Safety management system based on Internet of Things intelligent terminal

Abstract

The invention relates to the technical field of network information transmission security. The invention relates to a safety management system based on an Internet of Things intelligent terminal. The system comprises a terminal establishment unit, an access management unit, a positioning analysis unit, a prediction comparison unit and a false analysis unit. The terminal establishment unit is used for establishing an intelligent terminal, establishing an information collection area through the intelligent terminal and the indoor smart home, and setting a key for the information collection area to perform dynamic identity verification; the access management unit is used for monitoring access records of the smart home; the method comprises the following steps: predicting an equipment behavior baseline based on historical operation, comparing operation similarity and deviation in real time, triggering abnormal early warning, dynamically adjusting a threshold value to reduce false alarms, improving detection accuracy, generating false data to test abnormal equipment identification capability, limiting operation by selecting false data, and removing limitation by selecting real data. Legal equipment and hostile attacks are effectively distinguished, and anti-cheating and dynamic defense capabilities are enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of network information transmission security. Specifically, it relates to a security management system based on Internet of Things (IoT) intelligent terminals. Background Art

[0002] In the context of the rapid development of IoT technology, systems such as smart home and smart office based on intelligent terminals have been widely applied in daily life and work scenarios. Traditional systems usually protect data transmission through a single encryption protocol, control device access using a fixed permission allocation mechanism, and rely on simple log records to monitor abnormal operations, meeting the basic security requirements to a certain extent.

[0003] However, only using basic encryption means, lacking differential management of data privacy levels and timeliness, results in ineffective isolation between sensitive data (user privacy) and ordinary data. It is easy to cause data theft due to encryption vulnerabilities and cannot meet the refined security requirements. Secondly, relying on a fixed network protocol to verify device identities, without combining physical location information and indoor environmental characteristics for dynamic access control, it is difficult to identify illegal access by forged locations or counterfeit devices. Especially when new devices are connected, there is a lack of a flexible risk control mechanism, which may lead to malicious devices bypassing verification and invading the system. To reduce this situation, a security management system based on IoT intelligent terminals is proposed. Summary of the Invention

[0004] The purpose of the present invention is to provide a security management system based on IoT intelligent terminals to solve the problems raised in the above background art.

[0005] To achieve the above purpose, a security management system based on IoT intelligent terminals is provided, including a terminal establishment unit, an access management unit, a location analysis unit, a prediction comparison unit, and a false analysis unit; The terminal establishment unit is used to establish intelligent terminals, establish an information collection area with indoor smart homes through the intelligent terminals, and set keys for dynamic identity verification for the information collection area; The access management unit is used to monitor the access records of smart homes, save blacklisted devices according to the access records, and classify the home data collected by the home into security data and ordinary data; The location analysis unit is used to determine the indoor location range according to the home data, collect location data of the devices that have passed the identity verification, and perform device location identification by combining the location data with the indoor location range and the blacklist, and display ordinary data according to the identification results; The prediction and comparison unit is used to record the historical operation records of each passing device, predict operations based on the combination of historical operation records and real-time periods, compare real-time operations with predicted operations, and send abnormal signals to the false analysis unit according to the comparison results; The false analysis unit is used to receive the abnormal signals sent by the prediction and comparison unit, generate false data according to the historical operation records of the device, send the false data to the device for real analysis, and perform security control on the intelligent terminal according to the analysis results.

[0006] As a further improvement of this technical solution, the terminal establishment unit separately establishes an intelligent terminal indoors through the physical network. At the same time, the intelligent terminal establishes a connection with the smart home during establishment and has the control authority over the smart home.

[0007] As a further improvement of this technical solution, the terminal establishment unit includes a data collection module and a key setting module; The data collection module is used to control the smart home to send the generated home data to the intelligent terminal. At the same time, an information collection area is established in the intelligent terminal, and the home data is received through the information collection area and encrypted and saved. The key setting module is used to set a key for the information collection area by the indoor administrator, perform identity verification according to the key, and enter the intelligent terminal through the identity verification.

[0008] As a further improvement of this technical solution, when setting the key, the key setting module can set multiple keys and single keys; For a single key, all home data and all smart home management can be viewed after passing; For multiple keys, each key corresponds to different permissions, and each permission corresponds to the home data and smart home management that can be viewed.

