A method and system for internet of things multi-protocol adaptation

Abstract

The application discloses a method and system for multi-protocol self-adaption of an Internet of Things, and the method comprises the following steps: receiving a protocol message sent by an Internet of Things device; extracting a message feature and performing protocol identification; analyzing the message to obtain protocol message elements; generating a certificate template; generating a certificate according to the certificate template; and encapsulating the certificate into a corresponding protocol message and sending the protocol message to the Internet of Things device. The method realizes automatic and lightweight application and management of a device certificate in an Internet of Things environment mixed with LMS, MQTT, CoAP, LoRaWAN and Modbus.

Description

Technical Field

[0001] This invention relates to the field of information technology, and in particular to a method and system for multi-protocol self-adaptation in the Internet of Things. Background Technology

[0002] The current IoT environment faces two key challenges:

[0003] 1) Protocol Fragmentation: IoT devices use numerous communication protocols (such as DLMS / MQTT / CoAP / LoRaWAN / Modbus, etc.), with significant differences in protocol stacks, data formats, and security mechanisms. Traditional PKI (Public Key Infrastructure) systems (primarily designed for HTTP / HTTPS) struggle to directly adapt to these protocols, requiring custom development for each protocol or reliance on protocol conversion gateways, leading to complex deployments, high costs, and low efficiency. 2) Limited Device Resources: Many IoT devices have extremely limited computing power, memory, and storage space. The certificate size of traditional PKI systems is too burdensome for these devices, making implementation difficult.

[0004] Existing technologies typically use protocol gateways or custom PKIs to solve multi-protocol compatibility issues, but these have the following drawbacks: 1) Protocol-specific gateways: Introduce additional equipment, increasing single points of failure, latency, and cost; the gateway itself may become a bottleneck. 2) Custom PKIs: Simplify PKIs for specific protocols / devices, sacrificing versatility, making them difficult to scale and interoperate, and resulting in high maintenance costs. 3) Lightweight certificates: Only address the certificate size issue, without resolving cross-protocol compatibility problems. Summary of the Invention

[0005] The technical problem this application aims to solve is to provide a method and system for automating and lightweighting the application and management of device certificates in an IoT environment with multiple protocols such as DLMS / MQTT / CoAP / LoRaWAN / Modbus.

[0006] According to one aspect of this application, a method for multi-protocol self-adaptation in the Internet of Things (IoT) is provided, comprising the following steps: receiving protocol messages sent by an IoT device; extracting features of the protocol messages and performing protocol identification; parsing the protocol messages according to the protocol identification results to obtain protocol message elements, wherein the protocol message elements include a certificate signing request, a signature algorithm type, and a security level; generating a certificate template; generating a certificate according to the certificate template; and encapsulating the certificate into a corresponding protocol message and sending it to the IoT device.

[0007] According to some embodiments, the step of extracting features from the protocol message and performing protocol identification includes: establishing a protocol feature matrix and a feature parsing rule matrix; assigning weight values ​​to each element in the row vectors of the protocol feature matrix and normalizing the row vectors; extracting features from the protocol message according to the feature parsing rule matrix to obtain a message feature matrix and normalizing the row vectors in the message feature matrix; performing feature comparison between the row vectors of the message feature matrix and the row vectors of the protocol feature matrix and calculating the pairwise similarity; if the maximum similarity is greater than a threshold, the match is successful and the protocol identification is completed; otherwise, the protocol is an unknown protocol.

[0008] According to some embodiments, the protocol feature matrix, the feature parsing rule matrix, and the message feature matrix are all m×n matrices, where m is the number of protocols and n is the dimension of the feature vectors of the protocols; the protocol feature matrix contains feature vectors of m IoT protocols; the feature parsing rule matrix contains m feature parsing rule vectors; and the message feature matrix contains m message feature vectors.

