Internet of Things terminal security protection method and system based on edge computing and lightweight model

Abstract

The invention provides an Internet of Things terminal security protection method and system based on edge calculation and a lightweight model, and the method comprises the steps: obtaining the thermal radiation data of an Internet of Things terminal, and determining a resource capacity threshold range of a security isolation region; a task queue delay constraint parameter is combined to be input into a memory occupation prediction model, and a deployment strategy of the lightweight security component is generated; performing resource allocation mapping on the security isolation region to generate a memory allocation topological structure of the lightweight security component; generating a synchronous change parameter of the resource occupancy rate and the fluctuation characteristic value of the thermal radiation data by combining the fluctuation characteristic value of the thermal radiation data; and generating a cooperative protection instruction of the physical layer state of the Internet of Things terminal and the trusted execution environment according to the synchronous change parameter, and triggering real-time security protection operation on the Internet of Things terminal according to the cooperative protection instruction. According to the method, the problem of security protection failure of the resource-limited terminal is solved, the security protection real-time performance and the resource utilization rate are improved, and the defect that physical constraint and electrical protection are disjointed is overcome.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things terminal security protection technology, and in particular to an Internet of Things terminal security protection method and system based on edge computing and lightweight models. Background Art

[0002] With the widespread application of Internet of Things technology in resource-constrained terminal environments such as smart manufacturing, smart cities, and smart homes, terminal devices are facing increasingly complex security threats. These scenarios require security protection solutions to not only have real-time response capabilities, but also to adapt to limited computing resources and energy consumption constraints. Therefore, there is an urgent need for an efficient and adaptive security protection mechanism that can achieve efficient and adaptive security protection under resource-constrained conditions.

[0003] The current mainstream solution is a lightweight security isolation solution based on hardware-assisted virtualization. This approach leverages the trusted execution environment (TEE) functionality provided by embedded platforms to create an isolated secure operating zone locally on the terminal. Static memory partitioning and task priority scheduling ensure the stable operation of security components. Combined with pre-loaded lightweight intrusion detection models, it dynamically monitors terminal behavior to identify and block abnormal operations and physical attacks. Existing solutions have several inherent flaws, including reliance on pre-set fixed resource allocation strategies, which make it difficult to dynamically adjust to the terminal's real-time load status and physical environment changes, resulting in wasted resources or reduced security performance. Furthermore, the approach lacks effective modeling of the relationship between thermal radiation characteristics and resource utilization during system operation, making it impossible to timely perceive and coordinate optimization of power consumption and security strategies, affecting the stability and adaptability of the overall protection effect. Summary of the Invention

[0004] The present invention provides an Internet of Things terminal security protection method and system based on edge computing and lightweight models, which is used to solve the problems in the existing technology that it relies on pre-set fixed resource configuration strategies, is difficult to make dynamic adjustments according to the real-time load status of the terminal and changes in the physical environment, resulting in resource waste or reduced security performance; lacks effective modeling of the relationship between thermal radiation characteristics and resource occupancy during system operation, cannot timely perceive and make coordinated optimization of power consumption and security strategies, and affects the stability and adaptability of the overall protection effect.

[0005] In a first aspect, the present invention provides an IoT terminal security protection method based on edge computing and a lightweight model, comprising:

[0006] Obtaining thermal radiation data of the IoT terminal, and determining a resource capacity threshold range of a secure isolation zone of a trusted execution environment based on a fluctuation characteristic value of the thermal radiation data and a preset physical state threshold range;

[0007] Inputting the resource capacity threshold range and the task queue delay constraint parameters generated by the task scheduler in the edge computing node into a preset memory usage prediction model to generate a deployment strategy for a lightweight security component adapted to the trusted execution environment;

[0008] Performing a resource allocation mapping operation on the secure isolation area based on the deployment strategy to generate a memory allocation topology structure of the lightweight security component in the trusted execution environment;

[0009] Based on the memory allocation topology and the fluctuation characteristic value of the thermal radiation data, adjusting the operating power consumption parameter of the lightweight security component to generate a synchronous change parameter of the resource occupancy rate and the fluctuation characteristic value of the thermal radiation data;

[0010] Based on the synchronous change parameters, a collaborative protection instruction for the physical layer state of the Internet of Things terminal and the trusted execution environment is generated, and a real-time security protection operation for the Internet of Things terminal is triggered according to the collaborative protection instruction to perform security protection of the Internet of Things terminal.

[0011] Optionally, obtaining thermal radiation data of an IoT terminal and determining a resource capacity threshold range of a secure isolation area of ​​a trusted execution environment based on a fluctuation characteristic value of the thermal radiation data and a preset physical state threshold range include:

[0012] The thermal radiation sensor collects thermal radiation data from the chip surface of the IoT terminal and generates a thermal radiation intensity sequence marked with a continuous time stamp;

[0013] Extracting the fluctuation characteristic values ​​in the thermal radiation intensity sequence, wherein the fluctuation characteristic values ​​in the thermal radiation intensity sequence include the maximum variation amplitude and continuous fluctuation frequency of the thermal radiation intensity per unit time;

[0014] Inputting the maximum change amplitude and the continuous fluctuation frequency into a preset physical state threshold interval and matching them, and generating a physical state level that matches the maximum change amplitude and the continuous fluctuation frequency;

[0015] A resource capacity threshold range of the security isolation area is generated according to the constraint relationship between the physical status level and the preset resource capacity.

[0016] Optionally, the resource capacity threshold range and the task queue delay constraint parameter generated by the task scheduler in the edge computing node are input into a preset memory usage prediction model to generate a deployment strategy for a lightweight security component adapted to the trusted execution environment, including:

[0017] Decomposing the resource capacity threshold range into a set of capacity boundary values ​​of independent memory blocks through a resource delay bidirectional constraint engine in a preset memory occupancy prediction model;

[0018] The task queue status of the IoT terminal is monitored by a task scheduler in an edge computing node, a task queue delay constraint parameter is generated, and the task queue delay constraint parameter is converted into a time window sequence;

[0019] According to the spatiotemporal mapping relationship between the capacity boundary value set and the time window sequence, a matching search is performed in a preset lightweight security component deployment rule library, and a candidate lightweight security component set that meets the capacity boundary value set and covers the time window sequence is generated according to the search results;

[0020] Performing a difference calculation between a resource consumption scalar value of each lightweight security component in the candidate lightweight security component set and a capacity boundary value of the independent memory block to generate a resource margin difference sequence;

[0021] Generating a deployment priority sequence of the lightweight security components based on the numerical size relationship of the resource margin difference sequence;

[0022] The candidate lightweight security component set is mapped to the secure isolation area of ​​the trusted execution environment according to the deployment priority sequence to generate a deployment policy for the lightweight security component adapted to the trusted execution environment.

[0023] Optionally, performing a resource allocation mapping operation on the secure isolation area based on the deployment policy to generate a memory allocation topology structure of the lightweight security component in the trusted execution environment includes:

[0024] Parsing the resource quota field in the deployment policy, and generating a resource requirement feature vector and a target logical memory block identifier of the lightweight security component according to the parsing result;

[0025] Divide the continuous memory space of the secure isolation area into physical memory blocks corresponding to the resource quota field according to the target logical memory block identifier, and perform physical address encoding on the physical memory blocks to generate a block address mapping table;

[0026] Based on the matching relationship between the resource requirement feature vector and the space capacity of the physical memory block, the lightweight security component is allocated to the target physical memory block to generate a component block binding relationship set;

[0027] Generating a data channel connection relationship between the lightweight security components according to the deployment location field in the component block binding relationship set;

[0028] The block address mapping table, the component block binding relationship set, and the data channel connection relationship are combined to generate a memory allocation topology structure of the lightweight security component in the trusted execution environment.

