An internet of things data information security transmission method

Abstract

This invention belongs to the field of data security technology, and specifically relates to a method for secure data transmission in the Internet of Things (IoT). Addressing the challenges of limited resources and numerous security vulnerabilities in IoT device transmission, this method constructs end-to-end protection: generating dynamic device fingerprints based on physically unclonable functions and behavioral characteristics to ensure identity trustworthiness; employing an improved elliptic curve Diffie-Hellman algorithm to generate a shared key, adaptable to lightweight devices and resistant to attacks; dynamically fragmenting based on information entropy, encrypting data differently according to sensitivity and embedding redundant data; fragmenting data for multi-path transmission; fragment-level verification and precise retransmission, with alarm isolation triggered after more than three failures. This invention balances security and efficiency, comprehensively resisting threats such as forgery, eavesdropping, and hacking, ensuring the integrity and reliability of data transmission, and adapting to complex IoT application scenarios.

Description

Technical Field

[0001] This invention belongs to the field of data security technology, and in particular relates to a method for secure transmission of Internet of Things (IoT) data information. Background Technology

[0002] With the rapid development of IoT technology, various smart devices are widely integrated into production and daily life, and data interaction between devices is becoming increasingly frequent. The security and reliability of data transmission have become core requirements for IoT applications. However, IoT devices are often characterized by limited resources and dispersed deployments. Traditional data security transmission solutions suffer from poor adaptability and incomplete security protection, making them ill-equipped to handle security threats in complex network environments. In existing IoT data transmission processes, device authentication often relies on static identifiers or fixed keys, making them vulnerable to forgery and tampering attacks. Key exchange using traditional encryption algorithms incurs high computational overhead, failing to meet the efficient communication needs of lightweight devices. Data fragmentation strategies lack dynamic adjustment capabilities and do not employ differentiated encryption based on data sensitivity, while also lacking effective data obfuscation mechanisms, making them susceptible to interception and analysis by attackers. Inadequate data verification mechanisms, lacking precise anomaly handling and retransmission mechanisms after verification failures, make it difficult to guarantee the security, integrity, and availability of data transmission, severely hindering the large-scale application of IoT technology. Summary of the Invention

[0003] In view of the technical problems existing in the background art described above, the present invention proposes a method for secure transmission of Internet of Things (IoT) data information.

[0004] To achieve the above objectives, the technical solution adopted by the present invention includes the following steps:

[0005] S1. Generate a device fingerprint based on a physically unclonable function at the IoT device end. Utilize the inherent physical characteristics of the device hardware to generate an initial device fingerprint. Periodically combine the device behavior characteristics to dynamically update the initial device fingerprint to obtain a dynamic device fingerprint.

[0006] S2. Establish an encrypted communication channel between the IoT device and the target service node, and use an improved Diffie-Hellman key exchange algorithm based on elliptic curve cryptography to generate a shared key for data encryption.

[0007] S3. Perform fragmentation, encryption and obfuscation processing on the original data. Divide the original data into multiple data fragments according to the dynamic fragmentation strategy, generate an independent key for each fragment and embed deceptive redundant data in the fragments.

[0008] S4. The data fragments are routed to the target service nodes through a multi-path transmission mechanism. The data is reassembled at the service nodes, and the decryption keys corresponding to the data fragments are used to decrypt each data fragment to restore the original data content.

[0009] S5. Verify the original data content of the decrypted fragments. Trigger a security alarm and isolate the data that fails to be verified. Mark the data that is successfully verified as trusted data and authorize its subsequent use.

