Network security monitoring method for monitoring Internet of Things equipment

Abstract

The invention discloses a network security monitoring method for monitoring Internet of Things equipment, which belongs to the field of network security, and comprises the following steps: forcibly starting an encryption channel for bidirectional authentication of a child smart watch and a server, verifying the authenticity of the base station certificate through a hardware security chip preset in the child smart watch, and if an invalid certificate is detected, immediately cutting off the network, generating a first alarm code and sending the first alarm code to the parent APP; the method has the beneficial effects that the network security of the child smart watch is monitored, an encryption channel is forcibly started, and a pseudo base station attack is completely eradicated; measurement data of satellite positioning, WiFi positioning and base station triangulation positioning are analyzed in a cross mode, and position cheating caused by single dependence on satellite positioning is avoided; on the premise of low power consumption, high-risk voice real-time capture is realized, and the privacy invasion risk of continuous recording is avoided; and lawbreakers are effectively prevented from hurting children and parents by using network vulnerabilities.

Description

Technical Field

[0001] This invention belongs to the field of network security, and in particular relates to a network security monitoring method for monitoring Internet of Things (IoT) devices. Background Technology

[0002] Kids smartwatches are smart wearable IoT devices designed specifically for children, integrating location tracking, two-way calling, safety protection, health monitoring, and social functions. They work in conjunction with a parent's app through multiple positioning technologies (such as GPS / BeiDou / floor positioning) to protect children's safety in real time.

[0003] However, there are instances of exploiting network vulnerabilities to cause irreparable harm to children, thus necessitating the monitoring of cybersecurity for children's smartwatches. Summary of the Invention

[0004] Therefore, it is necessary to provide a network security monitoring method for monitoring IoT devices to address the above-mentioned problems.

[0005] This invention is implemented as follows: a network security monitoring method for monitoring IoT devices includes the following steps:

[0006] The encrypted channel for two-way authentication between the child's smartwatch and the server is forcibly enabled. The authenticity of the base station certificate is verified by the hardware security chip (such as eSIM) pre-installed in the child's smartwatch. If an invalid certificate (such as a fake base station) is detected, the network is immediately cut off and a first alarm code (indicating a previous communication anomaly) is generated and sent to the parent's APP to ensure that all subsequent communications are protected against eavesdropping and tampering.

[0007] Based on cross-analysis of satellite positioning, WiFi positioning, and base station triangulation measurement data through encrypted transmission channels, when a positioning anomaly is detected (spatial inconsistencies or speed anomalies are found), it is automatically marked as a suspicious positioning and a second alarm code (indicating a positioning anomaly) is sent to the parent's APP.

[0008] When a suspicious location is detected, the system analyzes the ambient audio in real time (to conserve energy) and identifies risk characteristics, including sensitive words (such as "Don't tell your parents" or "Get in the car") and abnormal voiceprints (such as a child crying). After capturing N risk characteristics, the system automatically encrypts the recording and uploads the clip to the parent's app.

[0009] In one embodiment, the present invention provides a network security monitoring method for monitoring IoT devices. The method involves forcibly enabling a two-way authentication encrypted channel between the child's smartwatch and the server. The authenticity of the base station certificate is verified using a hardware security chip pre-installed in the child's smartwatch. If an invalid certificate is detected, the network is immediately disconnected, and a first alarm code is generated and sent to the parent's app. This ensures that all subsequent communication anti-eavesdropping and anti-tampering steps are performed correctly. Specifically, this includes:

[0010] Enforce the use of a two-way authentication encrypted channel between the child smartwatch and the server. Verify the authenticity of the base station certificate through a three-layer verification process using a hardware security chip (such as eSIM) pre-installed in the child smartwatch. The first layer of verification uses a pre-installed CA public key to verify the digital signature of the base station certificate. The second layer of verification checks whether the unique identifier (such as ECI, a key parameter that uniquely identifies the cell) in the base station certificate matches the local whitelist. The third layer of verification uses the OCSP protocol (Online Certificate Status Protocol) to query the certificate revocation status in real time.

[0011] Upon successful completion of the three-layer authentication, an encrypted channel is established, a temporary session key is generated using the ECDH key exchange protocol (a key negotiation protocol), and SM4-GCM (an authentication encryption scheme) is enabled to encrypt and transmit service data (location / audio, etc.).

