calculating the load of the replica.

[0120] 3) Server load calculation:

[0121] The load of each server is the sum of the loads of the primary partitions and replicas allocated to it:

[0122]

[0123] Where, and are the set of primary partitions and replicas on server S i , respectively.

[0124] 4) Associated group total load:

[0125] G n : the nth association group.

[0126] The total load of all servers in the association group is:

[0127] The idle degree index of the association group is:

[0128]

[0129] The migration threshold, if the idle degree is higher than the migration threshold, it means that the resource occupation of the association group is very small, and it can be migrated to other association groups to save resources.

[0130] The theme merging algorithm is shown in Table 1 as follows:

[0131] Table 1

[0132]

[0133]

[0134] In some embodiments, in step 304, the determination of the idle degree index of each association group other than the target association group includes:

[0135] Step B1, the core network module determines the current total load of each server corresponding to each association group other than the target association group, and the maximum bearing load of the corresponding server.

[0136] Step B2, the core network module determines the idle degree index of each association group other than the target association group based on the current total load of each server and the maximum bearing load of the corresponding server through the following formula:

[0137]

[0138] wherein, represents the idle degree index, represents the current total load of the ith server, represents the maximum bearing load of the ith server.

[0139] In the above scheme, the core network module determines the current total load of the server in each association group other than the target association group (i.e. the current total load of the ith server). The total load refers to the total amount of tasks or data currently being processed by the server, which reflects the current working strength of the server.

[0140] Meanwhile, the core network module also determines the maximum load capacity of these servers (maximum load capacity of the i-th server). The maximum load capacity refers to the maximum amount of tasks or data that a server can handle without being damaged or experiencing a significant performance decline.

[0141] With the above information, the core network module uses a formula to calculate the idleness index of each association group (idleness index). This index is a dimensionless value that quantifies the degree of idleness of a server.

[0142] The idleness index in the formula is calculated based on the current total load and the maximum load capacity of each server. The idleness index reflects the utilization rate of the server.

[0143] The purpose of calculating the idleness index is to understand the usage of servers in each association group, so that more reasonable resource allocation decisions can be made. For example, in a load balancing scenario, new tasks or data can be allocated to the most idle server based on the idleness index, to improve resource utilization and overall system performance.

[0144] In summary, this description provides a method for calculating the idleness index of servers in the core network module, which evaluates the degree of idleness of servers by comparing their current total load and maximum load capacity, thereby providing important basis for subsequent resource allocation or network optimization.

[0145] In some embodiments, in step B1, the determination of the current total load of each server corresponding to each association group other than the target association group includes:

[0146] Step C1, the core network module performs the following operations for each other association group in each association group other than the target association group:

[0147] Step C11, the core network module obtains the load of the primary partition of the service topic corresponding to each server in the other association group, and the load of the replica of the corresponding service topic.

[0148] Step C12, the core network module determines the current total load of each server corresponding to each association group other than the target association group using the load of the primary partition of the service topic corresponding to each server in the other association group and the load of the replica of the corresponding service topic through the following formula:

[0149]

[0150] wherein, represents the current total load of the i-th server, represents the load of the primary partition of the k-th service topic, represents the load of the replica of the kth service topic, λ represents a scaling factor for the replica load, λ ∈ (0, 1), T k represents the kth service topic, represents the set of primary partitions on the i-th server, represents the set of replicas on the i-th server.

[0151] In the above scheme, for each server in the other associated group, the core network module obtains two main load information:

[0152] The load of the primary partition of the service topic: This is the load of the service topic running as a primary partition on the server. The primary partition is usually responsible for handling read and write requests for data.

[0153] The load of the replica of the service topic: This is the load of the service topic running as a replica on the server. The replica is usually used for redundant storage of data and possible read request processing to support high availability and fault tolerance of data.

[0154] The core network module uses the above-mentioned load information obtained by a specific formula to calculate the current total load of each server. This formula takes into account the load of the primary partition and the load of the replica, but the load of the replica is adjusted by a scaling factor (denoted as λ) when calculating the total load. The scaling factor λ may be used to reflect the lower involvement or efficiency of the replica in handling load relative to the primary partition.

[0155] Through this calculation method, the core network module can evaluate the load of the servers in each associated group, which is crucial for load balancing, resource allocation, fault recovery and other decisions. Especially in distributed systems or cloud computing environments, understanding the current load of each server helps to optimize performance, improve resource utilization and ensure the availability of services.

[0156] In some embodiments, in step 304, the preset policy synchronization message stored in the merged service topic is synchronized by a message synchronization processing algorithm to synchronize the storage of corresponding authorization policy modification information by each data center module, including:

[0157] Step D1, the core network module uses the session key generated by the key generation algorithm to encrypt the other fields in the preset policy synchronization message except the random number generated when each message is sent, the identifier of the Internet of Things device group, to obtain the encrypted other fields, wherein the other fields at least include the identifier of the data center module initiating synchronization, the list of data center modules needing synchronization and the authorization policy change type.

