A module applied to the Internet of Things and its control method

Abstract

The present invention discloses a module applied to the Internet of Things and its control method, which monitors the heartbeat signal and, aiming at the indication of heartbeat signal delay, performs batch monitoring through cluster analysis to detect abnormal data, thereby locating abnormal Internet of Things terminals. The method of batch monitoring through cluster analysis can avoid the need for individual analysis of each Internet of Things terminal in the case of a large number of Internet of Things terminals, thus reducing the computational overhead. At the same time, there is no need for physical isolation, reducing the cost.

Description

Technical Field

[0001] The present invention relates to the field of communications, and particularly to a module applied to the Internet of Things and a control method thereof. Background Art

[0002] The security requirements for network communications are increasing day by day. Therefore, it is necessary to identify and prevent various common network attack means. In the prior arts such as patent documents CN105282152A, CN102111411A, CN109218321A, etc., strong encryption protocols are usually used to protect communication data, or attacked terminals are discovered by monitoring data such as abnormal traffic, and there are also prior arts that directly perform protection through hardware isolation technology.

[0003] For the Internet of Things, due to the large number and wide distribution of terminals, it is more vulnerable to MITM attacks. However, the above-mentioned security measures in the prior arts cannot well cope with the MITM attacks on the Internet of Things. On the one hand, since the computing power of Internet of Things terminals is often limited, using complex encryption algorithms will bring a large computational burden, making it difficult to use strong encryption protocols to protect Internet of Things communication data; on the other hand, monitoring data such as abnormal traffic often analyzes the historical traffic or other data of each terminal, and since there are a large number of Internet of Things terminals, monitoring each terminal individually will bring huge computational overhead; through hardware isolation technology, a complex hardware isolation system needs to be newly built.

[0004] At the same time, the attack positions of MITM attacks are diverse, and corresponding security protection needs to be carried out according to the characteristics of different attack positions. The applicant found that when the attack position occurs between Internet of Things terminals and modules such as gateway modules and communication modules, due to the simplicity and periodicity of the signal content of their heartbeat signals, MITM attacks tend to start from attacking the heartbeat signals. Therefore, there is an urgent need for a module applied to the Internet of Things and a control method thereof to prevent MITM attacks between Internet of Things terminals and modules such as gateway modules and communication modules, avoid the disadvantages of prevention methods such as strong encryption protocols and individual monitoring in the prior arts in the Internet of Things, and at the same time minimize the false positive rate to meet basic requirements. Summary of the Invention

[0005] The purpose of the present invention is to provide a module applied to the Internet of Things and a control method thereof to better solve the problems raised in the background art.

[0006] The present invention provides the following technical solutions:

[0007] A module applied to the Internet of Things, comprising:

[0008] Comprising a grouping module, a communication module, an analysis module, and a reminder module;

[0009] The module is configured to perform the following steps:

[0010] S1. The grouping module divides multiple Internet of Things terminals connected to the module into multiple large groups according to the heartbeat signal period requirements of the multiple Internet of Things terminals. The heartbeat signal period requirements of the Internet of Things terminals within each large group are similar;

[0011] S2. For each large group, the communication module sends a first heartbeat signal encrypted by the first encryption method to all Internet of Things terminals within the large group and receives the corresponding first heartbeat confirmation signal;

[0012] S3. The grouping module divides the multiple Internet of Things terminals in each large group into multiple small groups under the large group according to the delay of the first heartbeat signal of each Internet of Things terminal. The delay of the first heartbeat signal of the Internet of Things terminals within each small group is similar;

[0013] S4. For each large group that meets the heartbeat signal period requirements, the communication module sends a second heartbeat signal encrypted by the first encryption method to all Internet of Things terminals in each small group within the large group and receives the corresponding second heartbeat confirmation signal; The analysis module performs clustering on the delays of the second heartbeat signals of all Internet of Things terminals in each small group in turn to determine whether there are abnormal Internet of Things terminals. If so, jump to step S5; if not, repeat step S4;

[0014] S5. The communication module sends a third heartbeat signal encrypted by the second encryption method to the abnormal Internet of Things terminals determined by the analysis module, and determines whether the corresponding third heartbeat confirmation signal is abnormal. If so, the reminder module reminds the staff to check the abnormal Internet of Things terminals; if not, cancel the abnormal mark of the abnormal Internet of Things terminals and jump to execute step S4.

