Module applied to Internet of Things and control method thereof

Abstract

The invention discloses a module applied to the Internet of Things and a control method thereof, which are used for monitoring heartbeat signals and carrying out batch monitoring and abnormal data troubleshooting in a clustering analysis mode according to an indication of heartbeat signal delay so as to position an abnormal Internet of Things terminal. According to the technical scheme of the invention, the method achieves the batch monitoring through the clustering analysis, can avoid the condition that each Internet of Things terminal needs to be independently analyzed under the condition of a large number of Internet of Things terminals, and reduces the calculation cost. Meanwhile, physical isolation is not needed, and the cost is reduced.

Description

Technical Field

[0001] The present invention relates to the field of communications, and particularly to a module applied to the Internet of Things and its control method. Background Art

[0002] The security requirements for network communications are increasing day by day. Therefore, it is necessary to identify and prevent various common network attack means. In prior arts such as patent documents CN105282152A, CN102111411A, CN109218321A, etc., strong encryption protocols are usually used to protect communication data, or attacked terminals are discovered by monitoring abnormal traffic and other data, and there are also prior arts that directly use hardware isolation technology for protection.

[0003] For the Internet of Things, due to the large number and wide distribution of terminals, it is more vulnerable to MITM attacks. However, the above security measures in the prior art cannot well cope with IoT MITM attacks. On the one hand, since the computing power of IoT terminals is often limited, using complex encryption algorithms will bring a large computational burden, making it difficult to use strong encryption protocols to protect IoT communication data; on the other hand, monitoring abnormal traffic and other data often analyzes the historical traffic or other data of each terminal, and since there are a large number of IoT terminals, individually monitoring each terminal will bring huge computational overhead; using hardware isolation technology requires building a complex hardware isolation system.

[0004] At the same time, the attack positions of MITM attacks are diverse, and corresponding security protection needs to be carried out according to the characteristics of different attack positions. The applicant found that when the attack position occurs between IoT terminals and modules such as gateway modules and communication modules, due to the simplicity and periodicity of the signal content of their heartbeat signals, MITM attacks tend to start from attacking the heartbeat signals. Therefore, there is an urgent need for a module applied to the Internet of Things and its control method to prevent MITM attacks between IoT terminals and modules such as gateway modules and communication modules, avoid the drawbacks of prevention methods such as strong encryption protocols and individual monitoring in the prior art in the Internet of Things, and at the same time minimize the false positive rate to meet basic requirements. Summary of the Invention

[0005] The purpose of the present invention is to provide a module applied to the Internet of Things and its control method to better solve the problems raised in the background art.

[0006] The present invention provides the following technical solutions: A module applied to the Internet of Things, comprising: comprising a grouping module, a communication module, an analysis module, and a reminder module; The module is configured to perform the following steps: S1. The grouping module divides multiple IoT terminals connected to the module into multiple large groups according to the heartbeat signal period requirements of the multiple IoT terminals. The heartbeat signal period requirements of the IoT terminals within each large group are similar. S2. For each large group, the communication module sends a first heartbeat signal encrypted using the first encryption method to all IoT terminals within the large group and receives the corresponding first heartbeat confirmation signal. S3. The grouping module divides the multiple IoT terminals in each large group into multiple small groups under the large group according to the delay of the first heartbeat signal of each IoT terminal. The delay of the first heartbeat signal of the IoT terminals within each small group is similar. S4. For each large group that meets the heartbeat signal period requirements, the communication module sends a second heartbeat signal encrypted using the first encryption method to all IoT terminals in each small group within the large group and receives the corresponding second heartbeat confirmation signal. The analysis module performs clustering on the delays of the second heartbeat signals of all IoT terminals in each small group in turn in units of small groups to determine whether there are abnormal IoT terminals. If so, jump to step S5; if not, repeat step S4. S5. The communication module sends a third heartbeat signal encrypted using the second encryption method to the abnormal IoT terminal judged by the analysis module, and determines whether the corresponding third heartbeat confirmation signal is abnormal. If so, the reminder module reminds the staff to check the abnormal IoT terminal; if not, cancel the abnormal mark of the abnormal IoT terminal and jump to execute step S4.

[0007] Further, in step S1, the ratio of the upper limit to the lower limit of the heartbeat signal period requirements of the IoT terminals within each large group is less than the first threshold.

