Internet of Things equipment self-adaptive secure communication method and system based on dynamic negotiation, Internet of Things equipment and storage medium

Abstract

The invention discloses a dynamic negotiation-based self-adaptive secure communication method and system for an internet of things device, the internet of things device and a storage medium, and the method comprises the steps that the internet of things device exchanges a security context through a first packet, and receives and updates a security configuration issued by a cloud in real time; the Internet of Things equipment reads and starts a corresponding encryption algorithm from the local or directly selects a plaintext transmission mode according to the negotiated algorithm configuration; the Internet of Things equipment dynamically manages the secret key, and decides to execute secret key derivation or read the cache secret key for encryption and decryption according to the updating period; the Internet of Things equipment analyzes the security context, obtains corresponding secret keys and algorithm parameters according to configuration requirements, and executes encryption or plaintext transmission; when the security context is changed, the Internet of Things equipment immediately updates an encryption and decryption algorithm adapter of uplink and downlink messages; and after the message is encrypted and decrypted, packaging the message body according to a preset message packaging format and then sending the message body. According to the invention, the communication efficiency and interoperability are improved by optimizing the communication process.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to an adaptive secure communication method, system, IoT device, and computer-readable storage medium for IoT devices based on dynamic negotiation. Background Technology

[0002] Current encryption solutions for IoT devices suffer from issues such as fixed algorithms and static key management. Traditional systems cannot dynamically switch encryption modes based on network conditions and device capabilities, resulting in insufficient protection in high-security scenarios and wasted resources in low-security scenarios. Especially in heterogeneous device networking, the lack of a unified algorithm negotiation mechanism creates cross-platform communication barriers.

[0003] Current technologies employ fixed encryption algorithms, making it difficult to dynamically adapt to the needs of scenarios with different security levels. Furthermore, the binding of keys to algorithms limits system flexibility. Additionally, switching between plaintext and ciphertext requires manual intervention, which is inefficient, especially when negotiating security protocols between heterogeneous devices.

[0004] Therefore, existing technologies still need to be improved and developed. Summary of the Invention

[0005] The main objective of this invention is to provide an adaptive secure communication method, system, IoT device, and computer-readable storage medium for IoT devices based on dynamic negotiation. This invention aims to solve the problems in the prior art where the encryption algorithm is fixed, cannot dynamically adapt to different security level requirements, has low system flexibility, and is inefficient when negotiating security protocols between heterogeneous devices.

[0006] To achieve the above objectives, the present invention provides an adaptive secure communication method for IoT devices based on dynamic negotiation, the method comprising the following steps: IoT devices establish a connection with the cloud, exchange security contexts through the first packet, receive and update security configurations issued by the cloud in real time, in order to establish a dynamic security baseline; IoT devices can read and enable the corresponding encryption algorithm from the local storage or directly select plaintext transmission mode based on the negotiated algorithm configuration. The IoT device dynamically manages the key, and decides whether to perform key derivation or read the cached key based on the update cycle for encryption and decryption operations; IoT devices parse the security context, obtain the corresponding key and algorithm parameters according to the configuration requirements, and perform encrypted or plaintext transmission. When the security context changes, IoT devices immediately update the encryption and decryption algorithm adapters for uplink and downlink messages; The cloud encapsulates downlink messages according to a preset message encapsulation format and sends them to IoT devices. The IoT devices decrypt the downlink messages. The IoT devices also encapsulate uplink messages according to a preset message encapsulation format and upload them to the cloud. The cloud uses a corresponding algorithm to decrypt the uplink messages.

[0007] Optionally, the aforementioned adaptive secure communication method for IoT devices based on dynamic negotiation, wherein the IoT device establishes a connection with the cloud, exchanges security context through the first packet, receives and updates the security configuration issued by the cloud in real time to establish a dynamic security baseline, specifically includes: When the IoT device establishes a connection with the cloud, the IoT device sends a security context structure as the first MQTT connection packet to the cloud. When the cloud returns the optimized security configuration to the IoT device, the IoT device receives the security configuration and updates its local configuration in real time to establish a dynamic security baseline.

[0008] Optionally, in the aforementioned adaptive secure communication method for IoT devices based on dynamic negotiation, the security context structure includes: an algorithm configuration identifier, a business scenario identifier, and a protocol version number.

