Internet of Things equipment encryption method and device and electronic equipment

Abstract

The invention relates to the technical field of Internet of Things equipment encryption, and discloses an Internet of Things equipment encryption method and device and electronic equipment, and the method comprises the steps of secret key level-to-level management, dynamic secret key updating, hierarchical encryption communication, and secret key revocation and recovery. According to the invention, a three-level architecture of the master key, the regional key and the equipment key is adopted, hierarchical isolation management of the keys is realized, and the key leakage risk is effectively reduced; a dynamic key updating mechanism can automatically identify and update expired or abnormal keys, so that the flexibility of the system is improved; equipment-level, area-level and core-level data isolation protection is realized through a layered encryption communication strategy, and cross-level attacks are prevented; by quickly identifying abnormal equipment and executing key revocation and recovery, safe operation of the system is ensured; a verification mechanism is introduced to guarantee the integrity and reliability of data transmission. The method is suitable for various scenes such as smart cities and industrial Internet of Things, and provides all-around safety guarantee for Internet of Things equipment.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things device encryption, and in particular to an Internet of Things device encryption method, device and electronic equipment. Background Art

[0002] With the rapid development of IoT technology, more and more devices are connected to the network, enabling data collection, transmission, and intelligent control. However, IoT devices are often deployed in open or uncontrollable environments, exposing them to security threats such as data leakage, tampering, forgery, and man-in-the-middle attacks. Traditional encryption methods (such as single-key systems or static key management) struggle to meet the dynamic, scalable, and security requirements of IoT scenarios. Specifically, they present the following challenges:

[0003] Insufficient key management: Once a single key system is leaked, the entire system will collapse; static keys remain unchanged for a long time and are easy to crack or abuse.

[0004] Lack of layered protection: Device, regional, and global data are not encrypted at different levels, and cross-layer data association may lead to privacy leakage or the spread of attacks.

[0005] Poor dynamic adaptability: It does not take into account device status (such as offline, low activity) or time factors (key expiration), making it difficult to update keys in a timely manner to address risks.

[0006] Delayed response to exceptions: An imperfect mechanism for revoking and recovering keys for abnormal devices (such as those that have been hacked or malfunctioned) may lead to persistent security risks.

[0007] In existing technologies, some solutions adopt multi-level key management, but do not combine dynamic updates and anomaly detection; other solutions support key rotation but lack regionalized layered encryption and global audit capabilities.

[0008] The present invention aims to solve the above problems and provide an efficient and reliable IoT device encryption method suitable for large-scale, distributed IoT application scenarios. Summary of the Invention

[0009] The purpose of the present invention is to provide an Internet of Things device encryption method, device and electronic equipment, which solve the technical problems raised in the background technology.

[0010] The purpose of the present invention can be achieved through the following technical solutions:

[0011] An IoT device encryption method includes the following steps:

[0012] Key hierarchical management: keys are divided into master key MK, regional key RK, and device key DK;

[0013] Dynamic key update: Dynamic key update based on time factor and device status,

[0014] Layered encrypted communication: Master key MK, regional key RK, and device key DK are used to encrypt communication data in layers;

[0015] Key revocation and recovery: When a device malfunctions, the use of the old key is terminated in a timely manner and a new key is generated.

[0016] As a further solution of the present invention: the master key MK is set by the core management server and stored in the hardware security module HSM. The master key MK is used to generate the regional key;

[0017] The regional key RK is derived from the master key and is used to manage the generation and update of device keys for devices within the region.

[0018] The device key DK is derived from the zone key and is used to encrypt and decrypt device data.

[0019] As a further solution of the present invention: the master key is set by manually inputting a master key value that meets the format requirements of a certain length and character type combination into the core management server.

[0020] As a further solution of the present invention, the regional key RK is generated as follows:

[0021] Step A1.1. Divide multiple device regions based on device geography or function, and assign a unique ID to each device region i , i is the serial number variable corresponding to each device area, i refers to the number of the device area;

[0022] StepA1.2. Use the master key MK to encrypt the unique identification ID corresponding to each device area. i , and generate the regional key RK for each device area i ;

[0023] Among them, ID i The encryption method uses AES-256 encryption algorithm;

[0024] The formula is:

[0025] In the formula, || is the splicing symbol, T i is the regional key RK i The timestamp corresponding to the addition when generated;

[0026] Among them, the timestamp is accurate to the second;

[0027] StepA1.3, RK iDistribute to the regional management node of the corresponding device area through a secure channel;

[0028] The core management server securely distributes the regional key to the corresponding regional management node.

[0029] The regional management node is responsible for storing and managing the regional key of the region, and using the regional key to generate and manage device keys for devices within the region.

[0030] As a further solution of the present invention, the device key DK is generated as follows:

[0031] Step A2.1. Receive device joining requests and assign unique identification IDs to each device in each device area. j , j is the serial number variable corresponding to each device in the corresponding device area, and j refers to the number of the device in the corresponding device area;

[0032] Step A2.2. Use the regional key RK in the corresponding device area i Encrypt the corresponding identification ID of each device in the device area j , and generate the device key DK j ;

[0033] Among them, ID j The encryption method uses AES-256 encryption algorithm;

[0034] The formula is:

[0035] Where, T j Device key DK j The timestamp corresponding to the addition when generated;

[0036] StepA2.3, DK j Distribute it to the device through a secure channel, and the device stores it in a secure storage area;

[0037] The secure storage area is used to store device keys and encrypt and decrypt device data.

