Security protection method and device of smart home gateway, electronic equipment and medium

Abstract

The application provides a security protection method and device of a smart home gateway, electronic equipment and a medium, the method comprises: carrying out access security protection on a smart home terminal and a remote control platform through identity authentication; carrying out data security protection on communication data between the smart home terminal, the smart home gateway and the remote control platform based on an encryption algorithm; carrying out privacy security protection on user sensitive data based on a local priority processing strategy; carrying out security protection on a firmware remote upgrade process based on a security channel constructed by an HTTPS protocol, in combination with a digital signature and an integrity check mechanism; and carrying out security protection on communication traffic based on a network traffic anomaly detection algorithm. The application adopts a multi-protocol, multi-level security mechanism and a privacy protection strategy, effectively prevents security risks such as illegal access, data leakage and privacy abuse, significantly improves the overall security of the smart home system and the user privacy protection capability, and meets the requirements of domestic security compliance.

Description

Technical Field

[0001] This application belongs to the field of smart home device technology, and relates to a security protection method, device, electronic device and medium for a smart home gateway. Background Technology

[0002] With the rapid development of IoT technology and the widespread application of smart home systems, the number of smart terminal devices connected to home network environments continues to grow, covering various types such as smart lighting, security monitoring, environmental sensing, and home appliance control. As the core hub of the home network, the smart home gateway undertakes key functions such as device access management, heterogeneous network communication, protocol conversion, and data aggregation and forwarding, making it a crucial node for achieving interconnectivity and centralized control of smart home systems.

[0003] However, because smart home gateways are typically exposed to the public internet and interact with numerous smart terminal devices, their security risks are becoming increasingly prominent. Existing smart home gateways generally suffer from weak security protection capabilities, making them vulnerable to network threats such as unauthorized device access, man-in-the-middle attacks, data eavesdropping, replay attacks, and malicious code injection. Furthermore, sensitive and private information such as user behavior data, identity information, and control commands lacks effective protection during transmission and storage, posing a risk of theft, alteration, or misuse, seriously threatening user privacy and home security.

[0004] Currently, security solutions for smart home gateways largely rely on internationally accepted encryption algorithms. However, with the increasing demands for the security and controllability of critical information infrastructure, such technical solutions struggle to meet the standards for domestically developed security compliance. Summary of the Invention

[0005] This application provides a security protection method, device, electronic device, and medium for smart home gateways, which can improve the security and user privacy protection capabilities of smart home systems, while meeting the requirements for domestic security compliance.

[0006] Firstly, this application provides a security protection method for a smart home gateway. The smart home gateway includes a Zigbee communication module, a main control module, and an Ethernet communication module. The Zigbee communication module communicates with a smart home terminal based on the Zigbee protocol. The main control module is connected to both the Zigbee communication module and the Ethernet communication module via serial communication. The Ethernet communication module communicates with a remote control platform based on the HTTPS and MQTT protocols. The method includes: providing access security protection for the smart home terminal and the remote control platform through identity authentication; providing data security protection for communication data between the smart home terminal, the smart home gateway, and the remote control platform based on encryption algorithms; providing privacy security protection for user-sensitive data generated by the smart home gateway through data interaction based on a local priority processing strategy; providing security protection for the firmware remote upgrade process based on a secure channel built using the HTTPS protocol, combined with digital signatures and integrity verification mechanisms; and providing security protection for communication traffic generated by the smart home gateway based on the Zigbee, HTTPS, and MQTT protocols based on a network traffic anomaly detection algorithm.

[0007] In one implementation of the first aspect, access security protection for the smart home terminal and the remote control platform through identity authentication includes: identifying and rejecting access requests from unauthorized terminals through a preset device whitelist and dynamic key negotiation mechanism to complete the verification of the identity legitimacy of the smart home terminal; responding to the access request from the remote control platform, authenticating the remote control platform based on a digital certificate or identity token, and authorizing the authenticated requester to access the corresponding gateway resources.

[0008] In one implementation of the first aspect, the remote control platform includes a client and a cloud server, with the client and the cloud server communicating with each other; authorizing an authenticated requester to access the corresponding gateway resources includes: after the client or the cloud server passes authentication, generating an identity token with time-sensitive, unique, and permission-binding characteristics; signing the identity token based on an encryption algorithm to obtain a signed identity token; validating the signed identity token; and authorizing the client or the cloud server to access the corresponding gateway resources after the signed identity token passes validity verification.

[0009] In one implementation of the first aspect, the smart home gateway further includes a security module, which is communicatively connected to the main control module. Data security protection of communication data between the smart home terminal, the smart home gateway, and the remote control platform based on encryption algorithms includes: encrypting data transmitted between the smart home terminal and the Zigbee communication module based on Advanced Encryption Standard (AES) algorithms; encrypting data transmitted between the Zigbee communication module and the main control module, and between the main control module and the Ethernet communication module, based on symmetric encryption algorithms, wherein the key used in the symmetric encryption algorithm is generated and managed by the security module based on a security key negotiation mechanism when the Zigbee communication module and the main control module are first paired; and encrypting data transmitted between the Ethernet communication module and the remote control platform using TLS / SSL encryption based on national cryptographic algorithms.