[0008] Further, in step S2, the module sends the first heartbeat signal to the IoT terminals within the same large group simultaneously and sends the first heartbeat signal to the IoT terminals between different large groups staggeredly.

[0009] Further, in step S3, the ratio of the upper limit to the lower limit of the delay of the first heartbeat signal of the IoT terminals within each small group is less than the second threshold.

[0010] Further, in step S4, when the communication module sends the second heartbeat signal to all IoT terminals in each small group within the large group, it sends the second heartbeat signal to the IoT terminals within the same small group of the same large group simultaneously.

[0011] Further, in step S4, the Mean Shift clustering algorithm is used to perform clustering analysis on the delays of the second heartbeat signals of all IoT terminals within the small group, and the delay of the second heartbeat signal exceeding the third threshold distance from the clustering center is the abnormal delay of the second heartbeat signal.

[0012] Furthermore, the time consumption of the decryption algorithm for the second encryption method calculated by the Internet of Things terminal is longer than that of the decryption algorithm for the first encryption method.

[0013] Furthermore, the Internet of Things terminal is preset with encryption and decryption methods corresponding to the first encryption method and the second encryption method; when the Internet of Things terminal receives a heartbeat signal, it first decrypts the heartbeat signal using the decryption algorithm corresponding to the first encryption method, and encrypts and sends the heartbeat confirmation signal to the module using the encryption algorithm corresponding to the first encryption method; if the heartbeat signal cannot be decrypted using the decryption algorithm corresponding to the first encryption method, it decrypts the heartbeat signal using the decryption algorithm corresponding to the second encryption method, and encrypts and sends the heartbeat confirmation signal to the module using the encryption algorithm corresponding to the second encryption method.

[0014] Furthermore, in step S5, after the staff checks the abnormal Internet of Things terminal and determines that it has been attacked by MITM, the first encryption method and the second encryption method are updated.

[0015] And a control method for a module applied to the Internet of Things, including the following steps: S1, the grouping module divides multiple Internet of Things terminals into multiple large groups according to the heartbeat signal period requirements of the multiple Internet of Things terminals connected to the module. The heartbeat signal period requirements of the Internet of Things terminals within each large group are similar; S2, for each large group, the communication module sends the first heartbeat signal encrypted using the first encryption method to all the Internet of Things terminals within the large group, and receives the corresponding first heartbeat confirmation signal; S3, the grouping module divides the multiple Internet of Things terminals in each large group into multiple small groups under the large group according to the delay of the first heartbeat signal of each Internet of Things terminal. The delay of the first heartbeat signal of the Internet of Things terminals within each small group is similar; S4, for each large group that meets the heartbeat signal period requirements, the communication module sends the second heartbeat signal encrypted using the first encryption method to all the Internet of Things terminals in each small group within the large group, and receives the corresponding second heartbeat confirmation signal; the analysis module performs joint clustering on the delay of the second heartbeat signal and the signal strength of the second heartbeat confirmation signal of each Internet of Things terminal in each small group in units of small groups to determine whether there are abnormal Internet of Things terminals. If so, jump to step S5; if not, repeat step S4; S5, the communication module sends the third heartbeat signal encrypted using the second encryption method to the abnormal Internet of Things terminal determined by the analysis module, and determines whether the corresponding third heartbeat confirmation signal is abnormal. If so, the reminder module reminds the staff to check the abnormal Internet of Things terminal. If not, cancel the abnormal mark of the abnormal Internet of Things terminal and jump to execute step S4.

[0016] The beneficial effects of the present invention are as follows: 1. Innovatively monitor the heartbeat signal, and for the indication of heartbeat signal delay, perform batch monitoring through clustering analysis to detect abnormal data, thereby locating abnormal IoT terminals. The method of batch monitoring through clustering analysis can avoid the need to analyze each IoT terminal individually in the case of a large number of IoT terminals, thus reducing the computational overhead. At the same time, there is no need for physical isolation, reducing costs.

[0017] 2. Only use complex encryption algorithms (i.e., the second encryption method) in abnormal situations, avoiding the use of complex encryption algorithms throughout the process, and reducing the computational burden on IoT terminals.