[0009] According to some embodiments, the feature parsing rule vector includes: the first N bytes, the protocol identifier, the position of the length field, the range of the first 4 bytes of Shannon entropy, the check start position, the check length, the check algorithm, and the transmission protocol; where N is an integer greater than 0.

[0010] According to some embodiments, the similarity is the cosine of the angle between the vectors.

[0011] According to some embodiments, the certificate template is a minimal certificate dynamically generated based on rules; the minimal certificate only contains required fields, and other optional fields are dynamically added according to the security level; each protocol has a corresponding certificate template.

[0012] According to another aspect of this application, a system for multi-protocol self-adaptation in the Internet of Things (IoT) is also provided to implement the aforementioned method. The system is characterized by comprising: a protocol adaptation microservice, a CA / RA microservice, and a dynamic certificate template engine; the protocol adaptation microservice includes a protocol identification engine, a protocol adapter library, and a protocol abstraction layer; the protocol identification engine is used to extract message features and perform protocol identification; the protocol adapter library is used to parse the messages to obtain protocol message elements; the protocol abstraction layer is used to provide a unified, protocol-independent core PKI operation interface; the CA / RA microservice is used to generate a certificate based on the certificate template and send the certificate and protocol tag to the protocol adaptation microservice through the protocol abstraction layer; the dynamic certificate template engine is used to generate a certificate template; the protocol adaptation microservice is used to receive protocol messages sent by IoT devices, perform protocol identification and message parsing, send the certificate template to the CA / RA microservice through the protocol abstraction layer, find the protocol adapter based on the protocol tag, encapsulate the certificate data into a corresponding protocol message, and send it to the IoT device.

[0013] According to some embodiments, the PKI operation interface of the protocol abstraction layer includes the following API functions: requestCertificate(), downloadCertificate(), and queryCertificate(). These API functions are used to shield the details of the underlying specific communication protocol, so that the core logic of PKI only interacts with the protocol abstraction layer.

[0014] According to another aspect of this application, a computer-readable storage medium is also provided, characterized in that the computer-readable storage medium includes a stored computer program, wherein, when the computer program is run by a processor, it controls the device where the storage medium is located to perform the IoT multi-protocol self-adaptation method as described above.

[0015] The beneficial effects of this application are as follows:

[0016] 1) A PKI system has been implemented that can seamlessly and automatically adapt to most mainstream and non-mainstream IoT protocols without requiring customized PKI components for each protocol or relying on external protocol converters. This solves the protocol fragmentation problem, achieving "deploy once, support multiple protocols" and possessing broad compatibility. Simultaneously, a microservice approach replaces dedicated protocol gateways, eliminating single points of failure and reducing latency and cost. 2) A lightweight certificate design is provided, enabling PKI functionality to run efficiently on resource-constrained IoT devices. 3) PKI components are microservice-based to meet the demands of massive IoT device connections, while providing excellent compatibility, scalability, and ease of deployment. 4) The microservice architecture and pluggable protocol adapter design facilitate horizontal system scaling and rapid support for emerging protocols. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A system block diagram of an IoT multi-protocol self-adaptation according to an example embodiment is shown.

[0019] Figure 2 A flowchart illustrating protocol identification according to an example embodiment is shown. Detailed Implementation

[0020] The embodiments of this application will now be described in detail with reference to the accompanying drawings. It should be understood that the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0021] Those skilled in the art should understand that the following specific embodiments or implementation methods are a series of optimized configurations listed in this application to further explain the specific application content. These configuration methods can be combined or used in conjunction with each other, unless this application explicitly states that some or a specific embodiment or implementation method cannot be associated with or used in conjunction with other embodiments or implementation methods. Furthermore, the following specific embodiments or implementation methods are only considered as optimized configurations and are not intended to limit the scope of protection of this application.

[0022] Example 1

[0023] Figure 1 A system block diagram of an IoT multi-protocol self-adaptation according to an example embodiment is shown.