[0010] Preferably, step S1 generates a device fingerprint based on a physically non-cloning function at the IoT device end, generates an initial device fingerprint using the inherent physical characteristics of the device hardware, and periodically updates the initial device fingerprint in combination with device behavior characteristics to obtain a dynamic device fingerprint. The specific implementation of this is as follows:

[0011] S11. First, extract the multi-dimensional hardware physical features of the IoT device, denoted as the hardware physical feature set. For the i-th dimension of hardware physical characteristics, a physically non-clonable function is used to generate a sub-device fingerprint. A hash operation is performed on the sub-device fingerprint to obtain a hash value; all hash values ​​are then XORed and merged to generate the primary device fingerprint. , where n is the feature set Dimensions Perform a hash operation on the fingerprint of the nth sub-device to obtain the hash value. This is an XOR operation;

[0012] S12. Collect data including frequency characteristics, network communication packet length fluctuation characteristics, and hardware power consumption fluctuation characteristics. Perform min-max normalization on these three characteristics to eliminate dimensional differences. Concatenate the normalized three behavioral characteristics in sequence into a behavioral feature string. Perform a hash operation on the feature string to obtain the hash value of the behavioral feature. ;

[0013] S13. Configure a fixed update cycle. When the device's cumulative runtime reaches a set value, the fingerprint update process is triggered. The update count is s. When s=1, the initial device fingerprint is used. Based on this, compare it with the behavioral feature hash value. Perform an XOR operation to generate the dynamic device fingerprint after the first update. When s>1, the dynamic device fingerprint is iteratively updated by repeating the XOR operation based on the previously updated dynamic device fingerprint to obtain the current dynamic device fingerprint. .

[0014] Preferably, step S2 establishes an encrypted communication channel between the IoT device and the target service node, and the specific implementation of generating a shared key for data encryption using an improved Diffie-Hellman key exchange algorithm based on elliptic curve cryptography is as follows:

[0015] S21. Choose a lightweight elliptic curve over a finite field, with the equation E: , where x, y are the coordinate variables of a point on the elliptic curve, a, b are the shape parameters of the elliptic curve, and p is a prime number;

[0016] S22. Randomly select the x-coordinate within a finite field. Substituting into the curve equation, we can calculate... ,like If it is a quadratic residue in a finite field, then take To obtain the curve points Calculate the order k of the point and verify whether k is a prime number; if k is a prime number, then determine... The coordinates are based on point G; otherwise, a new point is selected. The calculation continues until the base point G is obtained; the target service node pre-stores the elliptic curve parameters a, b, p, the base point G, and the order k into the IoT device to ensure that both parties use completely consistent parameters.

[0017] S23. IoT devices generate random temporary private keys. A temporary public key is generated through elliptic curve scalar multiplication: ,in, For scalar multiplication of elliptic curves;

[0018] S24. Transfer the temporary public key and dynamic device fingerprints Concatenate them into a public key with an identity identifier. And generate the current timestamp T, in order to Calculate the message authentication code for the key: ,in, For string concatenation operations; the device will , T is sent together to the target service node;

[0019] S25. After receiving the data, the target service node first verifies the timestamp: it checks whether the difference between the current time and T is less than a preset threshold. If it exceeds this threshold, it is determined to be a replay attack, and key exchange is rejected. If the timestamp is valid, it extracts... If the fingerprint digest is compared with the pre-stored latest dynamic fingerprint digest of the device, the key exchange is rejected; if the identity digest matches, the validity of the message authentication code (MAC) is verified, and a random temporary private key is generated upon successful verification. Calculate the temporary public key and will Return to IoT devices;

[0020] S26. The IoT device and the target service node each calculate the shared secret point. The device calculates: Target service node calculation: Based on the commutative law of elliptic curve scalar multiplication, it satisfies Obtain the coordinates of the shared secret point. ;

[0021] S27. Extract the x-coordinate of the shared secret point and convert it into a byte string to obtain the shared session key.

[0022] Preferably, in step S3, the original data is fragmented, encrypted, and obfuscated. The original data is divided into multiple data fragments according to a dynamic fragmentation strategy. An independent key is generated for each fragment, and deceptive redundant data is embedded in the fragment. The specific implementation is as follows:

[0023] S31. Calculate the information entropy of the raw data D collected by the Internet of Things. Determining the number of fragments based on information entropy ,in, For the number of fragments, Based on the number of basic fragments, Using the entropy weighting function, multiple data slices are obtained;

[0024] S32. Transform the data in each data slice into an input tensor, and extract the sensitive features of each data slice through the convolutional and pooling layers of a convolutional neural network. The feature mapping formula for each convolutional layer is: ,in, For depthwise convolution operations The convolutional kernel weights and bias terms are respectively used. The feature map output by the final convolutional layer is compressed into a one-dimensional sensitive feature vector through a global average pooling layer. The sensitive feature vector is then input into a fully connected layer and a softmax classifier to calculate the sensitivity of each data slice. The sensitivity is divided into high sensitivity, medium sensitivity, and low sensitivity.