[0018] 3. By combining methods to avoid network congestion, reconfirm abnormal IoT terminals, and use two-dimensional data for joint clustering, the false positive rate is reduced, making the scenario more widely applicable. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a schematic diagram of a control method for a module applied to the Internet of Things. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0020] As Figure 1 shown, the present invention provides a module applied to the Internet of Things and its control method. The Internet of Things includes a module and multiple IoT terminals, and the multiple IoT terminals communicate with the module. Since the MITM attack between the IoT terminal and the module more commonly occurs in the wireless connection method, preferably, the multiple IoT terminals communicate directly with the module wirelessly. The module of the present invention includes, but is not limited to, a gateway module for implementing gateway functions, a communication module for implementing communication management, a control module for implementing communication control, etc. The module of the present invention may also include other functions in addition to the functions described above and below. The modules for implementing various functions may be integrated into the module of the present invention. The module of the present invention may form a device alone or be embedded in other devices.

[0021] The module includes a grouping module. Among them, the module is configured to execute step S1: The grouping module divides multiple Internet of Things terminals into multiple large groups according to the heartbeat signal period requirements of the multiple Internet of Things terminals connected to the module. The heartbeat signal period requirements of the Internet of Things terminals within each large group are the same. Or, the heartbeat signal period requirements of the Internet of Things terminals within each large group are similar, that is, the ratio of the upper limit of the heartbeat signal period requirement to the lower limit of the heartbeat signal period requirement of the Internet of Things terminals within each large group is less than the first threshold. Specifically, the heartbeat signal period requirements of different Internet of Things terminals may be the same or different, and the heartbeat signal period requirement can be 10s, 11s, 30s, etc. The grouping module divides the Internet of Things terminals with heartbeat signal period requirements of 10s, 11s, and 30s into different large groups respectively. Or, according to the value of the first threshold (here if the value of the first threshold is 1.15), the Internet of Things terminals with heartbeat signal period requirements of 1s and 1.1s are divided into one large group, and the Internet of Things terminals with a heartbeat signal period requirement of 5s are divided into another large group. The value of the first threshold can be flexibly adjusted according to actual needs.

[0022] The module further includes a communication module. Among them, the module is further configured to execute step S2: For each large group, the communication module sends a first heartbeat signal encrypted by the first encryption method to all the Internet of Things terminals in the large group and receives the corresponding first heartbeat confirmation signal. Specifically, the first encryption method is non-encryption, or the first encryption method can adopt a mature encryption algorithm in the prior art, but it should adapt to the computing power of the Internet of Things terminals. It can be understood that the specific content of the heartbeat signal is determined according to the actual communication requirements of different Internet of Things terminals. Obviously, the heartbeat signal content of different Internet of Things terminals is different. The present invention does not limit the specific content of the heartbeat signal, but limits whether the heartbeat signal is encrypted or the encryption method. When the communication module sends the first heartbeat signal to all the Internet of Things terminals in the large group, the first heartbeat signal should be sent to the Internet of Things terminals in the same large group simultaneously (or as simultaneously as possible, such as successively). The first heartbeat confirmation signal is the heartbeat confirmation signal fed back by the Internet of Things terminal after receiving the first heartbeat signal.

[0023] To avoid network congestion, the module can stagger the sending of the first heartbeat signal for different large groups. Further, since the heartbeat signal period requirements of the Internet of Things terminals are grouped, the sending time of the first heartbeat signal for different large groups can be further adjusted according to the expected reception time of the first heartbeat confirmation signal of different large groups, so as to stagger the sending of the first heartbeat signal and the reception of the first heartbeat confirmation signal in time, further avoiding network congestion.

[0024] Further, the module is further configured to execute step S3: The grouping module delays according to the first heartbeat signals of each IoT terminal in step S2. For each large group, multiple IoT terminals within the same large group are divided into multiple small groups, and the first heartbeat signal delays of the IoT terminals within each small group are the same. Alternatively, the first heartbeat signal delays of the IoT terminals within each small group are similar, that is, the ratio of the upper limit of the first heartbeat signal delay to the lower limit of the first heartbeat signal delay of the IoT terminals within each small group is less than a second threshold. Specifically, the first heartbeat signal delay of each IoT terminal is the time difference between the module receiving the first heartbeat confirmation signal of the IoT terminal and sending the first heartbeat signal to the IoT terminal. Similarly, the value of the second threshold can be flexibly adjusted according to actual requirements.