[0010] In one implementation of the first aspect, the smart home gateway further includes a storage module, which is communicatively connected to both the main control module and the security module. Privacy and security protection of user-sensitive data generated by the smart home gateway through data interaction based on a local priority processing strategy includes: prioritizing the desensitization and minimization of the user-sensitive data locally, and writing the processed sensitive data into the storage module; when specific business needs are met, uploading the user-sensitive data to a cloud server through a secure channel built based on HTTPS or MQTT protocols; dynamically configuring the collection, storage, and sharing scope of the user-sensitive data based on the privacy policy set by the user on the client; encrypting the sensitive data using national cryptographic algorithms or international standard algorithms before writing the processed sensitive data into the storage module and during uploading the user-sensitive data, wherein the encryption key is generated and managed by the security module.

[0011] In one implementation of the first aspect, security protection of the communication traffic generated by the smart home gateway based on the Zigbee, HTTPS, and MQTT protocols using a network traffic anomaly detection algorithm includes: real-time monitoring of the communication traffic generated by the smart home gateway based on the Zigbee, HTTPS, and MQTT protocols; processing the monitored communication traffic based on the network traffic anomaly detection algorithm to identify security threats present when the smart home gateway communicates with the smart home terminal and the remote control platform, respectively; the security threats include unauthorized access, data leakage, and protocol attacks; and triggering corresponding security protection measures based on the security threats; the security protection measures include log recording, security alarms, communication blocking, and device isolation.

[0012] In one implementation of the first aspect, the cloud server is further provided with multi-layered security management based on a user management security mechanism; wherein the user management security mechanism includes multi-factor authentication, role-based access control, sensitive operation auditing and alerting, session security management, data encryption and privacy protection, and custom security policies.

[0013] Secondly, this application provides a security protection device for a smart home gateway. The smart home gateway includes a Zigbee communication module, a main control module, and an Ethernet communication module. The Zigbee communication module communicates with a smart home terminal based on the Zigbee protocol. The main control module is connected to both the Zigbee communication module and the Ethernet communication module via serial port communication. The Ethernet communication module communicates with a remote control platform based on HTTPS and MQTT protocols. The device includes: an access protection module for providing access security protection for the smart home terminal and the remote control platform through identity authentication; and a communication protection module for... The system employs an encryption algorithm to protect the communication data between the smart home terminal, the smart home gateway, and the remote control platform. A privacy protection module is used to protect the privacy of sensitive user data generated by the smart home gateway through data interaction, based on a local priority processing strategy. An update protection module is used to provide security protection for the remote firmware upgrade process through a secure channel built on the HTTPS protocol, combined with digital signatures and integrity verification mechanisms. A traffic protection module is used to protect the communication traffic generated by the smart home gateway based on the Zigbee, HTTPS, and MQTT protocols using a network traffic anomaly detection algorithm.

[0014] Thirdly, this application provides an electronic device, comprising: a memory for storing a computer program; and a processor for executing the computer program stored in the memory to cause the electronic device to perform the method described in any of the preceding claims.

[0015] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in any of the preceding claims.

[0016] As described above, the security protection method, device, electronic device and medium for smart home gateways described in this application effectively prevent security risks such as unauthorized access, data leakage, privacy abuse, malicious firmware injection and protocol layer attacks by adopting multi-protocol and multi-layer security mechanisms and privacy protection strategies, significantly improving the overall security, stability and anti-attack capability of smart home systems, while meeting the requirements for domestic security compliance. Attached Figure Description

[0017] Figure 1 The diagram shown is a structural schematic of a smart home system according to an embodiment of this application.

[0018] Figure 2 The diagram shown is a structural schematic of a smart home gateway in one embodiment of this application.

[0019] Figure 3 The flowchart shown is a security protection method for a smart home gateway according to an embodiment of this application.

[0020] Figure 4 The diagram shown is a structural schematic of a smart home gateway in another embodiment of this application.

[0021] Figure 5 The flowchart shown is a privacy and security protection process according to an embodiment of this application.

[0022] Figure 6 The diagram shown is a flowchart of communication traffic security protection according to an embodiment of this application.

[0023] Figure 7 This diagram shows the interaction timing between the modules of the smart home gateway, the smart home terminal, and the remote control platform, according to an embodiment of this application.

[0024] Figure 8 The diagram shown is a structural schematic of a security protection device for a smart home gateway according to an embodiment of this application.

[0025] Figure 9 The diagram shows the data flow of a smart home gateway system and a security protection device for the smart home gateway, according to an embodiment of this application.

[0026] Figure 10 The diagram shown is a structural schematic of an electronic device according to an embodiment of this application.