[0025] S33. Develop a key derivation strategy based on sensitivity, and use the Key Derivation Function (KDF) to generate independent encryption keys: ,in, The key seed is obtained by first converting the dynamic device fingerprint and fragment identifier into a binary stream, and then performing a concatenation hash operation. This is the key length. For the number of iterations; high sensitivity corresponds to It is 256 bits, with 5000 iterations, and corresponds to medium sensitivity. It is 128 bits, with 2000 iterations, and corresponds to low sensitivity. It is 64 bits long and has 1000 iterations.

[0026] S34. Randomly generate redundant data with a length of 10% according to the format of the data in each data fragment, and embed it into the specified position of the corresponding encrypted fragment to obtain the obfuscated final data fragment.

[0027] Preferably, in step S4, the decryption key corresponding to the data fragment is used to decrypt each data fragment to recover the original data content. This is achieved by stripping redundant data before decrypting the data fragment, removing redundant data, and then using the same key derivation function, combined with the generated key seed, the matching key length, and the number of iterations, to generate a decryption key. The generated decryption key is then used to decrypt the pure fragment data to obtain the original fragment data.

[0028] Preferably, in step S5, if the verification of the original fragment data fails, a retransmission request containing the unique fragment identifier of the failed fragment is sent to the IoT device based on the unique fragment identifier of each fragment, and retransmission verification benchmark information is attached simultaneously. After receiving the request, the device retrieves the original encrypted data and independent key of the corresponding fragment and retransmits the fragment according to the original sending logic. After receiving the retransmitted fragment, the target service node performs a second verification. If the verification passes, the reconstructed data is completed. If the same fragment fails to be retransmitted more than three times, a security alarm is triggered and the fragment is isolated, and the device is linked to investigate transmission or hardware abnormalities.

[0029] Compared with existing technologies, the advantages and positive effects of this invention are as follows: it uses a physically unclonable function combined with behavioral features to generate dynamic device fingerprints, solving the problem of static identifiers being easily forged and improving the credibility of identity authentication; it improves the elliptic curve Diffie-Hellman algorithm to adapt to lightweight devices, resists man-in-the-middle attacks by binding timestamps with identity, and makes key exchange more efficient and secure; it uses dynamic sharding based on information entropy, encrypts data differently according to data sensitivity and embeds redundant data to enhance the ability to resist interception and cracking; and it combines multi-path transmission with shard-level precise retransmission and anomaly isolation mechanisms to ensure data integrity and transmission reliability. Attached Figure Description

[0030] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1 This is a schematic diagram illustrating the implementation process of a secure data transmission method for the Internet of Things (IoT). Detailed Implementation

[0032] To better understand the above-mentioned objectives, features, and advantages of the present invention, the present invention will be further described below in conjunction with the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in these embodiments can be combined with each other.

[0033] Numerous specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways than those described herein, and therefore the invention is not limited to the specific embodiments disclosed in the following specification.

[0034] In the implementation of this invention, in large-scale IoT applications, devices are deployed in a dispersed manner, resources are limited, and the network environment is complex, posing multiple security risks to data transmission. Existing solutions rely on static identifiers for device authentication, which are easily forged; traditional key exchange algorithms have high computational overhead and are difficult to adapt to lightweight devices; data fragmentation strategies are fixed, encryption methods are singular, and there is a lack of differentiated protection based on data sensitivity and effective obfuscation mechanisms, making them vulnerable to interception and cracking by attackers; furthermore, there is no accurate retransmission or anomaly detection mechanism after data verification failure, affecting transmission reliability. To address these issues, this invention provides a secure data transmission method for IoT, achieving the goals of trusted identity, secure keys, comprehensive data protection, and reliable transmission. The specific implementation process is as follows: Figure 1 As shown.