[0009] As a further improvement of this technical solution, the access management unit includes a record monitoring module and a data classification module; The record monitoring module is used to keep the access function of the smart home open, but data collection and home control cannot be performed. At the same time, the access records of the smart home are monitored, the access records of the smart home are obtained, and then all devices included in the access records are included in the blacklist; The access record includes the device model; The data classification module is used to perform security privacy and timeliness analysis on the home data in the information collection area. According to the analysis results, the home data within the timeliness and involving security privacy are regarded as security data, and the home data other than the security data are regarded as ordinary data.

[0010] As a further improvement of the technical solution, the positioning and analysis unit includes a range determination module and a data display module; The range determination module is used to extract the location data and image data of each smart home according to the home data, and then analyze the indoor location range based on the location data combined with the image data to obtain the indoor location range managed by the smart terminal; The data display module is used to collect location data from devices authenticated by the key, obtain the location data of the device, and then analyze the location data combined with the indoor location range and the blacklist. The analysis steps are as follows: S1. When the location data is within the indoor location range, perform virtual location detection according to the extracted image data of the smart home. When the detection result shows virtual location, add the device to the blacklist. Conversely, when the detection result does not show virtual location, compare the device with the blacklist. When the device is in the blacklist, reject access to the smart terminal. Conversely, when the device is not in the blacklist, display ordinary data to the device; S2. When the location data is not within the indoor location range, compare the device with the blacklist. When the device is in the blacklist, reject access to the smart terminal. Conversely, when the device is not in the blacklist, display ordinary data to the device.

[0011] As a further improvement of the technical solution, when the data display module displays ordinary data to the device, when the device is a new device, it is judged and accessed by the administrator. When the administrator continuously rejects access, the key is automatically updated.

[0012] As a further improvement of the technical solution, the prediction and comparison unit includes an operation prediction module and an operation comparison module; The operation prediction module is used to record the historical operation records of each device passing the verification, combine the historical operation records with the real-time period for operation prediction, and obtain the predicted operation of the device connecting to the smart terminal in the real-time period; The operation comparison module is used to monitor the real-time operation of the device on the smart terminal, and at the same time set a similarity threshold. Compare the real-time operation with the predicted operation combined with the similarity threshold. When the similarity between the real-time operation and the predicted operation reaches the similarity threshold, display both the security data and the ordinary data to the device and lift the restriction on the device. Conversely, when the similarity between the real-time operation and the predicted operation does not reach the similarity threshold, send an abnormal signal to the false analysis unit.

[0013] As a further improvement of the technical solution, the false analysis unit includes a false generation module and a real comparison module; The false data generation module is used to receive the abnormal signal sent by the operation comparison module, then select data according to the historical operation records of the device, and then generate false data based on the selected data; The selected data is real data; The real data comparison module is used to combine the false data and the real data and send them to the device for real selection analysis. When the device selects the false data, the operation of the device on the intelligent terminal is restricted, so that it cannot continue to view data. On the contrary, when the device selects the real data, the restriction on the device is lifted, and all functions of the intelligent terminal are opened to it.

[0014] As a further improvement of this technical solution, the terminal establishment unit further includes a dynamic key module; The dynamic key module is used to record the models of the devices that have opened all functions of the intelligent terminal in history. Then, when device restrictions occur during the security management process, the key is automatically updated. However, the key for the devices with recorded models remains fixed, and the updated key is used to verify new devices; When the device enters the intelligent terminal, the device model is collected, and then the collected device model is identified, and the key verification result is set according to the identification result.

[0015] Compared with the prior art, the beneficial effects of the present invention are: 1. In this security management system based on the Internet of Things intelligent terminal, by predicting the device behavior baseline based on historical operations, comparing the operation similarity in real time, triggering an abnormal warning when deviating, dynamically adjusting the threshold to reduce false alarms, improving the detection accuracy. At the same time, false data is generated to test the abnormal device recognition ability. Selecting false data restricts the operation, and selecting real data lifts the restriction, effectively distinguishing legal devices from malicious attacks, and enhancing the anti-deception and dynamic defense capabilities.

[0016] 2. In this security management system based on the Internet of Things intelligent terminal, by combining location data and images to construct an indoor space model, accurately demarcating the management area, indoor devices are detected and prevented from being forged through virtual positioning, outdoor devices are matched with the blacklist to prevent illegal access. At the same time, new devices require administrator approval, and the key is automatically updated if consecutive rejections occur, preventing malicious attempts to invade.