[0015] Furthermore, in step S1, the ratio of the upper limit of the heartbeat signal period requirement to the lower limit of the heartbeat signal period requirement of the Internet of Things terminals within each large group is less than the first threshold.

[0016] Furthermore, in step S2, the module sends the first heartbeat signal to the Internet of Things terminals within the same large group simultaneously and sends the first heartbeat signal to the Internet of Things terminals between different large groups staggeredly.

[0017] Furthermore, in step S3, the ratio of the upper limit of the delay of the first heartbeat signal to the lower limit of the delay of the first heartbeat signal of the Internet of Things terminals within each small group is less than the second threshold.

[0018] Furthermore, in step S4, when the communication module sends the second heartbeat signal to all Internet of Things terminals in each small group within the large group, it sends the second heartbeat signal to the Internet of Things terminals within the same small group of the same large group simultaneously.

[0019] Further, in step S4, the Mean Shift clustering algorithm is used to perform clustering analysis on the second heartbeat signal delays of all IoT terminals within the group. The second heartbeat signal delays that exceed the third threshold distance from the clustering center are abnormal second heartbeat signal delays.

[0020] Further, the time-consuming of the decryption algorithm of the second encryption method calculated by the IoT terminal is longer than that of the decryption algorithm of the first encryption method.

[0021] Further, the IoT terminal presets encryption and decryption methods corresponding to the first encryption method and the second encryption method; when the IoT terminal receives a heartbeat signal, it first decrypts the heartbeat signal using the decryption algorithm corresponding to the first encryption method, and encrypts and sends the heartbeat confirmation signal to the module using the encryption algorithm corresponding to the first encryption method; if the heartbeat signal cannot be decrypted using the decryption algorithm corresponding to the first encryption method, it decrypts the heartbeat signal using the decryption algorithm corresponding to the second encryption method, and encrypts and sends the heartbeat confirmation signal to the module using the encryption algorithm corresponding to the second encryption method.

[0022] Further, in step S5, after the staff checks the abnormal IoT terminal and determines that it has been attacked by MITM, the first encryption method and the second encryption method are updated.

[0023] And a control method for a module applied to the Internet of Things, including the following steps:

[0024] S1, the grouping module divides multiple IoT terminals into multiple large groups according to the heartbeat signal period requirements of the multiple IoT terminals connected to the module. The heartbeat signal period requirements of the IoT terminals within each large group are similar;

[0025] S2, for each large group, the communication module sends the first heartbeat signal encrypted using the first encryption method to all IoT terminals within the large group and receives the corresponding first heartbeat confirmation signal;

[0026] S3, the grouping module divides the multiple IoT terminals of each large group into multiple small groups under the large group according to the first heartbeat signal delay of each IoT terminal. The first heartbeat signal delays of the IoT terminals within each small group are similar;

[0027] S4. For each large group that meets the heartbeat signal period requirement, the communication module sends a second heartbeat signal encrypted by the first encryption method to all IoT terminals in each small group within the large group, and receives the corresponding second heartbeat confirmation signal; the analysis module takes the small group as a unit, jointly clusters the second heartbeat signal delay and the signal strength of the second heartbeat confirmation signal of each IoT terminal in each small group, and determines whether there are abnormal IoT terminals. If so, jump to step S5; if not, repeat step S4.

[0028] S5. The communication module sends a third heartbeat signal encrypted by the second encryption method to the abnormal IoT terminal determined by the analysis module, and determines whether the corresponding third heartbeat confirmation signal is abnormal. If so, the reminder module reminds the staff to check the abnormal IoT terminal; if not, cancel the abnormal mark of the abnormal IoT terminal and jump to execute step S4.

[0029] The beneficial effects of the present invention are as follows:

[0030] 1. Innovatively monitor the heartbeat signal, and for the indication of heartbeat signal delay, perform batch monitoring through the clustering analysis method to detect abnormal data, thereby locating abnormal IoT terminals. The method of batch monitoring through clustering analysis can avoid the need to analyze each IoT terminal individually in the case of a large number of IoT terminals, thereby reducing the computational overhead. At the same time, there is no need for physical isolation, reducing costs.

[0031] 2. Only use a complex encryption algorithm (i.e., the second encryption method) in abnormal situations, avoiding the use of a complex encryption algorithm throughout the process, and reducing the computational burden on IoT terminals.