[0158] Step D2, the core network module determines whether the initiating synchronization data center module's identity exists in the list of data center modules that need synchronization, and in response to determining that it exists, transmits the authorization policy change type corresponding to the initiating synchronization data center module's identity to the corresponding data center module, so that the corresponding data center module updates the initial authorization policy according to the authorization policy change type, generates corresponding authorization policy modification information and synchronously stores it.

[0159] In the above scheme, the core network module generates a session key using a key generation algorithm. This session key is used to ensure the security of the communication.

[0160] Using this session key, the core network module encrypts certain fields in the preset policy synchronization message. These encrypted fields exclude the random number generated for each message transmission and the identity of the IoT device group.

[0161] Initiating synchronization data center module's identity: This identifies which data center module requested policy synchronization.

[0162] List of data center modules that need synchronization: This lists which data center modules need to receive updated authorization policies.

[0163] Authorization policy change type: This describes what type of change has occurred to the authorization policy, such as adding permissions, modifying permissions, or deleting permissions.

[0164] After encrypting and preparing the policy synchronization message, the core network module checks whether the initiating synchronization data center module's identity is included in the list of data center modules that need synchronization.

[0165] If the list does indeed include the initiating synchronization data center module's identity (which means that the initiating synchronization module also expects to receive updated policies), the core network module transmits the authorization policy change type corresponding to this module's identity to the data center module.

[0166] The data center module that receives the authorization policy change type updates its initial authorization policy according to this change type.

[0167] The updated authorization policy is converted into authorization policy modification information and synchronously stored within the data center module. This means that the updated policy information is securely saved in the module for subsequent use or further synchronization.

[0168] The whole process ensures the secure transmission and synchronization of the authorization policy change, prevents data leakage through encrypted communication, and ensures that only the correct module receives the updated policy information through the verification mechanism. This helps to maintain the consistency of the policy between the data center modules in the Internet of Things environment, while also enhancing the security of the system.

[0169] For example, after running the topic merging algorithm, the policy synchronization messages of different device groups are transmitted on a merged topic. In order to ensure that the NOS cannot perceive the synchronization information of the device group that does not belong to its jurisdiction to ensure privacy, while ensuring the real-time and flexibility of policy synchronization, some control information flow needs to be added in the policy synchronization message body.

[0170] The policy synchronization message is as shown in Figure 5 The nonce is a random number generated for each message transmission, which is used to generate a session key for message encryption. When a device group monopolizes a topic, the message does not need to be encrypted, and the field is empty at this time. The NOS periodically requests the encryption root key k of the device group corresponding to the groupid (i.e., the unique identity of the device group) from the KMS service of the core network, and then generates a session key using the key generation algorithm KDF (groupid, nonce, k) to encrypt the fields other than nonce and groupid. The nosid identifies the NOS that initiates the message synchronization, and the tnosid identifies the target NOS, which allows each NOS to select the target object it wants to synchronize, thereby making the policy synchronization more flexible. The stime allows other NOSs that receive the policy synchronization information to perceive the time at which the other nodes initiate the policy synchronization, and then check whether the newly accessed users still meet the new authorization policy within the time period of the policy synchronization message propagation. If not, the session of the user is interrupted. The type field identifies whether the authorization policy is added, deleted, or modified. The model and rule identify the actual changed authorization policy content. The other is supplementary information. Different NOSs exchange the above information on different topics through the MQTT protocol to synchronize the messages, and the message synchronization processing algorithm is as shown in Table 2:

[0171] Table 2

[0172]

[0173] In some embodiments, in step 305, the target data center module uses the authentication root key generated in the registration stage in the authentication process to authenticate the identity of the two transmission nodes communicating with each other, and obtains an identity authentication result, including:

[0174] Step E1, the target data center module determines a first challenge value of a first transmission node of the two transmission nodes respectively, and transmits a preset identity of the first transmission node and the first challenge value to a second transmission node of the two transmission nodes.

[0175] Step E2, the second transmission node of the target data center module obtains a first authentication root key of the first transmission node from the authentication root key generated in the registration stage, processes based on the first challenge value of the first transmission node, the preset identity of the second transmission node and the first authentication key of the first transmission node by Hash Message Authentication Code algorithm, determines a first response value of the first challenge value, and transmits the preset identity of the second transmission node and the first response value of the first challenge value to the first transmission node.