[0025] Specifically, in step S3, each large group is further divided into multiple small groups, that is, the first large group has multiple small groups, the second large group also has multiple small groups, and so on. The heartbeat signal period requirements of the IoT terminals within each large group are the same or similar, while the heartbeat signal period requirements of the IoT terminals between different large groups are different. The first heartbeat signal delay requirements of the IoT terminals within the same small group of the same large group are the same or similar, while the first heartbeat signal delays of the IoT terminals between different small groups of the same large group are different. Since the heartbeat signal is relatively short and unified (i.e., the content format is unified and the processing method is unified), not much computational consumption is required in the process of the IoT terminal receiving the first heartbeat signal and sending back the first heartbeat confirmation signal. Therefore, under normal circumstances, the time taken for the IoT terminal itself to process the first heartbeat signal and send back the first heartbeat confirmation signal is relatively fixed. At the same time, for the IoT terminals in the same large group, the time when the module sends the first heartbeat signal is basically the same, and the computing performance of the module is relatively strong, and the time taken to process the first heartbeat confirmation signal is also relatively fixed. Therefore, in the case of avoiding network congestion, the first heartbeat signal delay is mainly affected by signal interference caused by environmental factors. Since the IoT terminals are in different regions and different environments, and the positions of the IoT terminals are relatively fixed, the first heartbeat signal delays of different IoT terminals may be different, but the first heartbeat signal delay of the same IoT terminal will not change significantly under normal circumstances. If the first heartbeat signal delay changes due to environmental factors, multiple IoT terminals in the same region may change in the same trend. Dividing multiple IoT terminals into different small groups according to the first heartbeat signal delay enables the influence of environmental factors on the heartbeat signal delay to be excluded with a high probability within the same small group, which forms the analysis basis for the next step S4.

[0026] Further, the module further includes an analysis module. Among them, the module is further configured to execute step S4: for each large group that meets the heartbeat signal period requirement, the communication module sends a second heartbeat signal encrypted by the first encryption method to all Internet of Things terminals in each small group within the large group, and receives the corresponding second heartbeat confirmation signal; for each large group, the analysis module clusters the second heartbeat signal delays of each Internet of Things terminal in each small group to determine whether there are abnormal Internet of Things terminals. If so, jump to step S5. If not, repeat step S4. Similarly, the second heartbeat confirmation signal is the heartbeat confirmation signal fed back by the Internet of Things terminal after receiving the second heartbeat signal. The second heartbeat signal delay of each Internet of Things terminal is the time difference between the module receiving the second heartbeat confirmation signal of the Internet of Things terminal and sending the second heartbeat signal to the Internet of Things terminal. Optionally, when clustering, it is in units of small groups, that is, each small group is separately cluster-analyzed, and then this clustering analysis operation is performed on all small groups of the large group. Or, it can also be in units of large groups, that is, all small groups under a large group are cluster-analyzed.

[0027] When the communication module sends the second heartbeat signal to all Internet of Things terminals in each small group within the large group, in the order of small groups first and then large groups, for the Internet of Things terminals in the same small group within the same large group, the second heartbeat signal should be sent simultaneously (or as simultaneously as possible, such as successively). For example, first send the second heartbeat signal to the Internet of Things terminals in the first small group of the first large group, then send the second heartbeat signal to the Internet of Things terminals in the second small group of the first large group,... After the first large group is sent, then send the second heartbeat signal to the Internet of Things terminals in the first small group of the second large group, and then send the second heartbeat signal to the Internet of Things terminals in the second small group of the second large group,... And so on.

[0028] It should be explained that step S4 is not executed immediately after step S3. Since the heartbeat signal period requirements within each large group are the same or similar, for the Internet of Things terminals within each large group, after sending the first heartbeat signal, the second heartbeat signal should be sent after an interval of the heartbeat signal period requirement of the large group. At the same time, during the repeated execution of step S4, after sending the second heartbeat signal, the second heartbeat signal should be sent again after an interval of the heartbeat signal period requirement of the large group. That is, each time step S4 is executed, it is not necessary to send the second heartbeat signal to all Internet of Things terminals. Instead, according to the heartbeat signal period requirements of different large groups, the second heartbeat signal is sent to the Internet of Things terminals of the large groups that need to send the second heartbeat signal, and the subsequent steps "receive the corresponding second heartbeat confirmation signal; for each large group, the analysis module clusters the second heartbeat signal delays of each Internet of Things terminal in each small group to determine whether there are abnormal Internet of Things terminals" are executed.