[0032] 3. By combining methods such as avoiding network congestion, reconfirming abnormal IoT terminals, and using two-dimensional data for joint clustering, the false positive rate is reduced, making the scenario more widely applicable. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a schematic diagram of the control method of the module applied to the Internet of Things. DETAILED DESCRIPTION OF THE INVENTION

[0034] As Figure 1As shown, the present invention provides a module applied to the Internet of Things and its control method. The Internet of Things includes a module and multiple Internet of Things terminals, and the multiple Internet of Things terminals communicate with the module. Since the MITM attack between the Internet of Things terminals and the module more commonly occurs in the wireless connection mode, preferably, the multiple Internet of Things terminals communicate directly with the module in a wireless manner. The module of the present invention includes but is not limited to a gateway module for implementing gateway functions, a communication module for implementing communication management, a control module for implementing communication control, etc. The module of the present invention may also include other functions in addition to the functions described above and below. The modules for implementing various functions may be integrated into the module of the present invention. The module of the present invention may form a device alone or be embedded in other devices.

[0035] The module includes a grouping module. Among them, the module is configured to execute step S1: The grouping module divides the multiple Internet of Things terminals into multiple large groups according to the heartbeat signal period requirements of the multiple Internet of Things terminals connected to the module. The heartbeat signal period requirements of the Internet of Things terminals within each large group are the same. Or, the heartbeat signal period requirements of the Internet of Things terminals within each large group are similar, that is, the ratio of the upper limit of the heartbeat signal period requirement to the lower limit of the heartbeat signal period requirement of the Internet of Things terminals within each large group is less than a first threshold. Specifically, the heartbeat signal period requirements of different Internet of Things terminals may be the same or different, and the heartbeat signal period requirement may be 10s, 11s, 30s, etc. The grouping module divides the Internet of Things terminals with heartbeat signal period requirements of 10s, 11s, and 30s into different large groups respectively. Or, according to the value of the first threshold (here, if the value of the first threshold is 1.15), the Internet of Things terminals with heartbeat signal period requirements of 1s and 1.1s are divided into one large group, and the Internet of Things terminals with heartbeat signal period requirements of 5s are divided into another large group. The value of the first threshold can be flexibly adjusted according to actual needs.

[0036] The module further includes a communication module. Among them, the module is further configured to execute step S2: For each large group, the communication module sends a first heartbeat signal encrypted by a first encryption method to all the Internet of Things terminals in the large group and receives a corresponding first heartbeat confirmation signal. Specifically, the first encryption method is non-encryption, or the first encryption method may adopt a mature encryption algorithm in the prior art, but it should adapt to the computing power of the Internet of Things terminals. It can be understood that the specific content of the heartbeat signal is determined according to the actual communication requirements of different Internet of Things terminals. The heartbeat signal contents of different Internet of Things terminals are obviously different. The present invention does not limit the specific content of the heartbeat signal, but limits whether the heartbeat signal is encrypted or the encryption method. When the communication module sends the first heartbeat signal to all the Internet of Things terminals in the large group, the first heartbeat signal should be sent to the Internet of Things terminals in the same large group simultaneously (or as simultaneously as possible, such as successively). The first heartbeat confirmation signal is the heartbeat confirmation signal feedback by the Internet of Things terminal after receiving the first heartbeat signal.

[0037] To avoid network congestion, the module can stagger the sending of the first heartbeat signals for different large groups. Further, since the heartbeat signal periods of IoT terminals are grouped, the sending time of the first heartbeat signals for different large groups can be further adjusted according to the expected reception times of the first heartbeat confirmation signals for different large groups, so as to stagger the sending of the first heartbeat signals and the reception of the first heartbeat confirmation signals in time, further avoiding network congestion.

[0038] Further, the module is also configured to execute step S3: The grouping module divides the multiple IoT terminals within the same large group into multiple small groups for each large group according to the delay of the first heartbeat signal of each IoT terminal in step S2, and the delay of the first heartbeat signals of the IoT terminals within each small group is the same. Or, the delay of the first heartbeat signals of the IoT terminals within each small group is similar, that is, the ratio of the upper limit of the delay of the first heartbeat signal to the lower limit of the delay of the first heartbeat signal of the IoT terminals within each small group is less than a second threshold. Specifically, the delay of the first heartbeat signal of each IoT terminal is the time difference between the module receiving the first heartbeat confirmation signal of the IoT terminal and sending the first heartbeat signal to the IoT terminal. Similarly, the value of the second threshold can be flexibly adjusted according to actual requirements.

