Safety management system and management method based on NB-IoT (Narrow Band Internet of Things)

Abstract

The invention discloses a security management system based on NB-IoT (Narrow Band Internet of Things) and a management method thereof. The system comprises a terminal security access module, a communication encryption module, a dynamic key management module, a credible upgrading and tracking module and a security policy linkage module. According to the invention, through cooperation of terminal multi-operator adaptive access, SM2 / SM4 hybrid encryption communication, dynamic key life cycle management and credible remote upgrade and tracking, end-to-end communication security, key dynamic management and firmware security upgrade are realized; communication abnormity and security events can be monitored in real time, and the key refresh cycle, the security level parameter and the network optimization threshold are self-learned and adjusted through the security policy linkage module, so that a closed-loop protection mechanism is formed; therefore, the problems of single terminal network access, fixed secret key, lack of remote upgrading capability, difficulty in safety state tracing and the like in the prior art are effectively solved.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of NB-IoT Internet of Things, in particular to a security management system based on NB-IoT Internet of Things and a management method thereof. BACKGROUND

[0002] As an important communication technology in the 5G era, NB-IoT has been widely used in the fields of energy, transportation and public services. However, the existing NB-IoT terminal has the following problems in large-scale deployment: 1. Single network access: the existing NB-IoT terminal is usually bound to a single operator network when it leaves the factory, and cannot automatically switch in a multi-operator environment, resulting in poor communication reliability; 2. Fixed key mechanism: the terminal usually uses static key encryption, which has the risk of being cracked by brute force or replay attack; 3. Lack of security upgrade and life cycle management: the terminal device cannot be remotely upgraded during use, and there is also a lack of a mechanism for tracing the key and security state; therefore, there is an urgent need for an NB-IoT security management system that can realize multi-operator adaptive access, dynamic key security management and security life cycle tracking. For this reason, the application provides a security management system based on NB-IoT Internet of Things and a management method thereof. SUMMARY

[0003] Based on the technical problems existing in the background technology, the application provides a security management system based on NB-IoT Internet of Things and a management method thereof.

[0004] The security management system based on NB-IoT Internet of Things provided by the application comprises a terminal security access module, a communication encryption module, a dynamic key management module, a trusted upgrade and tracking module, a security policy linkage module and a cloud security control platform. The cloud security control platform is connected with the terminal security access module, the communication encryption module, the dynamic key management module, the trusted upgrade and tracking module and the security policy linkage module. An HTTPS communication channel is adopted between the terminal security access module and the cloud security control platform.

[0005] The terminal security access module is used for realizing identity authentication and security access of the terminal in the NB-IoT network environment.

[0006] The communication encryption module is used for realizing data encryption and integrity check by using a hybrid encryption algorithm during communication between the terminal and the cloud.

[0007] The dynamic key management module is used for realizing life cycle management of key generation, distribution, update, revocation and destruction, and recording key state logs.

[0008] The trusted upgrade and tracking module is used for realizing terminal remote firmware upgrade, authorization and security state tracking based on identity encryption and signature verification mechanism;

[0009] The cloud security control platform is responsible for issuing security policy, operator Profile, key update instruction and upgrade task, and receiving encrypted data and security log uploaded by the terminal;

[0010] The security policy linkage module is used for dynamically adjusting security policy parameters according to terminal running state and risk events, and realizing self-learning security protection closed loop of the system.

[0011] Preferably, the terminal security access module is embedded with eSIM and security encryption module (ESAM), stores multiple operator Profile files through eUICC multi-operator management technology, adopts dynamic network optimization algorithm of comprehensive weighting of network signal strength, delay and packet loss rate, realizes cross-operator automatic switching and redundant access, and uses the formula as follows:

[0012] ;

[0013] Wherein is the signal strength, is the link delay, is the packet loss rate, and α, β and γ are weighting coefficients, is the current operator selection coefficient, and the terminal selects the operator network access corresponding to the maximum.

[0014] Preferably, the communication encryption module adopts a hybrid encryption algorithm including SM2 asymmetric algorithm and SM4 symmetric algorithm, uses the SM2 asymmetric algorithm for identity authentication and key negotiation between the terminal and the cloud, and uses the SM4 symmetric algorithm to perform symmetric encryption on data by using the negotiated key;

[0015] The SM2 asymmetric algorithm encryption is based on elliptic curve parameters (p, a, b, G, n, h), and the key negotiation formula used is as follows: , wherein is the session key, , is the temporary public key point generated by the terminal, , is the temporary public key point generated by the cloud, H is a hash function used for generating a session key digest, is used for SM4 symmetric algorithm encryption, and the formula used for SM4 symmetric algorithm encryption is as follows: =E ( ), wherein E represents the encryption operation of SM4. This is plaintext data.