[0029] Optionally, based on the memory allocation topology and the fluctuation characteristic value of the thermal radiation data, adjusting the operating power consumption parameter of the lightweight security component to generate a synchronous variation parameter of the resource occupancy rate and the fluctuation characteristic value of the thermal radiation data includes:

[0030] dividing the thermally sensitive properties of the components of the lightweight safety component according to the continuous fluctuation frequency in the fluctuation characteristic value of the thermal radiation data to generate a thermally sensitive component set and a thermally stable component set;

[0031] Positioning a temperature monitoring point based on a physical memory block spatial location identifier in the memory allocation topology structure to generate temperature monitoring point coordinates of a target physical memory block where a heat-sensitive component in the heat-sensitive component set is located;

[0032] generating voltage frequency configuration parameters of the heat-sensitive component according to the coordinates of the temperature monitoring point and the fluctuation characteristic values ​​of the thermal radiation data;

[0033] Adjusting the power consumption of the heat-sensitive component based on the voltage-frequency configuration parameter, and using the operating power consumption parameter of the heat-stable component in the heat-stable component set as a reference value during the adjustment process to generate a resource occupancy rate of the lightweight safety component;

[0034] According to the maximum change amplitude of the resource occupancy rate and the fluctuation characteristic value of the thermal radiation data, the proportional coefficient of the change amount of the resource occupancy rate and the fluctuation characteristic value of the thermal radiation data is calculated to generate the synchronous change parameter of the resource occupancy rate and the fluctuation characteristic value of the thermal radiation data.

[0035] Optionally, adjusting the power consumption of the thermally sensitive component based on the voltage-frequency configuration parameter, and using the operating power consumption parameter of the thermally stable component in the thermally stable component set as a reference value during the adjustment process to generate the resource occupancy rate of the lightweight safety component, includes:

[0036] Loading the voltage and frequency configuration parameters to a hardware driver interface corresponding to the heat-sensitive component to generate a power consumption adjustment drive signal for the heat-sensitive component;

[0037] switching the voltage frequency of the heat-sensitive component according to the power consumption adjustment driving signal to generate real-time power consumption status data of the heat-sensitive component;

[0038] Inputting a preset reference voltage frequency maintenance signal into a thermally stable component in the thermally stable component set to generate reference power consumption state data of the thermally stable component;

[0039] Aggregating the real-time power consumption status data and the benchmark power consumption status data to generate a global power consumption distribution map of the lightweight security component;

[0040] The global power consumption distribution map is analyzed by a preset resource occupancy rate collector, and the resource occupancy rate of the lightweight security component is generated according to the analysis result.

[0041] Optionally, generating a collaborative protection instruction for the physical layer state of the IoT terminal and the trusted execution environment based on the synchronous change parameter, and triggering a real-time security protection operation for the IoT terminal based on the collaborative protection instruction to perform IoT terminal security protection, including:

[0042] Parsing the synchronous change parameter through a preset instruction generator to generate a physical layer security risk level identifier;

[0043] Matching the physical layer security risk level identifier with a preset protection mode rule library to generate an operating mode switching instruction for the lightweight security component;

[0044] Distributing the operation mode switching instruction to the secure isolation area, triggering an operation to update the operation status of the lightweight security component, and generating operation status update data of the lightweight security component;

[0045] Generate a terminal security protection status change record based on the running status update data;

[0046] A collaborative protection instruction for the physical layer status of the IoT terminal and the trusted execution environment is generated based on the terminal security protection status change record, and a real-time security protection operation is triggered to perform IoT terminal security protection.

[0047] In a second aspect, the present invention provides an Internet of Things terminal security protection system based on edge computing and a lightweight model, comprising:

[0048] An acquisition module is configured to acquire thermal radiation data of an IoT terminal and determine a resource capacity threshold range of a secure isolation zone of a trusted execution environment based on a fluctuation characteristic value of the thermal radiation data and a preset physical state threshold range;

[0049] An input module, configured to input the resource capacity threshold range and the task queue delay constraint parameters generated by the task scheduler in the edge computing node into a preset memory usage prediction model to generate a deployment strategy for a lightweight security component adapted to the trusted execution environment;

[0050] A mapping module, configured to perform a resource allocation mapping operation on the secure isolation area based on the deployment strategy, and generate a memory allocation topology structure of the lightweight security component in the trusted execution environment;

[0051] an adjustment module, configured to adjust the operating power consumption parameters of the lightweight security component based on the memory allocation topology and the fluctuation characteristic value of the thermal radiation data, and generate a synchronous variation parameter of the resource occupancy rate and the fluctuation characteristic value of the thermal radiation data;

[0052] A generation module is used to generate collaborative protection instructions for the physical layer state of the Internet of Things terminal and the trusted execution environment based on the synchronous change parameters, and trigger real-time security protection operations for the Internet of Things terminal according to the collaborative protection instructions to perform security protection of the Internet of Things terminal.

[0053] In a third aspect, the present invention provides a computing device comprising a processor and a memory, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute any of the methods described in the first aspect for protecting the security of an Internet of Things terminal based on edge computing and a lightweight model.

[0054] In a fourth aspect, the present invention provides a computer storage medium having computer program instructions stored thereon, which, when executed by a processor, implements an Internet of Things terminal security protection method based on edge computing and a lightweight model as described in any one of the first aspects.

[0055] The present invention uses a thermal radiation data-driven resource allocation mechanism to couple the physical layer chip status with the resource capacity of the trusted execution environment, thereby solving the problem of security protection failure caused by thermal mutations in resource-constrained terminals; through the coordinated deployment of edge computing nodes and lightweight models, the optimal security component deployment strategy is generated under the task queue delay constraint, achieving a dual improvement in security protection real-time performance and resource utilization; finally, through closed-loop joint control of the physical layer status and security protection instructions, the terminal maintains protection stability in thermal radiation fluctuation scenarios, breaking through the inherent defect of the disconnection between physical constraints and electrical protection in traditional security solutions.

[0056] Furthermore, dual-factor thermal radiation fluctuation feature extraction is used to accurately capture the mutation patterns and continuous abnormal characteristics of the chip's physical state, avoiding the risk of delayed response to a single temperature threshold. Through a rigid mapping mechanism between physical state level and resource capacity, the resource threshold range of the security isolation zone is determined directly based on the thermal radiation feature value, eliminating the computational overhead in traditional dynamic resource allocation, and enabling resource-constrained terminals to obtain millisecond-level physical state adaptation capabilities.

[0057] These and other aspects of the present invention will become more readily apparent from the following description of the embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0059] Figure 1 A flowchart of a method for protecting IoT terminal security based on edge computing and a lightweight model provided by an embodiment of the present invention;

[0060] Figure 2 A schematic diagram of the structure of an IoT terminal security protection system based on edge computing and a lightweight model provided by an embodiment of the present invention;

[0061] Figure 3 A schematic diagram of the structure of a computing device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0062] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0063] In some of the processes described in the specification and claims of the present invention and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or may be executed in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish between different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., and do not represent the order of precedence, nor do they limit "first" and "second" to be different types.

[0064] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of the present invention.

[0065] Figure 1 The present invention provides a flowchart of an IoT terminal security protection method based on edge computing and lightweight model, such as Figure 1 As shown, the method includes:

[0066] In the real-time security protection scenario of resource-constrained IoT terminals, the existing technology has two key defects: first, it is impossible to adjust the resource capacity boundary of the trusted execution environment security isolation zone according to the real-time physical state of the terminal, resulting in rigid resource allocation or overflow risks; second, the deployment and operation of security components lack deep coordination with the physical state and edge scheduling requirements, making it difficult to achieve linkage adjustment of resource occupancy and physical state, which can easily lead to failure or equipment damage. In response to these problems, the research and development ideas of the present invention are: first, by analyzing the fluctuation characteristics of the thermal radiation data of the IoT terminal, the dynamic resource capacity threshold range of the security isolation zone is determined in real time. Secondly, this dynamic threshold is input into the memory occupancy prediction model together with the delay constraint of the edge computing node task scheduling to generate the optimal deployment strategy of lightweight security components that matches the current trusted execution environment resources and edge requirements. Then, the isolation zone is executed according to the strategy to form a memory topology. Then, based on this topology and real-time thermal radiation characteristics, the operating power consumption of the security component is adjusted to ensure that the resource occupancy changes synchronously with the physical state. Finally, a collaborative protection instruction of the physical layer state and the trusted execution environment is generated to trigger cross-layer linkage protection operations. Based on this, the present invention provides an IoT terminal security protection method based on edge computing and lightweight models, such as Figure 1 ,include:

[0067] Step 101: Acquire thermal radiation data of an IoT terminal, and determine a resource capacity threshold range of a secure isolation area of ​​a trusted execution environment based on a fluctuation characteristic value of the thermal radiation data and a preset physical state threshold range.