[0017] 3. In this security management system based on the Internet of Things intelligent terminal, by monitoring access records to identify abnormal behaviors and blacklisting risky devices, dividing security data and ordinary data according to security privacy and timeliness, balancing security and utilization efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is the overall structure schematic diagram of the present invention.

[0019] The meanings of the reference numerals in the figure are as follows: 10. Terminal establishment unit; 20. Access management unit; 30. Location analysis unit; 40. Prediction comparison unit; 50. False analysis unit. Specific implementation manner

[0020] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0021] Please refer to Figure 1 As shown, the purpose of this embodiment is to provide a security management system based on an Internet of Things intelligent terminal, including a terminal establishment unit 10, an access management unit 20, a location analysis unit 30, a prediction comparison unit 40, and a false analysis unit 50; The terminal establishment unit 10 is used to establish an intelligent terminal, establish an information collection area with the indoor smart home through the intelligent terminal, and set a key for dynamic identity verification for the information collection area; The terminal establishment unit 10 separately establishes an intelligent terminal indoors through the physical network. The intelligent terminal is provided for personnel to use and view in the form of software. At the same time, when the intelligent terminal is established, it establishes a connection with the smart home and has control authority over the smart home.

[0022] Using a gateway device as an intermediary, connect the physical network device to a control system (such as a cloud server or a local area network). Each intelligent device sends data to the intelligent terminal through protocols such as Wi-Fi, Zigbee, and Bluetooth; On the intelligent terminal, develop an application program or use an existing software platform to create a user interface and a control interface. Through this interface, the user can view, control, and manage the devices connected to the smart home system. At the same time, the smart home devices are connected to the intelligent terminal through the network, and the intelligent terminal can control these devices according to the received instructions; The communication protocol (such as MQTT, CoAP, RESTful API, etc.) between the intelligent device and the intelligent terminal ensures the data transmission and control instruction transfer between the device and the platform.

[0023] The terminal establishment unit 10 includes a data collection module and a key setting module; The data collection module is used to control the smart home to send the generated home data to the intelligent terminal. At the same time, an information collection area is established on the intelligent terminal, and the home data is received through the information collection area and encrypted and saved. The specific steps are as follows: Intelligent Terminal Information Collection Area Setting: Set an information collection area on the intelligent terminal. This area is responsible for receiving all data sent by the smart home. After the data is received, it will be encrypted to ensure information security; Data Encryption and Storage: The received home data is encrypted and stored through an encryption method. Symmetric encryption or asymmetric encryption can be used for encryption; The key setting module is used to set a key for the information collection area by the indoor administrator. Authentication is performed based on the key, and access to the intelligent terminal can be granted after successful authentication.

[0024] When entering the intelligent terminal, the user needs to enter the key for authentication. Based on the verification result, the system will determine which home data the user can view or manage according to the set key permissions. After successful authentication, the user enters the intelligent terminal, and according to their permissions, the system will display the home data and management functions that they can access.

[0025] When setting the key, the key setting module can set multiple keys and a single key; For a single key, if passed, all home data and all smart home management can be viewed; Set a unified key, and any verified administrator can use this key to view all home data and manage all smart homes; For multiple keys, each key corresponds to different permissions, and each permission corresponds to the home data and smart home management that can be viewed.

[0026] Set multiple keys, each with different permissions. Each key corresponds to a certain user group (such as administrators, ordinary users, maintenance personnel, etc.), and the scope of smart home data and functions that they can view or manage are specified.

[0027] The access management unit 20 is used to monitor the access records of the smart home, save blacklisted devices based on the access records, and classify the home data collected by the home into security data and ordinary data; The access management unit 20 includes a record monitoring module and a data classification module; The record monitoring module is used to keep the access function of the smart home open (the software equipped with the smart home itself), but it cannot perform data collection and home control. At the same time, it monitors the access records of the smart home, obtains the access records of the smart home, and then includes all the devices contained in the access records in the blacklist; The access record includes the device model. The specific steps are as follows: Monitoring the access records of the smart home: All behaviors of accessing the smart home will be recorded, and the recorded information includes the visitor's identity, access time, accessed device model, etc. The recorded access information includes but is not limited to the following: Device model: Identifies the device type; Access time: Records the access timestamp; Visitor identity: Identifies who accessed the device; Operation type: Records operations for viewing status or making controls; Record storage and access control: Records access records through an intermediate server or database, and implements real-time monitoring to record every access; Access record analysis and blacklist management: Based on the device model in the access record, generates an access log and analyzes anomalies. If the access frequency of a certain device is abnormal, or the visitor makes too many control attempts on the device (even if the control is not successful), it is considered that there is a potential security problem with the device, and it is added to the blacklist, or the device repeatedly enters passwords for verification in the smart home equipped software.