[0016] Preferably, the dynamic key management module uses the following formula when generating keys: ,in This is a unique identifier for the terminal, where T is a timestamp. H( represents the current operator selection coefficient) ) is a hash function.

[0017] Preferably, the cloud security control platform includes a trusted service management submodule, a key management center, an upgrade scheduling engine, and a log auditing unit. The trusted service management submodule is responsible for terminal registration and authentication, profile distribution, service authorization, and trust relationship maintenance, and is the root of trust for secure communication between the terminal and the cloud.

[0018] The Key Management Center is responsible for the distribution, rotation, revocation, and backup of keys within the system, and is the core of key lifecycle management. Keys are distributed using SM2 encryption before distribution; the formula used for sealed rotation is: ,in This is the currently valid key. This is the key update interval. ( ) is the key derivation function; the formula used when revoking the key is: ,in For the key revocation log digest, H( ) is a hash function. For the old key that has been revoked. To revoke the timestamp, This is a unique identifier for the terminal; || is the concatenation operator.

[0019] The upgrade scheduling engine is used to generate firmware signature packages and distribute them to the terminal through the SM2 signature mechanism. The log auditing unit is used to record and verify the upgrade status and security events uploaded by the terminal.

[0020] Preferably, the security policy linkage module includes a risk detection unit, a policy learning engine, and a parameter adaptive adjuster. The risk detection unit is used to monitor and identify anomalies in terminal communication data and system behavior in real time, and the formula used is: ,in This is a real-time risk index. For encryption anomaly rate, To reduce the authentication failure rate, This represents the average link delay deviation. For packet loss rate, , , and This represents the weighting coefficient of each indicator. > At that time, and If the threshold is set, the system will consider the current state to be abnormal and trigger learning and adjustment.

[0021] The policy learning engine dynamically optimizes security level parameters, key refresh cycle, and network optimization threshold based on anomaly detection results;

[0022] The formula used to optimize the safety level parameters is: ,in For the system security level coefficient, For the system's target risk level, For learning rate;

[0023] When optimizing the key refresh cycle, the system dynamically shortens or extends the key rotation time based on the risk level. The formula used is as follows: ,in For key refresh cycle, As a weight for risk impact, This represents the maximum value of the risk index; as the risk increases, Rise, refresh cycle Automatically shortens for enhanced security;

[0024] The formula used for network optimization threshold is: ,in The historical average communication quality To ensure the current observation and communication quality, The threshold is an adjustment factor that adjusts the threshold value when communication quality degrades. Automatic elevation allows the system to prioritize more reliable carrier networks;

[0025] The parameter adaptive adjuster receives the optimized parameters output by the learning engine, writes the new parameters into the system operation configuration in real time, including the key refresh interval, encryption algorithm level selection, and network optimization coefficient, and returns the new parameter status and verification results to the cloud security control platform, forming a closed-loop update. The parameter adaptive adjuster performs updates based on the learning engine output, and the formula used is: Where A is the system parameter vector, containing [ , , ], As a smoothing factor, 0 < <1, used to avoid frequent oscillations. The optimal set of parameters computed by the policy learning engine. This is the updated set of adaptive parameters.

[0026] This invention also proposes a security management method based on NB-IoT, comprising the following steps:

[0027] S1: Terminal registration and multi-carrier profile loading: After the terminal starts up, it reads multiple carrier profile files from the eSIM and selects the optimal carrier to access the network based on a dynamic network optimization algorithm, taking into account signal strength, latency and packet loss rate.

[0028] S2: Establishing an encrypted communication connection: The terminal establishes a secure channel through SM2 authentication, and the cloud sends an SM4 session key to complete two-way encrypted communication;

[0029] S3: Dynamic Key Lifecycle Management: The cloud generates new keys based on the terminal status and time period, performs remote key update and old key destruction operations on the terminal, and records the key status log;

[0030] S4: Trusted Remote Upgrade and Tracking: When an abnormal terminal version or security vulnerability is detected, the trusted upgrade and tracking module generates a firmware package with a digital signature in the cloud and sends it to the terminal. After verifying the legality of the signature, the terminal performs the upgrade and sends back the version tracking information.

[0031] S5: Anomaly Detection and Policy Linkage: The cloud-based security control platform and security policy linkage module analyze communication status and security events. If anomalies are detected, the security policy is dynamically adjusted to form a self-learning security protection closed loop.