[0176] Step E3, the first transmission node of the target data center module processes based on the first challenge value of the first transmission node, the preset identity of the second transmission node and the first authentication key of the first transmission node by Hash Message Authentication Code algorithm, determines a second response value of the first challenge value, and compares the first response value and the second response value to obtain a comparison result.

[0177] Step E4, the target data center module determines that the identity authentication result is that there is an unregistered node in the two transmission nodes in response to the comparison result that the first response value and the second response value are not equal; or the target data center module determines that the identity authentication result is that there is no unregistered node in the two transmission nodes in response to the comparison result that the first response value and the second response value are equal.

[0178] In the above scheme, the identity authentication process between the two transmission nodes in the target data center module mainly relies on the challenge-response mechanism and the Hash Message Authentication Code (HMAC) algorithm to ensure that both transmission nodes have been registered and hold valid authentication keys.

[0179] Wherein, the target data center module determines a first challenge value of a first transmission node of the two transmission nodes (the first transmission node and the second transmission node).

[0180] Then, it transmits a preset identity of the first transmission node (Identity document, ID), this first challenge value, and possibly other necessary information to the second transmission node.

[0181] The second transmission node finds a first authentication root key corresponding to the first transmission node from the authentication root key generated in the registration stage.

[0182] Using this first authentication root key, the first challenge value of the first transport node, its own pre-set identity, and a Hashed Message Authentication Code (HMAC) algorithm, the second transport node generates a first response value for the first challenge value.

[0183] The second transport node then transmits its own pre-set identity and this first response value back to the first transport node.

[0184] The first transport node also generates a second response value for the first challenge value using the same Hashed Message Authentication Code (HMAC) algorithm, its own first challenge value, the pre-set identity of the second transport node, and the first authentication key of the first transport node (which can be derived from the authentication root key).

[0185] The first transport node then compares the second response value it generated with the first response value it received from the second transport node.

[0186] If the first response value and the second response value are not equal, the target data center module determines the identity authentication result to be that there is an unregistered node among the two transport nodes, or at least one of the authentication keys of the nodes is incorrect.

[0187] If the first response value and the second response value are equal, the target data center module determines the identity authentication result to be that there is no unregistered node among the two transport nodes, i.e., both nodes have successfully passed the identity authentication.

[0188] The core of this process lies in the use of the HMAC algorithm, which combines a key and a message (in this scenario, the challenge value and the identity) to generate an authentication code (response value) of a fixed length. Due to the characteristics of the HMAC algorithm, only the node that holds the correct key can generate the same response value as the other node, thereby ensuring that both nodes have been registered and hold valid authentication keys.

[0189] For example, compared with public network, the inner network has stronger autonomy and resource limitation. The traditional digital certificate authentication scheme suitable for public network has problems such as difficulty in establishing a public key infrastructure (PKI) in the inner network environment, difficulty in certificate life cycle management, and large performance overhead. In order to solve these problems, the two-way authentication protocol designed by the application is based on the certificateless identity-based encryption algorithm CL-IBE. The CL-IBE algorithm does not need to manage digital certificates, and each node can request its own identity-based private key from the key management unit and use its own identity as a public key. This makes the inner network key management unit only need to extract the private key for the inner network node at initialization or when the key needs to be updated, and does not need to participate in the long-term digital certificate management and digital certificate verification work, greatly reducing the pressure. In addition, unlike the traditional IBE which needs a fully trusted key generation center (KGC), the KGC of the scheme only generates part of the key for each node, and the actual use of the key is generated by the user himself, and the KGC cannot deduce the complete key generated by the user from the part of the key. This makes the KGC unable to know the secret private key used by the user even if the security parameters are accidentally leaked. In addition, the scheme uses a negotiated symmetric key as the authentication root key between nodes, which is not saved in the KGC. This not only reduces the risk of the KGC being invaded and the key being leaked, but also reduces the computational overhead of the authentication protocol using a symmetric key.

[0190] The authentication protocol proposed in the application can resist malicious attackers with certain social engineering capabilities in the inner network. Attackers can arbitrarily eavesdrop on the traffic transmitted in the inner network, can obtain the security parameters leaked by the key management unit through social engineering means, and can initiate a session or launch an active attack to any node. For such attackers, the protocol can guarantee the one-way consistency of the authentication between any nodes and the confidentiality of the session key.

[0191] The specific authentication protocol design involves the protocol initialization phase, the protocol authentication key agreement phase, and the authentication and key agreement phase.

[0192] System initialization phase:

[0193] The first phase of the protocol is the system initialization phase. As shown in Figure 6 , the key management unit first selects a set of security parameters for the NOS domain at the first initialization. Different security parameters are selected for different NOS domains to increase the cost of attacks by attackers. In the security domain parameters q is a large prime number, is a finite field with base q, is an elliptic curve defined on the finite field A cyclic subgroup of group G, where P is a generator of group G. The master private key and P are randomly selected by the key management unit. pub =sP is the primary public key. and These are two one-way collision-resistant hash functions.