[0024] like Figure 1 As shown, an IoT multi-protocol self-adaptive system (i.e. Figure 1The PKI microservice cluster includes: a protocol adaptation microservice module, CA / RA (Certificate Authority / Registration Authority) and other microservice modules, and a dynamic certificate template engine. The protocol adaptation microservice module includes a protocol recognition engine for extracting message features and performing protocol recognition; a protocol adapter library for parsing messages to obtain protocol message elements; and a protocol abstraction layer for providing a unified, protocol-independent core PKI operation interface. The dynamic certificate template engine generates certificate templates. The CA / RA and other microservice modules generate certificates based on the certificate templates and send the certificates and protocol tags to the protocol adaptation microservice module through the protocol abstraction layer. The protocol adaptation microservice module receives protocol messages from IoT devices, performs protocol recognition and message parsing, sends the certificate template to the CA / RA microservice through the protocol abstraction layer, finds the protocol adapter based on the protocol tags, encapsulates the certificate data into corresponding protocol messages, and sends them to the IoT devices.

[0025] like Figure 1 As shown, the overall process for IoT devices to apply for certificates using the aforementioned IoT multi-protocol self-adaptive system is as follows:

[0026] ① IoT devices send protocol messages to the PKI protocol adaptation microservice.

[0027] ② After receiving the message, the protocol adaptation microservice performs the following steps: S1, calls the protocol recognition engine to extract message features and perform recognition; S2, after recognition, calls the corresponding protocol adapter to parse the message and obtain the Certificate Signing Request (CSR), signature algorithm type, security level, etc.; S3, calls the dynamic certificate template engine to generate a certificate template.

[0028] ③ The protocol adaptation microservice sends the certificate template to the CA / RA microservice through the unified API provided by the protocol abstraction layer.

[0029] ④ The CA / RA microservice generates a certificate based on the certificate template and sends the certificate and protocol tag to the protocol adaptation microservice through a unified API.

[0030] ⑤ Protocol adaptation microservices locate the protocol adapter based on the protocol tag, encapsulate data such as certificates into corresponding protocol messages, and send them to IoT devices.

[0031] The protocol message includes CSR, signature algorithm type (optional), security level (optional), etc.; if the protocol message does not have signature algorithm type and security level, the default configuration is set in the certificate template.

[0032] Figure 2 A flowchart illustrating protocol identification according to an example embodiment is shown.

[0033] like Figure 2As shown, the protocol identification process is as follows:

[0034] Step S21: Establish the protocol feature matrix and feature parsing rule matrix.

[0035] Use A m×n Represents the protocol feature matrix, X m×n Let m represent the feature parsing rule matrix, where m represents the number of protocols and n represents the dimension of the protocol's feature vector.

[0036] Taking n=5 (expandable), the feature parsing rule vector x is represented as follows: [(header N bytes, protocol identifier), (length field position 1, length field position 2...), the range of the first 4 bytes of Shannon entropy (the first 4 bytes usually contain key information such as protocol identifier, version number, type field, etc., which can be expanded), (verification start position, length, verification algorithm) or (0: indicates no verification), (transmission protocol 1, transmission protocol 2...) (e.g., 0=UDP / DTLS, 1=TCP / TLS, 2=HTTP / HTTPS)].

[0037] The Shannon entropy is calculated as follows: H(X) = -Σp(x_i) × log2 (p(x_i)), where X is a random variable (here, a sequence of bytes), and p(x_i) is the probability of the byte value x_i appearing. For example, if X = [0x00, 0x01, 0x00, 0x01], then p(0x00) = 0.5, p(0x01) = 0.5, and H(X) = -(0.5 × log20.5 + 0.5 × log20.5) = 1.

[0038] For protocol feature matrix A m×n Each element in the row vector is assigned a weight value (such as the protocol identifier and the position of the length field are given larger weights), and the row vector is normalized. After this processing, the magnitude of the vector is 1, and the magnitude processing can be ignored for feature comparison, reducing the amount of computation.