[0032] Preferably, the specific logical steps of S2 are as follows:

[0033] S201: After the terminal device is powered on, a random number is generated. As a connection request identifier, it is sent to the cloud security control platform: ,in As a unique identifier for the terminal, For terminal random numbers, For the terminal public key;

[0034] S202: Received via cloud. Then, check the validity of the terminal and generate a random number. Simultaneously, the authentication digest is calculated using the following formula: , where H( ) represents the hash function, and || represents the concatenation operation;

[0035] S203: Cloud uses its private key Sign the digest and generate signature information. and return: Among them, For cloud public keys;

[0036] S204: The terminal verifies the signature's validity. If the verification is successful, it indicates that the cloud-based identity is trustworthy. The formula used is: Vreify( , , Next, the terminal calculates the session key seed using the following formula: ;

[0037] S205: The same parameters are used to calculate the symmetric key in the cloud. =H( The key is encrypted using the terminal's public key in the cloud. And the encrypted session key is sent to the terminal. ,in For timestamps, =SM2_Sign( H ( || );

[0038] S206: The terminal uses its own private key to decrypt the session key, using the following formula: = And verify the signature: Verify( , H ( || ))=True, save after successful verification. As the symmetric encryption key for the current session;

[0039] S207: At this point, both the terminal and the cloud hold the same session key. Both parties use SM4 symmetric encryption for data encryption and decryption. The encryption formula is as follows: =E ( The formula used for decryption is: = ( (), where M represents plaintext data and C represents ciphertext data. Here is the current session key, and E is the SM4 encryption operation;

[0040] S208: Each encrypted data packet includes a hash integrity check value. This forms the final transmission message: Packet={C, Verification is performed in the cloud: Verify ( , , =True, the encrypted communication channel has been established.

[0041] Preferably, the specific logical steps of S3 are as follows:

[0042] S301: The cloud generates a new key based on the terminal status, timestamp, and unique terminal identifier, using the following formula: ;

[0043] S302: The cloud uses SM2 asymmetric encryption to securely distribute the new key to the terminal. The formula used is as follows: =SM2_Encrypt( , After receiving the data, the terminal decrypts it using its own private key. = Complete session key synchronization to ensure that both parties hold the same key for subsequent communication;

[0044] S303: The key is updated periodically or dynamically based on the risk level in the cloud, using the following formula: ;

[0045] S304: Revoke keys that have expired or are at risk of being attacked, and log the revocation. The formula used is as follows: ;

[0046] S305: The cloud generates and stores logs for each key operation for auditing and tracking.

[0047] Preferably, the specific logical steps of S4 are as follows:

[0048] S401: The terminal periodically or triggeredly updates its firmware version. The formula used to upload security status information to the cloud is: Status_Report={ , H(Firmware), TS}, where H(Firmware) is the current firmware hash value and TS is the reporting timestamp. The cloud verifies the uploaded information to determine whether there is an abnormal version or security vulnerability.

[0049] S402: When the cloud detects an anomaly in the terminal firmware or a security vulnerability, a new firmware package is generated. And perform digital signature, using the following formula: ,in For cloud-based private keys, For the new firmware hash, This is the new firmware version number. Digitally sign the firmware;

[0050] S403: The cloud sends the firmware package and signature to the terminal through a secure channel. After receiving the package, the terminal verifies the legitimacy of the cloud signature using the formula: Vreify ( , , || If verification fails, the terminal will refuse to upgrade.

[0051] S404: After successful verification, the terminal will securely back up the old firmware, load the new firmware, update the version information, and calculate the hash value of the new firmware for subsequent tracking: H ( )=H ;

[0052] S405: After the upgrade is completed, the terminal uploads upgrade confirmation and tracking information to the cloud, and the cloud records the upgrade log to realize terminal firmware version tracking and security auditing.

[0053] Compared with existing technologies, the beneficial effects of this invention are:

[0054] This invention achieves end-to-end communication security, dynamic key management, and secure firmware upgrades through a combination of multi-carrier adaptive access for terminals, SM2 / SM4 hybrid encrypted communication, dynamic key lifecycle management, and trusted remote upgrades and tracking. Furthermore, it can monitor communication anomalies and security events in real time, and through a security policy linkage module, it self-learns and adjusts the key refresh cycle, security level parameters, and network optimization thresholds to form a closed-loop protection mechanism. This effectively solves the problems of single terminal network access, fixed keys, lack of remote upgrade capabilities, and difficulty in tracing security status in existing technologies, thereby improving the overall security, manageability, and system reliability of NB-IoT terminals. Attached Figure Description

[0055] Figure 1 This is a block diagram of a security management system based on NB-IoT proposed in this invention;

[0056] Figure 2 This is a flowchart of a security management method based on NB-IoT proposed in this invention. Detailed Implementation

[0057] The present invention will be further explained below with reference to specific embodiments.