[0009] Optionally, the aforementioned adaptive secure communication method for IoT devices based on dynamic negotiation, wherein the IoT device, according to the negotiated algorithm configuration, reads and enables the corresponding encryption algorithm locally or directly selects a plaintext transmission mode, specifically includes: The IoT device reads the locally built-in configuration file according to the algorithm configuration fields negotiated with the cloud; When the negotiation content is in encryption mode, the corresponding algorithm type, working mode and padding scheme are retrieved, and the matching algorithm is called to complete the decryption of the ciphertext; When the negotiation content is in plaintext mode, plaintext transmission is selected directly.

[0010] Optionally, the adaptive secure communication method for IoT devices based on dynamic negotiation, wherein the IoT device dynamically manages the key and determines whether to perform key derivation or read the cached key for encryption and decryption operations according to the update cycle, specifically includes: The IoT device dynamically selects a key derivation algorithm and determines whether the current time exceeds the update time period. If the current time exceeds the update time period, key derivation will be performed. If the current time has not exceeded the update time period, read the cached key; Import the key and perform encryption / decryption operations.

[0011] Optionally, the adaptive secure communication method for IoT devices based on dynamic negotiation, wherein the IoT device parses the security context, obtains the corresponding key and algorithm parameters according to configuration requirements, and performs encrypted or plaintext transmission, specifically includes: The IoT device parses the security context, reads the configuration file, and determines whether encryption is required. If encryption is required, obtain the key and message algorithm configuration, update the encryption / decryption parameter set, and perform encryption / decryption operations. If encryption is not required, transmit in plaintext.

[0012] Optionally, the adaptive secure communication method for IoT devices based on dynamic negotiation, wherein the IoT device immediately updates the encryption / decryption algorithm adapter for uplink and downlink messages when the security context changes, specifically includes: When the IoT device receives a downlink message from the cloud and the security context changes, it updates the decryption algorithm adapter and synchronizes the security context change information to the uplink message processing flow. The uplink message updates the encryption algorithm adapter immediately after encrypting the previous message, and starts using the latest encryption algorithm from the next message.

[0013] Furthermore, to achieve the above objectives, the present invention also provides an adaptive secure communication system for IoT devices based on dynamic negotiation, wherein the adaptive secure communication system for IoT devices based on dynamic negotiation includes: The initial connection and negotiation module is used for IoT devices to establish a connection with the cloud. It exchanges security context through the first packet, receives and updates the security configuration issued by the cloud in real time, so as to establish a dynamic security baseline. The transmission mode selection module is used by IoT devices to read and enable the corresponding encryption algorithm from the local storage or directly select the plaintext transmission mode based on the negotiated algorithm configuration. The key dynamic management module is used to dynamically manage keys for IoT devices. It determines whether to perform key derivation or read cached keys based on the update cycle for encryption and decryption operations. The message processing and execution module is used by IoT devices to parse the security context, obtain the corresponding key and algorithm parameters according to the configuration requirements, and perform encrypted or plaintext transmission. The algorithm dynamic update module is used to immediately update the encryption and decryption algorithm adapters of uplink and downlink messages when the security context changes in IoT devices; The message encapsulation and upload module is used to encapsulate downlink messages in a preset message encapsulation format in the cloud and send them to IoT devices. The IoT devices decrypt the downlink messages. The IoT devices also encapsulate uplink messages in a preset message encapsulation format and upload them to the cloud. The cloud uses a corresponding algorithm to decrypt the uplink messages.

[0014] Furthermore, to achieve the above objectives, the present invention also provides an Internet of Things (IoT) device, wherein the IoT device includes: a memory, a processor, and a dynamically negotiated IoT device adaptive secure communication program stored in the memory and executable on the processor, wherein when the dynamically negotiated IoT device adaptive secure communication program is executed by the processor, it implements the steps of the dynamically negotiated IoT device adaptive secure communication method as described above.

[0015] Furthermore, to achieve the above objectives, the present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a dynamically negotiated IoT device adaptive secure communication program, which, when executed by a processor, implements the steps of the dynamically negotiated IoT device adaptive secure communication method as described above.