[0027] Component designation explanation

[0028] 10 Smart Home Terminals

[0029] 20 Smart Home Gateways

[0030] 21 Zigbee communication module

[0031] 22 Main Control Module

[0032] 23 Ethernet communication module

[0033] 24 Security Modules

[0034] 25 Storage Modules

[0035] 30 Remote Control Platform

[0036] 31 Clients

[0037] 32 cloud servers

[0038] 41 Access Protection Module

[0039] 42 Communication Protection Module

[0040] 43 Privacy Protection Module

[0041] 44. Update the protection module

[0042] 45. Flow Protection Module

[0043] 51 Memory

[0044] 52 processor

[0045] 53 Monitors Detailed Implementation

[0046] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. This application can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be noted that, unless otherwise specified, the following embodiments and features in the embodiments can be combined with each other.

[0047] It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this application. Therefore, the drawings only show the components related to this application and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0048] This application provides a security protection method, device, electronic device, and medium for a smart home gateway through the following embodiments. This application utilizes the synergistic effect of multiple security protection mechanisms, including device access protection, data transmission protection, user privacy protection, firmware remote upgrade protection, and communication traffic protection, to form an integrated, multi-layered security protection architecture, constructing a defense-in-depth system covering the entire "end-network-cloud" link. This system can achieve legitimate device authentication on the terminal side, achieve local data security processing on the communication side through encrypted transmission, protocol security hardening, and traffic anomaly detection mechanisms, and achieve user permission control, operation auditing, and dynamic policy management on the cloud side, thereby comprehensively ensuring the security and controllability of the smart home system in key aspects such as device access, data transmission, storage processing, and remote control.

[0049] Before providing a detailed description of the technical solutions of this application, the hardware architecture of the smart home system and smart home gateway involved in the following embodiments of this application will be described first, so as to provide a clear basic framework for the subsequent technical content.

[0050] Please see Figure 1 The diagram shown is a structural schematic of a smart home system in one embodiment of this application.

[0051] like Figure 1 As shown, the smart home system includes a smart home terminal 10, a smart home gateway 20, and a remote control platform 30. The smart home gateway 20 is communicatively connected to both the smart home terminal 10 and the remote control platform 30.

[0052] Please see Figure 2 The image shown is a schematic diagram of the structure of a smart home gateway in one embodiment of this application.

[0053] like Figure 2 As shown, the smart home gateway 20 includes a Zigbee communication module 21, a main control module 22, and an Ethernet communication module 23. The Zigbee communication module 21 communicates with the smart home terminal 10 based on the Zigbee protocol. The main control module 22 is connected to the Zigbee communication module 21 and the Ethernet communication module 23 via serial communication. The Ethernet communication module 23 communicates with the remote control platform 30 based on the HTTPS (HyperText Transfer Protocol Secure) protocol and the MQTT (Message Queuing Telemetry Transport) protocol.

[0054] Specifically, the Zigbee communication module 21 conforms to the IEEE 802.15.4 standard and Zigbee protocol stack specification, and has the characteristics of low power consumption, self-organizing network, and multi-hop transmission. It is suitable for device interconnection scenarios in home environments where both reliability and energy efficiency are required.

[0055] The main control module 22, as the core processing unit of the smart home gateway 20, typically employs an embedded microprocessor or a system-on-a-chip (SoC). For example, it may use an ARM-based processor running a real-time operating system or a lightweight Linux system. The main control module 22 has functions such as protocol conversion, data processing, task scheduling, and security management. The main control module 22 establishes bidirectional communication connections with the Zigbee communication module 21 and the Ethernet communication module 23 via UART or USART serial ports, respectively, to achieve data interaction for command issuance and status feedback.

[0056] The Ethernet communication module 23 is used to establish a wide area network connection between the smart home gateway 20 and the remote control platform 30. This module connects to the home broadband network via a wired Ethernet interface, and then to the Internet. At the communication protocol level, the Ethernet communication module 23 uses HTTPS and MQTT protocols to interact with the remote control platform 30. HTTPS ensures the confidentiality and integrity of sensitive data such as user configuration information and authentication credentials during transmission, preventing eavesdropping and tampering. MQTT, as a lightweight publish / subscribe messaging protocol, is suitable for remote monitoring and control of devices in low-bandwidth, unstable network environments, offering advantages such as low latency and high efficiency.

[0057] The remote control platform 30 includes a client 31 and a cloud server 32, which are connected for communication. The cloud server 32 is deployed in a data center or cloud environment and is responsible for core functions such as device management, user authentication, data storage, business logic processing, and message routing. The client 31 can be an application (App) or web interface running on a smartphone, tablet, or personal computer, allowing users to remotely access, view the status of, and control smart home terminals. The client 31 and the cloud server 32 communicate via a secure encrypted channel (such as TLS / SSL) to ensure end-to-end data transmission security.

[0058] The following will describe in detail the principles and implementation methods of a security protection method, device, electronic device and medium for a smart home gateway according to this embodiment, so that those skilled in the art can understand the security protection method, device, electronic device and medium for a smart home gateway according to this embodiment without creative effort.

[0059] Please see Figure 3 The above is a flowchart illustrating a security protection method for a smart home gateway according to an embodiment of this application.

[0060] like Figure 3 As shown in the figure, this application provides a security protection method for a smart home gateway, which includes the following steps S100 to S500.

[0061] In step S100, access security protection is provided for the smart home terminal 10 and the remote control platform 30 through identity authentication.