[0068] In this step, thermal radiation data refers to the surface temperature distribution data of the IoT terminal collected by the infrared sensor, which is used to reflect the heating status of the chip and peripheral circuits when the device is running; the fluctuation characteristic value refers to the mean value of the main frequency amplitude extracted by frequency domain analysis of the thermal radiation data, which is used to quantify the abnormal fluctuation intensity of the terminal's physical state; the trusted execution environment refers to the isolated security area in the terminal hardware, which is used to protect the code and data integrity of key security components; the resource capacity threshold range refers to the upper and lower limits of the memory that can be dynamically allocated in the security isolation area, which is calculated based on the degree to which the thermal radiation fluctuation characteristic value exceeds the physical state threshold range.

[0069] In an embodiment of the present invention, thermal radiation data of IoT terminals is first acquired in real time through infrared sensors. Then, a sliding window Fourier transform algorithm is used to analyze the fluctuation characteristic values ​​of the thermal radiation data. The fluctuation characteristic values ​​are then compared with a preset physical state threshold range. Finally, based on the comparison results, the capacity threshold range of memory and computing resources in the secure isolation area of ​​the trusted execution environment is dynamically calculated.

[0070] Step 102: Input the resource capacity threshold range and the task queue delay constraint parameters generated by the task scheduler in the edge computing node into a preset memory occupancy prediction model to generate a deployment strategy for a lightweight security component adapted to the trusted execution environment.

[0071] In this step, the task queue delay constraint parameter refers to the maximum task processing delay time specified by the edge computing node scheduler, which is used to ensure the real-time security protection response; the preset memory usage prediction model refers to the LSTM neural network model trained based on historical resource usage data, which is used to predict the peak memory consumption of lightweight security components under specific resource thresholds; the deployment strategy refers to the combination of the loading order of lightweight security components, memory partitioning scheme and process priority configuration, which is used to adapt to the dynamic resource boundaries of the trusted execution environment.

[0072] In an embodiment of the present invention, the task queue delay constraint parameter is first extracted from the task scheduler of the edge computing node, and then the resource capacity threshold range and the delay constraint parameter are jointly input into a preset memory occupancy prediction model. Subsequently, the model is used to calculate the matching degree between the memory occupancy peak of the lightweight security component and the resource capacity threshold, and finally a lightweight security component deployment strategy is generated that meets the resource constraints of the trusted execution environment and conforms to the timeliness of edge scheduling.

[0073] Step 103: Perform a resource allocation mapping operation on the secure isolation area based on the deployment strategy to generate a memory allocation topology structure of the lightweight security component in the trusted execution environment.

[0074] In this step, the resource allocation mapping operation refers to the mapping process of converting the logical memory requests in the deployment strategy into physical memory addresses, and the buddy system algorithm is used to minimize fragmentation; the memory allocation topology structure refers to the tree structure that describes the distribution location of lightweight security components in the memory, including the data dependencies between components and shared memory areas.

[0075] In an embodiment of the present invention, first, according to the deployment strategy, a resource block mapping algorithm is used to perform an allocation operation on the physical memory address space of the secure isolation area. Secondly, a memory access path is constructed according to the component dependencies. Finally, a lightweight secure component memory allocation layout organized in a tree topology is generated to ensure that the communication overhead between components is minimized.

[0076] Step 104: Based on the memory allocation topology and the fluctuation characteristic value of the thermal radiation data, the operating power consumption parameters of the lightweight security component are adjusted to generate synchronous variation parameters of the resource occupancy rate and the fluctuation characteristic value of the thermal radiation data.

[0077] In this step, the operating power consumption parameters refer to the CPU frequency, voltage, and bus bandwidth configuration parameters of the security component, which are used to control its energy consumption during operation; the synchronous change parameter refers to the ratio of the change in resource occupancy to the change in the thermal radiation fluctuation characteristic value, which is used to characterize the linkage strength between the physical state and resource consumption.

[0078] In an embodiment of the present invention, firstly, based on the memory allocation topology structure and combined with the real-time thermal radiation fluctuation characteristic value, the dynamic voltage and frequency adjustment technology is used to adjust the operating power consumption parameters of the security component. Secondly, by monitoring the correlation coefficient between the resource occupancy rate and the thermal radiation fluctuation characteristic value, a quantitative parameter of the synchronous changes of the two is finally generated.

[0079] Step 105: Generate collaborative protection instructions for the physical layer state of the IoT terminal and the trusted execution environment based on the synchronous change parameters, and trigger real-time security protection operations for the IoT terminal based on the collaborative protection instructions to perform IoT terminal security protection.

[0080] In this step, the collaborative protection instruction refers to a compound instruction that includes both physical layer cooling control and security layer interception actions, and is used for cross-layer collaborative protection.

[0081] In an embodiment of the present invention, the synchronous change parameters are first used to construct a collaborative rule library of the physical layer state and the trusted execution environment, and then a collaborative protection instruction including resource adjustment instructions and threat interception instructions is generated through a rule engine, and finally real-time protection operations for the Internet of Things terminal are triggered.

[0082] For example, the terminal's built-in infrared sensor first collects thermal radiation data from the chip surface. Fast Fourier transform (FFT) is used to extract the thermal radiation fluctuation characteristic value. When this value exceeds a preset threshold, the resource capacity threshold range of the secure isolation zone is dynamically reduced. Secondly, the resource capacity threshold range and the latency constraint parameters issued by the edge node task scheduler are input into an LSTM memory prediction model to generate a deployment policy that only loads the core intrusion detection module. Based on this policy, a buddy system algorithm is then used to map memory blocks within the secure isolation zone, constructing a tree topology with the detection module as the root node and the logging module as child nodes. Next, the CPU frequency of the detection module is reduced based on the real-time thermal radiation fluctuation characteristic value, ensuring that resource utilization decreases synchronously with rising temperature. Finally, when the synchronous variation parameter exceeds a critical value, a coordinated protection command, combining a frequency reduction command with a process freeze command, is generated, triggering the terminal security protection system to interrupt high-risk processes and activate the cooling mechanism.

[0083] The embodiment of the present invention dynamically senses abnormal physical states of terminals through thermal radiation data, generates a resource-optimized lightweight security component deployment strategy based on edge scheduling requirements, and constructs a synchronous adjustment mechanism for physical layer status and resource occupancy, ultimately achieving a triple synergistic effect: first, it solves the problem of rigid resource allocation and avoids memory overflows caused by thermal anomalies; second, it reduces communication delays between components through memory topology optimization to meet the timeliness constraints of edge tasks; third, it establishes a linkage response between physical layer threats and security protection, significantly improving the active protection capabilities and equipment reliability of resource-constrained terminals.

[0084] To address the issue of resource allocation rigidity or overflow caused by the inability to dynamically adjust the resource capacity boundaries of the secure isolation zone of the trusted execution environment based on the real-time physical state of the terminal, this step determines the resource capacity threshold range of the secure isolation zone of the trusted execution environment. The present invention provides a specific embodiment, step 101, obtaining thermal radiation data from an IoT terminal and determining the resource capacity threshold range of the secure isolation zone of the trusted execution environment based on the fluctuation characteristic value of the thermal radiation data and a preset physical state threshold range. The specific steps include:

[0085] Step 111: Collect thermal radiation data from the chip surface of the IoT terminal through a thermal radiation sensor to generate a thermal radiation intensity sequence marked with a continuous time stamp.

[0086] In this step, the thermal radiation intensity sequence refers to a dataset of infrared radiation intensity on the surface of the terminal chip arranged in time stamp order, which is used to reflect the continuous trajectory of temperature changes during device operation.

[0087] In an embodiment of the present invention, thermal radiation data on the surface of an IoT terminal chip is first collected by a thermal radiation sensor at a fixed sampling frequency. Second, a timestamp accurate to the millisecond level is attached to each sampling point. Finally, a chronologically ordered sequence of thermal radiation intensities is generated.

[0088] Step 112: extracting the fluctuation characteristic values ​​in the thermal radiation intensity sequence, wherein the fluctuation characteristic values ​​in the thermal radiation intensity sequence include the maximum variation amplitude and continuous fluctuation frequency of the thermal radiation intensity per unit time.