[0035] To address the issues of existing IoT devices relying on static IDs or fixed keys for authentication, which are vulnerable to spoofing and replay attacks, a device fingerprint based on a physically non-cloning function is generated at the IoT device level. This involves using the inherent physical characteristics of the device hardware to generate an initial device fingerprint, and periodically updating the initial fingerprint based on device behavior characteristics to obtain a dynamic device fingerprint. Specifically, this is achieved by first extracting a multi-dimensional set of hardware physical features from the IoT device, including inherent physical characteristics such as crystal oscillator jitter, SRAM power-on initial values, and circuit delay differences. For each hardware feature, a corresponding sub-fingerprint value is generated using a physically non-cloning function, and a hash operation is performed on each sub-fingerprint to obtain a hash result. Finally, all hash results are XORed and fused to generate a primary device fingerprint. Furthermore, to enable the device identity to evolve dynamically, the behavioral characteristics of the device during operation are periodically collected, including data acquisition frequency characteristics, network communication packet length fluctuation characteristics, and hardware power consumption fluctuation characteristics. After the three behavioral characteristics are normalized by min-max, they are concatenated into a behavioral characteristic string, and a hash operation is performed on it to obtain the behavioral characteristic hash value. When the set update cycle arrives, the primary device fingerprint or the previous dynamic device fingerprint is XORed with the behavioral characteristic hash value to obtain a new dynamic device fingerprint.

[0036] Specifically, the first step is to extract the multi-dimensional hardware physical characteristics of IoT devices, denoted as the hardware physical characteristic set. For the i-th dimension of hardware physical characteristics, a physically non-clonable function is used to generate a sub-device fingerprint. A hash operation is performed on the sub-device fingerprint to obtain a hash value; all hash values ​​are then XORed and merged to generate the primary device fingerprint. , where n is the feature set Dimensions Perform a hash operation on the fingerprint of the nth sub-device to obtain the hash value. The process involves XOR operation; collecting data on frequency characteristics, network communication packet length fluctuation characteristics, and hardware power consumption fluctuation characteristics; performing min-max normalization on these three characteristics to eliminate dimensional differences; concatenating the normalized three behavioral characteristics in sequence into a behavioral feature string; and performing a hash operation on the feature string to obtain the hash value of the behavioral feature. Configure a fixed update cycle. When the device's cumulative runtime reaches a set value, the fingerprint update process is triggered. The update count is s. When s=1, the initial device fingerprint is used. Based on this, compare it with the behavioral feature hash value. Perform an XOR operation to generate the dynamic device fingerprint after the first update. When s>1, the dynamic device fingerprint is iteratively updated by repeating the XOR operation based on the previously updated dynamic device fingerprint to obtain the current dynamic device fingerprint. This solution enables device fingerprints to simultaneously integrate hardware uniqueness and time-varying behavior, thereby maintaining identity credibility and anti-cloning capabilities during long-term device operation.

[0037] Considering the limitations of existing technologies, such as the computational complexity of traditional key exchange algorithms, difficulty in adapting to lightweight IoT devices, lack of identity binding mechanisms, and vulnerability to man-in-the-middle attacks, this invention establishes an encrypted communication channel between the IoT device and the target service node. It employs an improved Diffie-Hellman key exchange algorithm based on elliptic curve cryptography to generate a shared key for data encryption. This is implemented by first selecting lightweight elliptic curve parameters over a finite field and then randomly searching for a prime point G on the curve. The elliptic curve parameters and the prime point are pre-stored on both the IoT device and the target service node. The device generates a random temporary private key and obtains a temporary public key through elliptic curve scalar multiplication. This temporary public key is then concatenated with the current dynamic device fingerprint to form an identity-identified public key. Combined with a timestamp, this generates a message authentication code, which is then sent to the target service node. Upon receiving the message, the target service node first verifies the timestamp to prevent replay attacks, then compares the dynamic device fingerprint digest to confirm identity, and finally verifies the integrity of the message authentication code. After all verifications pass, the node generates its own temporary private and public keys and returns them to the device. Both parties calculate a shared secret point based on the other party's public key and their own private key, and extract its x-coordinate to generate a shared session key.