[0194] The identity identifier is NID i During initialization, nodes within the domain request a portion of their private key from the key management unit. The node first transmits its identity identifier (NID) through a secure channel between the node and the key management unit. i Send to the key management unit. The key management unit selects a random number. And calculate R i =r i P and h i =H1(NID) i R i Finally, the key management unit computes the prekey s of the node. i =r i +h i s, and put the prekey s i It is securely sent to the corresponding node.

[0195] After receiving the prekey, the node randomly selects a random number. And calculate h′ i =H1(ID) i X i ), X i =x i P, z i =x i +h′ i s i The node then calculates S. i =(R i +h i P pub ) = s i P, then the node's identity base private key is SK i =(s i x i The identity base public key is PK. i =(R i S i X i ).

[0196] In this process, the key management unit is only responsible for calculating the pre-key. The actual node public and private keys are generated by the node itself. Even the key management unit itself cannot deduce the private key generated by the node using the pre-key from the pre-key and the corresponding node's public key.

[0197] Authentication key negotiation phase:

[0198] As Figure 7 shown, the authentication key agreement phase is the process that two legitimate nodes agree on the root key for identity authentication. This process only happens when the administrator initially configures the two nodes to be able to access each other or when the administrator updates the authentication key between the two nodes. The two nodes use the identity base key obtained in the last phase for key agreement. Even if the key agreement parameters are transmitted through the key management unit via the secure channel, the key management unit cannot calculate the final generated authentication key from the key agreement parameters. This mechanism makes the authentication key only perceived by the actual nodes, and the key management unit only saves the intermediate key generation parameters for tracing and cannot generate the authentication key table. Thus, it is ensured that even if the intermediate parameters are accidentally leaked by the system administrator of the key management unit, an attacker cannot calculate the authentication key from these security parameters.

[0199] The specific process of the key agreement phase is as follows:

[0200] 1) The administrator configures the two nodes to be able to access each other through the northbound interface.

[0201] 2) Node1 randomly selects calculates T1=(az1)P=a(x1+h'1s1(mod q))P. Node1 sends T1 to Node2 through the secure channel between Node1 (i.e., the first transmission node) and Node2 (i.e., the second transmission node) and the key management unit.

[0202] 3) Node2 randomly selects calculates T2=(bz2)P=b(x2+h'2s2(mod q))P.

[0203] 4) Node2 also responds to Node1 through the secure channel between Node1 and Node2 and the key management unit.

[0204] 5) Node1 calculates the pre-authentication key where h'1=H1(X1, NID1), and then generates the session key k=H2(NID1, NID2, T1, T2, K). Node2 calculates the pre-authentication key where h'2=H1(X2, NID2), and then generates the session key k=H2(NID1, NID2, T1, T2, K).

[0205] 6) Finally, Node1 and Node2 use the challenge-response mechanism combined with the HMAC function on the unprotected channel to mutually confirm the key.

[0206] Node authentication and session key agreement phase:

[0207] As Figure 8 shown in the figure, in this phase, the administrator configures two nodes that can access each other to perform identity authentication through the identity key negotiated in the two nodes and session key negotiation through the identity base key obtained from the key management unit. The separation of the authentication key and the key negotiation private key makes the boundary of the key clearer and can reduce the risk caused by the leakage of a single key. At the same time, the authentication key is a negotiated symmetric key, and the authentication mode based on the symmetric key is efficient and suitable for scenarios where nodes need to communicate frequently. The communication in this phase is performed on a normal channel without any additional security assumption.

[0208] The specific process of this phase is as follows:

[0209] 1) Node1 randomly selects two random numbers r1, Then calculates T1=a(x1+h'1s1(mod q))P, where h'1=H1(X1, NID1), and finally Node1 sends the identity NID1 to Node2 together with r1 and T1.

[0210] 2) Node2 randomly selects two random numbers r2, Then obtains the authentication key k of Node1 from the authentication key table, calculates the response value res1 of the challenge value r1, res1=HMAC(r1, NID2, k). Then Node2 calculates T2=b(x2+h'2s2(mod q))P, where h'2=H1(X2, NID2). Finally, Node2 calculates the pre-session key K=[b(x2+h 2′ s2(mod q))]T1, and generates the final session key k s =H2(NID1, NID2, T1, T2, K).

[0211] 3) Node2 sends the identity NID2, the challenge value r2, the key exchange parameter T2, and the response value res1 to Node1.

[0212] 4) Node1 calculates res'1=HMAC(r1, NID2, j), and checks whether res'1 and res1 are equal. If they are equal, the pre-session key K s =H2(NID1, NID2, T1, T2, K) is calculated, and the response value res2=HMAC(r2, NID1, k, k s ) is calculated.