[0028] The data classification module is used to perform security privacy and timeliness analysis on home data in the information collection area. According to the analysis results, home data within the timeliness and involving security privacy are regarded as security data, and home data other than security data are regarded as ordinary data. The specific steps are as follows; Security privacy analysis: Performs security privacy analysis on the data to determine which data involves user privacy or security-sensitive information. Analyzes through privacy information identification (detects whether it contains the user's personal information, such as name, address, ID number, etc.) and sensitive information identification (judges whether it contains control information of smart home devices or other sensitive data affecting security, such as control commands, device switches, etc.); Timeliness analysis: Analyzes the timeliness of the data to determine whether the data meets the real-time requirements. For example, compares the generation timestamp of the data with the current time. If the data generation time is within the set timeliness range (such as 5 hours, 10 hours, etc.), the data is regarded as "within timeliness"; Data classification: Data that is within timeliness (data that meets the timeliness requirements) and involves security privacy (data that contains user privacy or other security-sensitive information) is marked as security data; other data that does not meet the above conditions is marked as ordinary data.

[0029] The positioning analysis unit 30 is used to determine the indoor location range based on home data, collect location data of the authenticated devices, and combine the location data with the indoor location range and the blacklist for device positioning identification, and display ordinary data according to the identification results; The positioning analysis unit 30 includes a range determination module and a data display module; The range determination module is used to extract the location data and image data of each smart home based on the home data, and then analyze the indoor location range based on the location data combined with the image data to obtain the indoor location range managed by the smart terminal. The specific steps are as follows: Data collection: Obtain real-time location data of the home from sensors (such as GPS, Bluetooth, Wi-Fi, etc.), and collect indoor image data through cameras or other image capture devices. These image data can help identify the indoor environment and be combined with location data for analysis; Association of location and image data: Associating location data with image data. For example, if you use a camera to take an image of a certain location, obtain the coordinate values ​​corresponding to the image area, match these data, divide the image data by area, mark the location of the home, and analyze the spatial layout of the home; Indoor location range analysis: The geometric model of the indoor space is constructed through location data to analyze the spatial range of each home. The environmental information extracted from the image data (such as the boundaries of walls, doors and windows) is used to define the indoor range. The results of image recognition can be used to calculate the spatial occupancy range of each home, and then derive the coverage area managed by the smart terminal. The formula is as follows: ; Where R is the spatial range, n is the number of homes, P (x i ,y i ) is the location of the i-th home; ; Among them, A i is the occupied area of ​​the home, f is a function to calculate the occupied area, taking into account the actual size of the home and obstacles in the environment, Q is the size of the home, and W is the location of the obstacle; Determination of smart terminal management area: The management area is determined based on the space occupancy and location distribution of the home. Taking into account the impact of each home on the smart terminal (such as home appliances within the control range), the management range of the smart terminal is subdivided using a combination of image recognition and location data. The formula is as follows: ; Among them, E is the management scope.

[0030] By combining home location data with image data and analyzing indoor location ranges, smart terminals can effectively manage designated areas.

[0031] The data display module is used to collect location data from devices that have passed key identity authentication, obtain the location data of the device, and then analyze the location data in combination with the indoor location range and the blacklist. The analysis steps are as follows: S1. When the location data is within the indoor location range, virtual location detection is performed based on the extracted image data of the smart home (extracting the same image data as the location data, then performing device recognition on the image data to determine whether there is a device at this location). When the detection result shows virtual location, the device is pulled into the blacklist. Conversely, when the detection result does not show virtual location, the device is compared with the blacklist. When the device is in the blacklist, access to the smart terminal is refused. Conversely, when the device is not in the blacklist, ordinary data is displayed for the device; S2. When the location data is not within the indoor location range, the device is compared with the blacklist. When the device is in the blacklist, access to the smart terminal is refused. Conversely, when the device is not in the blacklist, ordinary data is displayed for the device.