[0062] Specifically, the smart home terminal 10 is a device that supports the Zigbee communication protocol. For example, the smart home terminal 10 can be a smart light fixture, a smart switch, and a smart curtain.

[0063] It should be noted that the number of smart home terminals 10 can be flexibly configured according to the actual application scenario, and there may be one or more, which is not limited in this application.

[0064] In one embodiment of this application, access security protection for the smart home terminal 10 and the remote control platform 30 through identity authentication includes the following steps S110 to S120.

[0065] In step S110, the access requests of unauthorized terminals are identified and rejected through a preset device whitelist and dynamic key negotiation mechanism to complete the verification of the identity and legitimacy of the smart home terminal 10.

[0066] In this embodiment, the device whitelist includes a set of authorized and legitimate device identification information. For example, the device's IEEE 802.15.4 MAC address, product serial number, or pre-set unique device ID. When a smart home terminal 10 initiates a network access request, the Zigbee communication module 21 receives the request and forwards it to the main control module 22. The main control module 22 parses the device identity information in the request message and compares it with records in the whitelist database. If the device identity is not within the whitelist, its access request is immediately rejected, and relevant event logs can be recorded for subsequent auditing.

[0067] To enhance security and prevent the impersonation of known legitimate devices, this application also introduces a dynamic key negotiation mechanism. Specifically, after a device passes the whitelist verification, the main control module 22 triggers the key negotiation process, requiring the requesting device to participate in the challenge-response authentication process. Only when the verification is successful is the device allowed to officially connect to the smart home gateway 20.

[0068] In this implementation, the dual verification mechanism of whitelist and dynamic key negotiation can effectively identify and block the spoofing access behavior of unauthorized devices, significantly improving the security protection capability of the local network boundary.

[0069] In step S120, in response to the access request from the remote control platform 30, the remote control platform 30 is authenticated based on a digital certificate or identity token, and the authenticated requester is authorized to access the corresponding gateway resources.

[0070] In this embodiment, the token can be generated based on user / service identity, device information and timestamp, and digitally signed using an encryption algorithm to ensure its immutability.

[0071] Furthermore, this application supports a token lifecycle management mechanism, including session management functions such as active expiration, remote logout, forced offline, and permission binding, to prevent unauthorized access and session hijacking. For example, when a user logs out or the device is unbound, the system adds the token to a blacklist or automatically expires it through a short validity period, thereby preventing credential abuse.

[0072] In one embodiment of this application, authorizing a requester who has passed identity authentication to access the corresponding gateway resources includes: after the client 31 or the cloud server 32 passes identity authentication, generating an identity token with time-limited, unique, and permission-binding characteristics; signing the identity token based on an encryption algorithm to obtain a signed identity token; verifying the validity of the signed identity token; and authorizing the client 31 or the cloud server 32 to access the corresponding gateway resources after the signed identity token passes the validity verification.

[0073] In this implementation, by adopting an identity token access control mechanism based on cryptographic signatures, unauthorized access and abuse of permissions can be effectively prevented, providing a reliable guarantee for the secure operation of smart home systems in open network environments.

[0074] In step S200, data security protection is provided for the communication data between the smart home terminal 10, the smart home gateway 20, and the remote control platform 30 based on an encryption algorithm.

[0075] Please see Figure 4 The diagram shown is a structural schematic of a smart home gateway 20 in another embodiment of this application.

[0076] like Figure 4 As shown, the smart home gateway 20 also includes a security module 24, which is communicatively connected to the main control module 22.

[0077] The security module 24 is used to generate and manage local data encryption keys. These local data encryption keys include Zigbee network keys, session keys, and device master keys. The security module 24 also supports a hierarchical encryption mechanism, which sets different encryption levels and access policies based on different data types (such as control commands, user privacy data, and log information) and access subjects (such as users, administrators, and third-party services), combining this with access control lists to achieve fine-grained data permission management.

[0078] In one embodiment of this application, data security protection of communication data between the smart home terminal 10, the smart home gateway 20 and the remote control platform 30 based on encryption algorithms includes the following steps S210 to S230.

[0079] In step S210, the data transmitted between the smart home terminal 10 and the Zigbee communication module 21 is encrypted based on the Advanced Encryption Standard (AES) algorithm.

[0080] Specifically, during the network access phase of the smart home terminal 10, the AES encryption algorithm is used for key negotiation and network security protection to ensure good interoperability and protocol compatibility between the smart home terminal 10 and the smart home gateway 20.

[0081] In step S220, the data transmitted between the Zigbee communication module 21 and the main control module 22, and between the main control module 22 and the Ethernet communication module 23, are encrypted based on a symmetric encryption algorithm.

[0082] In this embodiment, the key used by the symmetric encryption algorithm is generated and managed by the security module 24 based on the security key negotiation mechanism when the Zigbee communication module 21 and the main control module 22 are first paired.