[0016] In this invention, IoT devices establish a connection with the cloud, exchange security contexts via the first packet, receive and update security configurations sent from the cloud in real time to establish a dynamic security baseline. Based on the negotiated algorithm configuration, the IoT device reads and enables the corresponding encryption algorithm locally or directly selects a plaintext transmission mode. The IoT device dynamically manages keys, deciding whether to perform key derivation or read cached keys based on the update cycle for encryption and decryption operations. The IoT device parses the security context, obtains the corresponding keys and algorithm parameters according to configuration requirements, and performs encryption or plaintext transmission. When the security context changes, the IoT device immediately updates the encryption and decryption algorithm adapters for uplink and downlink messages. The cloud encapsulates downlink messages according to a preset message encapsulation format and sends them to the IoT device, which then decrypts the downlink messages. Similarly, the IoT device encapsulates uplink messages according to a preset message encapsulation format and uploads them to the cloud, where the cloud uses the corresponding algorithm to decrypt the uplink messages. This invention optimizes the communication process, improves communication efficiency and interoperability, and significantly enhances system performance, availability, and scalability while ensuring communication security. Attached Figure Description

[0017] Figure 1 This is a flowchart of a preferred embodiment of the adaptive secure communication method for IoT devices based on dynamic negotiation according to the present invention; Figure 2 This is a flowchart illustrating how IoT devices dynamically manage keys and decide whether to perform key derivation or read cached keys based on the update cycle, according to a preferred embodiment of the IoT device adaptive secure communication method based on dynamic negotiation of the present invention. Figure 3 This is a flowchart illustrating the dynamic switching of encryption and decryption algorithms in a preferred embodiment of the adaptive secure communication method for IoT devices based on dynamic negotiation of the present invention. Figure 4This is a structural diagram of a preferred embodiment of the adaptive secure communication system for IoT devices based on dynamic negotiation according to the present invention; Figure 5 This is a structural diagram of a preferred embodiment of the Internet of Things (IoT) device of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer and more explicit, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0019] The preferred embodiment of the present invention describes an adaptive secure communication method for IoT devices based on dynamic negotiation, such as... Figure 1 As shown, the adaptive secure communication method for IoT devices based on dynamic negotiation includes the following steps: Step S10: The IoT device establishes a connection with the cloud, exchanges security context through the first packet, receives and updates the security configuration issued by the cloud in real time, so as to establish a dynamic security baseline.

[0020] Specifically, when the IoT device establishes a connection with the cloud, the IoT device sends a security context structure as the first packet of the MQTT connection to the cloud. The security context structure includes information such as algorithm configuration identifier, business scenario identifier, and protocol version number. After the cloud returns the optimized security configuration to the IoT device, the IoT device receives the security configuration and updates its local configuration in real time to establish a dynamic security baseline.

[0021] After the IoT device establishes an MQTT connection with the cloud, the security context structure included in the first packet message is encapsulated in the message header when message transmission is initiated after the IoT device establishes an MQTT connection with the cloud. Its content fields include encryption algorithm type, encryption parameters (such as timestamp, IV value, AAD value), service name, etc., which facilitates the receiving end to match the corresponding decryption algorithm for ciphertext parsing.

[0022] IoT devices and the cloud first establish a connection by verifying the consistency of username and password. After the connection is successful, whether the IoT device or the cloud identifies a security risk and needs to upgrade the algorithm to select a more secure algorithm, or whether the current scenario does not need to use a high-security algorithm and is wasteful and needs to downgrade the security, the algorithm type will be updated in the security context structure carried in front of the sent message body. The receiver will match the decryption function according to the latest algorithm to decrypt the data.

[0023] Among them, dynamic security baseline refers to dynamic negotiation mechanism. Due to the addition of security context structure, the encryption and decryption algorithms between the end and the cloud are not fixed. The matching encryption algorithm can be selected according to different scenarios (such as selecting integrity verification only in low security scenarios, encryption only in medium security scenarios, and authentication encryption in high security scenarios). When the receiving end recognizes the algorithm update through the security context, it synchronously modifies the local algorithm type and uses the corresponding algorithm to decrypt subsequent messages.

[0024] When an IoT device initiates an MQTT connection, it sends a structured security context structure as the first data packet. This structure includes a list of the device's capabilities (such as supported cryptographic algorithm suites and key derivation algorithm versions), its current security status (such as the currently used algorithm ID and key version number), and the device's identity. Upon receiving this, the cloud intelligently selects the optimal security configuration from the device's supported capabilities based on its global security policy, real-time threat intelligence, and the device's specific business scenario, and then distributes this configuration to the IoT device. Once received, the IoT device can immediately apply the configuration without restarting or interrupting its operations, thus establishing a dynamic and customized security baseline for this connection session.