[0058] Example

[0059] Reference Figure 1This embodiment proposes a security management system based on NB-IoT, including a terminal security access module, a communication encryption module, a dynamic key management module, a trusted upgrade and tracking module, a security policy linkage module, and a cloud security control platform. The cloud security control platform is connected to the terminal security access module, the communication encryption module, the dynamic key management module, the trusted upgrade and tracking module, and the security policy linkage module. The terminal security access module and the cloud security control platform use an HTTPS communication channel.

[0060] The terminal security access module is used to realize terminal authentication and secure access in the NB-IoT network environment;

[0061] The terminal security access module embeds an eSIM and an ESAM security encryption module. It stores profile files from multiple operators using eUICC multi-operator management technology and employs a dynamic network optimization algorithm that weights network signal strength, latency, and packet loss rate to achieve automatic cross-operator handover and redundant access. The formula used is as follows:

[0062] ;

[0063] in For signal strength, For link latency, The packet loss rate is represented by α, β, and γ, which are weighting coefficients. The current operator selection coefficient, terminal selection The maximum corresponding carrier network access;

[0064] The communication encryption module is used to encrypt and verify data integrity using a hybrid encryption algorithm during communication between the terminal and the cloud.

[0065] The communication encryption module uses a hybrid encryption algorithm including the SM2 asymmetric algorithm and the SM4 symmetric algorithm. The SM2 asymmetric algorithm is used for terminal and cloud authentication and key negotiation, while the SM4 symmetric algorithm is used to symmetrically encrypt the data using the negotiated key.

[0066] The SM2 asymmetric encryption algorithm is based on elliptic curve parameters (p,a,b,G,n,h), and the key negotiation formula used is as follows: ,in For the session key, ( , ) is a temporary public key point generated by the terminal, ( , H is a temporary public key point generated in the cloud. ) is a hash function used to generate a session key digest, calculated as follows: Used for SM4 symmetric algorithm encryption, the formula used in SM4 symmetric algorithm encryption is: =E ( ), where E represents the SM4 encryption operation, Plaintext data;

[0067] The dynamic key management module is used to manage the lifecycle of keys, including generation, distribution, updating, revocation, and destruction, and to record key status logs.

[0068] The dynamic key management module uses the following formula to generate keys: ,in This is a unique identifier for the terminal, where T is a timestamp. H( represents the current operator selection coefficient) ) is a hash function;

[0069] The trusted upgrade and tracking module is used to enable remote firmware upgrades, authorization, and security status tracking of terminals based on identity encryption and signature verification mechanisms.

[0070] The cloud-based security control platform is responsible for issuing security policies, operator profiles, key update instructions, and upgrade tasks, and for receiving encrypted data and security logs uploaded by terminals.

[0071] The cloud security control platform includes a trusted service management submodule, a key management center, an upgrade scheduling engine, and a log auditing unit. The trusted service management submodule is responsible for terminal registration and authentication, profile distribution, service authorization, and trust relationship maintenance, and is the root of trust for secure communication between the terminal and the cloud.

[0072] The Key Management Center is responsible for the distribution, rotation, revocation, and backup of keys within the system, and is the core of key lifecycle management. Keys are distributed using SM2 encryption before distribution; the formula used for sealed rotation is: ,in This is the currently valid key. This is the key update interval. ( ) is the key derivation function; the formula used when revoking the key is: ,in For the key revocation log digest, H( ) is a hash function. For the old key that has been revoked. To revoke the timestamp, This is a unique identifier for the terminal; || is the concatenation operator.

[0073] The upgrade scheduling engine is used to generate firmware signature packages and distribute them to the terminal through the SM2 signature mechanism. The log auditing unit is used to record and verify the upgrade status and security events uploaded by the terminal.

[0074] The security policy linkage module is used to dynamically adjust security policy parameters based on the terminal's operating status and risk events, thereby realizing a self-learning security protection closed loop for the system.

[0075] The security policy linkage module includes a risk detection unit, a policy learning engine, and a parameter adaptive adjuster. The risk detection unit is used to monitor and identify anomalies in terminal communication data and system behavior in real time, and the formula it uses is: ,in This is a real-time risk index. For encryption anomaly rate, To reduce the authentication failure rate, This represents the average link delay deviation. For packet loss rate, , , and This represents the weighting coefficient of each indicator. > hour, If the threshold is set, the system will consider the current state to be abnormal and trigger learning and adjustment.