[0083] Specifically, the SM4 symmetric encryption algorithm can be used to encrypt all transmitted data packets. Simultaneously, the SM3 cryptographic hash algorithm is used to generate a data digest, which is then used to verify the integrity of the data packets, effectively preventing data eavesdropping, tampering, and replay attacks. The data packets contain a digest verification field generated by the SM3 algorithm, used at the receiving end to verify the integrity and authenticity of the data during transmission through the serial communication interface.

[0084] The symmetric encryption algorithm employs a key rotation mechanism, which enhances the long-term security of the system and reduces the security risks caused by key leakage by periodically updating the key.

[0085] In step S230, the data transmitted between the Ethernet communication module 23 and the remote control platform 30 is encrypted using TLS / SSL based on the national cryptographic algorithm.

[0086] In this embodiment, the national cryptographic algorithms used include the SM2 public-key cryptography algorithm, the SM3 hash cryptography algorithm, and the SM4 block cipher algorithm.

[0087] In some embodiments, cryptographic algorithms conforming to international standards may be used to encrypt the communication data between the Ethernet communication module 23 and the remote control platform 30 to achieve corresponding security protection.

[0088] In this implementation, by encrypting the data during transmission, the confidentiality and integrity of communication data during transmission over public networks can be effectively guaranteed.

[0089] In step S300, privacy and security protection is provided for the user-sensitive data generated by the smart home gateway 20 through data interaction based on a local priority processing strategy.

[0090] In this embodiment, the user-sensitive data may originate from data reported by the smart home terminal 10, control data sent by the user through the client 31, user operation logs, and system configuration data. Taking a smart home application scenario as an example, the user-sensitive data includes user identity information (such as user account, name, mobile phone number, email address), user authentication credentials (such as password, token, key), home network topology and spatial layout information, device operating status, and control commands, as well as other information closely related to user privacy.

[0091] In one embodiment of this application, the smart home gateway 20 further includes a storage module 25, which is communicatively connected to the main control module 22 and the security module 24.

[0092] Please see Figure 5 The above is a flowchart illustrating the privacy and security protection described in an embodiment of this application.

[0093] like Figure 5 As shown, the privacy and security protection of user sensitive data generated by the smart home gateway 20 through data interaction based on the local priority processing strategy includes the following steps S301 to S304.

[0094] In step S301, the user sensitive data is desensitized and minimized prior to local processing, and the processed sensitive data is written to the storage module 25.

[0095] Specifically, the desensitization process includes processing sensitive fields using techniques such as masking, hashing, replacement, or generalization to prevent them from directly identifying specific individuals or leaking key privacy information; the minimization process is used to retain data items necessary to meet specific functions or business purposes and remove irrelevant or redundant information, thereby reducing the risk of privacy leakage.

[0096] In step S302, when specific business requirements are met, the user sensitive data is uploaded to the cloud server 32 through a secure channel built based on the HTTPS protocol or the MQTT protocol.

[0097] Specifically, the specific business requirements include: remote device status monitoring, cross-regional device linkage control, fault diagnosis and log analysis, firmware upgrade service, user-authorized data synchronization, abnormal behavior detection, and system performance optimization, which require cloud computing resources or remote service support.

[0098] In step S303, based on the privacy policy set by the user on client 31, the scope of collection, storage and sharing of the user's sensitive data is dynamically configured.

[0099] Specifically, the privacy policy allows users to set data processing rules for different data types, devices, or application scenarios as needed, thereby achieving fine-grained privacy control.

[0100] In step S304, before writing the processed sensitive data into the storage module 25, and when uploading the user's sensitive data, the sensitive data is encrypted using a national cryptographic algorithm or an international standard algorithm.

[0101] Specifically, the encryption key is generated and managed by security module 24 to prevent data leakage through physical theft and unauthorized reading.

[0102] In this implementation, by adopting a local priority processing strategy, it can be ensured that sensitive user data is kept within the local network during collection, processing and storage, reducing unnecessary uploading of sensitive information to the cloud or external networks, thereby improving data privacy and security, and complying with the principle of data minimization and relevant technical requirements for personal information protection.

[0103] In step S400, a secure channel based on the HTTPS protocol, combined with digital signature and integrity verification mechanisms, is used to provide security protection for the remote firmware upgrade process.

[0104] Specifically, the remote firmware upgrade package is signed using digital signature technology at the publishing end, and integrity verification information is generated before transmission. At the receiving end, the upgrade package undergoes signature verification and integrity verification before the firmware is written.

[0105] This implementation effectively prevents the injection of malicious firmware and unauthorized flashing, ensuring that only certified legitimate firmware can complete the update operation, thereby achieving secure and reliable remote firmware upgrades and guaranteeing the stability of device operation and system security.

[0106] In step S500, the communication traffic generated by the smart home gateway 20 based on the Zigbee, HTTPS and MQTT protocols is protected by a network traffic anomaly detection algorithm.

[0107] Please see Figure 6 The diagram shown is a flowchart of communication traffic security protection according to an embodiment of this application.

[0108] like Figure 6As shown, the security protection of communication traffic generated by the smart home gateway 20 based on Zigbee, HTTPS and MQTT protocols based on the network traffic anomaly detection algorithm includes the following steps S501 to S503.