[0038] Specifically, we choose a lightweight elliptic curve over a finite field, with the equation E: Where x and y are the coordinate variables of a point on the elliptic curve, a and b are the shape parameters of the elliptic curve, and p is a prime number; the x-coordinates within a finite field are randomly selected. Substituting into the curve equation, we can calculate... ,like If it is a quadratic residue in a finite field, then take To obtain the curve points Calculate the order k of the point and verify whether k is a prime number; if k is a prime number, then determine... The coordinates are based on point G; otherwise, a new point is selected. The calculation continues until the base point G is obtained; the target service node pre-stores the elliptic curve parameters a, b, p, the base point G, and the order k into the IoT device to ensure that both parties use completely consistent parameters; the IoT device generates a random temporary private key. A temporary public key is generated through elliptic curve scalar multiplication: ,in, For elliptic curve scalar multiplication; use the temporary public key and dynamic device fingerprints Concatenate them into a public key with an identity identifier. And generate the current timestamp T, in order to Calculate the message authentication code for the key: ,in, For string concatenation operations; the device will , The timestamp and T are sent together to the target service node. After receiving the data, the target service node first verifies the timestamp: it checks whether the difference between the current time and T is less than a preset threshold. If it exceeds the threshold, it is determined to be a replay attack, and key exchange is rejected. If the timestamp is valid, it extracts the key. If the fingerprint digest is compared with the pre-stored latest dynamic fingerprint digest of the device, the key exchange is rejected; if the identity digest matches, the validity of the message authentication code (MAC) is verified, and a random temporary private key is generated upon successful verification. Calculate the temporary public key and will Return to IoT device; the IoT device and the target service node each calculate the shared secret point, and the device calculates: Target service node calculation: Based on the commutative law of elliptic curve scalar multiplication, it satisfies Obtain the coordinates of the shared secret point. In the preceding steps, the IoT device generates its own temporary private key and calculates its corresponding temporary public key. The target service node generates its temporary private key and calculates its temporary public key. After exchanging their respective temporary public keys through a secure channel, the IoT device uses the received target service node's public key as input to perform a scalar multiplication operation to calculate the shared secret point; the target service node, in turn, uses the received device public key as input to calculate the shared secret point. Since elliptic curve scalar multiplication satisfies the commutative law, we can obtain... Both parties independently obtain a shared secret point with identical coordinates without needing to transmit private keys. This implementation method provides strong resistance to eavesdropping and man-in-the-middle attacks during session key generation, laying a secure foundation for subsequent data encryption. Finally, the x-coordinate of the shared secret point is extracted and converted into a byte string to obtain the shared session key. The IoT device and the target service node each obtain the same shared secret point. In this invention, the x-coordinate of the shared secret point is preferably extracted. The x-coordinate is chosen as the initial key material because it exhibits uniform distribution and strong randomness within a finite field, and the calculation results from both parties are completely consistent, making it suitable as the basis for session key generation. Subsequently, the x-coordinate is converted from finite field integer form to a fixed-length byte string representation. During the conversion, it is encoded according to big-endian or little-endian format, and the byte string is truncated or padded with zeros according to the preset key length to meet the key length requirements of subsequent symmetric encryption algorithms. Further, to enhance the uniformity of the key and its resistance to statistical analysis, the byte string can be mapped using a hash function or key derivation function to obtain the final shared session key. Through the above processing, the IoT device and the target service node can independently generate completely consistent shared session keys based on the same shared secret point without additional interaction, thereby achieving secure and reliable establishment of the symmetric key during subsequent IoT data encryption transmission.