[0012] If the three-layer verification fails, the network is immediately disconnected, a first alarm code containing the base station ID and timestamp is generated, and pushed to the parent's APP via a backup communication link (such as SMS) to ensure that all subsequent communications are protected against eavesdropping and tampering.

[0013] In one embodiment, the present invention provides a network security monitoring method for monitoring IoT devices. The step of cross-analyzing satellite positioning, WiFi positioning, and base station triangulation measurement data based on encrypted transmission channels, and automatically marking a location as suspicious when an anomaly is detected (such as spatial inconsistencies or speed anomalies), and sending a second alarm code to the parent's app, specifically includes:

[0014] Satellite positioning is obtained by outputting latitude, longitude, altitude, and positioning accuracy factor through GPS / BeiDou module; base station triangulation is obtained by reading CID / RSSI / TA values ​​(key parameters for positioning, signal evaluation, and timing synchronization) of three nearby base stations through SIM card; and WiFi positioning is obtained by scanning the surrounding WiFi BSSID (core identifier in wireless networks) and signal strength (filtering mobile hotspots).

[0015] Real-time triple conflict detection is performed. When spatial contradictions or abnormal speeds are detected, they are automatically marked as suspicious locations. The triple conflicts are coordinate conflicts, motion state conflicts, and environmental feature conflicts.

[0016] A second alarm code containing evidence of spatial inconsistencies or abnormal speed is generated, and the suspicious location coordinates are sent to the parent's APP to trigger a vibration alert.

[0017] In one embodiment, the present invention provides a network security monitoring method for monitoring IoT devices. When a suspicious location is detected, the method involves real-time analysis of ambient audio to identify risk characteristics, including sensitive words and abnormal voiceprints. After capturing N instances of risk characteristics, the method automatically encrypts and records audio clips and uploads the recordings to a parental control app. Specifically, this includes:

[0018] When a suspicious location is detected, the ambient sound pressure is continuously monitored at an 8kHz sampling rate through the built-in DSP chip of the children's smartwatch. The main processor is only awakened when a sound intensity of >65dB is detected for more than 1 second.

[0019] After the main processor is activated, sensitive word detection is performed. The speech is translated into a text stream in real time using an ASR model (based on the Conformer architecture). A dual-array Trie tree (an efficient data structure for storing and retrieving strings) is used to match a dynamic keyword library (such as "don't tell your parents," "get on the bus," etc.). When a keyword is matched, the timestamp and confidence level are recorded. Abnormal voiceprint recognition is then performed. A pre-trained ResNet-18 model is run in parallel to extract Mel-spectral features and identify abnormal voiceprints, including crying (confidence threshold > 0.75) and screaming (confidence threshold > 0.85).

[0020] Set a 10-second sliding time window. When the number of times sensitive words are triggered reaches the first set value, the number of times abnormal voiceprints are triggered reaches the second set value, or the cumulative number of times sensitive words are triggered plus the number of times abnormal voiceprints are triggered reaches N times, encrypt and save 30 seconds of audio before and after the risk event (AES-256-CTR), generate a structured alarm message (ALERT_AUDIO_RISK) and push it to the parent APP, which includes the risk type, confidence level and audio segment hash value.

[0021] In one embodiment, the present invention provides a network security monitoring method for monitoring Internet of Things (IoT) devices, further comprising:

[0022] When children add friends through children's smartwatches, a security score is performed. The security score includes analyzing the other party's device model (such as an adult watch / phone), frequently used login location (a deduction is made if the distance from the child's location is >100km), checking the proportion of mutual friends (if <20% and there are no common groups, it is marked as low relevance), scanning the other party's historical activity (such as frequently posting content such as "free game skins"), and identifying marketing / fraudulent accounts.

[0023] When the score is greater than 80, the account is added normally. When the score is between 40 and 80, a pop-up reminder will be forced ("This user has no mutual friends with you, add with caution!") and the parent's APP will need to confirm by swiping. When the score is less than 40, the account will be automatically blocked and a "Risk Account Analysis Report" (including suspicious evidence chain) will be generated and pushed to the parent's APP.

[0024] In one embodiment, the present invention provides a network security monitoring method for monitoring Internet of Things (IoT) devices, further comprising:

[0025] For friend requests, an approval process will be conducted. If the requesting friend does not share any groups with the child or the age difference is greater than 3 years, the request will be automatically marked as a friend pending approval, pending secondary confirmation from the parent.