[0076] The policy learning engine dynamically optimizes security level parameters, key refresh cycle, and network optimization threshold based on anomaly detection results;

[0077] The formula used to optimize the safety level parameters is: ,in For the system security level coefficient, For the system's target risk level, For learning rate;

[0078] When optimizing the key refresh cycle, the system dynamically shortens or extends the key rotation time based on the risk level. The formula used is as follows: ,in For key refresh cycle, As a weight for risk impact, This represents the maximum value of the risk index; as the risk increases, Rise, refresh cycle Automatically shortens for enhanced security;

[0079] The formula used for network optimization threshold is: ,in The historical average communication quality To ensure the current observation and communication quality, The threshold is an adjustment factor that adjusts the threshold value when communication quality degrades. Automatic elevation allows the system to prioritize more reliable carrier networks;

[0080] The parameter adaptive adjuster receives the optimized parameters output by the learning engine, writes the new parameters into the system's runtime configuration in real time, including the key refresh interval, encryption algorithm level selection, and network optimization coefficients, and returns the new parameter status and verification results to the cloud security control platform, forming a closed-loop update. The parameter adaptive adjuster performs updates based on the learning engine's output, using the following formula: Where A is the system parameter vector, containing [ , , ], As a smoothing factor, 0 < <1, used to avoid frequent oscillations. The optimal set of parameters computed by the policy learning engine. This is the updated set of adaptive parameters.

[0081] Reference Figure 2 This embodiment also proposes a security management method based on NB-IoT, including the following steps:

[0082] S1: Terminal registration and multi-carrier profile loading: After the terminal starts up, it reads multiple carrier profile files from the eSIM and selects the optimal carrier to access the network based on a dynamic network optimization algorithm, taking into account signal strength, latency and packet loss rate.

[0083] S2: Establishing an encrypted communication connection: The terminal establishes a secure channel through SM2 authentication, and the cloud sends an SM4 session key to complete two-way encrypted communication;

[0084] The specific logical steps are as follows:

[0085] S201: After the terminal device is powered on, a random number is generated. As a connection request identifier, it is sent to the cloud security control platform: ,in As a unique identifier for the terminal, For terminal random numbers, For the terminal public key;

[0086] S202: Received via cloud. Then, check the validity of the terminal and generate a random number. Simultaneously, the authentication digest is calculated using the following formula: , where H( ) represents the hash function, and || represents the concatenation operation;

[0087] S203: Cloud uses its private key Sign the digest and generate signature information. and return: Among them, For cloud public keys;

[0088] S204: The terminal verifies the signature's validity. If the verification is successful, it indicates that the cloud-based identity is trustworthy. The formula used is: Vreify( , , Next, the terminal calculates the session key seed using the following formula: ;

[0089] S205: The same parameters are used to calculate the symmetric key in the cloud. =H( The key is encrypted using the terminal's public key in the cloud. And the encrypted session key is sent to the terminal. ,in For timestamps, =SM2_Sign( H ( || );

[0090] S206: The terminal uses its own private key to decrypt the session key, using the following formula: = And verify the signature: Verify( , H ( || ))=True, save after successful verification. As the symmetric encryption key for the current session;

[0091] S207: At this point, both the terminal and the cloud hold the same session key. Both parties use SM4 symmetric encryption for data encryption and decryption. The encryption formula is as follows: =E ( The formula used for decryption is: = ( (), where M represents plaintext data and C represents ciphertext data. Here is the current session key, and E is the SM4 encryption operation;

[0092] S208: Each encrypted data packet includes a hash integrity check value. This forms the final transmission message: Packet={C, Verification is performed in the cloud: Verify ( , , =True, the encrypted communication channel has been established;

[0093] S3: Dynamic Key Lifecycle Management: The cloud generates new keys based on the terminal status and time period, performs remote key update and old key destruction operations on the terminal, and records the key status log;

[0094] The specific logical steps are as follows:

[0095] S301: The cloud generates a new key based on the terminal status, timestamp, and unique terminal identifier, using the following formula: ;

[0096] S302: The cloud uses SM2 asymmetric encryption to securely distribute the new key to the terminal. The formula used is as follows: =SM2_Encrypt( , After receiving the data, the terminal decrypts it using its own private key. = Complete session key synchronization to ensure that both parties hold the same key for subsequent communication;

[0097] S303: The key is updated periodically or dynamically based on the risk level in the cloud, using the following formula: ;

[0098] S304: Revoke keys that have expired or are at risk of being attacked, and log the revocation. The formula used is as follows: ;

[0099] S305: The cloud generates and stores logs for each key operation for auditing and tracking;

[0100] S4: Trusted Remote Upgrade and Tracking: When an abnormal terminal version or security vulnerability is detected, the trusted upgrade and tracking module generates a firmware package with a digital signature in the cloud and sends it to the terminal. After verifying the legality of the signature, the terminal performs the upgrade and sends back the version tracking information.