[0039] Furthermore, to address the issues of traditional IoT data encryption being easily compromised as a whole, lack of differentiated protection for different sensitive data, and easy data structure analysis, the raw data undergoes fragmentation, encryption, and obfuscation. The raw data is divided into multiple data fragments according to a dynamic fragmentation strategy, with an independent key generated for each fragment and deceptive redundant data embedded within each fragment. This is implemented by calculating the information entropy of the collected raw data, adaptively determining the number of fragments based on the entropy value, dividing the raw data into multiple fragments, and then converting each fragment into an input tensor, which is fed into a convolutional neural network model. Sensitive features are extracted from the fragments through multiple layers of convolution and pooling, and then the fragment sensitivity level is output through a fully connected layer and a softmax classifier, classifying them into high-sensitivity, medium-sensitivity, and low-sensitivity categories. For different sensitivities, a key seed is generated based on the Key Derivation Function (KDF), combined with dynamic device fingerprints and fragment identifiers. Different key lengths and iteration counts are set to derive independent encryption keys, with longer keys and higher iteration strength used for encryption of high-sensitivity data. After encryption is completed, redundant data of about 10% length is randomly generated according to the fragment data format and embedded into the designated position of the encrypted fragment to form a confused fragment, making it difficult for attackers to distinguish between real content and interference information even if they intercept the data.

[0040] Specifically, the information entropy of the raw data D collected by the Internet of Things is calculated. Determining the number of fragments based on information entropy ,in, For the number of fragments, Based on the number of basic fragments, Using the entropy weight function, multiple data slices are obtained; the data in each data slice is transformed into an input tensor, and the sensitive features of each data slice are extracted through the convolutional and pooling layers of a convolutional neural network. The feature mapping formula for each convolutional layer is: ,in, For depthwise convolution operations The convolutional kernel weights and bias terms are respectively used. A global average pooling layer compresses the feature map output of the final convolutional layer into a one-dimensional sensitive feature vector. This sensitive feature vector is then input into a fully connected layer and a softmax classifier to calculate the sensitivity of each data slice. The sensitivity is categorized as high, medium, and low. A key derivation strategy is formulated based on the sensitivity, and the Key Derivation Function (KDF) generates independent encryption keys. ,in, The key seed is obtained by first converting the dynamic device fingerprint and fragment identifier into a binary stream, and then performing a concatenation hash operation. This is the key length. For the number of iterations; high sensitivity corresponds to It is 256 bits, with 5000 iterations, and corresponds to medium sensitivity. It is 128 bits, with 2000 iterations, and corresponds to low sensitivity. The algorithm uses 64 bits and iterates 1000 times. Redundant data, 10% of the data length, is randomly generated based on the format of the data in each data fragment and embedded into a designated position in the corresponding encrypted fragment, resulting in the obfuscated final data fragment. This scheme ensures high security for the data at both the content and structural levels.

[0041] Considering the vulnerability of single-path transmission to eavesdropping and interception, and the difficulty in guaranteeing data integrity, a multi-path transmission mechanism is adopted to route data fragments to target service nodes. At the service nodes, the data is reassembled, and each fragment is decrypted using a decryption key corresponding to its fragment to recover the original data content. This is achieved by stripping redundant data before decryption. Specifically, each encrypted and obfuscated data fragment is routed to the target service node via different network paths, reducing the risk of centralized interception. Upon receiving the fragments, the service nodes first strip redundant data based on the fragment identifier to recover clean encrypted fragments. Then, using the same key derivation function, combined with the generated key seed, the matching key length, and the number of iterations, a decryption key is generated. This decryption key is then used to decrypt the pure fragment data to obtain the original fragment data.

[0042] Finally, to address the issues of data loss and tampering in complex network environments and the lack of sophisticated anomaly handling mechanisms, a fragment-level verification and retransmission isolation mechanism is adopted to enhance data integrity and system robustness. The original data content of the decrypted fragments is verified. Data that fails verification triggers a security alert and is isolated, while successfully verified data is marked as trusted and authorized for subsequent use. Specifically, after fragment reassembly, integrity and consistency verification is performed on the decrypted data of each fragment. If the verification of the original fragment data fails, a retransmission request containing the unique fragment identifier of the failed fragment is sent to the IoT device, along with the retransmission verification baseline information. Upon receiving the request, the device retrieves the original encrypted data and independent key of the corresponding fragment and retransmits the fragment according to the original sending logic. After receiving the retransmitted fragment, the target service node performs another verification; if the verification passes, the reconstructed data is completed. If the same fragment fails to retransmit more than three times, a security alert is triggered, the fragment is isolated, and the device is contacted to investigate transmission or hardware anomalies.