[0026] In one embodiment, the present invention provides a network security monitoring method for monitoring Internet of Things (IoT) devices, further comprising:

[0027] The friend request will be automatically rejected if the phone number / email address linked to the account has appeared on the danger list. The danger list includes game boosting blacklists, numbers in the Cyberspace Administration of China's fraud database, and numbers with other reported records of children's smartwatches.

[0028] In one embodiment, the present invention provides a network security monitoring method for monitoring Internet of Things (IoT) devices, further comprising:

[0029] When children actively apply to join the group, the group's credibility is scored. The credibility detection includes checking the number of violations in the group within 30 days through blockchain evidence (such as reports of gambling or violence), checking whether the group name contains "welfare" or "free" but without official certification, analyzing the age distribution of group members (if more than 30% are non-students, a warning is triggered), and identifying the proportion of inactive accounts (such as no profile picture or less than 1 message per week).

[0030] When the group's credibility score is greater than 80, it can be added normally. When the score is between 40 and 80, a pop-up reminder will be forced ("This user has no mutual friends with you, add with caution!") and the parent's APP will need to swipe to confirm. When the score is less than 40, it will be automatically blocked and a "Risk Account Analysis Report" (including suspicious evidence chain) will be generated and pushed to the parent's APP.

[0031] Compared with existing technologies, the beneficial effects of this invention are: This invention monitors the network security of children's smartwatches, forcibly enabling encrypted channels to prevent attacks from fake base stations. It cross-analyzes satellite positioning, WiFi positioning, and base station triangulation measurement data, avoiding reliance on satellite positioning and vulnerability to location spoofing. It achieves real-time capture of high-risk voice messages with low power consumption and avoids the privacy risks of continuous recording. It effectively prevents criminals from exploiting network vulnerabilities to harm children and parents. Attached Figure Description

[0032] Figure 1 This is a schematic diagram of the first part of a network security monitoring method for monitoring Internet of Things (IoT) devices, provided as an embodiment of the present invention.

[0033] Figure 2 This is a schematic diagram illustrating the process of establishing an encrypted channel, as provided in an embodiment of the present invention.

[0034] Figure 3 This is a schematic diagram of the process for detecting suspicious locations provided in an embodiment of the present invention.

[0035] Figure 4 This is a schematic diagram of the process for identifying risk features provided in an embodiment of the present invention.

[0036] Figure 5 This is a schematic diagram of the second part of a network security monitoring method for monitoring Internet of Things (IoT) devices, provided as an embodiment of the present invention.

[0037] Figure 6 This is a schematic diagram of the third part of a network security monitoring method for monitoring Internet of Things (IoT) devices, provided as an embodiment of the present invention.

[0038] Figure 7 This is a schematic diagram of the fourth part of a network security monitoring method for monitoring Internet of Things (IoT) devices provided in an embodiment of the present invention.

[0039] Figure 8 This is a schematic diagram of the fifth part of a network security monitoring method for monitoring Internet of Things (IoT) devices, provided as an embodiment of the present invention. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0041] It is understood that the terms "first," "second," etc., used in this application may be used herein to describe various elements, but unless otherwise specified, these elements are not limited by these terms. These terms are used only to distinguish one element from another. For example, without departing from the scope of this application, a first script may be referred to as a second script, and similarly, a second script may be referred to as a first script.

[0042] In one embodiment, such as Figure 1 As shown, a network security monitoring method for monitoring IoT devices includes the following steps:

[0043] Step S1: Forcefully enable the encrypted channel for two-way authentication between the child smartwatch and the server. Verify the authenticity of the base station certificate through the hardware security chip (such as eSIM) pre-installed in the child smartwatch. If an invalid certificate (such as a fake base station) is detected, immediately disconnect the network and generate the first alarm code (previously there was a communication abnormality) and send it to the parent's APP to ensure that all subsequent communications are protected against eavesdropping and tampering.

[0044] Step S2: Based on the encrypted transmission channel, cross-analyze the satellite positioning, WiFi positioning, and base station triangulation measurement data. When a positioning anomaly is detected (spatial inconsistency or speed anomaly is found), it is automatically marked as a suspicious positioning and a second alarm code (indicating a positioning anomaly) is sent to the parent's APP.