[0089] In this step, the maximum variation amplitude refers to the absolute maximum value of the difference between the thermal radiation intensity of adjacent sampling points within the unit time window, which is used to characterize the intensity of the temperature mutation; the continuous fluctuation frequency refers to the number of times the thermal radiation intensity value continuously crosses the average value within the unit time, which is used to quantify the temperature oscillation frequency.

[0090] In an embodiment of the present invention, the thermal radiation intensity sequence is first segmented into sliding windows. Secondly, the absolute values ​​of the intensity differences between adjacent sampling points are calculated in each time window, and the maximum value is taken as the maximum variation amplitude per unit time. Then, the number of times the intensity value in the window continuously crosses the average value is counted as the continuous fluctuation frequency, and finally the fluctuation characteristic value including the maximum variation amplitude and the continuous fluctuation frequency is extracted.

[0091] Step 113: Input the maximum change amplitude and the continuous fluctuation frequency into a preset physical state threshold interval and perform matching, thereby generating a physical state level that matches the maximum change amplitude and the continuous fluctuation frequency.

[0092] In this step, the preset physical state threshold interval refers to a pre-established two-dimensional coordinate system area, the horizontal axis is the maximum change amplitude classification threshold, and the vertical axis is the continuous fluctuation frequency classification threshold, which is used to divide the equipment thermal state level; the matching operation refers to the process of using the maximum change amplitude and continuous fluctuation frequency as coordinate points to locate their corresponding area in the physical state threshold interval; the physical state level refers to the discrete thermal state identification determined by the matching operation, including three levels: normal, warning, and dangerous, which are divided based on the intensity of thermal radiation fluctuations.

[0093] In an embodiment of the present invention, the preset physical state threshold interval is first divided into multiple sub-intervals, each sub-interval corresponds to a specific thermal anomaly level, and then the maximum change amplitude and continuous fluctuation frequency are mapped to the horizontal and vertical coordinate axes of the threshold interval respectively. Then, the sub-interval to which the intersection area belongs is determined by double-parameter matching, and finally the corresponding physical state level is generated.

[0094] Step 114: Generate a resource capacity threshold range for the security isolation area based on the constraint relationship between the physical status level and the preset resource capacity.

[0095] In this step, the preset resource capacity constraint relationship refers to a mapping rule table between physical status levels and resource thresholds, for example, the danger level corresponds to a fifty percent reduction in the memory upper limit.

[0096] In an embodiment of the present invention, a preset resource capacity constraint relationship table is first queried, which defines the corresponding rules between the physical state level and the memory resource upper limit. Secondly, the maximum memory value allowed to be allocated is found according to the physical state level, and then the minimum guarantee value is calculated in combination with the basic resource requirements of the trusted execution environment, and finally the resource capacity threshold range of the security isolation area is generated.

[0097] The embodiment of the present invention achieves triple optimization through a dual-parameter thermal radiation feature extraction and hierarchical matching mechanism: accurately quantifying the degree of abnormality of the terminal's physical state to avoid misjudgment of a single parameter, establishing a dynamic mapping of thermal state levels and resource thresholds to address the risk of overheating and downtime caused by traditional static resource allocation, and providing precise resource boundary basis for the deployment of lightweight security components to ensure the sustainable operation of protection functions under extreme thermal conditions.

[0098] In order to solve the problem that the security component deployment strategy is difficult to simultaneously meet the dynamic resource boundary constraints and the real-time requirements of edge computing tasks, resulting in resource contention or excessive delays, this step generates a deployment strategy for lightweight security components that is adapted to the trusted execution environment. The present invention provides a specific embodiment, step 102, inputs the resource capacity threshold range and the task queue delay constraint parameters generated by the task scheduler in the edge computing node into a preset memory usage prediction model, and generates a deployment strategy for lightweight security components that is adapted to the trusted execution environment, specifically including the following steps:

[0099] Step 201: Decompose the resource capacity threshold range into a set of capacity boundary values ​​of independent memory blocks through a resource delay bidirectional constraint engine in a preset memory occupancy prediction model.

[0100] In this step, the resource delay bidirectional constraint engine refers to an optimization module that considers both memory resource boundaries and task delay constraints, and is used to decompose resource thresholds and coordinate spatiotemporal conflicts. The decomposition operation refers to the process of breaking down the total resource capacity threshold according to the time slice and memory block dimensions to form multidimensional constraints. The capacity boundary value set refers to the set of upper and lower memory limit values ​​that are allowed to be allocated to independent memory blocks within a specific time window.

[0101] In an embodiment of the present invention, first, a resource delay bidirectional constraint engine built into a preset memory occupancy prediction model is used to decompose the resource capacity threshold range by time slice using a dynamic partitioning algorithm. Secondly, independent blocks are divided according to the memory isolation requirements of the security component, and finally a set of capacity boundary values ​​including the upper and lower limits of the memory of each block is generated.

[0102] Step 202: Monitor the task queue status of the IoT terminal through the task scheduler in the edge computing node, generate task queue delay constraint parameters, and convert the task queue delay constraint parameters into a time window sequence.

[0103] In this step, the task queue status refers to the accumulated number of tasks to be processed by the IoT terminal and the waiting time of the oldest task, which is used to assess real-time risks; the monitoring operation refers to the real-time collection of queue depth and task retention time through the task scheduler's counter; the conversion operation refers to dividing the task queue delay constraint parameters into continuous time slices with millisecond-level accuracy to form schedulable units; the time window sequence refers to a sequence composed of continuous equal-time time slices, and each window corresponds to a set of resource capacity boundaries.

[0104] In an embodiment of the present invention, the task scheduler of the edge computing node first monitors the backlog depth and processing delay of the IoT terminal task queue in real time, then extracts the maximum allowable delay time as the task queue delay constraint parameter, and then converts it into a continuous time window sequence according to the time slice granularity.

[0105] Step 203: Based on the spatiotemporal mapping relationship between the capacity boundary value set and the time window sequence, a matching search is performed in a preset lightweight security component deployment rule library, and a candidate lightweight security component set that meets the capacity boundary value set and covers the time window sequence is generated based on the search results.

[0106] In this step, the spatiotemporal mapping relationship refers to the corresponding association between the capacity boundary value set and the time window sequence, ensuring that resource allocation meets timeliness; the matching retrieval operation refers to screening security components in the rule base that meet both memory boundary constraints and time window constraints.

[0107] In an embodiment of the present invention, a spatiotemporal mapping relationship between a set of capacity boundary values ​​and a time window sequence is first established, that is, each time window is associated with a set of capacity boundaries of independent memory blocks. Secondly, components that meet all block capacity boundaries and can be initialized within the corresponding time window are retrieved from the lightweight security component deployment rule library, and finally a set of candidate lightweight security components is generated.

[0108] Step 204: performing a difference calculation between the resource consumption scalar value of each lightweight security component in the candidate lightweight security component set and the capacity boundary value of the independent memory block to generate a resource margin difference sequence.

[0109] In this step, the resource consumption scalar value refers to the fixed estimated value of the memory required for the initialization and operation of the lightweight security component; the resource margin difference sequence refers to the difference set between the component resource consumption scalar value and the independent memory block capacity boundary value, reflecting the deployment margin.

[0110] In an embodiment of the present invention, the resource consumption scalar value of each lightweight security component in the candidate set is first obtained, and then subtracted from the capacity boundary value of the independent memory block respectively, and finally a resource margin difference sequence reflecting the memory usage margin of each component is generated.

[0111] Step 205: Based on the numerical value relationship of the resource margin difference sequence, generate a deployment priority sequence of the lightweight security component.

[0112] In this step, the deployment priority sequence refers to the order of component loading arranged in descending order of resource margin difference, where the larger the difference, the higher the priority.

[0113] In an embodiment of the present invention, the resource margin differences are first sorted from large to small, and then the larger the difference, the stronger the adaptability of the component to the memory boundary. Finally, a lightweight security component deployment priority sequence is generated in descending order of adaptability.

[0114] Step 206: Map the candidate lightweight security component set to the secure isolation area of ​​the trusted execution environment according to the deployment priority sequence to generate a deployment strategy for lightweight security components that is compatible with the trusted execution environment.