[0101] The specific logical steps are as follows:

[0102] S401: The terminal periodically or triggeredly updates its firmware version. The formula used to upload security status information to the cloud is: Status_Report={ , H(Firmware), TS}, where H(Firmware) is the current firmware hash value and TS is the reporting timestamp. The cloud verifies the uploaded information to determine whether there is an abnormal version or security vulnerability.

[0103] S402: When the cloud detects an anomaly in the terminal firmware or a security vulnerability, a new firmware package is generated. And perform digital signature, using the following formula: ,in For cloud-based private keys, For the new firmware hash, This is the new firmware version number. Digitally sign the firmware;

[0104] S403: The cloud sends the firmware package and signature to the terminal through a secure channel. After receiving the package, the terminal verifies the legitimacy of the cloud signature using the formula: Vreify ( , , || If verification fails, the terminal will refuse to upgrade.

[0105] S404: After successful verification, the terminal will securely back up the old firmware, load the new firmware, update the version information, and calculate the hash value of the new firmware for subsequent tracking: H ( )=H ;

[0106] S405: After the upgrade is completed, the terminal uploads the upgrade confirmation and tracking information to the cloud, and the cloud records the upgrade log to realize terminal firmware version tracking and security auditing;

[0107] S5: Anomaly Detection and Policy Linkage: The cloud-based security control platform and security policy linkage module analyze communication status and security events. If an anomaly is detected, the security policy is dynamically adjusted to form a self-learning security protection closed loop.

[0108] This embodiment achieves end-to-end communication security, dynamic key management, and secure firmware upgrades through a combination of multi-carrier adaptive access for terminals, SM2 / SM4 hybrid encrypted communication, dynamic key lifecycle management, and trusted remote upgrades and tracking. It can also monitor communication anomalies and security events in real time, and adjust the key refresh cycle, security level parameters, and network optimization thresholds through a security policy linkage module to form a closed-loop protection mechanism. This effectively solves the problems of single terminal network access, fixed keys, lack of remote upgrade capabilities, and difficulty in tracing security status in existing technologies, improving the overall security, manageability, and system reliability of NB-IoT terminals.

[0109] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A security management system based on NB-IoT (Internet of Things), characterized in that, It includes a terminal security access module, a communication encryption module, a dynamic key management module, a trusted upgrade and tracking module, a security policy linkage module, and a cloud security control platform. The cloud security control platform is connected to the terminal security access module, the communication encryption module, the dynamic key management module, the trusted upgrade and tracking module, and the security policy linkage module. The terminal security access module and the cloud security control platform use an HTTPS communication channel. The terminal security access module is used to realize terminal identity authentication and secure access in the NB-IoT network environment; The communication encryption module is used to perform data encryption and integrity verification using a hybrid encryption algorithm during communication between the terminal and the cloud. The dynamic key management module is used to manage the lifecycle of keys, including generation, distribution, updating, revocation, and destruction, and to record key status logs. The trusted upgrade and tracking module is used to realize remote firmware upgrade, authorization and security status tracking of the terminal based on the identity encryption and signature verification mechanism. The cloud-based security control platform is responsible for issuing security policies, operator profiles, key update instructions, and upgrade tasks, and for receiving encrypted data and security logs uploaded by terminals. The security policy linkage module is used to dynamically adjust security policy parameters according to the terminal's operating status and risk events, thereby realizing a self-learning security protection closed loop for the system.

2. The security management system based on NB-IoT as described in claim 1, characterized in that, The terminal security access module embeds an eSIM and a security encryption module. It stores profile files from multiple operators using eUICC multi-operator management technology and employs a dynamic network optimization algorithm that weights network signal strength, latency, and packet loss rate to achieve automatic cross-operator handover and redundant access. The formula used is as follows: ； in For signal strength, For link latency, The packet loss rate is represented by α, β, and γ, which are weighting coefficients. The current operator selection coefficient, terminal selection The maximum corresponding carrier network access.