[0032] When the data display module displays ordinary data for a device, when the device is a new device, it is judged and accessed by the administrator. When the administrator continuously refuses access, the key is automatically updated.

[0033] The prediction comparison unit 40 is used to record the historical operation records of each passed device, perform operation prediction by combining the historical operation records with the real-time time period, and compare the real-time operation with the predicted operation. According to the comparison result, an abnormal signal is sent to the false analysis unit 50; The prediction comparison unit 40 includes an operation prediction module and an operation comparison module; The operation prediction module is used to record the historical operation records of each device passing the verification (including information such as the smart terminal controlled by the device, operation type, time, etc.), combine the historical operation records with the real-time time period to perform operation prediction, and obtain the predicted operation of the device connecting to the smart terminal in the real-time time period; According to the historical operation records and the active time period of the device, the expected operation of the device in the current time period is predicted through a prediction model. The formula is as follows: ; Among them, Y is the predicted operation, h is the operation prediction model (machine learning and time series), the operation type of the device is predicted according to the historical operation and the current time period, K is the historical operation record, and T is the real-time time period; The model first needs to process the historical operation records and the real-time time period to extract effective features; The historical operation records include operation sequence, operation timestamp, operation frequency, and operation interval; The real-time time period includes the current timestamp and environmental context; Machine learning: Then, taking the historical operation features as input, a classification model is trained using machine learning classification to predict the operation type. For example, input features (time period = 8 o'clock, day of the week = working day, previous operation = none), and the output prediction (operation type = turn on); Time series: Re-use time series analysis to make predictions based on the time patterns of historical operations. For example, if there is a 90% probability that the device will perform the "turn on" operation at 8 am on weekdays, then predict that the operation at the current time period (8 am on weekdays) is "turn on". Combine the above time series and machine learning results, determine the final prediction through voting or weighted averaging, and adjust the model parameters according to the actual execution results to achieve continuous optimization, identify operations that do not conform to historical patterns (such as abnormal access during non-working hours), and trigger a security review.

[0034] The operation comparison module is used to monitor the real-time operations of the device on the intelligent terminal, and at the same time set a similarity threshold, and compare the real-time operation with the predicted operation in combination with the similarity threshold. When the similarity between the real-time operation and the predicted operation reaches the similarity threshold, both the security data and the ordinary data are displayed to the device, and the restriction on the device is lifted. On the contrary, when the similarity between the real-time operation and the predicted operation does not reach the similarity threshold, an abnormal signal is sent to the false analysis unit 50. The formula is as follows: ; where, S(O Y , O S ) is the similarity of operation i, m is the number of operations, Sim is the cosine similarity, O Y，j is the jth predicted operation, and O S，j is the jth real-time operation; Compare the real-time operation with the predicted operation: Compare the similarity between the real-time operation and the predicted operation. If the similarity reaches the preset similarity threshold, the device behavior is considered normal, otherwise, it is considered that there is abnormal behavior; The number of operations and the similarity threshold can be set according to the historical operation records. The more historical operation records, the more the number of operations, and at the same time, the higher the similarity threshold.

[0035] The false analysis unit 50 is used to receive the abnormal signal sent by the prediction comparison unit 40, generate false data according to the historical operation records of the device, and send the false data to the device for real analysis, and perform security control on the intelligent terminal according to the analysis results.

[0036] The false analysis unit 50 includes a false generation module and a real comparison module; The false generation module is used to receive the abnormal signal sent by the operation comparison module, then select data according to the historical operation records of the device, and then generate false data according to the selected data; The selected data is real data; The real comparison module is used to send the combination of false data and real data to the device for real selection analysis. When the device selects false data, the operations of the device on the smart terminal are restricted, preventing it from continuing to view data. Conversely, when the device selects real data, the restrictions on the device are lifted, and all functions of the smart terminal are opened to it. The specific steps are as follows: Receive an abnormal signal: Receive an abnormal signal from the operation comparison module, indicating that there is an abnormality in the current device operation and further processing or verification is required; Obtain historical operation records: According to the received abnormal signal, the system needs to select relevant data from the historical operation records of the device. These data are usually the normal operation data of the device and can help the system determine whether the operation of the device is abnormal; Data selection and false data generation: Select relevant real data from the historical operation records of the device and generate false data based on the selected data. The generated false data is used to interfere with the normal operation of the device to test the system's processing ability for false data. The formula is as follows: ; where, V d is false data, Z is a transformation function, and R d is real data; Generate false data by changing the order of data, introducing irrelevant variables, etc.; Suppose the real data is an air conditioner set temperature value of 25°C. The transformation function may add a certain amount of noise (e.g., ±2°C) to this data. Then the generated false data may be 23°C or 27°C.