[0115] In this step, the mapping operation refers to the process of binding the component logical address to the physical address of the secure isolation area based on priority.

[0116] In an embodiment of the present invention, first, according to the order of the deployment priority sequence, the address space layout randomization technology is used to load the candidate lightweight security components into the secure isolation area, and then the physical memory address offset is adjusted according to the component dependency, and finally a deployment strategy that takes into account both resource utilization and security is generated.

[0117] The embodiments of the present invention achieve triple breakthroughs through the dual-dimensional space-time constraint decomposition and priority mapping mechanism: dynamically decomposing resource thresholds into independent block boundaries coupled in space and time to solve the problem of resource fragmentation, establishing dual matching rules for candidate components and memory time windows to ensure that the deployment plan meets both resource isolation and real-time requirements, and prioritizing based on resource margin differences to maximize the deployment density and reliability of security components.

[0118] To address the configuration ambiguity, memory out-of-bounds risks, and high inter-component communication latency issues that arise when allocating memory based on deployment policies, this step generates a memory allocation topology for the lightweight security component within the trusted execution environment. The present invention provides a specific embodiment, step 103, performing a resource allocation mapping operation on the secure isolation area based on the deployment policy to generate a memory allocation topology for the lightweight security component within the trusted execution environment, specifically comprising the following steps:

[0119] Step 301: Parse the resource quota field in the deployment policy, and generate a resource requirement feature vector and a target logical memory block identifier of the lightweight security component according to the parsing result.

[0120] In this step, the resource quota field refers to the configuration item in the deployment policy that defines the memory size, type, and alignment required for the lightweight security component; the parsing operation refers to the process of performing grammatical decomposition and semantic analysis on the resource quota field to extract memory requirement elements; the resource requirement feature vector refers to a digital vector composed of the component's basic memory requirement, cache size, and dependent component identifiers; the target logical memory block identifier refers to a predefined memory partition logical number used to identify storage areas with different security levels.

[0121] In an embodiment of the present invention, first, the resource quota field in the deployment strategy that describes the memory size and type required by each lightweight security component is semantically parsed, then the minimum unit and dependency relationship of the component memory requirement are extracted, and finally a resource requirement feature vector containing the requirement dimension and its corresponding target logical memory block identifier are generated.

[0122] Step 302: Divide the continuous memory space of the secure isolation area into physical memory blocks corresponding to the resource quota field according to the target logical memory block identifier, and perform physical address encoding on the physical memory blocks to generate a block address mapping table.

[0123] In this step, the physical address encoding operation refers to the process of assigning a unique hardware address to the divided physical memory block and recording the offset; the block address mapping table refers to an index table that records the correspondence between the logical block identifier and the physical memory start and end addresses.

[0124] In an embodiment of the present invention, the continuous memory space of the secure isolation area is first located based on the target logical memory block identifier, and then the physical memory blocks are divided according to the resource quota field using the buddy system algorithm. Then, the physical address of each block is encoded and the start and end addresses are recorded, and finally a block address mapping table is generated.

[0125] Step 303: Based on the matching relationship between the resource requirement feature vector and the space capacity of the physical memory block, the lightweight security component is allocated to the target physical memory block to generate a component block binding relationship set.

[0126] In this step, the spatial capacity matching relationship refers to the comparison relationship between the total capacity of the component resource demand feature vector and the available capacity of the physical memory block; the component block binding relationship set refers to the correspondence table describing the lightweight security component instance and the physical memory block to which it is allocated.

[0127] In an embodiment of the present invention, the total capacity requirement of the resource requirement feature vector is first calculated, and then it is sorted by matching degree with the spatial capacity of the physical memory block. Then, the component is allocated to the target physical memory block with the closest capacity and satisfying the dependency relationship, and finally a set describing the binding relationship between the component and the block is generated.

[0128] Step 304: Generate a data channel connection relationship between the lightweight security components according to the deployment location field in the component block binding relationship set.

[0129] In this step, the deployment location field refers to the data item in the binding relationship table that records the starting address of the physical memory block where the component is located; the data channel connection relationship refers to the set of shared memory area access paths between adjacent components established based on the deployment location field.

[0130] In an embodiment of the present invention, the deployment location field in the component block binding relationship set is first parsed, and then a shared memory channel is established between adjacent physical memory blocks according to the preset data flow rules between components, and finally a cross-component data channel connection relationship diagram is generated.

[0131] Step 305: Combine the block address mapping table, the component block binding relationship set, and the data channel connection relationship to generate a memory allocation topology structure of the lightweight security component in the trusted execution environment.

[0132] In this step, the combining operation refers to integrating the address mapping, binding relationship and channel connection data into a unified structure according to the tree topology rules.

[0133] In an embodiment of the present invention, the block address mapping table, component block binding relationship set and data channel connection relationship are first aligned according to the topological rules, and then merged into a tree structure including memory distribution, component location and communication path, and finally a complete memory allocation topology structure of the lightweight security component in the trusted execution environment is generated.

[0134] The embodiment of the present invention achieves memory optimization through triple refined mapping: based on semantic analysis, the deployment strategy is converted into quantifiable resource demand characteristics to solve the ambiguity problem of traditional configuration; through precise encoding of physical addresses and capacity matching, strict binding of components and memory blocks is achieved to avoid memory out-of-bounds risks; and data channels are dynamically constructed based on deployment locations to significantly reduce communication delays between components and improve the real-time security protection.

[0135] To address the issue of inaccurate power consumption adjustment during operation of lightweight security components under temperature fluctuations, resulting in the inability to achieve coordinated control of resource occupancy and physical status, this step generates synchronous variation parameters for resource occupancy and the fluctuation characteristic values ​​of the thermal radiation data. The present invention provides a specific embodiment, step 104, which adjusts the operating power consumption parameters of the lightweight security component based on the memory allocation topology and the fluctuation characteristic values ​​of the thermal radiation data, and generates synchronous variation parameters for resource occupancy and the fluctuation characteristic values ​​of the thermal radiation data, specifically comprising the following steps:

[0136] Step 401: dividing the thermally sensitive properties of the lightweight safety components according to the continuous fluctuation frequency in the fluctuation characteristic value of the thermal radiation data to generate a thermally sensitive component set and a thermally stable component set.

[0137] In this step, the component thermal sensitivity property refers to the sensitivity of the power consumption of the safety component to temperature fluctuations during operation, which is classified based on historical temperature rise test data; the thermally sensitive component refers to the component whose power consumption increases nonlinearly when the temperature rises, and its operating stability is easily affected by thermal fluctuations; the thermally stable component refers to the component whose power consumption maintains linear changes within the temperature fluctuation range, which serves as the power consumption adjustment benchmark.

[0138] In an embodiment of the present invention, a threshold for determining the thermal sensitivity of a component is first set based on the frequency of continuous fluctuations in the fluctuation characteristic value of the thermal radiation data. Then, components with a sensitivity to the continuous fluctuation frequency higher than the threshold are classified as a set of thermally sensitive components, and components with a sensitivity to the continuous fluctuation frequency lower than the threshold are classified as a set of thermally stable components.

[0139] Step 402: Positioning a temperature monitoring point based on a physical memory block spatial location identifier in the memory allocation topology structure to generate temperature monitoring point coordinates of a target physical memory block where a heat-sensitive component in the heat-sensitive component set is located.

[0140] In this step, the physical memory block spatial location identifier refers to the code in the memory allocation topology that describes the coordinates of the block on the physical chip; the temperature monitoring point positioning operation refers to the process of deploying the infrared sensor to the corresponding area of ​​the chip based on the spatial location identifier.

[0141] In an embodiment of the present invention, first, based on the physical memory block spatial location identifier recorded in the memory allocation topology structure, the address reverse parsing technology is used to locate the physical coordinates of the block where the heat-sensitive component is located, and then infrared temperature sensors are deployed at the corresponding coordinates as temperature monitoring points, and finally a set of temperature monitoring point coordinates is generated.

[0142] Step 403: Generate voltage frequency configuration parameters of the heat-sensitive component according to the temperature monitoring point coordinates and the fluctuation characteristic values ​​of the thermal radiation data.

[0143] In this step, the voltage and frequency configuration parameters refer to the instruction parameters for dynamically adjusting the component operating voltage and clock frequency, which are used to control the temperature rise rate.