3. A security management system based on NB-IoT as described in claim 1, characterized in that, The communication encryption module employs a hybrid encryption algorithm that includes the SM2 asymmetric algorithm and the SM4 symmetric algorithm. The SM2 asymmetric algorithm is used for terminal and cloud authentication and key negotiation, while the SM4 symmetric algorithm is used to symmetrically encrypt data using the negotiated key. The SM2 asymmetric encryption algorithm is based on elliptic curve parameters (p,a,b,G,n,h), and the key negotiation formula used is as follows: ,in For the session key, ( , ) is a temporary public key point generated by the terminal, ( , H is a temporary public key point generated in the cloud. ) is a hash function used to generate a session key digest, calculated as follows: Used for SM4 symmetric algorithm encryption, the formula used in SM4 symmetric algorithm encryption is: =E ( ), where E represents the SM4 encryption operation, This is plaintext data.

4. A security management system based on NB-IoT as described in claim 1, characterized in that, The dynamic key management module uses the following formula to generate keys: ,in This is a unique identifier for the terminal, where T is a timestamp. H( represents the current operator selection coefficient) ) is a hash function.

5. A security management system based on NB-IoT as described in claim 1, characterized in that, The cloud-based security control platform includes a trusted service management submodule, a key management center, an upgrade scheduling engine, and a log auditing unit. The trusted service management submodule is responsible for terminal registration and authentication, profile distribution, service authorization, and trust relationship maintenance, and serves as the root of trust for secure communication between the terminal and the cloud. The Key Management Center is responsible for the distribution, rotation, revocation, and backup of keys within the system, and is the core of key lifecycle management. Keys are distributed using SM2 encryption before distribution; the formula used for sealed rotation is: ,in This is the currently valid key. This is the key update interval. ( ) is the key derivation function; the formula used when revoking the key is: ,in For the key revocation log digest, H( ) is a hash function. For the old key that has been revoked. To revoke the timestamp, This is a unique identifier for the terminal; || is the concatenation operator. The upgrade scheduling engine is used to generate firmware signature packages and distribute them to the terminal through the SM2 signature mechanism. The log auditing unit is used to record and verify the upgrade status and security events uploaded by the terminal.

6. A security management system based on NB-IoT as described in claim 1, characterized in that, The security policy linkage module includes a risk detection unit, a policy learning engine, and a parameter adaptive adjuster. The risk detection unit is used to monitor and identify anomalies in terminal communication data and system behavior in real time, and the formula it uses is: ,in This is a real-time risk index. For encryption anomaly rate, To reduce the authentication failure rate, This represents the average link delay deviation. For packet loss rate, , , and This represents the weighting coefficient of each indicator. > At that time, and If the threshold is set, the system will consider the current state to be abnormal and trigger learning and adjustment. The policy learning engine dynamically optimizes security level parameters, key refresh cycle, and network optimization threshold based on anomaly detection results; The formula used to optimize the safety level parameters is: ,in For the system security level coefficient, For the system's target risk level, For learning rate; When optimizing the key refresh cycle, the system dynamically shortens or extends the key rotation time based on the risk level. The formula used is as follows: ,in For key refresh cycle, As a weight for risk impact, This represents the maximum value of the risk index; as the risk increases, Rise, refresh cycle Automatically shortens for enhanced security; The formula used for network optimization threshold is: ,in The historical average communication quality To ensure the current observation and communication quality, The threshold is an adjustment factor that adjusts the threshold value when communication quality degrades. Automatic upgrades allow the system to prioritize more reliable carrier networks; The parameter adaptive adjuster receives the optimized parameters output by the learning engine, writes the new parameters into the system operation configuration in real time, including the key refresh interval, encryption algorithm level selection, and network optimization coefficient, and returns the new parameter status and verification results to the cloud security control platform, forming a closed-loop update. The parameter adaptive adjuster performs updates based on the learning engine output, and the formula used is: Where A is the system parameter vector, containing [ , , ], As a smoothing factor, 0 < <1, used to avoid frequent oscillations. The optimal parameter set computed by the policy learning engine. This is the updated set of adaptive parameters.