[0039] Specifically, in step S3, each large group is further divided into multiple small groups, that is, the first large group has multiple small groups, the second large group also has multiple small groups, and so on. The heartbeat signal period requirements of the Internet of Things terminals within each large group are the same or similar, while the heartbeat signal period requirements of the Internet of Things terminals between different large groups are different. The first heartbeat signal delay requirements of the Internet of Things terminals within the same small group of the same large group are the same or similar, while the first heartbeat signal delays of the Internet of Things terminals between different small groups of the same large group are different. Since the heartbeat signal is relatively short and uniform (i.e., the content format is unified and the processing method is unified), not much computational consumption is required in the process of the Internet of Things terminal receiving the first heartbeat signal and feedbacking the first heartbeat confirmation signal. Therefore, under normal circumstances, the time consumed by the Internet of Things terminal itself to process the first heartbeat signal and feedback the first heartbeat confirmation signal is relatively fixed. At the same time, for the Internet of Things terminals in the same large group, the time when the module sends the first heartbeat signal is basically the same, and the computing performance of the module is relatively strong, and the time to process the first heartbeat confirmation signal is also relatively fixed. Therefore, in the case of avoiding network congestion, the first heartbeat signal delay is mainly affected by the signal interference caused by environmental factors. Since the Internet of Things terminals are in different regions and different environments, and the positions of the Internet of Things terminals are relatively fixed, the first heartbeat signal delays of different Internet of Things terminals may be different, but the first heartbeat signal delay of the same Internet of Things terminal will not change significantly under normal circumstances. If the first heartbeat signal delay changes due to environmental factors, multiple Internet of Things terminals in the same region may change in the same trend. By classifying multiple Internet of Things terminals into different small groups according to the first heartbeat signal delay, it is possible to exclude the influence of environmental factors on the heartbeat signal delay with a high probability within the same small group, which becomes the analysis basis for the next step S4.

[0040] Furthermore, the module further includes an analysis module. Among them, the module is further configured to execute step S4: for each large group that meets the heartbeat signal period requirements, the communication module sends a second heartbeat signal encrypted by the first encryption method to all Internet of Things terminals in each small group within the large group, and receives the corresponding second heartbeat confirmation signal; for each large group, the analysis module clusters the second heartbeat signal delays of each Internet of Things terminal in each small group to determine whether there are abnormal Internet of Things terminals. If so, jump to step S5; if not, repeat step S4. Similarly, the second heartbeat confirmation signal is the heartbeat confirmation signal feedbacked by the Internet of Things terminal after receiving the second heartbeat signal. The second heartbeat signal delay of each Internet of Things terminal is the time difference between the module receiving the second heartbeat confirmation signal of the Internet of Things terminal and sending the second heartbeat signal to the Internet of Things terminal. Optionally, when clustering, it is based on small groups, that is, each small group is analyzed separately by clustering, and then this clustering analysis operation is performed on all small groups of this large group. Or, it can also be based on large groups, that is, clustering analysis is performed on all small groups under a large group.

[0041] When the communication module sends the second heartbeat signal to all the IoT terminals in each subgroup within a large group, it should send the second heartbeat signal to the IoT terminals in the same subgroup within the same large group simultaneously (or as close to simultaneously as possible, such as in sequence) in the order of subgroup first and then large group. For example, first send the second heartbeat signal to the IoT terminals in the first subgroup of the first large group, then send the second heartbeat signal to the IoT terminals in the second subgroup of the first large group, …… After sending in the first large group is completed, then send the second heartbeat signal to the IoT terminals in the first subgroup of the second large group, then send the second heartbeat signal to the IoT terminals in the second subgroup of the second large group, …… And so on.

[0042] It should be noted that step S4 is not executed immediately after step S3. Since the heartbeat signal cycle requirements within each large group are the same or similar, for the IoT terminals within each large group, after sending the first heartbeat signal, the second heartbeat signal should be sent after an interval equal to the heartbeat signal cycle requirement of that large group. Also, during the repeated execution of step S4, after sending the second heartbeat signal, the second heartbeat signal should be sent again after an interval equal to the heartbeat signal cycle requirement of that large group. That is, each time step S4 is executed, it is not necessary to send the second heartbeat signal to all the IoT terminals. Instead, according to the heartbeat signal cycle requirements of different large groups, the second heartbeat signal is sent to the IoT terminals in the large groups that need to send the second heartbeat signal, and the subsequent steps “receive the corresponding second heartbeat confirmation signal; for each large group, the analysis module clusters the second heartbeat signal delays of each IoT terminal in each subgroup to determine whether there are abnormal IoT terminals” are executed.