[0045] Step S3: When a suspicious location is detected, the ambient audio is analyzed in real time (to conserve energy) to identify risk characteristics, including sensitive words (such as "Don't tell your parents" or "Get in the car") and abnormal voiceprints (such as a child crying). After capturing N risk characteristics, the recording is automatically encrypted and the clip is uploaded to the parent's APP.

[0046] Step S1 is to ensure the security and reliability of the communication link. This fundamentally protects the confidentiality and integrity of all data transmissions (location, voice, messages) between the child's smartwatch and the server, preventing the acquisition of sensitive information or the injection of malicious commands.

[0047] Step S2 addresses the vulnerability of single location sources (such as GPS) to spoofing or interference, rendering location information unreliable. By fusing satellite, base station, and WiFi data and leveraging their physical differences for cross-verification, positioning accuracy and reliability are significantly improved. This effectively identifies attacks such as GPS spoofing and base station hijacking, promptly detects anomalies such as children being quickly abducted or location information being falsified, and provides accurate triggering evidence for subsequent actions (such as audio monitoring and alarms).

[0048] Step S3 involves risk audio monitoring triggered by suspicious location data. In high-risk scenarios like abnormal location activity, the system actively listens to ambient sounds to capture potentially dangerous conversations or distress signals from children. By limiting energy-intensive audio analysis to high-risk scenarios (suspicious location), the watch's battery life is significantly reduced. Combined with keyword and voiceprint recognition, it effectively captures potential audible evidence of kidnapping, abduction, or intimidation, providing crucial clues for parents and police.

[0049] In one embodiment, such as Figure 2 As shown, a network security monitoring method for monitoring IoT devices includes step S1, which forcibly enables a two-way authentication encrypted channel between the child's smartwatch and the server. The authenticity of the base station certificate is verified using a hardware security chip pre-installed in the child's smartwatch. If an invalid certificate is detected, the network is immediately disconnected and a first alarm code is generated and sent to the parent's app. This ensures that all subsequent communication anti-eavesdropping and anti-tampering steps are performed. Specifically, this includes:

[0050] Step S11: Forcefully enable the encrypted channel for two-way authentication between the child smartwatch and the server. Verify the authenticity of the base station certificate through a three-layer verification using a hardware security chip (such as eSIM) pre-installed in the child smartwatch. The first layer of verification uses a pre-installed CA public key to verify the digital signature of the base station certificate. The second layer of verification checks whether the unique identifier (such as ECI, a key parameter that uniquely identifies the cell) in the base station certificate matches the local whitelist. The third layer of verification queries the certificate revocation status in real time through the OCSP protocol (Online Certificate Status Protocol).

[0051] Step S12: When the three-layer verification is successful, an encrypted channel is established, a temporary session key is generated using the ECDH key exchange protocol (a key negotiation protocol), and SM4-GCM (an authentication encryption scheme) is enabled to encrypt and transmit service data (location / audio, etc.).

[0052] Step S13: If the three-layer verification fails, immediately disconnect the network, generate a first alarm code containing the base station ID and timestamp, and push it to the parent APP through a backup communication link (such as SMS) to ensure that all subsequent communications are protected against eavesdropping and tampering.

[0053] Step S11 performs a three-layer verification of the base station certificate, ensuring its authenticity and validity from different levels to defend against sophisticated fake base station attacks. CA public key verification ensures the certificate is issued by a trusted authority. ECI whitelist prevents attackers from using forged certificates to simulate unauthorized cells. OCSP protocol query prevents attacks using revoked certificates. This triple verification significantly raises the barrier to entry for fake base station attacks and increases the success rate of detection.

[0054] Step S12 uses the ECDH key exchange protocol to generate a temporary session key, providing perfect forward confidentiality; even if the key is leaked long-term, historical sessions cannot be decrypted. SM4-GCM encryption is enabled for transmitted service data to ensure data confidentiality and integrity. This guarantees the security of all transmitted data (location, voice, messages).

[0055] Step S13: Upon detecting a fake base station or an invalid certificate, immediately terminate the insecure connection and issue an alarm. Disconnect the network to prevent any data from being transmitted through the insecure link. The first alarm code (including evidence) should be promptly sent to parents to notify them of the specific threat (base station ID, time). A backup link (SMS) ensures that alarm information is delivered to parents even in the worst-case scenario (no secure data connection).