[0038] As a further solution of the present invention: the dynamic key update method is as follows:

[0039] Step B1. Time factor generation:

[0040] First, extract each device key DK j Additional timestamp T j , T j The time when the device was last key updated;

[0041] By calculating the current time T d With Tj The absolute value of the difference between the two values determines the time factor T y , that is, T y，j =T d -T j ;

[0042] The time factor T y，j With the pre-set time threshold TY y For comparison:

[0043] When T y，j >TY y , a key periodic update signal is generated, and the key periodic update signal is used to periodically trigger key updates;

[0044] Step B2, device status detection:

[0045] The regional management node periodically detects the activity of each device A j ;

[0046] A j The calculation formula is: j =N j / N max ;

[0047] Among them, N j N is the number of communications of the device in the recent specified detection period. max is the preset maximum communication number threshold;

[0048] Set activity level A j Compare with the pre-set activity threshold AY:

[0049] When A j When <AY, the device is determined to be in a low activity state, and a key forced update signal is generated. The key forced update signal is used to trigger a forced key update;

[0050] Step B3, key derivation update:

[0051] When T y，j >TY y and A j When any one of AY is true, then:

[0052] , generate a new device key DK` j :

[0053] Where, T d is the current time node, DK j The device key that was last updated by the device since the current time point.

[0054] As a further solution of the present invention: communication data layered encryption includes:

[0055] Device-level encryption: The encrypted object is the original data collected by the device and its timestamp;

[0056] Regional aggregate encryption: The encryption object is the collection results of all devices in a single device area;

[0057] Core-level global encryption: The encrypted object is the collection results of all devices in all device areas, that is, global audit information;

[0058] As a further solution of the present invention: the device-level encryption method is as follows:

[0059] Collect the data plain text corresponding to each device, and then pass it through DK j Encrypt it to obtain the device data ciphertext;

[0060] The formula is: ;

[0061] Where C j The device data ciphertext corresponding to each device; D j is the data plaintext corresponding to each device in the corresponding device area, j = 1, 2, ... m, m represents the number of devices in the corresponding device area; E is the AES-256 algorithm used, H j is the check value of the corresponding data plaintext;

[0062] in, ;

[0063] Where CRC32 is a cyclic redundancy check algorithm used to generate a 32-bit checksum;

[0064] As a further solution of the present invention: the regional level aggregate encryption method is as follows:

[0065] Step C2.1. The regional management node receives the ciphertext data of each device in the device area, decrypts the ciphertext data of the device using the device key stored in the secure storage area, and obtains the plaintext data corresponding to each device;

[0066] Step C2.2, combined with the ID of the i-th device area i , splicing the data plaintext corresponding to each device in the device area and forming an aggregate data packet;

[0067] The expression for aggregating packets is as follows:

[0068] ;

[0069] Where: P i is the aggregated data packet of the i-th device area; Hi is the checksum of the aggregated data packet in the i-th device area;

[0070] in, ;

[0071] Where, ⊕ is the exclusive OR symbol;

[0072] Step C2.3, through RK i Encrypt the aggregated data packet to obtain the regional data ciphertext;

[0073] The formula is: ;

[0074] Where, CP i is the encrypted aggregate data packet, i.e., the regional data ciphertext; E is the adopted AES-256 algorithm;

[0075] As a further solution of the present invention: the core-level global encryption method is as follows:

[0076] Step C3.1. The core management server receives all the regional data ciphertexts corresponding to each device region. The core management server extracts the regional key from the regional management node and decrypts the regional data ciphertexts to obtain the aggregated data packets corresponding to each device region.

[0077] Step C2.2: Combine the IDs of each device area i , the aggregated data packets in each device area are spliced together to form a global audit log;

[0078] The expression of global audit log is as follows:

[0079] ;

[0080] Where: L is the global audit log; P i ={P1, P2, ... P n}, n represents the number of device areas;

[0081] Step C2.3, encrypt the global audit log using MK to obtain the global data ciphertext;

[0082] The formula is:

[0083] Where CL is the encrypted global audit log, that is, the global data ciphertext; E is the adopted AES-256 algorithm.

[0084] As a further solution of the present invention: the key revocation and recovery method is as follows:

[0085] Step D1, abnormal device detection:

[0086] The regional management node continuously monitors the abnormal characteristic parameters of each device in the device area, including communication failure rate and device offline time;

[0087] Step D1.1, communication failure rate detection:

[0088] Extract the number of communications N of the jth device in the recent specified detection period j , and count the number of failed communications SN of the jth device in the recent specified detection period j ;

[0089] Among them, in the communication system, if the receiver passes the test value H j If an error occurs when verifying the plaintext of the transmitted data, the communication will be judged as a failed communication;

[0090] Then through: , calculate the communication failure rate F of the jth device in the recent specified detection period j ;

[0091] Step D1.2, device offline time detection:

[0092] Extract the time node corresponding to the normal communication of the jth device in the recent specified detection period, then calculate the time difference between it and the current time node, and record it as the device offline time TC j ;

[0093] Among them, in the communication system, if the receiver passes the test value H j If no error occurs when verifying the plaintext of the transmitted data, the communication will be determined to be normal;

[0094] Step D1.3, abnormality determination:

[0095] The communication failure rate F j and device offline time TC j Respectively correspond to the preset failure rate threshold F y and offline abnormality judgment value TC d For comparison:

[0096] When F j >F y and TC j >TC d If at least one of the following is true, the device is considered abnormal;

[0097] When F j ≤F y and TC j ≤TC d If all of them are true, the device is considered normal;

[0098] Step D2, key revocation process:

[0099] When the device is abnormal, the key will be revoked. The key revocation is to change the corresponding device ID j Add to pre-established regional blacklists and global revocation lists;

[0100] Step D3, key recovery:

[0101] For devices that perform key revocation, delete the corresponding RK in the relevant device area. i All derived DKs j ;

[0102] Then the core server regenerates a new regional key;

[0103] At the same time, the data plaintext corresponding to the devices that have not been revoked is spliced to form a new aggregate data packet, where the check value H in the aggregate data packet is i Update based on the plaintext data corresponding to the device that has not been revoked;

[0104] The new aggregate data packet is then encrypted using a new regional key. The updated aggregate data packets in each device area are then concatenated to form a new global audit log. The global audit log is then encrypted using MK to obtain the global data ciphertext.

[0105] As a further solution of the present invention: the key revocation method is as follows:

[0106] Step D2.1. Add to regional blacklist:

[0107] Establish a corresponding regional blacklist BL based on the device area i , then record the ID in the regional blacklist BLi j ;

[0108] Among them, the record is in the regional blacklist BL i Chinese ID j , all subsequent communication requests from the corresponding device will be rejected;

[0109] Step D2.2, add to the global revocation list:

[0110] A global revocation list (GBL) is created in the core server. At the same time, a revocation request is sent to the core server. The core server marks the device ID in the global revocation list based on the revocation request. j .

[0111] An Internet of Things device encryption device, the device is used to execute an Internet of Things device encryption method, the device comprising:

[0112] Master key management unit: used to manually input the master key MK through the core management server and store it in the hardware security module;

[0113] Regional key derivation unit: Divide the device into regions based on geography or function, and encrypt the unique regional ID using the master key MK. i Generate regional key RK i and distributed to regional management nodes through secure channels;

[0114] Device key derivation unit: through the regional key RK i Encrypted device unique ID j Generate device key DK j , and DK j Distribute to the device's secure storage area;

[0115] Time factor detection unit: calculates the current time and device key timestamp T j The difference T y,j , when T y,j Exceeding threshold TY y Trigger key periodic update;

[0116] Equipment status monitoring unit: periodically calculates equipment activity A j , when A j When the value falls below the threshold AY, a forced key update is triggered;

[0117] Key derivation and update unit: determines whether it is a new device key based on the time factor or device status, and updates the key records of the device and regional management node;

[0118] Device-level encryption unit: uses the device key DK j Encrypt the original data plaintext to generate device data ciphertext;

[0119] Regional level aggregate encryption unit: The regional management node decrypts the device ciphertext and splices the data packet, through RK i Encryption generates regional data ciphertext;

[0120] Core-level global encryption unit: The core management server decrypts the regional ciphertext and then splices the global audit log, generating the global data ciphertext through MK encryption;

[0121] Anomaly detection unit: monitors the communication failure rate F of the device j and offline time TC j and compare them with their respective preset thresholds to determine abnormalities;

[0122] Key revocation unit: the abnormal device ID jAdd them to pre-established regional blacklists and global revocation lists to deny their communication requests;

[0123] Key recovery unit: Delete the DK of abnormal devices j , regenerate the regional key RK i , update the aggregate packet check value H i , and synchronized to the global audit log.

[0124] An electronic device includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor. When the program or instruction is executed by the processor, an encryption method for an Internet of Things device is implemented.

[0125] Beneficial effects of the present invention:

[0126] This invention implements hierarchical key management through a three-tiered key architecture consisting of a master key (MK), a regional key (RK), and a device key (DK). The master key is used only to derive regional keys and does not directly participate in communication encryption, effectively reducing the risk of core key leakage. Regional and device keys are generated using the AES-256 encryption algorithm and timestamps to ensure key uniqueness and timeliness. Even if a key layer is compromised, it will not affect data security at other layers, significantly improving the overall security of the system.

[0127] The present invention triggers key updates based on the dual conditions of time factor and device activity. When the key usage time exceeds a preset threshold, it is automatically updated to prevent security risks caused by long-term use of the same key. It forces key updates on low-activity devices to avoid potential vulnerabilities caused by device idleness or abnormalities. This mechanism can dynamically adapt to the complex environment of IoT devices, reduce manual intervention, and improve the system's anti-attack capabilities.

[0128] The present invention adopts a three-level encryption strategy at the device level, regional level and core level: device-level encryption: protects local device data to prevent physical theft or direct reading of original data; regional-level aggregate encryption: ensures the integrity and privacy of device data within the region, and prevents cross-device data correlation analysis; core-level global encryption: protects the tamper-proof nature of global audit information, which can only be decrypted by the core server; this layered design effectively isolates data at different levels to avoid global risks caused by the compromise of a single node.

[0129] The present invention quickly identifies abnormal devices by monitoring the communication failure rate and device offline time and performs the following operations: blacklisting: immediately terminating the communication permissions of the abnormal device to prevent it from continuing to participate in network activities; key recovery and update: deleting the key of the abnormal device and regenerating the regional key to ensure seamless connection of unaffected devices; this mechanism can block potential threats in a timely manner while maintaining the normal operation of the system, significantly improving fault tolerance and security response efficiency.