[0043] For example, if there are two large groups, the heartbeat signal cycle requirement of the first large group is 2s, and the heartbeat signal cycle requirement of the second large group is 3s. Then at the 0s, steps S2 - S3 are executed; at the 2s, step S4 is executed for the first large group (at this time, the first large group meets its heartbeat signal cycle requirement); at the 3s, step S4 is executed for the second large group (at this time, the second large group meets its heartbeat signal cycle requirement); at the 4s, step S4 is executed for the first large group (at this time, the first large group meets its heartbeat signal cycle requirement); at the 6s, step S4 is executed for the first and second large groups (at this time, both the first and second large groups meet their heartbeat signal cycle requirements) …… And so on. Of course, this example does not consider the situation of avoiding network congestion mentioned above. If considered, the first heartbeat signal can be sent to the first large group at 0s, the first heartbeat signal to the second large group at 0.5s, the second heartbeat signal to the first large group at 2s, the second heartbeat signal to the second large group at 3.5s …… And so on.

[0044] It should be emphasized that the first heartbeat signal in step S2, the second heartbeat signal in step S4, and the third heartbeat signal that will appear later of the same Internet of Things terminal may be different in content, in the case where the heartbeat signal carries timestamp data; however, they may also be the same, such as in the case where the heartbeat signal does not carry timestamp data. But as mentioned above, the present invention does not limit the specific content of the heartbeat signal. The terms "first heartbeat signal" / "second heartbeat signal" are used herein to refer to the heartbeat signals in steps S2 / S4 that have the same encryption method and are distinguished from the encryption method of the "third heartbeat signal" that will appear later.

[0045] The analysis module clusters the second heartbeat signal delays of all Internet of Things terminals in each group to determine whether there are abnormal Internet of Things terminals with abnormal second heartbeat signal delays. Specifically, the analysis module takes each group as a unit and performs a clustering analysis on the second heartbeat signal delays of all Internet of Things terminals in that group to determine whether there are abnormal second heartbeat signal delays (i.e., outlier second heartbeat signal delays), and marks the Internet of Things terminals corresponding to the abnormal second heartbeat signal delays as abnormal Internet of Things terminals. The existing commonly used clustering analysis methods in the prior art can be used to cluster the second heartbeat signal delays, and the abnormal second heartbeat signal delays are judged according to the third threshold. The value of the third threshold can be flexibly adjusted according to actual needs. By way of example, the DBSCAN clustering algorithm can be used to perform a clustering analysis on the second heartbeat signal delays of all Internet of Things terminals in the group. The second heartbeat signal delay corresponding to the outlier is the abnormal second heartbeat signal delay. At this time, the neighborhood radius parameter of DBSCAN is the third threshold, and the minimum number of samples of DBSCAN is adjusted according to the actual number of Internet of Things terminals in that group according to requirements. Alternatively, the Mean Shift clustering algorithm can be used to perform a clustering analysis on the second heartbeat signal delays of all Internet of Things terminals in the group. The second heartbeat signal delay that exceeds the third threshold distance from the clustering center is the abnormal second heartbeat signal delay. According to the different clustering analyses adopted, its third threshold and the specific parameters of the clustering analysis used should also be flexibly adjusted according to actual needs. The choice of the clustering analysis algorithm should adapt to the computing power of the module.

[0046] Similar to the analysis of the first heartbeat signal delay above, the second heartbeat signal delay is mainly affected by three factors: the time taken for the IoT terminal to process the second heartbeat signal and feedback the second heartbeat confirmation signal; the time taken for the module to send the second heartbeat signal and process the second heartbeat confirmation signal; and environmental factors. The relatively short and uniform characteristics of the heartbeat signal enable the IoT terminal to quickly process the heartbeat signal, avoid network congestion using the method described above, and through the grouping method of the group, to a certain extent, avoid the influence of the above three factors. Therefore, under normal circumstances, there will be no outliers in the second heartbeat signal delay of the same group after clustering, so that the system can continuously loop in step S4. Even if the environmental factors in a certain area change, resulting in changes in the second heartbeat signal delay, there may be many IoT terminals in the same group that are also affected by the change in environmental factors. The second heartbeat signal delays of these IoT terminals will independently form a new group, thus avoiding the generation of outliers under normal circumstances. Therefore, this situation should also be considered when selecting the specific method of clustering analysis, so as to reduce the misjudgment rate.