[0056] In one embodiment, such as Figure 3As shown, a network security monitoring method for monitoring IoT devices includes step S2, which involves cross-analyzing satellite positioning, WiFi positioning, and base station triangulation measurement data through an encrypted transmission channel. When a positioning anomaly is detected (such as spatial inconsistencies or speed anomalies), it is automatically marked as a suspicious location, and a second alarm code is sent to the parent's app. The specific steps include:

[0057] Step S21: Obtain satellite positioning by outputting latitude, longitude, altitude and positioning accuracy factor through GPS / BeiDou module; obtain base station triangulation positioning by reading CID / RSSI / TA values ​​(key parameters for positioning, signal evaluation and timing synchronization) of 3 nearby base stations through SIM card; and obtain WIFI positioning by scanning surrounding WiFi BSSID (core identifier in wireless network) and signal strength (filtering mobile hotspots).

[0058] Step S22: Perform triple conflict detection in real time. When spatial contradictions or abnormal speeds are detected, they are automatically marked as suspicious locations. The triple conflicts are coordinate conflict, motion state conflict, and environmental feature conflict.

[0059] Step S23: Generate a second alarm code containing evidence of spatial inconsistencies or abnormal speeds, send the suspicious location coordinates to the parent's APP, and trigger a vibration alert.

[0060] Coordinate Distance Conflict: Calculate the spherical distance between satellite positioning and base station triangulation coordinates. If the distance is >500 meters and the satellite HDOP (Horizontal Accuracy Attenuation Factor) <2 (high confidence), mark it as an anomaly. Motion State Conflict: Detect static / walking status using IMU sensors (accelerometer + gyroscope). If the satellite shows continuous movement >30km / h, trigger a speed anomaly. Environmental Feature Conflict: Call the pre-installed map API (Application Programming Interface) to verify the positioning point's terrain (e.g., satellite positioning returning to the center of a river, WiFi scanning detecting a library hotspot) to determine if environmental features conflict.

[0061] In one embodiment, such as Figure 4 As shown, a network security monitoring method for monitoring IoT devices includes step S3, which involves real-time analysis of ambient audio when a suspicious location is detected to identify risk characteristics, including sensitive words and abnormal voiceprints. After capturing N instances of risk characteristics, the method automatically encrypts and records audio segments and uploads them to the parental control app. The steps specifically include:

[0062] Step S31: When a suspicious location is detected, the ambient sound pressure is continuously monitored at an 8kHz sampling rate through the built-in DSP chip of the children's smartwatch. The main processor is only woken up when a sound intensity of >65dB is detected for more than 1 second.

[0063] Step S32: After the main processor is activated, sensitive word detection is performed. The speech is translated into a text stream in real time using an ASR model (based on the Conformer architecture). A dual-array Trie tree (an efficient data structure for storing and retrieving strings) is used to match a dynamic keyword library (such as "don't tell your parents," "get on the bus," etc.). When a keyword is matched, the timestamp and confidence level are recorded. Abnormal voiceprint recognition is then performed. A pre-trained ResNet-18 model is run in parallel to extract Mel-spectral features and identify abnormal voiceprints, including crying (confidence threshold > 0.75) and screaming (confidence threshold > 0.85).

[0064] Step S33: Set a 10-second sliding time window. When the number of times sensitive words are triggered reaches the first set value, the number of times abnormal voiceprints are triggered reaches the second set value, or the cumulative number of times sensitive words are triggered plus the number of times abnormal voiceprints are triggered reaches N times, encrypt and save 30 seconds of audio before and after the risk event (AES-256-CTR), generate a structured alarm message (ALERT_AUDIO_RISK) and push it to the parent APP, which includes the risk type, confidence level and audio segment hash value.

[0065] Step S31 is implemented because continuous recording and analysis consume a lot of power, so the main processor is only activated when necessary. The DSP chip is a low-power chip that continuously monitors the baseline sound pressure level. A sound intensity / duration threshold setting (>65dB for 1 second) effectively filters background noise and brief sounds, waking the main processor only when high-intensity, continuous sounds (such as cries for help, arguments, or car doors closing) occur. This significantly reduces system power consumption, extends watch battery life, and makes real-time audio risk monitoring feasible on children's smartwatches.

[0066] Step S32 requires simultaneous detection of dangerous keyword content and abnormal vocal emotions (crying, screaming). An ASR model combined with a dual-array Trie tree efficiently and accurately identifies preset sensitive words in real time. A ResNet-18 model extracts Mel-spectrum features to effectively identify specific abnormal vocal characteristics (crying, screaming). Different thresholds (0.75 for crying, 0.85 for screaming) are set to balance the detection rate and false alarm rate, adapting to varying levels of vocal recognition difficulty.