[0130] This invention introduces a CRC32 checksum and an XOR checksum (Hi) into encrypted communications to verify the integrity and accuracy of data transmissions. The checksum allows the recipient to quickly identify data tampering or transmission errors, reducing the risk of man-in-the-middle attacks and data forgery, while ensuring the reliability of the communication process.

[0131] This invention supports dynamic access and management of massive devices through regionalized key management and layered encryption design. The core server only needs to maintain the master key and global audit information, while regional management nodes are responsible for key distribution and data aggregation in their respective regions. This effectively reduces the computing and storage pressure on central nodes and improves system scalability and deployment efficiency.

[0132] In summary, the present invention achieves high security, high flexibility and high reliability protection of IoT device data through the synergistic effect of multi-level key management, dynamic update, layered encryption and abnormal revocation mechanism, and is suitable for various application scenarios such as smart cities, industrial IoT, smart homes, etc. BRIEF DESCRIPTION OF THE DRAWINGS

[0133] The present invention will be further described below with reference to the accompanying drawings.

[0134] Figure 1 It is a schematic flow diagram of the present invention.

[0135] Figure 2 It is a system block diagram of the present invention. DETAILED DESCRIPTION

[0136] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0137] Example 1

[0138] See also Figure 1 and Figure 2 As shown, the present invention is an Internet of Things device encryption method, comprising the following steps:

[0139] Key hierarchical management: keys are divided into master key MK, regional key RK, and device key DK;

[0140] in:

[0141] The master key MK is set by the core management server and stored in the hardware security module HSM. The master key MK is used to generate the regional key;

[0142] In this embodiment, the master key MK does not participate in communication encryption, and its only function is to generate the zone key through the encryption algorithm;

[0143] The master key is set by manually inputting a master key value that meets the requirements of a certain length and character type combination format into the core management server;

[0144] The regional key RK is derived from the master key and is used to manage the generation and update of device keys for devices within the region.

[0145] The regional key RK is generated as follows:

[0146] Step A1.1. Divide multiple device regions based on device geography or function, and assign a unique ID to each device region i , i is the serial number variable corresponding to each device area, i refers to the number of the device area;

[0147] StepA1.2. Use the master key MK to encrypt the unique identification ID corresponding to each device area. i , and generate the regional key RK for each device area i ;

[0148] Among them, ID i The encryption method uses AES-256 encryption algorithm;

[0149] The formula is: ;

[0150] In the formula, || is the splicing symbol, T i is the regional key RK i The timestamp corresponding to the addition when generated;

[0151] Among them, the timestamp is accurate to the second;

[0152] StepA1.3, RK i Distribute to the regional management node of the corresponding device area through a secure channel;

[0153] The core management server securely distributes the regional key to the corresponding regional management node.

[0154] The regional management node is responsible for storing and managing the regional key of the region, and using the regional key to generate and manage the device keys of the devices in the region;

[0155] The device key DK is derived from the regional key and is used to encrypt and decrypt device data;

[0156] The device key DK is generated as follows:

[0157] Step A2.1. Receive device joining requests and assign unique identification IDs to each device in each device area. j , j is the serial number variable corresponding to each device in the corresponding device area, and j refers to the number of the device in the corresponding device area;

[0158] Step A2.2. Use the regional key RK in the corresponding device area i Encrypt the corresponding identification ID of each device in the device area j , and generate the device key DK j ;

[0159] Among them, ID j The encryption method uses AES-256 encryption algorithm;

[0160] The formula is: ;

[0161] Where, T j Device key DK j The timestamp corresponding to the addition when generated;

[0162] StepA2.3, DK j Distribute it to the device through a secure channel, and the device stores it in a secure storage area;

[0163] The secure storage area is used to store device keys and encrypt and decrypt device data;

[0164] Layered encrypted communication: Use three levels of keys (master key MK, regional key RK, device key DK) to encrypt communication data in layers to ensure the isolation of data at different levels;

[0165] Communication data layered encryption includes:

[0166] Device-level encryption: The encrypted object is the raw data collected by the device and its timestamp. The purpose of encryption is to ensure the confidentiality of the data when it is stored locally on the device or transmitted to the regional management node, and to prevent the raw data from being directly read when the device is physically stolen.

[0167] Regional-level aggregate encryption: The encryption object is the collection results of all devices in a single device area. The purpose of encryption is to protect the integrity and privacy of device data in the area, prevent cross-device data correlation analysis, and ensure that external nodes cannot parse data from other areas when transmitting between areas.

[0168] Core-level global encryption: The encrypted object is the collection results of all devices in all device areas, that is, global audit information;

[0169] The purpose of encryption is to protect the immutability of global audit information, and only the core server can decrypt it;

[0170] Step C1, device-level encryption:

[0171] Collect the data plain text corresponding to each device, and then pass it through DK j Encrypt it to obtain the device data ciphertext;

[0172] The formula is: ;

[0173] Where C j The device data ciphertext corresponding to each device; D j is the data plaintext corresponding to each device in the corresponding device area, j = 1, 2, ... m, m represents the number of devices in the corresponding device area; E is the AES-256 algorithm used, H j is the check value of the corresponding data plaintext;

[0174] in, ;

[0175] Where CRC32 is a cyclic redundancy check algorithm used to generate a 32-bit checksum;