[0144] In an embodiment of the present invention, the real-time temperature data of the temperature monitoring point coordinates is first read, and then a weighted fusion calculation is performed on it and the fluctuation characteristic value of the thermal radiation data. Then, the preset voltage and frequency configuration rules are matched through a table lookup method, and finally the dynamic voltage and frequency configuration parameters of the heat-sensitive component are generated.

[0145] Step 404: adjusting the power consumption of the thermally sensitive component based on the voltage-frequency configuration parameters, and using the operating power consumption parameters of the thermally stable components in the thermally stable component set as a reference value during the adjustment process to generate the resource occupancy rate of the lightweight safety component.

[0146] In this step, the power consumption adjustment operation refers to the technical action of modifying the component supply voltage and clock frequency in real time through the power management unit; the resource utilization rate refers to the percentage of memory and CPU usage of the lightweight security component during operation to the total available resources.

[0147] In an embodiment of the present invention, the supply voltage and clock frequency of the heat-sensitive components are first adjusted according to the voltage-frequency configuration parameters. Secondly, the operating power consumption parameters of the heat-stable component set are kept constant as the baseline value. Then, the total memory and CPU usage data of the lightweight security components are collected in real time, and finally the resource usage rate is generated.

[0148] Step 405: Calculate the proportional coefficient of the change in the resource occupancy rate and the fluctuation characteristic value of the thermal radiation data based on the maximum change amplitude in the resource occupancy rate and the fluctuation characteristic value of the thermal radiation data to generate a synchronous change parameter of the resource occupancy rate and the fluctuation characteristic value of the thermal radiation data.

[0149] In this step, the proportional coefficient calculation refers to a mathematical operation of dividing the change in resource occupancy by the maximum change amplitude of the thermal radiation fluctuation characteristic value.

[0150] In an embodiment of the present invention, the continuous change of resource occupancy over time is first recorded, and then the ratio of the change to the maximum change amplitude in the thermal radiation data fluctuation characteristic value is calculated, and finally a proportional coefficient representing the synchronization of the changes of the two is generated as a synchronization change parameter.

[0151] The embodiment of the present invention realizes triple temperature adaptive control through thermal attribute classification: through thermal attribute classification, precise regulation at the component level is realized to avoid performance loss caused by overall frequency reduction, a direct mapping between temperature monitoring points and physical memory locations is established to solve the positioning deviation problem of traditional global temperature measurement, and the dynamic coupling relationship between resource occupancy and physical state is quantified based on the proportional coefficient to provide a precise adjustment basis for cross-layer protection.

[0152] In order to improve the speed and accuracy of power consumption adjustment for thermally sensitive components and resolve software adjustment delay issues, this step generates the resource occupancy rate of the lightweight safety component. The present invention provides a specific embodiment, step 404, in which the power consumption of the thermally sensitive component is adjusted based on the voltage and frequency configuration parameters. During the adjustment process, the operating power consumption parameters of the thermally stable components in the thermally stable component set are used as a reference value to generate the resource occupancy rate of the lightweight safety component. The specific steps include:

[0153] Step 441: Load the voltage and frequency configuration parameters to the hardware driver interface corresponding to the heat-sensitive component to generate a power consumption adjustment driving signal for the heat-sensitive component.

[0154] In this step, the loading operation refers to the process of writing the voltage and frequency configuration parameters into the hardware driver interface register to realize the conversion from software instructions to hardware control; the power consumption adjustment drive signal refers to a composite signal composed of a pulse width modulation wave and a clock division instruction, which is used to accurately control the voltage and clock of the component.

[0155] In an embodiment of the present invention, the voltage and frequency configuration parameters are first transmitted to the hardware driver interface corresponding to the heat-sensitive component through the system bus. Then, the driver interface converts the parameters into a pulse width modulation signal, and finally generates a power consumption adjustment drive signal that can adjust the supply voltage and clock frequency.

[0156] Step 442: Switch the voltage frequency of the heat-sensitive component according to the power consumption adjustment driving signal to generate real-time power consumption status data of the heat-sensitive component.

[0157] In this step, the switching operation refers to the technical action of the power management chip dynamically adjusting the output voltage according to the driving signal, and the phase-locked loop circuit synchronously changing the clock frequency; the real-time power consumption status data refers to a dynamic data set containing the instantaneous voltage, current, frequency and derived power consumption values ​​of the components, which is updated multiple times per second.

[0158] In an embodiment of the present invention, the output voltage of the power management chip is first controlled according to the power consumption adjustment drive signal, and then the clock generator frequency is switched through the phase-locked loop circuit, and then the real-time current and frequency data of the component are collected, and finally the real-time power consumption status data including the instantaneous power consumption value is generated.

[0159] Step 443: Inputting a preset reference voltage frequency maintaining signal into the thermally stable component in the thermally stable component set to generate reference power consumption state data of the thermally stable component.

[0160] In this step, the reference voltage and frequency maintenance signal refers to a control instruction that forces the component to operate at a preset rated operating point to maintain power consumption stability; the reference power consumption state data refers to the constant power consumption record generated by the thermally stable component continuously operating at the rated voltage and frequency.

[0161] In an embodiment of the present invention, a reference voltage and frequency maintenance signal is first sent to the drive interface of the thermally stable component. Secondly, the signal forces the component to operate at the rated voltage and basic frequency. Then, the constant power consumption curve of the component is recorded, and finally, the reference power consumption status data is generated.

[0162] Step 444: Aggregate the real-time power consumption status data and the baseline power consumption status data to generate a global power consumption distribution map of the lightweight security component.

[0163] In this step, the aggregation operation refers to the algorithmic processing process of integrating the power consumption data of multiple components into a three-dimensional matrix according to spatial position; the global power consumption distribution map indicator is a thermal distribution map of the real-time power consumption intensity of each component at the physical position of the chip.

[0164] In an embodiment of the present invention, the real-time power consumption status data and the reference power consumption status data are first aligned according to the component identifier, and then a three-dimensional power consumption distribution model is constructed using a spatial interpolation algorithm, and finally a global power consumption distribution map is generated that marks the power consumption thermal value of each component.

[0165] Step 445: Analyze the global power consumption distribution map using a preset resource occupancy rate collector, and generate the resource occupancy rate of the lightweight security component according to the analysis result.

[0166] In this step, the parsing operation refers to the data processing process of extracting characteristic values ​​from the power consumption distribution map and converting them into resource utilization rates; the parsing result refers to the memory and CPU occupancy percentages calculated through the mapping formula between power consumption density and resource occupancy.

[0167] In an embodiment of the present invention, the power consumption density data in the global power consumption distribution map is first analyzed by a resource occupancy rate collector, and then the memory and CPU usage are calculated based on the linear relationship between power consumption density and resource occupancy, and finally the resource occupancy rate of the lightweight security component is generated.

[0168] The embodiment of the present invention achieves triple precision control through the classification regulation of thermal-sensitive components and the dynamic feedback mechanism of power consumption: millisecond-level voltage and frequency switching of thermal-sensitive components is achieved through hardware-level driving signals to solve the delay problem of traditional software adjustment; the benchmark maintenance mechanism ensures that the operating point of thermally stable components is constant to avoid performance fluctuations caused by global adjustment; resource occupancy rate analysis based on power consumption distribution map is used to establish a direct correlation model between physical power consumption and logical resource occupancy, thereby improving the accuracy of state perception.

[0169] In order to solve the problem of delayed risk response caused by the lack of a dynamic coordination mechanism between physical layer anomalies and security protection layer actions, this step performs security protection for IoT terminals. The present invention provides a specific embodiment, step 105, based on the synchronous change parameters, generates a coordinated protection instruction for the physical layer state of the IoT terminal and the trusted execution environment, and triggers a real-time security protection operation for the IoT terminal based on the coordinated protection instruction to perform IoT terminal security protection, specifically including the following steps:

[0170] Step 501: parse the synchronous change parameter through a preset instruction generator to generate a physical layer security risk level identifier.

[0171] In this step, the parsing operation refers to the data processing process of identifying the numerical range and mapping the risk level of the synchronous change parameter; the physical layer security risk level identifier refers to the discrete code that characterizes the degree of terminal overheating risk, which is determined based on the multiple of the synchronous change parameter exceeding the threshold.