[0067] Step S33 captures associated risk events within a short period using a sliding time window (10 seconds). Diverse triggering conditions (keyword counts, voiceprint counts, total counts N) allow for flexible setting of alarm thresholds, adapting to different risk scenarios and improving alarm credibility. Encrypting and saving 30 seconds of audio before and after the event provides crucial contextual evidence; AES-256-CTR (a symmetric encryption scheme combining strong AES-256 encryption with the efficiency of CTR mode) ensures audio security. Structured alarm messages (type, confidence level, hash) make the information clear and structured, facilitating quick understanding and verification of audio authenticity by parents (through hash values). This reduces false alarms while ensuring the capture of genuine risk events and providing parents with actionable and verifiable details.

[0068] In one embodiment, such as Figure 5 As shown, a network security monitoring method for monitoring IoT devices further includes:

[0069] Step S4: When a child adds friends through a children's smartwatch, a security score is performed. The security score includes analyzing the other party's device model (such as an adult watch / phone), frequently used login location (points are deducted if the distance from the child's location is >100km), checking the proportion of mutual friends (if <20% and there are no common groups, it is marked as low relevance), scanning the other party's historical activity (such as frequently posting content such as "free game skins"), and identifying marketing / fraudulent accounts.

[0070] Step S5: When the score is greater than 80, add the account normally. When the score is between 40 and 80, a pop-up reminder will be forced ("This user has no mutual friends with you, add with caution!") and the parent's APP will need to swipe to confirm. When the score is less than 40, the account will be automatically blocked and a "Risk Account Analysis Report" (including suspicious evidence chain) will be generated and pushed to the parent's APP.

[0071] Step S4, friend security scoring, quantifies multiple features using preset rules and weights. Specifically, these features include: device model (deducting X points if an adult device model is detected), login location distance (deducting Y points for every 100km exceeding the baseline), proportion of mutual friends (deducting Z points if less than 20% and no shared groups), and historical dynamic content (deducting W points for each piece of misleading / fraudulent content identified). The deductions for each dimension are then weighted and summed using preset weighting coefficients (e.g., device model weight 0.3, distance weight 0.2, social weight 0.2, content weight 0.3) to obtain an initial total score. This score is then mapped to a final score range of 0-100 based on business logic (e.g., setting a base score or normalization).

[0072] In one embodiment, such as Figure 6 As shown, a network security monitoring method for monitoring IoT devices further includes:

[0073] Step S6: Review the friend request. If the friend requester and the child do not share a group or the age difference is greater than 3 years, the friend requester will be automatically marked as pending review and will be approved by the parent for a second confirmation.

[0074] Friend requests from children lacking a shared social circle or with a significant age gap are significantly more suspicious in terms of motive. Targeted identification of the most suspicious stranger friend requests (especially those from imposters) and mandatory secondary parental verification create a crucial filter for children's social circles, reducing the risk of exposure to harmful individuals.

[0075] In one embodiment, such as Figure 7 As shown, a network security monitoring method for monitoring IoT devices further includes:

[0076] Step S7: If the mobile phone number / email address of the account requested by a friend has appeared on the danger list, the friend request will be automatically rejected. The danger list includes the game boosting blacklist, the Cyberspace Administration of China's fraud number database, and other reports of children's smartwatches.

[0077] When an account (whether it actively requests to add a child or a child requests to add the other party) triggers a friend request, the account's primary contact information (phone number, email address) is extracted as the query key, and a real-time parallel query is initiated:

[0078] 1. Connect to the blacklist database provided by the game boosting service provider for matching.

[0079] 2. Matching is performed using a database of fraudulent phone numbers / email addresses that is regularly updated or accessed via API by the Cyberspace Administration of China.

[0080] 3. Matching is performed in the system's internal database of dangerous account records reported by other children's smartwatch users and preliminarily verified by the platform.

[0081] If the contact information is found on any of the aforementioned dangerous lists, the system will automatically reject the friend request, terminating the process and recording the reason for rejection (source of the matching list) for future reference. It utilizes external authoritative or historical risk databases to quickly identify known malicious accounts. It efficiently blocks accounts already proven to be risky (fraud, harassment, account boosting, reported accounts), forming a proactive defense layer. Integrating official blacklists from the Cyberspace Administration of China enhances the authority and coverage of the interception.