[0037] Combine false data and real data: Combine the generated false data with real data and send it to the device. The purpose of this step is to verify whether the device can distinguish false data from real data; Device selection analysis: The device performs selection analysis on the received data. If the device selects false data, it indicates that there is a problem with the device's judgment ability or it has been misled; if it selects real data, it indicates that the device can correctly identify real information; Restrict device operations: If the device selects false data, all operations of the device on the smart terminal are restricted, preventing it from continuing to view data or perform other function operations; If the device selects real data, the operation restrictions on the device are lifted, and all functions of the smart terminal are opened to it.

[0038] The terminal establishment unit 10 further includes a dynamic key module; The dynamic key module is used to record the models of devices with all functions of historical open intelligent terminals. Then, when device restrictions occur during the security management process, the key is automatically updated. However, the key remains fixed for the devices with recorded models, and the updated key is used to verify new devices. A device restriction monitoring module is set up. When device restrictions occur to a device on the intelligent terminal, the key is automatically updated. Conversely, when no device restrictions occur to a device on the intelligent terminal, continuous monitoring is maintained.

[0039] The updated key can be set in advance by the administrator. When the key is updated, the key set in advance by the administrator is used as the updated key.

[0040] When a device enters the intelligent terminal, the device model is collected, and then the collected device model is identified. The key verification result is set according to the identification result.

[0041] A whitelist library is established based on the collected device models (the identification code or device number corresponding to each device individually) (the key for the initial connection of the intelligent terminal corresponding to each device model). When each device enters the intelligent terminal, the model is collected and compared with the whitelist library. According to the comparison result, the key corresponding to the initial connection of the device model is extracted and combined with the updated key, both of which are used as the ways for the device to pass verification (there are two keys that can pass verification). However, for devices not in the whitelist library, only the updated key can be used to complete verification.

[0042] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art of this industry should understand that the present invention is not limited by the above embodiments. The above embodiments and the descriptions in the specification are only preferred examples of the present invention and are not used to limit the present invention. Without departing from the spirit and scope of the present invention, the present invention will have various changes and improvements, and these changes and improvements all fall within the scope of the present invention claimed. The scope of protection claimed by the present invention is defined by the appended claims and their equivalents.

Claims

1. A security management system based on an Internet of Things intelligent terminal, characterized in that: It includes a terminal establishment unit (10), an access management unit (20), a location analysis unit (30), a prediction comparison unit (40), and a false analysis unit (50); The terminal establishment unit (10) is used to establish an intelligent terminal, establish an information collection area with the indoor smart home through the intelligent terminal, and set a key for dynamic identity authentication for the information collection area; The access management unit (20) is used to monitor the access records of the smart home, save blacklisted devices according to the access records, and classify the home data collected by the home into security data and ordinary data; The location analysis unit (30) is used to determine the indoor location range according to the home data, collect location data of the devices that have passed the authentication, and combine the location data with the indoor location range and the blacklist for device location identification, and display ordinary data according to the identification result; The prediction comparison unit (40) is used to record the historical operation records of each passed device, predict the operation according to the combination of the historical operation records and the real-time period, compare the real-time operation with the predicted operation, and send an abnormal signal to the false analysis unit (50) according to the comparison result; The false analysis unit (50) is used to receive the abnormal signal sent by the prediction comparison unit (40), generate false data according to the historical operation records of the device, send the false data to the device for real analysis, and perform security control on the intelligent terminal according to the analysis result.

2. The security management system based on an Internet of Things intelligent terminal according to claim 1, wherein: The terminal establishment unit (10) separately establishes an intelligent terminal indoors through the physical network. At the same time, the intelligent terminal has the control authority over the smart home after establishing a connection with the smart home.

3. The security management system based on an Internet of Things intelligent terminal according to claim 1, characterized in that: The terminal establishment unit (10) includes a data collection module and a key setting module; The data collection module is used to control the smart home to send the generated home data to the intelligent terminal. At the same time, an information collection area is established in the intelligent terminal, the home data is received through the information collection area, and the received home data is encrypted and saved; The key setting module is used to set a key for the information collection area by the indoor administrator, perform identity authentication according to the key, and enter the intelligent terminal through the authentication.