[0213] 5) After receiving the response value, Node2 calculates res2'=HMAC(r2, NID1, k, k s), if res2 = res'2, the authentication ends, and the session key is k s .

[0214] In some embodiments, in step 305, the session key negotiation for the two transmission nodes in mutual communication is performed using a certificateless identity-based encryption algorithm, and a negotiated session key is obtained, including:

[0215] Step F1, the target data center module obtains a pre-session key, a first key exchange parameter of a first transmission node in the two transmission nodes in mutual communication, and a second key exchange parameter of a second transmission node in the two transmission nodes in mutual communication.

[0216] Step F2, the target data center module processes the pre-set identity of the first transmission node, the pre-set identity of the second transmission node, the first key exchange parameter, the second key exchange parameter, and the pre-session key through a hash function to obtain a negotiated session key.

[0217] In the above scheme, the pre-session key can be shared in a secure manner before communication, or provided by a trusted third party. The purpose of the pre-session key is to serve as the basis for generating the final session key.

[0218] Key exchange parameter of transmission node: In the key exchange protocol, each node will generate or select a parameter, which plays a key role in the subsequent key negotiation process. For the first transmission node and the second transmission node, they have their own first key exchange parameter and second key exchange parameter respectively. These parameters are usually randomly generated to ensure that the session key of each communication is unique.

[0219] Identity of transmission node: Each transmission node has a unique identity (such as public key, certificate or username, etc.) for verifying the identity of the node during communication. Here, the pre-set identity of the first transmission node and the pre-set identity of the second transmission node are used to ensure that the participants in the key negotiation process are the expected two parties.

[0220] Target data center module: This is an intermediate entity that receives key exchange parameters and pre-session keys from two transmission nodes, as well as the identities of the two nodes. The task of the target data center module is to generate the final session key based on this information using a secure method (such as a hash function).

[0221] Hash function processing: A hash function is a one-way mathematical function that converts input data of arbitrary length into output data of fixed length, called a hash value or digest. In this scenario, the target data center module takes the identity of the first transport node, the identity of the second transport node, the first key exchange parameter, the second key exchange parameter, and the pre-session key as input, processes them through a hash function, and obtains a fixed-length output, which is the negotiated session key.

[0222] In this way, the two transport nodes can securely negotiate a shared session key for subsequent encrypted communication. Due to the one-way and collision-resistant nature of the hash function, even if an attacker intercepts all the information transmitted during the key negotiation process, it is difficult to calculate the final session key. Therefore, this method provides a secure and reliable key negotiation mechanism.

[0223] It should be noted that the method of the embodiments of the present application can be executed by a single device, such as a computer or a server, etc. The method of the embodiments of the present application can also be applied in a distributed scenario, and be completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only execute one or more steps in the method of the embodiments of the present application, and the multiple devices can interact with each other to complete the method.

[0224] It should be noted that some embodiments of the present application have been described above. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in a different order than the order described above and still achieve the desired result. In addition, the processes depicted in the accompanying drawings do not necessarily require the particular order shown or sequential order to achieve the desired results. In certain implementations, multitasking and parallel processing can be advantageous or possible.

[0225] Based on the same inventive concept, the present application also provides an Internet of Things-oriented data transmission device corresponding to any of the above-mentioned embodiment methods.

[0226] Reference Figure 9 The Internet of Things-oriented data transmission device is arranged in a physical network-oriented data transmission system, which includes a core network module, multiple user devices, multiple data center modules, and multiple Internet of Things device groups corresponding to each data center module. The device includes:

[0227] The data center module 901 is configured to take any data center module in the data center module as a target data center module, and the target data center module collects physical network data generated in the running process of a corresponding plurality of Internet of Things device groups; the target data center module receives authorization policy modification information of a requested service of a user device, authenticates the authority of the target user device by using the authorization policy modification information, and in response to the authority of the target user device meeting the authorization policy modification information, sends Internet of Things data of a service subject corresponding to the service request to the target user device; or, in response to the authority of the target user device meeting the authorization policy modification information, terminates sending the Internet of Things data of the service subject corresponding to the service request to the target user device; the target data center module performs identity authentication on two transmission nodes in mutual communication by using an authentication root key generated in a registration stage in the authentication process, obtains an identity authentication result, and in response to the identity authentication result being that there is an unregistered node in the two transmission nodes, refuses access of the unregistered node; or, in response to the identity authentication result being that there is no unregistered node in the two transmission nodes, performs session key negotiation on the two transmission nodes in mutual communication by using a certificateless identity-based encryption algorithm, obtains a negotiated session key, and encrypts a data transmission process between the two transmission nodes by using the negotiated session key;

[0228] The user device 902 is configured to take a user device initiating a service request in the plurality of user devices as a target user device, and the target user device sends a service request to the target data center module.