[0029] For example, if there are two large groups, the heartbeat signal cycle requirement of the first large group is 2s, and the heartbeat signal cycle requirement of the second large group is 3s. Then at the 0th second, steps S2 - S3 are executed; at the 2nd second, step S4 is executed for the first large group (at this time, the first large group meets its heartbeat signal cycle requirement); at the 3rd second, step S4 is executed for the second large group (at this time, the second large group meets its heartbeat signal cycle requirement); at the 4th second, step S4 is executed for the first large group (at this time, the first large group meets its heartbeat signal cycle requirement); at the 6th second, step S4 is executed for the first large group and the second large group (at this time, both the first and second large groups meet their heartbeat signal cycle requirements) and so on. Of course, this example does not consider the situation of avoiding network congestion described above. If considered, the first heartbeat signal can be sent to the first large group at the 0th second, the first heartbeat signal can be sent to the second large group at the 0.5th second, the second heartbeat signal can be sent to the first large group at the 2nd second, the second heartbeat signal can be sent to the second large group at the 3.5th second and so on.

[0030] It should be emphasized that the first heartbeat signal in step S2, the second heartbeat signal in step S4, and the third heartbeat signal that appears later of the same Internet of Things terminal may be different in content when the heartbeat signal carries timestamp data; but they may also be the same, such as when the heartbeat signal does not carry timestamp data. However, as described above, the present invention does not limit the specific content of the heartbeat signal. The present invention uses the terms "first heartbeat signal" / "second heartbeat signal" here, which means that the heartbeat signals in steps S2 / S4 are the same in encryption method and are distinguished from the encryption method of the "third heartbeat signal" that appears later.

[0031] The analysis module clusters the second heartbeat signal delays of all IoT terminals in each group to determine whether there are abnormal IoT terminals with abnormal second heartbeat signal delays. Specifically, the analysis module takes each group as a unit and performs a clustering analysis on the second heartbeat signal delays of all IoT terminals within that group to determine whether there are abnormal second heartbeat signal delays (i.e., outlier second heartbeat signal delays), and marks the IoT terminals corresponding to the abnormal second heartbeat signal delays as abnormal IoT terminals. The second heartbeat signal delays can be clustered using common clustering analysis methods in the prior art, and the abnormal second heartbeat signal delays are judged according to the third threshold. The value of the third threshold can be flexibly adjusted according to actual needs. For example, the DBSCAN clustering algorithm can be used to perform a clustering analysis on the second heartbeat signal delays of all IoT terminals in the group. The second heartbeat signal delay corresponding to the outlier is the abnormal second heartbeat signal delay. At this time, the neighborhood radius parameter of DBSCAN is the third threshold, and the minimum number of samples of DBSCAN is adjusted according to the actual number of IoT terminals in the group according to requirements. Alternatively, the Mean Shift clustering algorithm can be used to perform a clustering analysis on the second heartbeat signal delays of all IoT terminals in the group. The second heartbeat signal delay that exceeds the third threshold distance from the clustering center is the abnormal second heartbeat signal delay. According to the different clustering analyses adopted, its third threshold and the specific parameters of the clustering analysis used should also be flexibly adjusted according to actual needs. The choice of the clustering analysis algorithm should adapt to the computing power of the module.

[0032] Similar to the analysis of the first heartbeat signal delay above, the second heartbeat signal delay is mainly affected by three factors: the time taken by the IoT terminal to process the second heartbeat signal and feedback the second heartbeat confirmation signal; the time taken by the module to send the second heartbeat signal and process the second heartbeat confirmation signal; and environmental factors. The relatively short and unified characteristics of the heartbeat signal enable the IoT terminal to quickly process the heartbeat signal. Using the method described above to avoid network congestion and through the grouping method of groups, it is possible to avoid the influence of the above three factors to a certain extent. Thus, under normal circumstances, there will be no outliers in the clustering of the second heartbeat signal delays of the same group, so that the system can continuously loop in step S4. Even if the environmental factors in a certain area change, resulting in a change in the second heartbeat signal delay, there may be many IoT terminals in the same group that are also affected by this change in environmental factors. The second heartbeat signal delays of these IoT terminals will independently form a new cluster, thus avoiding the generation of outliers under normal circumstances. Therefore, this situation should also be considered when choosing the specific method of clustering analysis, so as to reduce the misjudgment rate.