[0109] In step S501, the communication traffic generated by the smart home gateway 20 based on the Zigbee protocol, HTTPS protocol and MQTT protocol is monitored in real time.

[0110] Specifically, the monitoring scope covers both uplink and downlink data streams, collecting multi-dimensional traffic characteristic information including packet length, communication frequency, session duration, target address distribution, protocol field characteristics, and data transmission rate, providing a data foundation for subsequent anomaly detection.

[0111] In step S502, the monitored communication traffic is processed based on a network traffic anomaly detection algorithm to identify security threats that exist when the smart home gateway 20 communicates with the smart home terminal 10 and the remote control platform 30, respectively.

[0112] In this embodiment, the security threats include unauthorized access, data leakage, and protocol attacks.

[0113] Specifically, the network traffic anomaly detection algorithm may employ a detection mechanism based on rule matching, statistical analysis, machine learning models, or a combination thereof, which can dynamically learn normal communication behavior patterns and thereby determine abnormal traffic that deviates from normal behavior.

[0114] In step S503, based on the security threat, corresponding security protection measures are triggered; the security protection measures include log recording, security alarms, communication blocking, and device isolation.

[0115] This implementation enables real-time monitoring and intelligent analysis of multi-protocol communication traffic. Without relying on external security devices, the smart home gateway can autonomously identify and respond to typical security threats such as unauthorized access, data leakage, and protocol layer attacks, significantly enhancing the system's security capabilities and overall protection level.

[0116] In one embodiment of this application, the security protection method for the smart home gateway described in this embodiment further includes step S600.

[0117] In step S600, the cloud server 32 is subjected to multiple security management based on the user management security mechanism; wherein the user management security mechanism includes multi-factor authentication, role-based access control, sensitive operation auditing and alarm, session security management, data encryption and privacy protection, and custom security policy.

[0118] In this implementation, the synergistic effect of multiple security management mechanisms can effectively improve the overall security protection level of cloud servers in terms of user identity authentication, access control, operation auditing and data protection, meet the compliance requirements of high-security application scenarios, and provide users with a reliable remote service environment.

[0119] Please see Figure 7 The diagram shows the interaction timing between the various modules of the smart home gateway, the smart home terminal, and the remote control platform according to an embodiment of this application.

[0120] like Figure 7 As shown, in this embodiment, the data interaction between each module of the smart home gateway 20 and the smart home terminal 10 and the remote control platform 30 follows a specific execution order.

[0121] It should be noted that the scope of protection of the smart home gateway security protection method described in this application embodiment is not limited to the execution order of the steps listed in this embodiment. Any solution implemented by adding, subtracting, or replacing steps in the prior art based on the principles of this application is included within the scope of protection of this application.

[0122] Please see Figure 8 The diagram shows a structural schematic of a security protection device for a smart home gateway according to an embodiment of this application.

[0123] like Figure 8 As shown, this application provides a security protection device for a smart home gateway, the device including an access protection module 41, a communication protection module 42, a privacy protection module 43, an update protection module 44, and a traffic protection module 45.

[0124] The access protection module 41 is used to provide access security protection for the smart home terminal 10 and the remote control platform 30 through identity authentication.

[0125] The communication protection module 42 is used to protect the communication data between the smart home terminal 10, the smart home gateway 20 and the remote control platform 30 based on encryption algorithms.

[0126] The privacy protection module 43 is used to protect the privacy and security of sensitive user data generated by the smart home gateway 20 through data interaction based on a local priority processing strategy.

[0127] The update protection module 44 is used to build a secure channel based on the HTTPS protocol and, in conjunction with digital signature and integrity verification mechanisms, to provide security protection for the remote firmware upgrade process.

[0128] The traffic protection module 45 is used to provide security protection for the communication traffic generated by the smart home gateway 20 based on the Zigbee protocol, HTTPS protocol and MQTT protocol based on the network traffic anomaly detection algorithm.

[0129] It should be noted that the structure and principle of the access protection module 41, communication protection module 42, privacy protection module 43, update protection module 44 and traffic protection module 45 described in this embodiment correspond one-to-one with the steps in the security protection method of the smart home gateway described above, so they will not be repeated here.

[0130] Please see Figure 9 This diagram illustrates the data flow between a smart home gateway system and a security protection device of the smart home gateway, according to an embodiment of this application. Figure 9 The data exchange process between the smart home gateway's security protection device and the smart home gateway itself, as well as between the smart home gateway and the smart home terminal and remote control platform, can be seen in detail.

[0131] It should be noted that the diagram only illustrates some examples of data interaction. In actual operation scenarios, there may be other implicit data interaction links that are not shown in the diagram.

[0132] The security protection device for the smart home gateway provided in this application embodiment can implement the security protection method for the smart home gateway described in this application. However, the implementation device for the security protection method for the smart home gateway described in this application includes, but is not limited to, the structure of the security protection device for the smart home gateway listed in this embodiment. All structural modifications and substitutions of the prior art made based on the principles of this application are included within the protection scope of this application.

[0133] Please see Figure 10 The image shown is a schematic diagram of the structure of an electronic device according to an embodiment of this application.