[0229] The core network module 903 is configured to count a total number of service subjects borne by all servers corresponding to the target data center module inside the core network module in the authentication process, in response to the total number of service subjects being greater than a preset total number threshold, perform merging processing on the service subjects borne by the servers by using a service subject merging algorithm to obtain merged service subjects, store a preset policy synchronization message in the merged service subjects, and perform synchronization processing on the preset policy synchronization message stored in the merged service subjects by using a message synchronization processing algorithm, so as to synchronously store corresponding authorization policy modification information by each data center module.

[0230] For the convenience of description, the above apparatus is described as various modules in function. Of course, the functions of the modules can be implemented in one or more software and / or hardware in the implementation of the present application.

[0231] The apparatus of the above embodiment is used to implement the corresponding Internet of Things-oriented data transmission method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which are not described here again.

[0232] Based on the same inventive concept, the present application also provides an electronic device corresponding to the method of any of the above embodiments, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method of any of the above embodiments.

[0233] Figure 10 A more specific hardware structure of an electronic device is shown, which can include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 for communication within the device.

[0234] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits, etc., for executing related programs to implement the technical solutions provided by the embodiments of the present specification.

[0235] The memory 1020 can be implemented by a ROM (Read Only Memory), a RAM (Random Access Memory), a static storage device, a dynamic storage device, etc. The memory 1020 can store an operating system and other application programs, and when the technical solutions provided by the embodiments of the present specification are implemented by software or firmware, the related program codes are stored in the memory 1020 and executed by the processor 1010.

[0236] The input / output interface 1030 is used to connect input / output modules to realize information input and output. The input / output modules can be configured as components in the device (not shown in the figure) or externally connected to the device to provide corresponding functions. The input devices can include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output devices can include a display, a speaker, a vibrator, an indicator light, etc.

[0237] The communication interface 1040 is used to connect the communication module (not shown in the figure) to realize the communication interaction between the device and other devices. The communication module can realize communication through wired means (such as USB, network cable, etc.) or through wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0238] The bus 1050 includes a path for transferring information between the various components (for example, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040) of the device.

[0239] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device can also include other components necessary for normal operation. In addition, those skilled in the art can understand that the above device can also only contain the components necessary to implement the embodiments of the present application, and does not have to contain all the components shown in the figure.

[0240] The electronic device of the above embodiment is used to implement the corresponding Internet of Things-oriented data transmission method in any of the preceding embodiments, and has the beneficial effects of the corresponding method embodiments, which are not repeated here.

[0241] Based on the same inventive concept, corresponding to the method of any of the above embodiments, the present application also provides a non-transitory computer readable storage medium storing computer instructions for causing the computer to execute the Internet of Things-oriented data transmission method of any of the above embodiments.

[0242] The computer readable medium of the present embodiment includes permanent and non-permanent, removable and non-removable media, which can be implemented by any method or technology to store information. The information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device, or any other non-transmission medium that can be used to store information accessible by a computing device.

[0243] The computer instructions stored in the storage medium of the above embodiment are used to cause the computer to execute the Internet of Things-oriented data transmission method of any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which are not repeated here.

[0244] Those of ordinary skill in the art will realize that the foregoing discussion of any of the embodiments has been presented for the purpose of illustration and description and is not intended to be exhaustive or to limit the application to the precise forms described. Many modifications and variations will be apparent to those of ordinary skill in the art. For example, other memory architectures (e.g., dynamic RAM (DRAM)) can use the embodiments discussed.

[0245] In addition, to simplify the description and discussion, and so as not to make the embodiments of the application difficult to understand, the well-known power / ground connections to integrated circuit (IC) chips and other components can or can not be shown in the provided drawings. Further, devices can be shown in block diagram form so as not to make the embodiments of the application difficult to understand, and this also takes into account the fact that details regarding implementation of these block diagram devices are highly dependent on the platform on which the embodiments of the application are to be implemented (i.e., these details should be well within the understanding of one of ordinary skill in the art). Where specific details (e.g., circuitry) are set forth in order to describe an illustrative embodiment of the application, it should be apparent to one of ordinary skill in the art that the embodiments of the application can be practiced without or with variations of these specific details. Thus, the description should not be viewed as limiting the application, but rather as merely describing illustrative embodiments.

[0246] While the application has been described in connection with specific embodiments thereof, it will be understood that many modifications, variations and alternatives will be apparent to those skilled in the art as a result of the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) can use the embodiments discussed.