[0082] In one embodiment, such as Figure 8 As shown, a network security monitoring method for monitoring IoT devices further includes:

[0083] Step S8: When a child actively applies to join the group, the group's credibility is scored. The credibility detection includes checking the number of violations in the group within 30 days through blockchain evidence (such as reports of gambling or violence), checking whether the group name contains "welfare" or "free" but without official certification, analyzing the age distribution of group members (if >30% are non-students, a warning is triggered), and identifying the proportion of inactive accounts (such as no profile picture or <1 message / week).

[0084] Step S9: When the group's credibility score is greater than 80, add the user normally. When the score is between 40 and 80, a pop-up reminder will be forced ("This user has no mutual friends with you, add with caution!") and the parent's APP will need to confirm by swiping. When the score is less than 40, the account will be automatically blocked and a "Risk Account Analysis Report" (including suspicious evidence chain) will be generated and pushed to the parent's APP.

[0085] Step S8, group credibility scoring, is based on a quantitative analysis of the group's historical behavior and member composition. Specifically, it involves: querying the number of violations recorded on the blockchain in the past 30 days (M points deducted for each violation); detecting the misleading nature of the group name (N points deducted for unverified keywords such as "welfare" and "free"); analyzing the proportion of non-student members (P points deducted proportionally for those exceeding the 30% threshold); calculating the proportion of zombie accounts (identifying zombie accounts according to preset rules, deducting R points for every Q% increase in the proportion); and weighting and summing the deduction values ​​of each dimension according to their respective weight coefficients (e.g., violation weight 0.3, group name weight 0.2, member composition weight 0.3, zombie account weight 0.2) to obtain an initial total score. After adjustments (e.g., setting a baseline score or range conversion), a credibility score of 0-100 is finally output. Steps S5 and S9 can share a single preset program.

[0086] It should be understood that although the steps in the flowcharts of the various embodiments of the present invention are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the various embodiments may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least a portion of the sub-steps or stages of other steps.

[0087] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0088] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

[0089] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

[0090] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. A network security monitoring method for monitoring Internet of Things (IoT) devices, characterized in that, The network security monitoring method for monitoring IoT devices includes the following steps: The encrypted channel for two-way authentication between the child's smartwatch and the server is forcibly enabled. The authenticity of the base station certificate is verified by the hardware security chip pre-installed in the child's smartwatch. If an invalid certificate is detected, the network is immediately cut off and the first alarm code is generated and sent to the parent's APP to ensure that all subsequent communications are protected against eavesdropping and tampering. Based on cross-analysis of satellite positioning, WiFi positioning, and base station triangulation measurement data through encrypted transmission channels, when an abnormal positioning is detected, it is automatically marked as a suspicious positioning and a second alarm code is sent to the parent's APP. When a suspicious location is detected, the system analyzes the ambient audio in real time to identify risk characteristics, including sensitive words and abnormal voiceprints. After capturing N risk characteristics, the system automatically encrypts the recording and uploads the segment to the parent's app.

2. The network security monitoring method for monitoring IoT devices according to claim 1, characterized in that, The mandatory activation of the encrypted channel for two-way authentication between the child's smartwatch and the server verifies the authenticity of the base station certificate through a hardware security chip pre-installed in the child's smartwatch. If an invalid certificate is detected, the network is immediately cut off and a first alarm code is generated and sent to the parent's APP. This ensures that all subsequent communication anti-eavesdropping and anti-tampering steps include: Enforce the use of a two-way authentication encrypted channel between the child smartwatch and the server. Verify the authenticity of the base station certificate through a three-layer verification using the hardware security chip pre-installed in the child smartwatch. The first layer of verification uses a pre-installed CA public key to verify the digital signature of the base station certificate. The second layer of verification checks whether the unique identifier in the base station certificate matches the local whitelist. The third layer of verification queries the certificate revocation status in real time through the OCSP protocol. When the three-layer verification is successful, an encrypted channel is established, a temporary session key is generated using the ECDH key exchange protocol, and SM4-GCM encrypted transmission of service data is enabled. If the three-layer verification fails, the network is immediately disconnected, a first alarm code containing the base station ID and timestamp is generated, and pushed to the parent's APP through the backup communication link to ensure that all subsequent communications are protected against eavesdropping and tampering.