[0134] like Figure 10 As shown, this embodiment provides an electronic device, including a memory 51 and a processor 52.

[0135] Specifically, the memory 51 is used to store computer programs and may include various media that can store program code, such as ROM, RAM, magnetic disk, USB flash drive, memory card or optical disk.

[0136] In this embodiment, memory 51 may include a computer system readable medium in the form of volatile memory, such as RAM and / or cache memory. The electronic device may further include other removable / non-removable, volatile / non-volatile computer system storage media. Memory 51 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of the embodiments of this application.

[0137] The processor 52 is connected to the memory 51 and is used to execute the computer program stored in the memory 51 so that the electronic device performs any of the methods described above.

[0138] For example, processor 52 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc. In other embodiments, processor 52 may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0139] In some implementations, the electronic device provided in this application embodiment may further include a display 53. The display 53 is communicatively connected to the memory 51 and the processor 52, and is used to display a graphical user interface (GUI) related to the electrical drawing design method based on the DeepSeek model.

[0140] In this embodiment, the display 53 may include a display screen (display panel). In some implementations, a liquid crystal display (LCD), an organic light-emitting diode (OLED), or similar form of display panel may be used. Alternatively, the display 53 may also be a touch panel (touchscreen, touch screen), which may include a display screen and a touch-sensitive surface. When the touch-sensitive surface detects a touch operation on or near it, it transmits the information to the processor 52 to determine the type of touch event. Subsequently, the processor 52 provides corresponding visual output on the display device based on the type of touch event.

[0141] In the embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, or methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of modules / units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or units may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection of apparatuses or modules or units may be electrical, mechanical, or other forms.

[0142] The modules / units described as separate components may or may not be physically separate. The components shown as modules / units may or may not be physical modules; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules / units can be selected to achieve the objectives of the embodiments of this application, depending on actual needs. For example, the functional modules / units in the various embodiments of this application may be integrated into one processing module, or each module / unit may exist physically separately, or two or more modules / units may be integrated into one module / unit.

[0143] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0144] This application also provides a computer-readable storage medium on which a computer program is stored, which, when executed by a processor, implements the method described in any of the above embodiments. Those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing a processor. The program can be stored in a computer-readable storage medium, which is a non-transitory medium, such as random access memory, read-only memory, flash memory, hard disk, solid-state drive, magnetic tape, floppy disk, optical disk, and any combination thereof. The above storage medium can be any available medium accessible to a computer or a data storage device such as a cloud server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., digital video disc (DVD)), or a semiconductor medium (e.g., solid-state disk (SSD)).

[0145] In summary, the security protection method, device, electronic device and medium for smart home gateways provided in this application effectively prevent security risks such as unauthorized access, data leakage, privacy abuse, malicious firmware injection and protocol layer attacks by adopting multi-protocol and multi-layer security mechanisms and privacy protection strategies. This significantly improves the overall security, stability and anti-attack capability of the smart home system, while meeting the requirements for domestic security compliance.

[0146] The descriptions of the processes or structures corresponding to the above figures each have their own emphasis. For parts of a process or structure that are not described in detail, please refer to the relevant descriptions of other processes or structures.

[0147] The above embodiments are merely illustrative of the principles and effects of this application and are not intended to limit this application. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of this application. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in this application should still be covered by the claims of this application.

Claims

1. A security protection method for a smart home gateway, characterized in that, The smart home gateway includes a Zigbee communication module, a main control module, and an Ethernet communication module; the Zigbee communication module communicates with the smart home terminal based on the Zigbee protocol; the main control module is connected to the Zigbee communication module and the Ethernet communication module via serial communication. The Ethernet communication module communicates with the remote control platform based on HTTPS and MQTT protocols; the method includes: Identity authentication is used to provide access security protection for the smart home terminal and the remote control platform; Data security protection is provided for the communication data between the smart home terminal, the smart home gateway and the remote control platform based on encryption algorithms; Privacy and security protection is implemented for user-sensitive data generated by the smart home gateway through data interaction based on a local priority processing strategy. A secure channel built on the HTTPS protocol, combined with digital signatures and integrity verification mechanisms, provides security protection for the remote firmware upgrade process. Security protection is provided for the communication traffic generated by the smart home gateway based on Zigbee, HTTPS and MQTT protocols using a network traffic anomaly detection algorithm. The smart home gateway further includes a security module and a storage module, wherein the security module is communicatively connected to the main control module, and the storage module is communicatively connected to both the main control module and the security module. Privacy and security protection for sensitive user data generated by the smart home gateway through data interaction based on a local priority processing strategy includes: The sensitive user data is desensitized and minimized before being processed locally, and the processed sensitive data is written to the storage module. When specific business needs are met, the sensitive user data is uploaded to the cloud server through a secure channel built on the HTTPS or MQTT protocol. The specific business needs include: remote device status monitoring, cross-regional device linkage control, fault diagnosis and log analysis, firmware upgrade service, user-authorized data synchronization, abnormal behavior detection, and system performance optimization. Based on the privacy policy set by the user on the client, the scope of collection, storage and sharing of the user's sensitive data is dynamically configured; Before writing the processed sensitive data into the storage module, and when uploading the user's sensitive data, the sensitive data is encrypted using national cryptographic algorithms or international standard algorithms. The encryption key is generated and managed by the security module.