[0039] The formula for normalizing vector ai is as follows: aij' = aij / ∥ai∥, where 1≤i≤m, 1≤j≤n, ∥ai∥ is the modulus of vector ai before processing, aij is the element of vector ai before processing, aij' is the element of vector ai after processing, and the modulus of vector ai after processing is 1.

[0040] For example, in the DLMS protocol: the feature parsing rule vector x=[(2,0x0001), (7,8), (1,2), (0), (1)], the feature vector a= [4, 4, 1, 0, 1], and after normalization a'=[4 / √34, 4 / √34, 1 / √34, 0, 1 / √34].

[0041] Step S22, message feature extraction.

[0042] Using matrix B m×n This represents the extracted message features. Based on X m×n For each protocol, features are extracted once according to the feature parsing rules. If the message matches parsing rule x... ij Then b ij = a ij Otherwise b ij = 0, finally for vector b i Perform unitization (where 1 ≤ i ≤ m, 1 ≤ j ≤ n). The processing of each protocol is independent and can be processed in parallel. Efficient extraction can be achieved using parallel techniques such as multithreading.

[0043] Step S23, feature comparison.

[0044] For B m×n With A m×n For feature comparison of the corresponding row vectors, the similarity can be calculated using the cosine of the angle θ between the two vectors, with the formula being cosθ. i = b i .a i / (∥b i ∥∥a i ∥) = b i .a i = ij a ij Let $\mathbf{a}$ be the vector dot product, $\mathbf{a}$ be the vector magnitudes (all have a magnitude of 1 due to normalization). A larger cosine indicates greater similarity. We select the cosθ with the largest cosine. max As the final similarity, if cosθ max If the value is greater than or equal to the threshold (e.g., the threshold is 0.9, which is adjustable), then it is a matching result; otherwise, it is an unknown protocol.

[0045] The protocol adapter library parses protocol messages and encapsulates certificate data into protocol formats. The protocol adapter library is pluggable; to add a new protocol, simply add a new protocol adapter and register it in the protocol adapter library, then add the corresponding row vectors to matrices A and X.

[0046] The protocol abstraction layer defines a unified, protocol-independent core PKI operation interface (such as requestCertificate(), downloadCertificate(), queryCertificate(), etc.). This layer hides the details of the specific communication protocol at the lower level. The core logic of PKI (CA, RA) only interacts with the protocol abstraction layer.

[0047] The dynamic certificate template engine is used to dynamically generate minimal certificates based on rules. Each protocol has a certificate template, which by default only contains required fields; other optional fields are dynamically added according to the security level. Table 1 provides examples of required and optional fields for DLMS and CoAP protocols.

[0048] Table 1 Examples of required and optional fields for the two protocols

[0049]

[0050] Example 2

[0051] This application also provides a computer-readable storage medium storing a program thereon, which, when executed by a processor, implements an IoT multi-protocol self-adaptation method as described above.

[0052] The computer-readable storage medium can be an internal storage unit of any data processing device described in any of the foregoing embodiments, such as a hard disk or memory. The computer-readable storage medium can also be an external storage device of any data processing device, such as a plug-in hard disk, smart media card (SMC), SD card, flash card, etc., equipped on the device. Furthermore, the computer-readable storage medium can include both internal storage units and external storage devices of any data processing device. The computer-readable storage medium is used to store the computer program and other programs and data required by the data processing device, and can also be used to temporarily store data that has been output or will be output.