[0033] However, if outliers still appear, that is, abnormal delays in the second heartbeat signals occur, it indicates that the time taken for the corresponding IoT terminal to process the second heartbeat signal and feedback the second heartbeat confirmation signal has changed, or the environment of the IoT terminal has changed compared to other IoT terminals in the same group. This all indicates that it may be at risk of being attacked by MITM. Therefore, the IoT terminal corresponding to the abnormal second heartbeat signal delay is marked as an abnormal IoT terminal.

[0034] The module further includes a reminder module. Specifically, the module is further configured to execute step S5: the reminder module reminds the staff to check the abnormal IoT terminals determined by the analysis module.

[0035] Thus, the relatively short and relatively uniform characteristics of the heartbeat signal are the analysis basis for step S4. For other communication signals of the IoT terminal, due to their different signal lengths and computational processing overheads, resulting in different signal delays, it is impossible to continue using the method of step S4 for analysis. Therefore, the present invention is specifically dedicated to heartbeat signals.

[0036] However, there is a possibility of misjudgment for the abnormal IoT terminals in step S4. To further reduce the misjudgment rate and conduct a secondary confirmation of the abnormal IoT terminals, step S5 can be replaced with: the communication module sends a third heartbeat signal encrypted using the second encryption method to the abnormal IoT terminals determined by the analysis module, and determines whether the corresponding third heartbeat confirmation signal is abnormal. If so, the reminder module reminds the staff to check the abnormal IoT terminals. If not, the abnormal IoT terminals are marked as normal IoT terminals (or the marks of the abnormal IoT terminals are cancelled) and step S4 is executed by jumping. The third heartbeat confirmation signal (if any) is the heartbeat confirmation signal feedback by the IoT terminal after receiving the third heartbeat signal.

[0037] Specifically, the second encryption method is different from the first encryption method. The second encryption method can adopt a mature encryption algorithm in the prior art, but it should adapt to the computing power of the IoT terminal. If the first encryption method is non-encryption, then the second encryption method is encryption. Or, the encryption algorithms of the second encryption method and the first encryption method are the same, but the key of the second encryption method is longer than that of the first encryption method. Or, the encryption algorithms of the second encryption method and the first encryption method are different, and the encryption algorithm of the second encryption method is more complex than that of the first encryption method. For example, the first encryption method adopts the ECC encryption algorithm, and the second encryption method adopts the RSA encryption algorithm. When the IoT terminal decrypts the heartbeat signals encrypted using the second encryption method and the first encryption method and encrypts the heartbeat confirmation signal, different computational time consumptions should be reflected. For example, the time consumption of the IoT terminal for calculating the decryption algorithm of the second encryption method is longer than that for calculating the decryption algorithm of the first encryption method.

[0038] Specifically, the Internet of Things (IoT) terminals are preset with encryption and decryption methods corresponding to the first encryption method and the second encryption method (including encryption and decryption algorithms, preset keys, etc.). When the IoT terminal receives a heartbeat signal, it first decrypts the heartbeat signal using the decryption algorithm corresponding to the first encryption method, and encrypts the heartbeat confirmation signal using the encryption algorithm corresponding to the first encryption method and sends it to the module. If the decryption algorithm corresponding to the first encryption method fails to decrypt the heartbeat signal, it decrypts the heartbeat signal using the decryption algorithm corresponding to the second encryption method, and encrypts the heartbeat confirmation signal using the encryption algorithm corresponding to the second encryption method and sends it to the module.

[0039] Similarly, the module is also preset with encryption and decryption algorithms corresponding to the first encryption method and the second encryption method. The module can decrypt the received heartbeat confirmation signal and determine whether the encryption algorithm used is the one corresponding to the first encryption method or the second encryption method.