2. The method according to claim 1, characterized in that, Security protection for accessing the smart home terminal and the remote control platform through identity authentication includes: By using a preset device whitelist and a dynamic key negotiation mechanism, the system identifies and rejects access requests from unauthorized terminals to verify the identity and legitimacy of the smart home terminals. In response to the access request from the remote control platform, the remote control platform is authenticated based on a digital certificate or identity token, and the authenticated requester is authorized to access the corresponding gateway resources.

3. The method according to claim 2, characterized in that, The remote control platform includes a client and a cloud server, and the client and the cloud server communicate with each other. Authorizing authenticated requesters to access the corresponding gateway resources includes: After the client or the cloud server completes identity authentication, an identity token with time-sensitive, unique, and permission-binding characteristics is generated. The identity token is signed using an encryption algorithm to obtain a signed identity token; The validity of the signed identity token is verified; Once the signed identity token passes validity verification, the client or the cloud server is authorized to access the corresponding gateway resources.

4. The method according to claim 1, characterized in that, Data security protection for communication data between the smart home terminal, the smart home gateway, and the remote control platform based on encryption algorithms includes: The data transmitted between the smart home terminal and the Zigbee communication module is encrypted using an advanced encryption standard algorithm. The data transmitted between the Zigbee communication module and the main control module, and between the main control module and the Ethernet communication module, are encrypted using a symmetric encryption algorithm. The key used in the symmetric encryption algorithm is generated and managed by the security module based on a security key negotiation mechanism when the Zigbee communication module and the main control module are first paired. The data transmitted between the Ethernet communication module and the remote control platform is encrypted using TLS / SSL based on the national cryptographic algorithm.

5. The method according to claim 1, characterized in that, Security protection for communication traffic generated by the smart home gateway based on Zigbee, HTTPS, and MQTT protocols, using a network traffic anomaly detection algorithm, includes: Real-time monitoring of the communication traffic generated by the smart home gateway based on the Zigbee, HTTPS, and MQTT protocols; The monitored communication traffic is processed based on a network traffic anomaly detection algorithm to identify security threats that exist when the smart home gateway communicates with the smart home terminal and the remote control platform, respectively; the security threats include unauthorized access, data leakage, and protocol attacks; Based on the aforementioned security threat, corresponding security protection measures are triggered; these security protection measures include logging, security alerts, communication blocking, and device isolation.

6. The method according to claim 3, characterized in that, Also includes: The cloud server is subject to multiple security management mechanisms based on user management security mechanisms, including multi-factor authentication, role-based access control, sensitive operation auditing and alerting, session security management, data encryption and privacy protection, and customizable security policies.

7. A security protection device for a smart home gateway, characterized in that, The smart home gateway includes a Zigbee communication module, a main control module, and an Ethernet communication module; the Zigbee communication module communicates with the smart home terminal based on the Zigbee protocol; the main control module is connected to the Zigbee communication module and the Ethernet communication module via serial communication. The Ethernet communication module communicates with the remote control platform based on HTTPS and MQTT protocols; the device includes: An access protection module is used to provide access security protection for the smart home terminal and the remote control platform through identity authentication. The communication protection module is used to protect the communication data between the smart home terminal, the smart home gateway and the remote control platform based on encryption algorithms; The privacy protection module is used to protect the privacy and security of sensitive user data generated by the smart home gateway through data interaction based on a local priority processing strategy. The updated protection module is used to secure the remote firmware upgrade process by combining a secure channel built on the HTTPS protocol with digital signature and integrity verification mechanisms. The traffic protection module is used to provide security protection for the communication traffic generated by the smart home gateway based on the Zigbee, HTTPS and MQTT protocols based on the network traffic anomaly detection algorithm. The smart home gateway further includes a security module and a storage module, wherein the security module is communicatively connected to the main control module, and the storage module is communicatively connected to both the main control module and the security module. The privacy protection module, based on a local priority processing strategy, protects the privacy and security of sensitive user data generated by the smart home gateway through data interaction, including: The sensitive user data is desensitized and minimized before being processed locally, and the processed sensitive data is written to the storage module. When specific business needs are met, the sensitive user data is uploaded to the cloud server through a secure channel built on the HTTPS or MQTT protocol. The specific business needs include: remote device status monitoring, cross-regional device linkage control, fault diagnosis and log analysis, firmware upgrade service, user-authorized data synchronization, abnormal behavior detection, and system performance optimization. Based on the privacy policy set by the user on the client, the scope of collection, storage and sharing of the user's sensitive data is dynamically configured; Before writing the processed sensitive data into the storage module, and when uploading the user's sensitive data, the sensitive data is encrypted using national cryptographic algorithms or international standard algorithms. The encryption key is generated and managed by the security module.

8. An electronic device, characterized in that, include: The memory is used to store computer programs; A processor for executing a computer program stored in the memory to cause the electronic device to perform the method of any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 6.

Images