[0043] This invention constructs an integrated IoT data information security transmission system from multiple levels, including device identity, key exchange, data fragmentation encryption, transmission path, and reassembly verification. It can achieve secure data transmission that balances security, real-time performance, and reliability in resource-constrained and network-complex IoT environments, providing solid support for the large-scale deployment and high-value applications of IoT systems.

[0044] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments for application in other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A method for secure transmission of Internet of Things (IoT) data, characterized in that, Includes the following steps: S1. Generate a device fingerprint based on a physically unclonable function at the IoT device end. Utilize the inherent physical characteristics of the device hardware to generate an initial device fingerprint. Periodically combine the device behavior characteristics to dynamically update the initial device fingerprint to obtain a dynamic device fingerprint. S2. Establish an encrypted communication channel between the IoT device and the target service node, and use an improved Diffie-Hellman key exchange algorithm based on elliptic curve cryptography to generate a shared key for data encryption. S3. Perform fragmentation, encryption and obfuscation processing on the original data. Divide the original data into multiple data fragments according to the dynamic fragmentation strategy, generate an independent key for each fragment and embed deceptive redundant data in the fragments. S4. The data fragments are routed to the target service nodes through a multi-path transmission mechanism. The data is reassembled at the service nodes, and the decryption keys corresponding to the data fragments are used to decrypt each data fragment to restore the original data content. S5. Verify the original data content of the decrypted fragments. Trigger a security alarm and isolate the data that fails to be verified. Mark the data that is successfully verified as trusted data and authorize its subsequent use. Step S2 establishes an encrypted communication channel between the IoT device and the target service node. The specific implementation of generating a shared key for data encryption using an improved Diffie-Hellman key exchange algorithm based on elliptic curve cryptography is as follows: S21. Choose a lightweight elliptic curve over a finite field, with the equation E: , where x, y are the coordinate variables of a point on the elliptic curve, a, b are the shape parameters of the elliptic curve, and p is a prime number; S22. Randomly select the x-coordinate within a finite field. Substituting into the curve equation, we can calculate... ,like If it is a quadratic residue in a finite field, then take To obtain the curve points Calculate the order k of the point and verify whether k is a prime number; if k is a prime number, then determine... The coordinates are based on point G; otherwise, a new point is selected. The calculation continues until the base point G is obtained; the target service node pre-stores the elliptic curve parameters a, b, p, the base point G, and the order k into the IoT device to ensure that both parties use completely consistent parameters. S23. IoT devices generate random temporary private keys. A temporary public key is generated through elliptic curve scalar multiplication: ,in, For scalar multiplication of elliptic curves; S24. Transfer the temporary public key and dynamic device fingerprints Concatenate them into a public key with an identity identifier. And generate the current timestamp T, in order to Calculate the message authentication code for the key: ,in, For string concatenation operations; the device will , T is sent together to the target service node; S25. After receiving the data, the target service node first verifies the timestamp: it checks whether the difference between the current time and T is less than a preset threshold. If it exceeds this threshold, it is determined to be a replay attack, and key exchange is rejected. If the timestamp is valid, it extracts... The key exchange is rejected if the fingerprint digest is not matched with the pre-stored latest dynamic fingerprint digest of the device; otherwise, the identity digest is matched, and the validity of the message authentication code (MAC) is verified. Upon successful verification, a random temporary private key is generated. Calculate the temporary public key and will Return to IoT devices; S26. The IoT device and the target service node each calculate the shared secret point. The device calculates: Target service node calculation: Based on the commutative law of elliptic curve scalar multiplication, it satisfies Obtain the coordinates of the shared secret point. ; S27. Extract the x-coordinate of the shared secret point and convert it into a byte string to obtain the shared session key.