[0047] However, if outliers still appear, that is, abnormal second heartbeat signal delays occur, it indicates that the time taken for the corresponding IoT terminal to process the second heartbeat signal and feedback the second heartbeat confirmation signal has changed, or the environment of the IoT terminal has changed relative to other IoT terminals in the same group. This all indicates that there may be a risk of being attacked by MITM. Therefore, the IoT terminal corresponding to the abnormal second heartbeat signal delay is marked as an abnormal IoT terminal.

[0048] The module further includes a reminder module. Among them, the module is further configured to execute step S5: the reminder module reminds the staff to check the abnormal IoT terminals judged by the analysis module.

[0049] It can be seen that the relatively short and relatively uniform characteristics of the heartbeat signal are the analysis basis of step S4. For other communication signals of the IoT terminal, due to their different signal lengths and computational processing overheads, resulting in different signal delays, it is impossible to continue using the method of step S4 for analysis. Therefore, the present invention is specifically for heartbeat signals.

[0050] However, there is a possibility that the abnormal IoT terminals in step S4 may be misjudged. To further reduce the misjudgment rate, a secondary confirmation of the abnormal IoT terminals is carried out. Step S5 can be replaced with: The communication module sends a third heartbeat signal encrypted by the second encryption method to the abnormal IoT terminals judged by the analysis module, and determines whether the corresponding third heartbeat confirmation signal is abnormal. If so, the reminder module reminds the staff to check the abnormal IoT terminals. If not, the abnormal IoT terminals are marked as normal IoT terminals (or the marks of the abnormal IoT terminals are cancelled) and step S4 is executed by jumping. The third heartbeat confirmation signal (if any) is the heartbeat confirmation signal fed back by the IoT terminal after receiving the third heartbeat signal.

[0051] Specifically, the second encryption method is different from the first encryption method. The second encryption method can adopt a mature encryption algorithm in the prior art, but it should adapt to the computing power of the IoT terminal. If the first encryption method is non-encryption, the second encryption method is encryption. Or, the encryption algorithms of the second encryption method and the first encryption method are the same, but the key of the second encryption method is longer than the key of the first encryption method. Or, the encryption algorithms of the second encryption method and the first encryption method are different, and the encryption algorithm of the second encryption method is more complex than the encryption algorithm of the first encryption method. For example, the first encryption method adopts the ECC encryption algorithm, and the second encryption method adopts the RSA encryption algorithm. When the IoT terminal decrypts the heartbeat signals encrypted by the second encryption method and the first encryption method and encrypts the heartbeat confirmation signal, different computing time consumptions should be reflected. For example, the computing time consumption of the decryption algorithm of the second encryption method by the IoT terminal is longer than the computing time consumption of the decryption algorithm of the first encryption method.

[0052] Specifically, each IoT terminal is preset with encryption and decryption methods (including encryption and decryption algorithms, preset keys, etc.) corresponding to the first encryption method and the second encryption method. When the IoT terminal receives the heartbeat signal, it first decrypts the heartbeat signal by using the corresponding decryption algorithm of the first encryption method, and encrypts and sends the heartbeat confirmation signal to the module by using the corresponding encryption algorithm of the first encryption method. If the heartbeat signal cannot be decrypted by using the corresponding decryption algorithm of the first encryption method, the heartbeat signal is decrypted by using the corresponding decryption algorithm of the second encryption method, and the heartbeat confirmation signal is encrypted and sent to the module by using the corresponding encryption algorithm of the second encryption method.

[0053] Similarly, the module is also preset with encryption and decryption algorithms corresponding to the first encryption method and the second encryption method. The module can decrypt the received heartbeat confirmation signal and determine whether the encryption algorithm used is the one corresponding to the first encryption method or the second encryption method.

[0054] The communication module sends a third heartbeat signal encrypted by the second encryption method to the abnormal IoT terminal determined by the analysis module. If the communication module does not receive the third heartbeat confirmation signal, it determines that the corresponding third heartbeat confirmation signal is abnormal; and / or if the encryption algorithm of the third heartbeat confirmation signal received by the communication module does not correspond to the second encryption method (for example, the third heartbeat confirmation signal is still encrypted using the corresponding encryption algorithm of the first encryption method, or the third heartbeat confirmation signal is not encrypted), it determines that the corresponding third heartbeat confirmation signal is abnormal; and / or if the delay of the third heartbeat signal of the IoT terminal exceeds the fourth threshold, it determines that the corresponding third heartbeat confirmation signal is abnormal, where the delay of each third heartbeat signal of the IoT terminal is the time difference between the module receiving the third heartbeat confirmation signal of the IoT terminal and sending the third heartbeat signal to the IoT terminal, and the value of the fourth threshold can be flexibly adjusted according to actual needs.