[0176] Step C2, regional level aggregate encryption:

[0177] Step C2.1. The regional management node receives the ciphertext data of each device in the device area, decrypts the ciphertext data of the device using the device key stored in the secure storage area, and obtains the plaintext data corresponding to each device;

[0178] Step C2.2, combined with the ID of the i-th device area i , splicing the data plaintext corresponding to each device in the device area and forming an aggregate data packet;

[0179] The expression for aggregating packets is as follows:

[0180] ;

[0181] Where: P i is the aggregated data packet of the i-th device area; H i is the checksum of the aggregated data packet in the i-th device area;

[0182] in, ;

[0183] Where, ⊕ is the exclusive OR symbol;

[0184] Step C2.3, through RK i Encrypt the aggregated data packet to obtain the regional data ciphertext;

[0185] The formula is:

[0186] Where, CP i is the encrypted aggregate data packet, i.e., the regional data ciphertext; E is the adopted AES-256 algorithm;

[0187] Step C3, core-level global encryption:

[0188] Step C3.1. The core management server receives all the regional data ciphertexts corresponding to each device region. The core management server extracts the regional key from the regional management node and decrypts the regional data ciphertexts to obtain the aggregated data packets corresponding to each device region.

[0189] Step C2.2: Combine the IDs of each device area i , the aggregated data packets in each device area are spliced together to form a global audit log;

[0190] The expression of global audit log is as follows:

[0191] ;

[0192] Where: L is the global audit log; P i ={P1, P2, ... P n}, n represents the number of device areas;

[0193] Step C2.3, encrypt the global audit log using MK to obtain the global data ciphertext;

[0194] The formula is:

[0195] Where CL is the encrypted global audit log, that is, the global data ciphertext; E is the adopted AES-256 algorithm.

[0196] This embodiment implements layered encrypted communication through hierarchical key management (master key MK, regional key RK, and device key DK), ensuring data isolation and security at different levels. The master key MK is only used to derive regional keys and does not directly participate in communication encryption, reducing the risk of master key leakage. The derivation of regional and device keys utilizes the AES-256 encryption algorithm and a timestamp mechanism, enhancing key uniqueness and timeliness. Three levels of encryption—device-level, regional-level, and core-level—protect local device data, inter-regional data transmission, and global audit information, respectively, effectively preventing data leakage, tampering, and cross-device correlation analysis. Furthermore, the introduction of checksums (such as CRC32 and XOR) further ensures data integrity and transmission reliability.

[0197] Example 2

[0198] See also Figure 1 and Figure 2 As shown, as the second embodiment of the present invention, when the present application is specifically implemented, compared with the first embodiment, the technical solution of this embodiment is different from that of the first embodiment only in that this embodiment further includes the step of dynamic key update, which performs dynamic key update based on the time factor and the device status. The specific steps are as follows:

[0199] Step B1. Time factor generation:

[0200] First, extract each device key DK j Additional timestamp T j , T j The time when the device was last key updated;

[0201] By calculating the current time T d With T j The absolute value of the difference between the two values determines the time factor T y , that is, T y，j =T d -T j ;

[0202] The time factor T y，j With the pre-set time threshold TY y For comparison:

[0203] When T y，j >TY y , a key periodic update signal is generated, and the key periodic update signal is used to periodically trigger key updates;

[0204] Step B2, device status detection:

[0205] The regional management node periodically detects the activity of each device A j ;

[0206] A j The calculation formula is: j =N j / N max ;

[0207] Among them, N j N is the number of communications of the device in the recent specified detection period. max is the preset maximum communication number threshold;

[0208] Set activity level A j Compare with the pre-set activity threshold AY:

[0209] When A jWhen <AY, the device is determined to be in a low activity state, and a key forced update signal is generated. The key forced update signal is used to trigger a forced key update;

[0210] Step B3, key derivation update:

[0211] When T y，j >TY y and A j When any one of AY is true, then:

[0212] , generate a new device key DK` j ;

[0213] Where, T d is the current time node, DK j The device key that was last updated by the device since the current time point.

[0214] This embodiment introduces a dynamic key update mechanism based on Example 1, triggering key updates based on both a time factor and device activity. This collaborative assessment of the time factor (based on key usage duration) and the activity threshold (based on device communication frequency) dynamically identifies key expiration or abnormal device status, allowing for the timely generation of new keys and mitigating potential security risks associated with long-term key retention or low device activity. This mechanism significantly enhances system flexibility and attack resistance, making it particularly suitable for IoT scenarios with widely distributed and constantly changing device states, while also reducing the cost of manual intervention.

[0215] Example 3

[0216] See also Figure 1 and Figure 2 As shown, as the third embodiment of the present invention, when the present application is specifically implemented, compared with the first and second embodiments, the technical solution of this embodiment is to combine the solutions of the first and second embodiments. The technical solution of this embodiment is different from the first and second embodiments only in that this embodiment further includes the steps of: key revocation and recovery. This step terminates the use of the old key in time and regenerates a new key when the device is abnormal, thereby ensuring system security.

[0217] The specific method is as follows:

[0218] Step D1, abnormal device detection:

[0219] The regional management node continuously monitors the abnormal characteristic parameters of each device in the device area, including communication failure rate and device offline time;

[0220] Step D1.1, communication failure rate detection:

[0221] Extract the number of communications N of the jth device in the recent specified detection period j , and count the number of failed communications SN of the jth device in the recent specified detection period j ;

[0222] Among them, in the communication system, if the receiver passes the test value H j If an error occurs when verifying the plaintext of the transmitted data, the communication will be judged as a failed communication;

[0223] This verification mechanism is mainly used to verify the integrity and accuracy of data during transmission. Failure of verification indicates that the data may have been tampered with or there is a transmission error.