[0040] The communication module sends a third heartbeat signal encrypted with the second encryption method different from the first encryption method to the abnormal IoT terminal judged by the analysis module. If the communication module does not receive the third heartbeat confirmation signal, it determines that the corresponding third heartbeat confirmation signal is abnormal; and / or if the encryption algorithm of the third heartbeat confirmation signal received by the communication module does not correspond to the second encryption method (such as the third heartbeat confirmation signal is still encrypted using the encryption algorithm corresponding to the first encryption method, or the third heartbeat confirmation signal is not encrypted), it determines that the corresponding third heartbeat confirmation signal is abnormal; and / or if the delay of the third heartbeat signal of the IoT terminal exceeds the fourth threshold, it determines that the corresponding third heartbeat confirmation signal is abnormal, where the delay of each third heartbeat signal of the IoT terminal is the time difference between the module receiving the third heartbeat confirmation signal of the IoT terminal and sending the third heartbeat signal to the IoT terminal, and the value of the fourth threshold can be flexibly adjusted according to actual needs.

[0041] Using the second encryption method different from the first encryption method can, to a certain extent, identify whether the IoT terminal has been attacked by a man-in-the-middle (MITM) attack. Because if the IoT terminal has been successfully attacked by an MITM attack, it indicates that the first encryption method has probably been cracked by the MITM attack. At this time, switching to the second encryption method that has not appeared before to encrypt the heartbeat signal can prevent the MITM attacker from immediately cracking the second encryption method that has not appeared before, so that the module can determine whether the corresponding third heartbeat confirmation signal is abnormal to determine whether the abnormal IoT terminal is misjudged, thereby reducing the misjudgment rate.

[0042] Preferably, after determining that the corresponding third heartbeat confirmation signal is abnormal, or after the staff member checks the abnormal IoT terminal and determines that it has been attacked by MITM, the global first encryption method and second encryption method can be updated, such as updating the key or encryption algorithm. After that, the process can be restarted from step S1, or the loop of step S4 can be continued. At the same time, after a certain period of time, the global first encryption method and second encryption method should also be updated.

[0043] It can be understood that the module and its control method of the present invention may still have misjudgments in the case of IoT terminal failures or disconnections. However, there are mature mechanisms and corresponding control methods in the prior art to monitor and handle IoT terminal failures or disconnections, and they can be combined with the module and its control method of the present invention according to actual needs. The present invention is more suitable for scenarios with a longer heartbeat signal period and a larger number of IoT terminals. At the same time, the module and its control method of the present invention cannot identify an MITM attack when the IoT terminal has been attacked by MITM when sending the first heartbeat signal, but this situation belongs to an extreme case and is not considered by the present invention for the time being. At the same time, if a new IoT terminal is connected to the module during the loop of step S4, the new IoT terminal can be added to the existing large group / small group or a new large group / small group can be created by referring to the process of steps S1 - S3.

[0044] Furthermore, "the analysis module clusters the second heartbeat signal delays of each IoT terminal in each group" in step S4 can also be replaced with "the analysis module jointly clusters the second heartbeat signal delays and the signal strengths of the second heartbeat confirmation signals of each IoT terminal in each group". Specifically, the second heartbeat signal delays and the signal strengths of the second heartbeat confirmation signals of the IoT terminals are used as two-dimensional data, and clustering analysis is performed on this two-dimensional data. The specific method of clustering analysis can refer to the above text and will not be elaborated here. Since the second heartbeat signal delays and the signal strengths of the second heartbeat confirmation signals are related under normal circumstances, the outliers after clustering analysis indicate that the IoT terminal has an abnormal situation. Therefore, the IoT terminal corresponding to the outlier can be marked as an abnormal IoT terminal. Through this clustering method, it can better adapt to the situation where the IoT terminal is moving and can further reduce the misjudgment rate.

Claims

1. A module applied to the Internet of Things, characterized in that: include: Grouping module, communication module, analysis module and reminder module; The module is configured to perform the following steps: S1, the grouping module divides the multiple IoT terminals into multiple large groups according to the heartbeat signal cycle requirements of the multiple IoT terminals connected to the module, and the heartbeat signal cycle requirements of the IoT terminals in each large group are similar; S2, for each large group, the communication module sends a first heartbeat signal encrypted using a first encryption method to all IoT terminals in the large group, and receives a corresponding first heartbeat confirmation signal; S3, the grouping module divides the multiple IoT terminals in each large group into multiple small groups under the large group according to the first heartbeat signal delay of each IoT terminal, and the first heartbeat signal delay of the IoT terminals in each small group is similar; S4, for each large group that meets the heartbeat signal cycle requirement, the communication module sends a second heartbeat signal encrypted using the first encryption method to all IoT terminals in each small group in the large group, and receives a corresponding second heartbeat confirmation signal; the analysis module clusters the second heartbeat signal delays of all IoT terminals in each small group in turn in small groups, and determines whether there is an abnormal IoT terminal. If so, jump to step S5, if not, repeat step S4; S5, the communication module sends the third heartbeat signal encrypted by the second encryption method to the abnormal IoT terminal determined by the analysis module, and determines whether the corresponding third heartbeat confirmation signal is abnormal. If so, the reminder module reminds the staff to check the abnormal IoT terminal. If not, the abnormal mark of the abnormal IoT terminal is cancelled and the process jumps to step S4.