[0172] In an embodiment of the present invention, the numerical range of the synchronous change parameter is first parsed by a preset instruction generator, and then the risk level is divided according to the preset threshold interval, and finally a physical layer security risk level identifier representing the degree of physical layer overheating risk is generated.

[0173] Step 502: Match the physical layer security risk level identifier with a preset protection mode rule library to generate an operation mode switching instruction for the lightweight security component.

[0174] In this step, the matching operation refers to the process of associating and querying the risk level identifier with the component operation policy predefined in the protection mode rule library; the operation mode switching instruction refers to the command set that controls the lightweight security component to switch the working mode, such as downgrading from full-function mode to running only the core detection module.

[0175] In an embodiment of the present invention, the physical layer security risk level identifier is first input into the protection mode rule library, then the predefined lightweight security component operation mode configuration rules are matched, and finally an operation mode switching instruction including a component working mode adjustment instruction is generated.

[0176] Step 503: Distribute the operation mode switching instruction to the secure isolation area, trigger the operation of updating the operation status of the lightweight security component, and generate operation status update data of the lightweight security component.

[0177] In this step, the running status update data refers to a set of real-time working parameters fed back after the component executes mode switching, including the current running mode identifier and resource occupancy value.

[0178] In an embodiment of the present invention, the operation mode switching instruction is first transmitted through the instruction distribution interface of the secure isolation area, and then the component is triggered to execute the mode switching action and collect status feedback, and finally the operation status update data containing new working parameters is generated.

[0179] Step 504: Generate a terminal security protection status change record based on the running status update data.

[0180] In this step, the terminal security protection status change record refers to a structured log that stores protection mode switching events in chronological order, recording the event type, timestamp, and associated risk level.

[0181] In an embodiment of the present invention, key fields in the running status update data are first extracted, and then the timestamp and risk level identifier are associated, and finally a terminal security protection status change record is generated that records the entire process of the protection mode change.

[0182] Step 505: Generate collaborative protection instructions for the physical layer status of the IoT terminal and the trusted execution environment based on the terminal security protection status change record, and trigger real-time security protection operations to perform IoT terminal security protection.

[0183] In this step, the generation operation refers to the data integration process of constructing cross-layer control instructions based on the state change records.

[0184] In an embodiment of the present invention, first, a cross-layer collaboration rule is constructed based on the terminal security protection status change record, and then a collaborative protection instruction is generated that includes both the physical layer cooling instruction and the security layer interception action, and finally a real-time security protection operation is triggered.

[0185] The embodiment of the present invention realizes triple collaborative protection through a dynamic risk response mechanism: quantifying the physical layer thermal risk into an operational security level identifier to solve the risk perception lag problem of traditional solutions, precise mode switching based on the rule base to ensure that the security components maintain the core protection function under overheating conditions, and synchronously triggering the physical layer cooling and security layer interception through collaborative protection instructions to improve the survivability of the terminal under extreme working conditions.

[0186] Figure 2 The present invention provides a schematic diagram of the structure of an Internet of Things terminal security protection system based on edge computing and lightweight model, as shown in FIG. Figure 2 As shown, the system includes:

[0187] An acquisition module is configured to acquire thermal radiation data of an IoT terminal and determine a resource capacity threshold range of a secure isolation zone of a trusted execution environment based on a fluctuation characteristic value of the thermal radiation data and a preset physical state threshold range;

[0188] An input module, configured to input the resource capacity threshold range and the task queue delay constraint parameters generated by the task scheduler in the edge computing node into a preset memory usage prediction model to generate a deployment strategy for a lightweight security component adapted to the trusted execution environment;

[0189] A mapping module, configured to perform a resource allocation mapping operation on the secure isolation area based on the deployment strategy, and generate a memory allocation topology structure of the lightweight security component in the trusted execution environment;

[0190] an adjustment module, configured to adjust the operating power consumption parameters of the lightweight security component based on the memory allocation topology and the fluctuation characteristic value of the thermal radiation data, and generate a synchronous variation parameter of the resource occupancy rate and the fluctuation characteristic value of the thermal radiation data;

[0191] A generation module is used to generate collaborative protection instructions for the physical layer state of the Internet of Things terminal and the trusted execution environment based on the synchronous change parameters, and trigger real-time security protection operations for the Internet of Things terminal according to the collaborative protection instructions to perform security protection of the Internet of Things terminal.

[0192] Figure 2 The IoT terminal security protection system based on edge computing and lightweight model can be executed Figure 1 The implementation principle and technical effects of the IoT terminal security protection method based on edge computing and lightweight models described in the illustrated embodiment will not be repeated here. The specific manner in which each module and unit performs operations in the IoT terminal security protection system based on edge computing and lightweight models in the above embodiment has been described in detail in the embodiments of the method and will not be elaborated on here.

[0193] In one possible design, Figure 2 The IoT terminal security protection system based on edge computing and lightweight model of the embodiment shown can be implemented as a computing device, such as Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32;

[0194] The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32 .

[0195] The processing component 32 is configured to: obtain thermal radiation data from an IoT terminal; determine a resource capacity threshold range for a secure isolation zone of a trusted execution environment based on a fluctuation characteristic value of the thermal radiation data and a preset physical state threshold range; input the resource capacity threshold range and a task queue delay constraint parameter generated by a task scheduler in an edge computing node into a preset memory occupancy prediction model to generate a deployment strategy for a lightweight security component adapted to the trusted execution environment; perform a resource allocation mapping operation on the secure isolation zone based on the deployment strategy to generate a memory allocation topology for the lightweight security component in the trusted execution environment; adjust the operating power consumption parameters of the lightweight security component based on the memory allocation topology and the fluctuation characteristic value of the thermal radiation data to generate a synchronous variation parameter for the resource occupancy rate and the fluctuation characteristic value of the thermal radiation data; and generate a coordinated protection instruction for the physical layer state of the IoT terminal and the trusted execution environment based on the synchronous variation parameter, and trigger a real-time security protection operation for the IoT terminal based on the coordinated protection instruction to perform IoT terminal security protection.

[0196] The processing component 32 may include one or more processors to execute computer instructions to perform all or part of the steps in the above method. Of course, the processing component may also be implemented as one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above method.

[0197] The storage component 31 is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile memory device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk, or optical disk.

[0198] Of course, a computing device may also include other components, such as input / output interfaces, display components, communication components, etc.

[0199] The input / output interface provides an interface between the processing component and the peripheral interface module, which can be an output device, an input device, etc.

[0200] The communication component is configured to facilitate, among other things, wired or wireless communications between the computing device and other devices.

[0201] Among them, the computing device can be a physical device or an elastic computing host provided by a cloud computing platform, etc. In this case, the computing device can refer to a cloud server, and the above-mentioned processing components, storage components, etc. can be basic server resources rented or purchased from the cloud computing platform.

[0202] The embodiment of the present invention further provides a computer storage medium storing a computer program, which can achieve the above-mentioned Figure 1 The illustrated embodiment provides a method for protecting IoT terminal security based on edge computing and a lightweight model.

[0203] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0204] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0205] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0206] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A security protection method for IoT terminals based on edge computing and lightweight models, characterized in that: include: Obtaining thermal radiation data of the IoT terminal, and determining a resource capacity threshold range of a secure isolation zone of a trusted execution environment based on a fluctuation characteristic value of the thermal radiation data and a preset physical state threshold range; Inputting the resource capacity threshold range and the task queue delay constraint parameters generated by the task scheduler in the edge computing node into a preset memory usage prediction model to generate a deployment strategy for a lightweight security component adapted to the trusted execution environment; Performing a resource allocation mapping operation on the secure isolation area based on the deployment strategy to generate a memory allocation topology structure of the lightweight security component in the trusted execution environment; Based on the memory allocation topology and the fluctuation characteristic value of the thermal radiation data, adjusting the operating power consumption parameter of the lightweight security component to generate a synchronous change parameter of the resource occupancy rate and the fluctuation characteristic value of the thermal radiation data; Based on the synchronous change parameters, a collaborative protection instruction for the physical layer state of the Internet of Things terminal and the trusted execution environment is generated, and a real-time security protection operation for the Internet of Things terminal is triggered according to the collaborative protection instruction to perform security protection of the Internet of Things terminal.