[0247] It is therefore intended that the embodiments of the application embrace all such alternatives, modifications and variations as falling within the broad scope of the appended claims. Accordingly, any and all departures from the above described methods, apparatus and techniques are intended to be included within the scope of the application.

Claims

1. A data transmission method for Internet of Things, characterized in that, The application is applied to a physical network-oriented data transmission system, the system comprises a core network module, a plurality of user equipment, a plurality of data center modules and a plurality of Internet of Things equipment groups corresponding to each data center module, and the method comprises: Any data center module in the data center module is taken as a target data center module, the target data center module collects physical network data generated by the corresponding plurality of Internet of Things equipment groups in the running process; A user equipment initiating a service request in the plurality of user equipment is taken as a target user equipment, and the target user equipment sends a service request to the target data center module; The target data center module receives authorization policy modification information of the requested service of the user equipment, authenticates the authority of the target user equipment by using the authorization policy modification information, and in response to the authority of the target user equipment meeting the authorization policy modification information, sends Internet of Things data of a service subject corresponding to the service request to the target user equipment; or, in response to the authority of the target user equipment meeting the authorization policy modification information, terminates the sending of the Internet of Things data of the service subject corresponding to the service request to the target user equipment; The core network module counts the total number of service subjects borne by all servers corresponding to the target data center module inside the core network module in the authentication process, and in response to the total number of service subjects being greater than a preset total number threshold, merges the service subjects borne by the servers by using a service subject merging algorithm to obtain merged service subjects, stores a preset policy synchronization message in the merged service subjects, and synchronously processes the preset policy synchronization message stored in the merged service subjects by using a message synchronization processing algorithm, so as to synchronously store the corresponding authorization policy modification information by each data center module; The target data center module performs identity authentication on two transmission nodes in mutual communication by using an authentication root key generated in a registration stage in the authentication process, obtains an identity authentication result, and in response to the identity authentication result being that there is an unregistered node in the two transmission nodes, refuses the access of the unregistered node; or, in response to the identity authentication result being that there is no unregistered node in the two transmission nodes, performs session key negotiation on the two transmission nodes in mutual communication by using a certificateless identity-based encryption algorithm to obtain a negotiated session key, and encrypts the data transmission process between the two transmission nodes by using the negotiated session key.

2. The method of claim 1, wherein, The service subject merging algorithm comprises: The core network module divides all servers into a plurality of association groups according to a preset server number; The core network module determines the number of Internet of Things equipment groups currently accommodated by the servers corresponding to each association group, and screens a target association group from each association group, in which the number of Internet of Things equipment groups currently accommodated is greater than the maximum number of Internet of Things equipment groups allowed to be transmitted simultaneously; The core network module determines the idle degree index of each other association group except the target association group in each association group; The core network module finds target other association groups greater than a preset migration threshold from the idleness indexes of each other association group; The core network module determines a final target other association group from the target other association groups, in which the idleness index is the largest and the total load of all servers corresponding to the final target other association group is greater than or equal to the total load of the target association group, and merges the service topics carried by the servers corresponding to the target association group into the service topics carried by the servers corresponding to the final target other association group to obtain merged service topics.

3. The method of claim 2, wherein, The determination of the idleness indexes of the other association groups in each association group except the target association group includes: The core network module determines the current total load of each server corresponding to the other association groups in each association group except the target association group and the maximum load of the corresponding server; The core network module determines the idleness indexes of the other association groups in each association group except the target association group based on the current total load of each server and the maximum load of the corresponding server by the following formula: wherein, represents the idle degree index, represents the total load of the i-th server at present, represents the maximum load of the i-th server.

4. The method of claim 3, wherein, The determination of the current total load of each server corresponding to the other association groups in each association group except the target association group includes: The core network module performs the following operations for each other association group in each association group except the target association group: The core network module obtains the load of the primary partition of the service topic corresponding to each server in the other association group and the load of the replica of the corresponding service topic; The core network module determines the current total load of each server corresponding to the other association groups in each association group except the target association group by the following formula using the load of the primary partition of the service topic corresponding to each server in the other association group and the load of the replica of the corresponding service topic: wherein, represents the total load of the i-th server at present, represents the load of the primary partition of the k-th service topic, represents the load of the replica of the k-th service topic, λ represents a reduction factor of the replica load, λ ∈ (0, 1), T k represents the k-th service topic, represents the set of primary partitions on the i-th server, represents the set of replicas on the i-th server.