4. The security management system based on an Internet of Things intelligent terminal according to claim 3, wherein: When setting the key, the key setting module can set multiple keys and single keys; For a single key, all home data and all smart home management can be viewed after passing; For multiple keys, each key corresponds to different permissions, and each permission corresponds to the home data and smart home management that can be viewed.

5. A security management system based on an Internet of Things intelligent terminal according to claim 1, characterized in that: The access management unit (20) includes a record monitoring module and a data classification module; The record monitoring module is used to keep the access function of the smart home open, but data collection and home control cannot be performed. At the same time, it monitors the access records of the smart home, obtains the access records of the smart home, and then lists all the devices included in the access records in the blacklist; The access record includes the device model; The data classification module is used to perform security privacy and timeliness analysis on home data in the information collection area. According to the analysis results, home data within the timeliness and related to security privacy are regarded as security data, and home data other than security data are regarded as ordinary data.

6. The security management system based on an Internet of Things intelligent terminal according to claim 1, wherein: The positioning analysis unit (30) includes a range determination module and a data display module; The range determination module is used to extract the location data and image data of each smart home according to the home data, and then analyze the indoor location range based on the location data combined with the image data to obtain the indoor location range managed by the smart terminal; The data display module is used to collect location data from devices authenticated by the key, obtain the location data of the device, and then analyze the location data combined with the indoor location range and the blacklist. The analysis steps are as follows: S1. When the location data is within the indoor location range, perform virtual location detection according to the extracted image data of the smart home. When the detection result shows virtual location, the device is pulled into the blacklist. On the contrary, when the detection result does not show virtual location, compare the device with the blacklist. When the device is in the blacklist, access to the smart terminal is refused. On the contrary, when the device is not in the blacklist, ordinary data is displayed to the device; S2. When the location data is not within the indoor location range, compare the device with the blacklist. When the device is in the blacklist, access to the smart terminal is refused. On the contrary, when the device is not in the blacklist, ordinary data is displayed to the device.

7. The security management system based on an Internet of Things intelligent terminal according to claim 6, wherein: When the data display module displays ordinary data to the device, when the device is a new device, it is judged and accessed by the administrator. When the administrator continuously refuses access, the key is automatically updated.

8. The security management system based on an Internet of Things intelligent terminal according to claim 1, characterized in that: The prediction comparison unit (40) includes an operation prediction module and an operation comparison module; The operation prediction module is used to record the historical operation records of each device passing the verification, combine the historical operation records with the real-time period for operation prediction, and obtain the predicted operation of the device connecting to the smart terminal in the real-time period; The operation comparison module is used to monitor the real-time operation of the device on the smart terminal, and at the same time set a similarity threshold. Compare the real-time operation with the predicted operation combined with the similarity threshold. When the similarity between the real-time operation and the predicted operation reaches the similarity threshold, both security data and ordinary data are displayed to the device, and the restriction on the device is lifted. On the contrary, when the similarity between the real-time operation and the predicted operation does not reach the similarity threshold, an abnormal signal is sent to the false analysis unit (50).

9. A security management system based on an Internet of Things intelligent terminal according to claim 1, characterized in that: The false analysis unit (50) includes a false generation module and a real comparison module; The false generation module is used to receive the abnormal signal sent by the operation comparison module, then select data according to the historical operation record of the device, and then generate false data according to the selected data; The selected data is real data; The real comparison module is used to send the combination of false data and real data to the device for real selection analysis. When the device selects false data, the operation of the device on the intelligent terminal is restricted, making it unable to continue data viewing. On the contrary, when the device selects real data, the restriction on the device is lifted, and all functions of the intelligent terminal are opened to it.

10. A security management system based on an Internet of Things intelligent terminal according to claim 1, characterized in that: The terminal establishment unit (10) further includes a dynamic key module; The dynamic key module is used to record the models of the devices that have opened all functions of the intelligent terminal in history. Then, when device restrictions occur during the security management process, the key is automatically updated. However, the key remains fixed for the devices with recorded models, and the updated key is used to verify new devices; When the device enters the intelligent terminal, the device model is collected, and then the collected device model is identified, and the key verification result is set according to the identification result.

Images