2. The module according to claim 1, characterized in that: In step S1, the ratio of the upper limit of the heartbeat signal cycle requirement to the lower limit of the heartbeat signal cycle requirement of the Internet of Things terminals in each large group is less than a first threshold.

3. The module according to claim 1, characterized in that: In step S2, the module sends the first heartbeat signal to the IoT terminals in the same large group at the same time, and sends the first heartbeat signal to the IoT terminals in different large groups at different times.

4. The module according to claim 1, characterized in that: In step S3, the ratio of the upper limit of the first heartbeat signal delay to the lower limit of the first heartbeat signal delay of the Internet of Things terminals in each group is less than the second threshold.

5. The module according to claim 1, characterized in that: In step S4, when the communication module sends the second heartbeat signal to all the Internet of Things terminals in each small group in the large group, the second heartbeat signal is sent to the Internet of Things terminals in the same small group of the same large group at the same time.

6. The module according to claim 1, characterized in that: In step S4, the Mean Shift clustering algorithm is used to perform cluster analysis on the second heartbeat signal delays of all IoT terminals in the group, and the second heartbeat signal delay that exceeds the third threshold distance from the cluster center is an abnormal second heartbeat signal delay.

7. The module according to claim 1, characterized in that: The time consumed by the IoT terminal to calculate the decryption algorithm of the second encryption method is longer than the time consumed to calculate the decryption algorithm of the first encryption method.

8. The module according to claim 1, characterized in that: The Internet of Things terminal is preset with encryption and decryption methods corresponding to the first encryption method and the second encryption method; when the Internet of Things terminal receives a heartbeat signal, it first uses the decryption algorithm corresponding to the first encryption method to decrypt the heartbeat signal, and uses the encryption algorithm corresponding to the first encryption method to encrypt the heartbeat confirmation signal and send it to the module; if the decryption algorithm corresponding to the first encryption method cannot decrypt the heartbeat signal, the decryption algorithm corresponding to the second encryption method is used to decrypt the heartbeat signal, and the encryption algorithm corresponding to the second encryption method is used to encrypt the heartbeat confirmation signal and send it to the module.

9. The module according to claim 1, characterized in that: In step S5, after the staff checks the abnormal IoT terminal and determines that it has been attacked by MITM, they update the first encryption method and the second encryption method.

10. A control method for a module applied to the Internet of Things, characterized in that: The following steps are involved: S1, according to the heartbeat signal cycle requirements of the multiple IoT terminals connected to the module, the multiple IoT terminals are divided into multiple large groups, and the heartbeat signal cycle requirements of the IoT terminals in each large group are similar; S2, for each large group, sending a first heartbeat signal encrypted using a first encryption method to all IoT terminals in the large group, and receiving a corresponding first heartbeat confirmation signal; S3, according to the first heartbeat signal delay of each IoT terminal, dividing the multiple IoT terminals in each large group into multiple small groups under the large group, and the first heartbeat signal delays of the IoT terminals in each small group are similar; S4, for each large group that meets the heartbeat signal cycle requirement, sending a second heartbeat signal encrypted using the first encryption method to all IoT terminals in each small group within the large group, and receiving a corresponding second heartbeat confirmation signal; Taking the group as a unit, jointly cluster the second heartbeat signal delay and the signal strength of the second heartbeat confirmation signal of each IoT terminal in each group to determine whether there is an abnormal IoT terminal. If so, jump to step S5; if not, repeat step S4; S5, sending the third heartbeat signal encrypted by the second encryption method to the abnormal IoT terminal determined by the analysis module, and determining whether the corresponding third heartbeat confirmation signal is abnormal. If so, reminding the staff to check the abnormal IoT terminal; if not, canceling the abnormal mark of the abnormal IoT terminal and jumping to step S4.

Images