[0224] Then through: , calculate the communication failure rate F of the jth device in the recent specified detection period j ;

[0225] Step D1.2, device offline time detection:

[0226] Extract the time node corresponding to the normal communication of the jth device in the recent specified detection period, then calculate the time difference between it and the current time node, and record it as the device offline time TC j ;

[0227] Among them, in the communication system, if the receiver passes the test value H j If no error occurs when verifying the plaintext of the transmitted data, the communication will be determined to be normal;

[0228] Step D1.3, abnormality determination:

[0229] The communication failure rate F j and device offline time TC j Respectively correspond to the preset failure rate threshold F y and offline abnormality judgment value TC d For comparison:

[0230] When F j >F y and TC j >TC d If at least one of the following is true, the device is considered abnormal;

[0231] When F j ≤F y and TC j ≤TC d If all of them are true, the device is considered normal;

[0232] Step D2, key revocation process:

[0233] When the device is abnormal, the key revocation is executed;

[0234] The key revocation method is as follows:

[0235] Step D2.1. Add to regional blacklist:

[0236] Establish a corresponding regional blacklist BL based on the device area i , then record the ID in the regional blacklist BLi j ;

[0237] Among them, the record is in the regional blacklist BL i Chinese ID j , all subsequent communication requests from the corresponding device will be rejected;

[0238] Step D2.2, add to the global revocation list:

[0239] A global revocation list (GBL) is created in the core server. At the same time, a revocation request is sent to the core server. The core server marks the device ID in the global revocation list based on the revocation request. j , to update the global revocation list;

[0240] Step D3, key recovery:

[0241] For devices that perform key revocation, delete the corresponding RK in the relevant device area. i All derived DKs j ;

[0242] Then the core server regenerates a new regional key;

[0243] At the same time, the data plaintext corresponding to the devices that have not been revoked is spliced to form a new aggregate data packet, where the check value H in the aggregate data packet is i Update based on the plaintext data corresponding to the device that has not been revoked;

[0244] The new aggregate data packet is then encrypted using a new regional key. The updated aggregate data packets in each device area are then concatenated to form a new global audit log. The global audit log is then encrypted using MK to obtain the global data ciphertext.

[0245] This embodiment combines Examples 1 and 2, further adding key revocation and recovery capabilities. By monitoring communication failure rates and device offline time, it quickly identifies abnormal devices and triggers the key revocation process. The abnormal device is added to a blacklist and the global revocation list is updated, preventing it from further communication. After key revocation, the system regenerates regional keys and updates the aggregated data package, ensuring seamless connectivity for unaffected devices. This mechanism effectively addresses abnormal situations such as device intrusion or failure, improving the system's fault tolerance and overall security, while also reducing management complexity through automated processes.

[0246] Example 4

[0247] See also Figure 1 and Figure 2 As shown, as the fourth embodiment of the present invention, when this application is specifically implemented, compared with the first, second and third embodiments, the technical solution of this embodiment is to combine the solutions of the above-mentioned first, second, third and fourth embodiments.

[0248] This embodiment integrates all the advantages of the previous three embodiments to form a complete encryption and security management solution for IoT devices. Through a multi-layered protection mechanism that includes hierarchical key management, dynamic updates, anomaly detection, and revocation and recovery, it achieves full lifecycle security management from key generation, use, to disposal. The system combines data isolation, dynamic adaptability, anomaly response capabilities, and global consistency, making it suitable for large-scale, high-security IoT scenarios. It significantly reduces the risks of data leakage, key cracking, and malicious attacks, while optimizing operational efficiency.

[0249] See also Figure 1 and Figure 2 As shown, the present invention also provides an Internet of Things device encryption device, which is used to execute an Internet of Things device encryption method, and the device includes:

[0250] Master key management unit: used to manually input the master key MK through the core management server and store it in the hardware security module;

[0251] Regional key derivation unit: Divide the device into regions based on geography or function, and encrypt the unique regional ID using the master key MK. i Generate regional key RK i and distributed to regional management nodes through secure channels;

[0252] Device key derivation unit: through the regional key RK i Encrypted device unique ID j Generate device key DK j , and DK j Distribute to the device's secure storage area;

[0253] Time factor detection unit: calculates the current time and device key timestamp T j The difference T y,j , when T y,j Exceeding threshold TY y Trigger key periodic update;

[0254] Equipment status monitoring unit: periodically calculates equipment activity A j , when A j When the value falls below the threshold AY, a forced key update is triggered;

[0255] Key derivation and update unit: determines whether it is a new device key based on the time factor or device status, and updates the key records of the device and regional management node;

[0256] Device-level encryption unit: uses the device key DK j Encrypt the original data plaintext to generate device data ciphertext;

[0257] Regional level aggregate encryption unit: The regional management node decrypts the device ciphertext and splices the data packet, through RK i Encryption generates regional data ciphertext;

[0258] Core-level global encryption unit: The core management server decrypts the regional ciphertext and then splices the global audit log, generating the global data ciphertext through MK encryption;

[0259] Anomaly detection unit: monitors the communication failure rate F of the device j and offline time TC j and compare them with their respective preset thresholds to determine abnormalities;

[0260] Key revocation unit: the abnormal device ID j Add them to pre-established regional blacklists and global revocation lists to deny their communication requests;

[0261] Key recovery unit: Delete the DK of abnormal devices j , regenerate the regional key RK i , update the aggregate packet check value H i , and synchronized to the global audit log.