5. The method of claim 1, wherein, The storage of the preset policy synchronization message in the merged service topics, the synchronization processing of the preset policy synchronization message stored in the merged service topics by a message synchronization processing algorithm, and the synchronization storage of the corresponding authorized policy modification information by each data center module include: The core network module encrypts the fields in the preset policy synchronization message except the random number generated when each message is sent, the identifier of the Internet of Things device group, and other fields by using the session key generated by the key generation algorithm to obtain encrypted other fields, wherein the other fields at least include the identifier of the data center module initiating synchronization, the list of data center modules requiring synchronization, and the authorized policy change type; The core network module determines whether the identifier of the data center module initiating synchronization exists in the list of data center modules requiring synchronization, and in response to determining that the identifier exists, transmits the authorized policy change type corresponding to the identifier of the data center module initiating synchronization to the corresponding data center module, so that the corresponding data center module performs authorized policy update on the initial authorized policy according to the authorized policy change type, generates the corresponding authorized policy modification information, and synchronously stores the authorized policy modification information.

6. The method of claim 1, wherein, The target data center module performs identity authentication on two transmission nodes in mutual communication in an authentication process by using the authentication root key generated in the registration stage, and obtains an identity authentication result, including: The target data center module determines a first challenge value of a first transmission node in the two transmission nodes, and transmits a preset identity of the first transmission node and the first challenge value to a second transmission node in the two transmission nodes; The second transmission node in the target data center module obtains a first authentication root key of the first transmission node from the authentication root key generated in the registration stage, processes the first challenge value of the first transmission node, the preset identity of the second transmission node and the first authentication key of the first transmission node by a hash operation message authentication code algorithm, determines a first response value of the first challenge value, and transmits the preset identity of the second transmission node and the first response value of the first challenge value to the first transmission node; The first transmission node in the target data center module processes the first challenge value of the first transmission node, the preset identity of the second transmission node and the first authentication key of the first transmission node by a hash operation message authentication code algorithm, determines a second response value of the first challenge value, and compares the first response value and the second response value to obtain a comparison result; The target data center module determines that the identity authentication result is that there is an unregistered node in the two transmission nodes in response to the comparison result that the first response value and the second response value are not equal; or the target data center module determines that the identity authentication result is that there is no unregistered node in the two transmission nodes in response to the comparison result that the first response value and the second response value are equal.

7. The method of claim 1, wherein, The target data center module performs session key negotiation on two transmission nodes in mutual communication by using a certificateless identity-based encryption algorithm, and obtains a negotiated session key, including: The target data center module obtains a pre-session key, a first key exchange parameter of a first transmission node in the two transmission nodes in mutual communication, and a second key exchange parameter of a second transmission node in the two transmission nodes in mutual communication; The target data center module processes the preset identity of the first transmission node, the preset identity of the second transmission node, the first key exchange parameter, the second key exchange parameter and the pre-session key by a hash function to obtain the negotiated session key.

8. A data transmission device for Internet of Things, characterized in that, The device is arranged in a data transmission system facing a physical network, the system includes a core network module, a plurality of user equipment, a plurality of data center modules and a plurality of Internet of Things device groups corresponding to each data center module, and the device includes: A data center module is configured to take any data center module in the data center module as a target data center module, and the target data center module collects physical network data generated by a corresponding plurality of Internet of Things device groups in a running process; the target data center module receives authorization policy modification information of a service request of a user device, authenticates the authority of the target user device by using the authorization policy modification information, and in response to the authority of the target user device meeting the authorization policy modification information, sends Internet of Things data of a service subject corresponding to the service request to the target user device; or, in response to the authority of the target user device meeting the authorization policy modification information, terminates sending the Internet of Things data of the service subject corresponding to the service request to the target user device; the target data center module uses an authentication root key generated in a registration stage to perform identity authentication on two transmission nodes in mutual communication in an authentication process, obtains an identity authentication result, and in response to the identity authentication result being that there is an unregistered node in the two transmission nodes, refuses access of the unregistered node; or, in response to the identity authentication result being that there is no unregistered node in the two transmission nodes, uses a certificateless identity-based encryption algorithm to perform session key negotiation on the two transmission nodes in mutual communication, obtains a negotiated session key, and uses the negotiated session key to encrypt a data transmission process between the two transmission nodes; A user device is configured to take a user device initiating a service request in the plurality of user devices as a target user device, and the target user device sends a service request to the target data center module; A core network module is configured to count a total number of service subjects borne by all servers corresponding to the target data center module inside the core network module in an authentication process, and in response to the total number of service subjects being greater than a preset total number threshold, use a service subject merging algorithm to perform merging processing on the service subjects borne by the servers, obtain merged service subjects, store a preset policy synchronization message in the merged service subjects, use a message synchronization processing algorithm to perform synchronization processing on the preset policy synchronization message stored in the merged service subjects, and synchronize storage of corresponding authorization policy modification information by each data center module.

9. An electronic device comprising a memory, a processor, and a computer program stored on the memory and running on the processor, characterized in that, The processor executes the program to implement the method of any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to make the computer execute the method of any one of claims 1 to 7.

Images