2. The method according to claim 1, characterized in that Acquire thermal radiation data from the IoT terminal, and determine a resource capacity threshold range for the secure isolation zone of the trusted execution environment based on a fluctuation characteristic value of the thermal radiation data and a preset physical state threshold range, including: The thermal radiation sensor collects thermal radiation data from the chip surface of the IoT terminal and generates a thermal radiation intensity sequence marked with a continuous time stamp; Extracting the fluctuation characteristic values ​​in the thermal radiation intensity sequence, wherein the fluctuation characteristic values ​​in the thermal radiation intensity sequence include the maximum variation amplitude and continuous fluctuation frequency of the thermal radiation intensity per unit time; Inputting the maximum change amplitude and the continuous fluctuation frequency into a preset physical state threshold interval and matching them, and generating a physical state level that matches the maximum change amplitude and the continuous fluctuation frequency; A resource capacity threshold range of the security isolation area is generated according to the constraint relationship between the physical status level and the preset resource capacity.

3. The method according to claim 1, characterized in that Inputting the resource capacity threshold range and the task queue delay constraint parameters generated by the task scheduler in the edge computing node into a preset memory usage prediction model to generate a deployment strategy for a lightweight security component adapted to the trusted execution environment, including: Decomposing the resource capacity threshold range into a set of capacity boundary values ​​of independent memory blocks through a resource delay bidirectional constraint engine in a preset memory occupancy prediction model; The task queue status of the IoT terminal is monitored by a task scheduler in an edge computing node, a task queue delay constraint parameter is generated, and the task queue delay constraint parameter is converted into a time window sequence; According to the spatiotemporal mapping relationship between the capacity boundary value set and the time window sequence, a matching search is performed in a preset lightweight security component deployment rule library, and a candidate lightweight security component set that meets the capacity boundary value set and covers the time window sequence is generated according to the search results; Performing a difference calculation between a resource consumption scalar value of each lightweight security component in the candidate lightweight security component set and a capacity boundary value of the independent memory block to generate a resource margin difference sequence; Generating a deployment priority sequence of the lightweight security components based on the numerical size relationship of the resource margin difference sequence; The candidate lightweight security component set is mapped to the secure isolation area of ​​the trusted execution environment according to the deployment priority sequence to generate a deployment policy for the lightweight security component adapted to the trusted execution environment.

4. The method according to claim 1, wherein Performing a resource allocation mapping operation on the secure isolation area based on the deployment strategy to generate a memory allocation topology structure of the lightweight security component in the trusted execution environment includes: Parsing the resource quota field in the deployment policy, and generating a resource requirement feature vector and a target logical memory block identifier of the lightweight security component according to the parsing result; Divide the continuous memory space of the secure isolation area into physical memory blocks corresponding to the resource quota field according to the target logical memory block identifier, and perform physical address encoding on the physical memory blocks to generate a block address mapping table; Based on the matching relationship between the resource requirement feature vector and the space capacity of the physical memory block, the lightweight security component is allocated to the target physical memory block to generate a component block binding relationship set; Generating a data channel connection relationship between the lightweight security components according to the deployment location field in the component block binding relationship set; The block address mapping table, the component block binding relationship set, and the data channel connection relationship are combined to generate a memory allocation topology structure of the lightweight security component in the trusted execution environment.

5. The method according to claim 1, wherein Based on the memory allocation topology and the fluctuation characteristic value of the thermal radiation data, adjusting the operating power consumption parameter of the lightweight security component to generate a synchronous change parameter of the resource occupancy rate and the fluctuation characteristic value of the thermal radiation data, including: dividing the thermally sensitive properties of the components of the lightweight safety component according to the continuous fluctuation frequency in the fluctuation characteristic value of the thermal radiation data to generate a thermally sensitive component set and a thermally stable component set; Positioning a temperature monitoring point based on a physical memory block spatial location identifier in the memory allocation topology structure to generate temperature monitoring point coordinates of a target physical memory block where a heat-sensitive component in the heat-sensitive component set is located; generating voltage frequency configuration parameters of the heat-sensitive component according to the coordinates of the temperature monitoring point and the fluctuation characteristic values ​​of the thermal radiation data; Adjusting the power consumption of the heat-sensitive component based on the voltage-frequency configuration parameter, and using the operating power consumption parameter of the heat-stable component in the heat-stable component set as a reference value during the adjustment process to generate a resource occupancy rate of the lightweight safety component; According to the maximum change amplitude of the resource occupancy rate and the fluctuation characteristic value of the thermal radiation data, the proportional coefficient of the change amount of the resource occupancy rate and the fluctuation characteristic value of the thermal radiation data is calculated to generate the synchronous change parameter of the resource occupancy rate and the fluctuation characteristic value of the thermal radiation data.

6. The method according to claim 5, characterized in that The power consumption of the heat-sensitive component is adjusted based on the voltage-frequency configuration parameter, and during the adjustment process, the operating power consumption parameter of the heat-stable component in the heat-stable component set is used as a reference value to generate the resource occupancy rate of the lightweight safety component, including: Loading the voltage and frequency configuration parameters to a hardware driver interface corresponding to the heat-sensitive component to generate a power consumption adjustment drive signal for the heat-sensitive component; switching the voltage frequency of the heat-sensitive component according to the power consumption adjustment driving signal to generate real-time power consumption status data of the heat-sensitive component; Inputting a preset reference voltage frequency maintenance signal into a thermally stable component in the thermally stable component set to generate reference power consumption state data of the thermally stable component; Aggregating the real-time power consumption status data and the benchmark power consumption status data to generate a global power consumption distribution map of the lightweight security component; The global power consumption distribution map is analyzed by a preset resource occupancy rate collector, and the resource occupancy rate of the lightweight security component is generated according to the analysis result.

7. The method according to claim 1, characterized in that Generating a coordinated protection instruction for the physical layer state of the IoT terminal and the trusted execution environment according to the synchronous change parameter, and triggering a real-time security protection operation for the IoT terminal according to the coordinated protection instruction to perform IoT terminal security protection, including: Parsing the synchronous change parameter through a preset instruction generator to generate a physical layer security risk level identifier; Matching the physical layer security risk level identifier with a preset protection mode rule library to generate an operating mode switching instruction for the lightweight security component; Distributing the operation mode switching instruction to the secure isolation area, triggering an operation to update the operation status of the lightweight security component, and generating operation status update data of the lightweight security component; Generate a terminal security protection status change record based on the running status update data; A collaborative protection instruction for the physical layer status of the IoT terminal and the trusted execution environment is generated based on the terminal security protection status change record, and a real-time security protection operation is triggered to perform IoT terminal security protection.

8. An IoT terminal security protection system based on edge computing and lightweight model, characterized in that: include: An acquisition module is configured to acquire thermal radiation data of an IoT terminal and determine a resource capacity threshold range of a secure isolation zone of a trusted execution environment based on a fluctuation characteristic value of the thermal radiation data and a preset physical state threshold range; An input module, configured to input the resource capacity threshold range and the task queue delay constraint parameters generated by the task scheduler in the edge computing node into a preset memory usage prediction model to generate a deployment strategy for a lightweight security component adapted to the trusted execution environment; A mapping module, configured to perform a resource allocation mapping operation on the secure isolation area based on the deployment strategy, and generate a memory allocation topology structure of the lightweight security component in the trusted execution environment; an adjustment module, configured to adjust the operating power consumption parameters of the lightweight security component based on the memory allocation topology and the fluctuation characteristic value of the thermal radiation data, and generate a synchronous variation parameter of the resource occupancy rate and the fluctuation characteristic value of the thermal radiation data; A generation module is used to generate collaborative protection instructions for the physical layer state of the Internet of Things terminal and the trusted execution environment based on the synchronous change parameters, and trigger real-time security protection operations for the Internet of Things terminal according to the collaborative protection instructions to perform security protection of the Internet of Things terminal.

9. A computing device, characterized in that It includes a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement an Internet of Things terminal security protection method based on edge computing and lightweight model as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that A computer program is stored, and when the computer program is executed by a computer, an Internet of Things terminal security protection method based on edge computing and a lightweight model as described in any one of claims 1 to 7 is implemented.

Images