[0262] The present invention also provides an electronic device, comprising a processor, a memory, and a program or instruction stored in the memory and executable on the processor. When the program or instruction is executed by the processor, an encryption method for an Internet of Things device is implemented.

[0263] It should be stated that all data collected in this application is collected with the user's consent and authorization, and the use of the data is legal and compliant, and the use and processing of the data complies with the relevant laws, regulations and standards of the relevant regions.

[0264] The above formulas are all dimensionless and numerical calculations. The formulas are obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters and thresholds in the formulas are set by technicians in this field according to actual conditions.

[0265] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. An Internet of Things device encryption method, characterized in that: The following steps are involved: Key hierarchical management: keys are divided into master key MK, regional key RK, and device key DK; Dynamic key update: Dynamic key update based on time factor and device status; Layered encrypted communication: Master key MK, regional key RK, and device key DK are used to encrypt communication data in layers; Key revocation and recovery: When a device malfunctions, the use of the old key is terminated in a timely manner and a new key is generated.

2. The method for encrypting an Internet of Things device according to claim 1, wherein: The master key MK is set by the core management server and stored in the hardware security module HSM. The master key MK is used to generate the regional key; The regional key RK is derived from the master key and is used to manage the generation and update of device keys for devices within the region. The device key DK is derived from the zone key and is used to encrypt and decrypt device data.

3. The method for encrypting an Internet of Things device according to claim 2, wherein: The master key is generated as follows: Manually enter the master key value that meets the required length and character type combination format into the core management server; The regional key RK is generated as follows: Step A1.

1. Divide multiple device regions based on device geography or function, and assign a unique ID to each device region i , i is the serial number variable corresponding to each device area, i refers to the number of the device area; StepA1.

2. Use the master key MK to encrypt the unique identification ID corresponding to each device area. i , and generate the regional key RK for each device area i ; Among them, ID i The encryption method uses AES-256 encryption algorithm; The formula is: ; In the formula, || is the splicing symbol, T i is the regional key RK i The timestamp corresponding to the generation is added; the timestamp is accurate to the second; StepA1.3, RK i Distribute to the regional management node of the corresponding device area through a secure channel; The device key DK is generated as follows: Step A2.

1. Receive device joining requests and assign unique identification IDs to each device in each device area. j , j is the serial number variable corresponding to each device in the corresponding device area, and j refers to the number of the device in the corresponding device area; Step A2.

2. Use the regional key RK in the corresponding device area i Encrypt the corresponding identification ID of each device in the device area j , and generate the device key DK j ; Among them, ID j The encryption method uses AES-256 encryption algorithm; The formula is: ; Where, T j Device key DK j The timestamp corresponding to the addition when generated; StepA2.3, DK j Distributed to the device through a secure channel, and stored by the device in a secure storage area.

4. The method for encrypting an Internet of Things device according to claim 3, wherein: Dynamic key update method is as follows: Step B1. Time factor generation: First, extract each device key DK j Additional timestamp T j , T j The time when the device was last key updated; By calculating the current time T d With T j The absolute value of the difference between the two values determines the time factor T y , that is, T y，j =T d -T j ; The time factor T y，j With the pre-set time threshold TY y For comparison: When T y，j >TY y , then key updates are triggered regularly; Step B2, device status detection: The regional management node periodically detects the activity of each device A j ; A j The calculation formula is: j =N j / N max ; Among them, N j N is the number of communications of the device in the recent specified detection period. max is the preset maximum communication number threshold; Set activity level A j Compare with the pre-set activity threshold AY: When A j When <AY, the device is judged to be in low activity state, and a forced key update is triggered; Step B3, key derivation update: When T y，j >TY y and A j When any one of <AY is true, a new device key is generated.

5. The method for encrypting an Internet of Things device according to claim 3, wherein: The communication data is encrypted in layers as follows: Step C1, device-level encryption: Collect the data plain text corresponding to each device, and then pass it through DK j Encrypt it to obtain the device data ciphertext; The formula is: ; Where C j The device data ciphertext corresponding to each device; D j is the data plaintext corresponding to each device in the corresponding device area, j = 1, 2, ... m, m represents the number of devices in the corresponding device area; E is the AES-256 algorithm used, H j is the check value of the corresponding data plaintext; in, ; Where CRC32 is a cyclic redundancy check algorithm used to generate a 32-bit checksum; Step C2, regional level aggregate encryption: Step C2.

1. The regional management node receives the ciphertext data of each device in the device area, decrypts the ciphertext data of the device using the device key stored in the secure storage area, and obtains the plaintext data corresponding to each device; Step C2.2, combined with the ID of the i-th device area i , splicing the data plaintext corresponding to each device in the device area and forming an aggregate data packet; The expression for aggregating packets is as follows: ； P i is the aggregated data packet of the i-th device area; H i is the checksum of the aggregated data packet in the i-th device area; in, ; Where, ⊕ is the exclusive OR symbol; Step C2.3, through RK i Encrypt the aggregated data packet to obtain the regional data ciphertext; The formula is: ; Where, CP i is the encrypted aggregate data packet, i.e., the regional data ciphertext; E is the adopted AES-256 algorithm; Step C3, core-level global encryption: Step C3.