[0053] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for multi-protocol self-adaptation in the Internet of Things, characterized in that, Includes the following steps: IoT devices send protocol messages to the PKI protocol adaptation microservice; After receiving the message, the protocol adaptation microservice performs the following steps: S1, calls the protocol recognition engine to extract message features and perform recognition; S2, after identification, call the corresponding protocol adapter to parse the message to obtain the Certificate Signing Request (CSR), signature algorithm type, and security level; S3, call the dynamic certificate template engine to generate a certificate template; The certificate template is a minimal certificate dynamically generated based on rules, and each protocol has a corresponding certificate template; The protocol adaptation microservice sends the certificate template to the CA / RA microservice through the unified API provided by the protocol abstraction layer; The CA / RA microservice generates certificates based on certificate templates and sends the certificates and protocol tags to the protocol adaptation microservices through a unified API. The protocol adaptation microservice locates the protocol adapter based on the protocol tag, encapsulates the certificate data into the corresponding protocol message, and sends it to the IoT device.

2. The method for multi-protocol self-adaptation in the Internet of Things according to claim 1, characterized in that, The steps of extracting message features and performing identification include: Establish the protocol feature matrix and feature parsing rule matrix; Assign a weight value to each element in the row vector of the protocol feature matrix, and normalize the row vector; The features of the protocol message are extracted according to the feature parsing rule matrix to obtain the message feature matrix, and the row vectors in the message feature matrix are normalized. The row vectors of the message feature matrix are compared with the row vectors of the protocol feature matrix to calculate the pairwise similarity. If the maximum similarity is greater than the threshold, the match is successful and the protocol identification is completed; otherwise, the protocol is an unknown protocol.

3. The method for multi-protocol self-adaptation in the Internet of Things according to claim 2, characterized in that, The protocol feature matrix, the feature parsing rule matrix, and the message feature matrix are all m×n matrices, where m is the number of protocols and n is the dimension of the protocol's feature vector. The protocol feature matrix contains m feature vectors of IoT protocols; The feature parsing rule matrix contains m feature parsing rule vectors; The message feature matrix contains m message feature vectors.

4. The method for multi-protocol self-adaptation in the Internet of Things according to claim 3, characterized in that, The feature parsing rule vector includes: The header N bytes, protocol identifier, length field position, range of Shannon entropy in the header 4 bytes, check start position, check length, check algorithm, and transmission protocol; where N is an integer greater than 0.

5. The method for multi-protocol self-adaptation in the Internet of Things according to claim 2, characterized in that, The similarity is the cosine of the angle between the vectors.

6. The method for multi-protocol self-adaptation in the Internet of Things according to claim 1, characterized in that, The minimized certificate contains only the required fields, and other optional fields are added dynamically according to the security level.

7. A multi-protocol self-adaptive system for the Internet of Things, used to implement the method of any one of claims 1-6, characterized in that, include: The protocol is compatible with microservices, CA / RA microservices, and dynamic certificate template engines. The protocol adaptation microservice includes a protocol identification engine, a protocol adapter library, and a protocol abstraction layer; The protocol identification engine is used to extract message features and perform protocol identification. The protocol adapter library is used to parse messages and obtain protocol message elements; The protocol abstraction layer is used to provide a unified, protocol-independent core PKI operation interface; The CA / RA microservice is used to generate a certificate based on the certificate template, and send the certificate and protocol tag to the protocol adaptation microservice through the protocol abstraction layer; The dynamic certificate template engine is used to generate certificate templates; The protocol adaptation microservice is used to receive protocol messages sent by IoT devices, perform protocol identification and message parsing, send the certificate template to the CA / RA microservice through the protocol abstraction layer, find the protocol adapter according to the protocol tag, encapsulate the certificate data into the corresponding protocol message and send it to the IoT device.

8. The IoT multi-protocol self-adaptation system according to claim 7, characterized in that, The PKI operation interface of the protocol abstraction layer includes the following API functions: requestCertificate(), downloadCertificate() and queryCertificate(), The API functions are used to shield the details of the underlying communication protocol, so that the core logic of PKI only interacts with the protocol abstraction layer.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed by a processor, it controls the device containing the storage medium to perform the Internet of Things multi-protocol self-adaptation method as described in any one of claims 1-6.

Images