[0055] Using the second encryption method different from the first encryption method can, to a certain extent, identify whether the IoT terminal has been attacked by MITM. Because if the IoT terminal has been successfully attacked by MITM, it indicates that the first encryption method has probably been cracked by the MITM attack. At this time, switching to the second encryption method that has not appeared before to encrypt the heartbeat signal can prevent the MITM attacker from immediately cracking the second encryption method that has not appeared before, so that the module can determine whether the corresponding third heartbeat confirmation signal is abnormal to determine whether the abnormal IoT terminal is misjudged, thereby reducing the misjudgment rate.

[0056] Preferably, after determining that the corresponding third heartbeat confirmation signal is abnormal, or after the staff checks the abnormal IoT terminal and determines that it has been attacked by MITM, the global first encryption method and the second encryption method can be updated, such as updating the key or the encryption algorithm. After that, the execution can start from step S1 again, or continue to execute the loop of step S4. At the same time, the global first encryption method and the second encryption method should also be updated every certain period of time.

[0057] It can be understood that there may still be misjudgments in the module of the present invention and its control method in the case of failures or disconnections of IoT terminals. However, there are mature mechanisms and corresponding control methods in the prior art to monitor and handle the failures or disconnections of IoT terminals, and they can be combined with the module of the present invention and its control method according to actual needs. The present invention is more applicable to scenarios with a longer heartbeat signal period and a larger number of IoT terminals. At the same time, the module of the present invention and its control method cannot identify a MITM attack when the IoT terminal has been attacked by MITM when sending the first heartbeat signal, but this situation belongs to an extreme case and is not considered by the present invention for the time being. At the same time, if a new IoT terminal is connected to the module during the loop of step S4, the new IoT terminal can be added to the existing large group / small group or a new large group / small group can be created by referring to the process of steps S1-S3 similarly.

[0058] Further, "the analysis module clusters the second heartbeat signal delays of each IoT terminal in each group" in step S4 can also be replaced by "the analysis module performs joint clustering on the second heartbeat signal delays and the signal strengths of the second heartbeat confirmation signals of each IoT terminal in each group". Specifically, the second heartbeat signal delays and the signal strengths of the second heartbeat confirmation signals of the IoT terminals are used as two-dimensional data, and clustering analysis is performed on this two-dimensional data. The specific method of clustering analysis can refer to the above text and will not be elaborated here. Since the second heartbeat signal delays and the signal strengths of the second heartbeat confirmation signals are related under normal circumstances, the outliers after clustering analysis indicate that there are abnormal situations for the IoT terminals corresponding to them. Therefore, the IoT terminals corresponding to the outliers can be marked as abnormal IoT terminals. Through this clustering method, it can better adapt to the situation where the IoT terminals are moving and can further reduce the misjudgment rate.

Claims

1. A module applied to the Internet of Things, characterized in that, Including: a grouping module, a communication module, an analysis module, and a reminder module; wherein, the module is configured to perform the following steps: S1. The grouping module divides multiple Internet of Things terminals connected to the module into multiple large groups according to the heartbeat signal cycle requirements of the multiple Internet of Things terminals, and the heartbeat signal cycle requirements of the Internet of Things terminals within each large group are similar; S2. For each large group, the communication module sends a first heartbeat signal encrypted by a first encryption method to all Internet of Things terminals in the large group and receives the corresponding first heartbeat confirmation signal; S3. The grouping module divides the multiple Internet of Things terminals in each large group into multiple small groups under the large group according to the delay of the first heartbeat signal of each Internet of Things terminal, and the delay of the first heartbeat signal of the Internet of Things terminals within each small group is similar; S4. For each large group that meets the heartbeat signal cycle requirements, the communication module sends a second heartbeat signal encrypted by the first encryption method to all Internet of Things terminals in each small group of the large group and receives the corresponding second heartbeat confirmation signal; the analysis module performs clustering on the delays of the second heartbeat signals of all Internet of Things terminals in each small group in turn to determine whether there are abnormal Internet of Things terminals. If so, jump to step S5; if not, repeat step S4; wherein, the delay of the second heartbeat signal exceeding the third threshold distance from the clustering center is an abnormal second heartbeat signal delay, and the Internet of Things terminal corresponding to the abnormal second heartbeat signal delay is determined as an abnormal Internet of Things terminal; S5. The communication module sends a third heartbeat signal encrypted by a second encryption method to the abnormal Internet of Things terminals determined by the analysis module, and determines whether the corresponding third heartbeat confirmation signal is abnormal. If so, the reminder module reminds the staff to check the abnormal Internet of Things terminals. If not, cancel the abnormal mark of the abnormal Internet of Things terminals and jump to execute step S4; wherein, the time-consuming of the Internet of Things terminal to calculate the decryption algorithm of the second encryption method is longer than the time-consuming of calculating the decryption algorithm of the first encryption method.