[0025] This approach enables fine-grained, scenario-adaptive security policies, avoiding the performance waste or security risks associated with a "one-size-fits-all" approach to security configuration. By prioritizing and structuring security negotiation, capability exchange and policy distribution are completed in the first packet, significantly reducing the number of handshake protocol interactions and lowering connection establishment latency. A dynamic security baseline is established, allowing for flexible adjustment of the security level throughout the communication process, providing a foundation for addressing future threats and compliance changes.

[0026] Step S20: The IoT device reads and enables the corresponding encryption algorithm from the local storage or directly selects the plaintext transmission mode according to the negotiated algorithm configuration.

[0027] Specifically, regarding the configuration file algorithm mapping, since there are many algorithm names and types, this invention adopts a dictionary mapping method to compress the algorithm in order to reduce message transmission overhead. The IoT device reads the locally built-in configuration file according to the algorithm configuration fields negotiated with the cloud; when the negotiated content is in encryption mode, it retrieves the corresponding algorithm type, working mode, and padding scheme to call the matching algorithm to complete the decryption of the ciphertext; when the negotiated content is in plaintext mode, it directly selects plaintext transmission.

[0028] The algorithm configuration field is a mapping to a set of multiple parameters. Since the number of parameters added in the security context is limited (too many parameters would introduce additional performance overhead), the algorithm configuration field is used in conjunction with a configuration file. The configuration file acts as a dictionary, and the corresponding algorithm and its specific parameter configuration can be indexed in the configuration file through the algorithm configuration field. For example, if the algorithm configuration field is "11112", then the content indexed in the configuration file would be: { "type": "11112", "algconfig": { "secure": xxx, "hmac": xxx, "hkdf": xxx", "symmetric": xxxx, "sig": null, "hkdf_length": xxx } } Among them, "symmetric" corresponds to the specific message body encryption algorithm, "hkdf" corresponds to the key encryption algorithm, "secure" indicates whether encryption is required, and the other fields are also the corresponding key and cryptographic algorithms. The structure is for example only.

[0029] The "algorithm configuration field" negotiated between IoT devices and the cloud is a defined enumerated value or flag. After parsing this field, the IoT device accesses a pre-built, structured configuration file (such as JSON or XML format) locally. If the field indicates encryption mode, the configuration file acts as an algorithm dictionary. The device retrieves the corresponding specific algorithm type (such as AES), operating mode (such as GCM), padding scheme (such as PKCS7), and other parameters based on the field value, and loads the corresponding encryption library module. If the field indicates plaintext mode, the encryption process is bypassed, and the data is sent to the transmission queue.

[0030] This approach achieves decoupling and flexibility: separating the algorithm identifier from the specific implementation allows new algorithms to be supported simply by modifying the configuration file, without requiring changes to the device firmware code. It also supports seamless switching between plaintext and ciphertext: meeting the diverse data privacy requirements of IoT applications. For example, device status heartbeat packets can use plaintext to save resources, while control commands must be encrypted.

[0031] Step S30: Dynamically manage the key for IoT devices. Based on the update cycle, decide whether to perform key derivation or read the cached key for encryption and decryption operations.

[0032] Specifically, such as Figure 2 As shown, the IoT device dynamically selects a key derivation algorithm based on the negotiated security context, and periodically updates the derivation timestamp to prevent replay attacks, etc. It determines whether the current time exceeds the update time period T; if the current time exceeds the update time period T, key derivation is performed; if the current time does not exceed the update time period T, the cached key is read to reduce the overhead of key derivation and improve system performance; the key is imported and encryption / decryption operations are performed.

[0033] The key derivation algorithm (such as the HMAC-based key derivation function HKDF) is also configurable. The IoT device internally maintains a key lifecycle timer. When the current time exceeds a preset key update cycle (e.g., 24 hours), a key derivation process is triggered. Using the master key or the key from the previous cycle as input, a new session key is derived, and the timer and cached key are updated. If the timeout has not occurred, the cached key is read directly from the secure storage area. Finally, the finalized key is imported into the designated key slot of the encryption / decryption engine.