2. The method for secure transmission of IoT data information according to claim 1, characterized in that, Step S1 generates a device fingerprint based on a physically non-cloning function at the IoT device end. An initial device fingerprint is generated using the inherent physical characteristics of the device hardware. The dynamic device fingerprint is then periodically updated by combining the initial fingerprint with device behavior characteristics. The specific implementation of this dynamic device fingerprint is as follows: S11. First, extract the multi-dimensional hardware physical features of the IoT device, denoted as the hardware physical feature set. For the i-th dimension of hardware physical characteristics, a physically non-clonable function is used to generate a sub-device fingerprint. A hash operation is performed on the sub-device fingerprint to obtain a hash value; all hash values ​​are then XORed and merged to generate the primary device fingerprint. , where n is the feature set Dimensions Perform a hash operation on the fingerprint of the nth sub-device to obtain the hash value. This is an XOR operation; S12. Collect data including frequency characteristics, network communication packet length fluctuation characteristics, and hardware power consumption fluctuation characteristics. Perform min-max normalization on these three characteristics to eliminate dimensional differences. Concatenate the normalized three behavioral characteristics in sequence into a behavioral feature string. Perform a hash operation on the feature string to obtain the hash value of the behavioral feature. ; S13. Configure a fixed update cycle. When the device's cumulative runtime reaches a set value, the fingerprint update process is triggered. The update count is s. When s=1, the initial device fingerprint is used. Based on this, compare it with the behavioral feature hash value. Perform an XOR operation to generate the dynamic device fingerprint after the first update. When s>1, the dynamic device fingerprint is iteratively updated by repeating the XOR operation based on the previously updated dynamic device fingerprint to obtain the current dynamic device fingerprint. .

3. The method for secure transmission of IoT data information according to claim 1, characterized in that, In step S3, the original data is fragmented, encrypted, and obfuscated. The original data is divided into multiple data fragments according to a dynamic fragmentation strategy. An independent key is generated for each fragment, and deceptive redundant data is embedded in the fragment. The specific implementation of this is as follows: S31. Calculate the information entropy of the raw data D collected by the Internet of Things. Determining the number of fragments based on information entropy ,in, For the number of fragments, Based on the number of basic fragments, Using the entropy weighting function, multiple data slices are obtained; S32. Transform the data in each data slice into an input tensor, and extract the sensitive features of each data slice through the convolutional and pooling layers of a convolutional neural network. The feature mapping formula for each convolutional layer is: ,in, For depthwise convolution operations The convolutional kernel weights and bias terms are respectively used. The feature map output by the final convolutional layer is compressed into a one-dimensional sensitive feature vector through a global average pooling layer. The sensitive feature vector is then input into a fully connected layer and a softmax classifier to calculate the sensitivity of each data slice. The sensitivity is divided into high sensitivity, medium sensitivity, and low sensitivity. S33. Develop a key derivation strategy based on sensitivity, and use the Key Derivation Function (KDF) to generate independent encryption keys: ,in, The key seed is obtained by first converting the dynamic device fingerprint and fragment identifier into a binary stream, and then performing a concatenation hash operation. This is the key length. For the number of iterations; high sensitivity corresponds to It is 256 bits, with 5000 iterations, and corresponds to medium sensitivity. It is 128 bits, with 2000 iterations, and corresponds to low sensitivity. It is 64 bits long and has 1000 iterations. S34. Randomly generate redundant data with a length of 10% according to the format of the data in each data fragment, and embed it into the specified position of the corresponding encrypted fragment to obtain the obfuscated final data fragment.

4. The method for secure transmission of IoT data information according to claim 1, characterized in that, The implementation of step S4, which uses the decryption key corresponding to the data fragment to decrypt each data fragment and restore the original data content, involves stripping redundant data before decrypting the data fragment. Then, using the same key derivation function, a decryption key is generated by combining the generated key seed, the matching key length, and the number of iterations. The generated decryption key is then used to decrypt the pure fragment data to obtain the original fragment data.

5. The method for secure transmission of IoT data information according to claim 1, characterized in that, If the verification of the original data of the fragment fails in step S5, a retransmission request containing the unique fragment identifier of the failed fragment is then sent to the IoT device based on the unique fragment identifier of each fragment, and the retransmission verification benchmark information is attached simultaneously. After receiving the request, the device retrieves the original encrypted data and independent key of the corresponding fragment and retransmits the fragment according to the original sending logic; After the target service node receives the retransmitted fragment, it performs a second verification. If the verification passes, the reconstructed data is completed. If the same fragment fails to be retransmitted more than three times, a security alarm is triggered and the fragment is isolated. The device is then contacted to investigate transmission or hardware abnormalities.

Images