2. The module according to claim 1, wherein in step S1, the ratio of the upper limit of the heartbeat signal cycle requirement to the lower limit of the heartbeat signal cycle requirement of the Internet of Things terminals within each large group is less than a first threshold.

3. The module according to claim 1, wherein in step S2, the module sends the first heartbeat signal to the Internet of Things terminals within the same large group simultaneously and sends the first heartbeat signal to the Internet of Things terminals between different large groups staggeredly.

4. The module according to claim 1, wherein in step S3, the ratio of the upper limit of the delay of the first heartbeat signal to the lower limit of the delay of the first heartbeat signal of the Internet of Things terminals within each small group is less than a second threshold.

5. The module according to claim 1, wherein in step S4, when the communication module sends the second heartbeat signal to all Internet of Things terminals in each small group of the large group, it sends the second heartbeat signal to the Internet of Things terminals within the same small group of the same large group simultaneously.

6. The module according to claim 1, wherein The Internet of Things terminal is preset with encryption and decryption methods corresponding to the first encryption method and the second encryption method; when the Internet of Things terminal receives a heartbeat signal, it first decrypts the heartbeat signal using the decryption algorithm corresponding to the first encryption method, and encrypts the heartbeat confirmation signal using the encryption algorithm corresponding to the first encryption method and sends it to the module; if the heartbeat signal cannot be decrypted using the decryption algorithm corresponding to the first encryption method, it decrypts the heartbeat signal using the decryption algorithm corresponding to the second encryption method, and encrypts the heartbeat confirmation signal using the encryption algorithm corresponding to the second encryption method and sends it to the module.

7. The module according to claim 1, wherein In step S5, after the staff checks the abnormal Internet of Things terminal and determines that it has been attacked by MITM, the first encryption method and the second encryption method are updated.

8. A control method for a module applied to the Internet of Things, characterized in that, It includes the following steps: S1, according to the heartbeat signal period requirements of multiple Internet of Things terminals connected to the module, divide the multiple Internet of Things terminals into multiple large groups, and the heartbeat signal period requirements of the Internet of Things terminals within each large group are similar; S2, for each large group, send the first heartbeat signal encrypted using the first encryption method to all the Internet of Things terminals within the large group, and receive the corresponding first heartbeat confirmation signal; S3, according to the delay of the first heartbeat signal of each Internet of Things terminal, divide the multiple Internet of Things terminals in each large group into multiple small groups under the large group, and the delay of the first heartbeat signal of the Internet of Things terminals within each small group is similar; S4, for each large group that meets the heartbeat signal period requirements, send the second heartbeat signal encrypted using the first encryption method to all the Internet of Things terminals in each small group within the large group, and receive the corresponding second heartbeat confirmation signal; Taking the small group as a unit, jointly cluster the delay of the second heartbeat signal and the signal strength of the second heartbeat confirmation signal of each Internet of Things terminal in each small group to determine whether there is an abnormal Internet of Things terminal. If so, jump to step S5; if not, repeat step S4; among them, the delay of the second heartbeat signal exceeding the third threshold distance from the clustering center is the abnormal second heartbeat signal delay, and the Internet of Things terminal corresponding to the abnormal second heartbeat signal delay is determined as the abnormal Internet of Things terminal; S5, send the third heartbeat signal encrypted using the second encryption method to the abnormal Internet of Things terminal judged by the analysis module, and judge whether the corresponding third heartbeat confirmation signal is abnormal. If so, remind the staff to check the abnormal Internet of Things terminal. If not, cancel the abnormal mark of the abnormal Internet of Things terminal and jump to execute step S4; among them, the time-consuming of the Internet of Things terminal to calculate the decryption algorithm of the second encryption method is longer than the time-consuming of calculating the decryption algorithm of the first encryption method.

Images