1. The core management server receives all the regional data ciphertexts corresponding to each device region. The core management server extracts the regional key from the regional management node and decrypts the regional data ciphertexts to obtain the aggregated data packets corresponding to each device region. Step C2.2: Combine the IDs of each device area i , the aggregated data packets in each device area are spliced together to form a global audit log; The expression of global audit log is as follows: ； Where: L is the global audit log; P i ={P1, P2, ... P n }, n represents the number of device areas; Step C2.3, encrypt the global audit log using MK to obtain the global data ciphertext; The formula is: ; Where CL is the encrypted global audit log, that is, the global data ciphertext; E is the adopted AES-256 algorithm.

6. The method for encrypting an Internet of Things device according to claim 5, wherein: The key revocation and recovery methods are as follows: Step D1, abnormal device detection: The regional management node continuously monitors the abnormal characteristic parameters of each device in the device area, including communication failure rate and device offline time; Step D1.1, communication failure rate detection: Extract the number of communications N of the jth device in the recent specified detection period j , and count the number of failed communications SN of the jth device in the recent specified detection period j ; Then through: , calculate the communication failure rate F of the jth device in the recent specified detection period j ; Step D1.2, device offline time detection: Extract the time node corresponding to the normal communication of the jth device in the recent specified detection period, then calculate the time difference between it and the current time node, and record it as the device offline time TC j ; Step D1.3, abnormality determination: The communication failure rate F j and device offline time TC j Respectively correspond to the preset failure rate threshold F y and offline abnormality judgment value TC d For comparison: When F j >F y and TC j >TC d If at least one of the following is true, the device is considered abnormal; When F j ≤F y and TC j ≤TC d If all of them are true, the device is considered normal; Step D2, key revocation process: When the device is abnormal, the key will be revoked. The key revocation is to change the corresponding device ID j Add to pre-established regional blacklists and global revocation lists; Step D3, key recovery: For devices that perform key revocation, delete the corresponding RK in the relevant device area. i All derived DKs j ; Then the core server regenerates a new regional key; At the same time, the data plaintext corresponding to the devices that have not been revoked is spliced to form a new aggregate data packet, where the check value H in the aggregate data packet is i Update based on the plaintext data corresponding to the device that has not been revoked; The new aggregate data packet is then encrypted using a new regional key. The updated aggregate data packets in each device area are then concatenated to form a new global audit log. The global audit log is then encrypted using MK to obtain the global data ciphertext.

7. The method for encrypting an Internet of Things device according to claim 6, wherein: in, If the receiver passes the test value H j If an error occurs when verifying the plaintext of the transmitted data, the communication will be judged as a failed communication; Otherwise, the communication will be judged as normal communication.

8. The method for encrypting an Internet of Things device according to claim 6, wherein: The key revocation method is as follows: Step D2.

1. Add to regional blacklist: Establish a corresponding regional blacklist BL based on the device area i , then record the ID in the regional blacklist BLi j ; Among them, the record is in the regional blacklist BL i Chinese ID j , all subsequent communication requests from the corresponding device will be rejected; Step D2.2, add to the global revocation list: A global revocation list (GBL) is created in the core server. At the same time, a revocation request is sent to the core server. The core server marks the device ID in the global revocation list based on the revocation request. j .

9. An Internet of Things device encryption device, the device being used to execute an Internet of Things device encryption method according to any one of claims 1 to 8, characterized in that: The device includes: Master key management unit: used to manually input the master key MK through the core management server and store it in the hardware security module; Regional key derivation unit: Divide the device into regions based on geography or function, and encrypt the unique regional ID using the master key MK. i Generate regional key RK i and distributed to regional management nodes through secure channels; Device key derivation unit: through the regional key RK i Encrypted device unique ID j Generate device key DK j , and DK j Distribute to the device's secure storage area; Time factor detection unit: calculates the current time and device key timestamp T j The difference T y,j , when T y,j Exceeding threshold TY y Trigger key periodic update; Equipment status monitoring unit: periodically calculates equipment activity A j , when A j When the value falls below the threshold AY, a forced key update is triggered; Key derivation and update unit: determines whether it is a new device key based on the time factor or device status, and updates the key records of the device and regional management node; Device-level encryption unit: uses the device key DK j Encrypt the original data plaintext to generate device data ciphertext; Regional level aggregate encryption unit: The regional management node decrypts the device ciphertext and splices the data packet, through RK i Encryption generates regional data ciphertext; Core-level global encryption unit: The core management server decrypts the regional ciphertext and then splices the global audit log, generating the global data ciphertext through MK encryption; Anomaly detection unit: monitors the communication failure rate F of the device j and offline time TC j and compare them with their respective preset thresholds to determine abnormalities; Key revocation unit: the abnormal device ID j Add them to pre-established regional blacklists and global revocation lists to deny their communication requests; Key recovery unit: Delete the DK of abnormal devices j , regenerate the regional key RK i , update the aggregate packet check value H i , and synchronized to the global audit log.

10. An electronic device, characterized in that: The invention comprises a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein when the program or instruction is executed by the processor, an encryption method for an Internet of Things device according to any one of claims 1 to 8 is implemented.

Images