7. A security management method based on NB-IoT (Internet of Things), applied to the security management system described in any one of claims 1-6, characterized in that, Includes the following steps: S1: Terminal registration and multi-carrier profile loading: After the terminal starts up, it reads multiple carrier profile files from the eSIM and selects the optimal carrier to access the network based on a dynamic network optimization algorithm, taking into account signal strength, latency and packet loss rate. S2: Establishing an encrypted communication connection: The terminal establishes a secure channel through SM2 authentication, and the cloud sends an SM4 session key to complete two-way encrypted communication; S3: Dynamic Key Lifecycle Management: The cloud generates new keys based on the terminal status and time period, performs remote key update and old key destruction operations on the terminal, and records the key status log; S4: Trusted Remote Upgrade and Tracking: When an abnormal terminal version or security vulnerability is detected, the trusted upgrade and tracking module generates a firmware package with a digital signature in the cloud and sends it to the terminal. After verifying the legality of the signature, the terminal performs the upgrade and sends back the version tracking information. S5: Anomaly Detection and Policy Linkage: The cloud-based security control platform and security policy linkage module analyze communication status and security events. If anomalies are detected, the security policy is dynamically adjusted to form a self-learning security protection closed loop.

8. A security management method based on NB-IoT Internet of Things according to claim 7, characterized in that, The specific logical steps of S2 are as follows: S201: After the terminal device is powered on, a random number is generated. As a connection request identifier, it is sent to the cloud security control platform: ,in As a unique identifier for the terminal, For terminal random numbers, For the terminal public key; S202: Received via cloud. Then, check the validity of the terminal and generate a random number. Simultaneously, the authentication digest is calculated using the following formula: , where H( ) represents the hash function, and || represents the concatenation operation; S203: Cloud uses its private key Sign the digest and generate signature information. and return: Among them, For cloud public keys; S204: The terminal verifies the signature's validity. If the verification is successful, it indicates that the cloud-based identity is trustworthy. The formula used is: Vreify( , , Next, the terminal calculates the session key seed using the following formula: ; S205: The same parameters are used to calculate the symmetric key in the cloud. =H( The key is encrypted using the terminal's public key in the cloud. And the encrypted session key is sent to the terminal. ,in For timestamps, =SM2_Sign( H ( || ); S206: The terminal uses its own private key to decrypt the session key, using the following formula: = And verify the signature: Verify( , H ( || ))=True, save after successful verification. As the symmetric encryption key for the current session; S207: At this point, both the terminal and the cloud hold the same session key. Both parties use SM4 symmetric encryption for data encryption and decryption. The encryption formula is as follows: =E ( The formula used for decryption is: = ( (), where M represents plaintext data and C represents ciphertext data. Here is the current session key, and E is the SM4 encryption operation; S208: Each encrypted data packet includes a hash integrity check value. This forms the final transmission message: Packet={C, Verification is performed in the cloud: Verify ( , , =True, the encrypted communication channel has been established.

9. A security management method based on NB-IoT Internet of Things according to claim 7, characterized in that, The specific logical steps of S3 are as follows: S301: The cloud generates a new key based on the terminal status, timestamp, and unique terminal identifier, using the following formula: ; S302: The cloud uses SM2 asymmetric encryption to securely distribute the new key to the terminal. The formula used is as follows: =SM2_Encrypt( , After receiving the data, the terminal decrypts it using its own private key. = Complete session key synchronization to ensure that both parties hold the same key for subsequent communication; S303: The key is updated periodically or dynamically based on the risk level in the cloud, using the following formula: ; S304: Revoke keys that have expired or are at risk of being attacked, and log the revocation. The formula used is as follows: ; S305: The cloud generates and stores logs for each key operation for auditing and tracking.

10. A security management method based on NB-IoT Internet of Things according to claim 7, characterized in that, The specific logical steps of S4 are as follows: S401: The terminal periodically or triggeredly updates its firmware version. The formula used to upload security status information to the cloud is: Status_Report={ , H(Firmware), TS}, where H(Firmware) is the current firmware hash value and TS is the reporting timestamp. The cloud verifies the uploaded information to determine whether there is an abnormal version or security vulnerability. S402: When the cloud detects an anomaly in the terminal firmware or a security vulnerability, a new firmware package is generated. And perform digital signature, using the following formula: ,in For cloud-based private keys, For the new firmware hash, This is the new firmware version number. Digitally sign the firmware; S403: The cloud sends the firmware package and signature to the terminal through a secure channel. After receiving the package, the terminal verifies the legitimacy of the cloud signature using the formula: Vreify ( , , || If verification fails, the terminal will refuse to upgrade. S404: After successful verification, the terminal will securely back up the old firmware, load the new firmware, update the version information, and calculate the hash value of the new firmware for subsequent tracking: H ( )=H ; S405: After the upgrade is completed, the terminal uploads upgrade confirmation and tracking information to the cloud, and the cloud records the upgrade log to realize terminal firmware version tracking and security auditing.

Images