3. The network security monitoring method for monitoring IoT devices according to claim 1, characterized in that, The step of cross-analyzing satellite positioning, WiFi positioning, and base station triangulation measurement data based on encrypted transmission channels, and automatically marking a suspicious location when an abnormal positioning is detected, and sending a second alarm code to the parent's APP, specifically includes: Satellite positioning is obtained by outputting latitude, longitude, altitude and positioning accuracy factor through GPS / BeiDou module; base station triangulation is obtained by reading CID / RSSI / TA values ​​of 3 nearby base stations through SIM card; and WiFi positioning is obtained by scanning the surrounding WiFi BSSID and signal strength. Real-time triple conflict detection is performed. When spatial contradictions or abnormal speeds are detected, they are automatically marked as suspicious locations. The triple conflicts are coordinate conflicts, motion state conflicts, and environmental feature conflicts. A second alarm code containing evidence of spatial inconsistencies or abnormal speed is generated, and the suspicious location coordinates are sent to the parent's APP to trigger a vibration alert.

4. The network security monitoring method for monitoring IoT devices according to claim 1, characterized in that, When a suspicious location is detected, the system analyzes the ambient audio in real time to identify risk characteristics, including sensitive words and abnormal voiceprints. After capturing N instances of risk characteristics, the system automatically encrypts and records audio clips and uploads them to the parent's app. Specifically, this includes: When a suspicious location is detected, the ambient sound pressure is continuously monitored at an 8kHz sampling rate through the built-in DSP chip of the children's smartwatch. The main processor is only woken up when a sound intensity of >65dB is detected for more than 1 second. After the main processor is activated, sensitive word detection is performed. The speech is translated into a text stream in real time through the ASR model. A dual-array Trie tree is used to match the dynamic keyword library. When a keyword is hit, the timestamp and confidence level are recorded. Abnormal voiceprint recognition is performed. The pre-trained ResNet-18 model is run in parallel to extract Mel spectrum features and identify abnormal voiceprints, including crying and screaming. Set a 10-second sliding time window. When the number of times sensitive words are triggered reaches the first set value, the number of times abnormal voiceprints are triggered reaches the second set value, or the cumulative number of times sensitive words are triggered plus the number of times abnormal voiceprints are triggered reaches N times, encrypt and save the audio before and after the risk event for 30 seconds, generate a structured alarm message and push it to the parent's APP, including the risk type, confidence level and audio segment hash value.

5. The network security monitoring method for monitoring IoT devices according to any one of claims 1, characterized in that, Also includes: When children add friends through children's smartwatches, a security score is performed. The security score includes analyzing the other party's device model, frequently used login location, checking the proportion of mutual friends, scanning the other party's historical activity, and identifying marketing / fraudulent accounts. When the score is greater than 80, it is added normally. When the score is between 40 and 80, a pop-up reminder is forced and the parent needs to swipe to confirm in the parent's app. When the score is less than 40, it is automatically blocked and a "Risk Account Analysis Report" is generated and pushed to the parent's app.

6. The network security monitoring method for monitoring IoT devices according to claim 1 or 5, characterized in that, Also includes: For friend requests, an approval process will be conducted. If the requesting friend does not share any groups with the child or the age difference is greater than 3 years, the request will be automatically marked as a friend pending approval, pending secondary confirmation from the parent.

7. The network security monitoring method for monitoring IoT devices according to claim 6, characterized in that, Also includes: The friend request will be automatically rejected if the phone number / email address linked to the account has appeared on the danger list. The danger list includes game boosting blacklists, numbers in the Cyberspace Administration of China's fraud database, and numbers with other reported records of children's smartwatches.

8. The network security monitoring method for monitoring IoT devices according to any one of claims 1, characterized in that, Also includes: When children actively apply to join a group, the group's credibility is scored. The credibility test includes checking the number of violations in the group within 30 days through blockchain evidence, checking whether the group name contains "welfare" or "free" but without official certification, analyzing the age distribution of group members, and identifying the proportion of inactive accounts. When the group's credibility score is greater than 80, it can be added normally. When the score is between 40 and 80, a pop-up reminder will be forced and the parent's APP will need to swipe to confirm. When the score is less than 40, it will be automatically blocked and a "Risk Account Analysis Report" will be generated and pushed to the parent's APP.

Images