[0034] This approach achieves forward security: even if a single session key is compromised, the history of previous communications will not be affected due to regular key updates. It reduces key derivation overhead: by caching and periodic updates, it avoids computationally expensive key derivation for every communication, striking a balance between security and performance. It also improves the automation level of key management and reduces the risks associated with long-term use of a single key.

[0035] Step S40: The IoT device parses the security context, obtains the corresponding key and algorithm parameters according to the configuration requirements, and performs encrypted or plaintext transmission.

[0036] Specifically, such as Figure 3 As shown, the IoT device parses the security context, reads the configuration file, and determines whether encryption is required. If encryption is required, it obtains the key and message algorithm configuration, updates the encryption / decryption parameter set, and performs encryption / decryption operations. If encryption is not required, it transmits the data in plaintext.

[0037] The encryption / decryption algorithm is dynamically switched through a three-tier architecture, primarily consisting of security context parsing, an algorithm selection engine, and encryption / decryption operations. For example, in high-security scenarios, an authentication encryption mode (such as block cipher authentication) is used, while in basic security scenarios, a message authentication mode (such as hash-based message authentication) is employed. This approach flexibly adapts to the security requirements of different scenarios, improving device performance.

[0038] For each specific message to be sent or received, the IoT device parses its associated security context again. This process, combined with the configuration file, determines whether the message needs encryption (e.g., based on the message topic or specific flags in the message content). If encryption is required, the currently valid key and the algorithm configuration selected for the message are dynamically obtained, an encryption / decryption parameter set (including key handle, algorithm ID, initialization vector IV, etc.) is instantiated or updated, and the encryption / decryption engine is invoked to perform the operation. If encryption is not required, plaintext transmission is performed directly.

[0039] This operation achieves message-level security control, allowing different security policies to be applied to data of varying importance and subject matter, resulting in more efficient resource utilization. Dynamic parameter set updates ensure that each message uses the latest and most accurate security parameters, guaranteeing communication consistency and security.

[0040] Step S50: When the security context changes, the IoT device immediately updates the encryption / decryption algorithm adapter for uplink and downlink messages.

[0041] Specifically, when the IoT device receives a downlink message from the cloud and the security context changes, it updates the decryption algorithm adapter and synchronizes the security context change information to the uplink message processing flow. Similarly, when an uplink message completes the encryption of the previous message, it immediately updates the encryption algorithm adapter and uses the latest encryption algorithm from the next message onwards. In other words, the encryption of uplink messages and the decryption of downlink messages are executed independently through two asynchronous threads. When the IoT device receives a downlink message and detects a security context change, it immediately updates the decryption algorithm adapter and synchronizes the information to the uplink message processing flow. Similarly, when an uplink message completes the encryption of the previous message, it immediately updates the encryption algorithm adapter and uses the latest encryption algorithm from the next message onwards. This asynchronous processing method effectively improves the system's message transmission efficiency.

[0042] When an IoT device receives a downlink message from the cloud and detects that the message carries a "security context change" instruction (such as an algorithm upgrade notification), it immediately updates the decryption algorithm adapter used to process the downlink message. Simultaneously, to maintain security consistency between uplink and downlink communication, this change information is synchronized to the uplink message processing flow via the internal message bus or a flag. After completing the encryption of the currently processed message, the uplink process immediately switches the encryption algorithm adapter. This means that the next uplink message will use the new algorithm and key, achieving a smooth, uninterrupted upgrade.

[0043] This operation enables seamless and coordinated switching of algorithms and keys, completely avoiding communication interruptions or decryption failures caused by uplink / downlink algorithm mismatches during the switching process. It ensures communication continuity and high availability, meeting the stringent requirements for long-term stable operation in IoT applications. The instant synchronization and processing of change commands allows the system to quickly respond to adjustments in security policies.

[0044] Step S60: The cloud encapsulates the downlink message according to the preset message encapsulation format and sends it to the IoT device. The IoT device decrypts the downlink message. The IoT device encapsulates the uplink message according to the preset message encapsulation format and uploads it to the cloud. The cloud uses the corresponding algorithm to decrypt the uplink message.

[0045] Specifically, both uplink and downlink messages follow the format of message header (security context) + message body (i.e., a preset message encapsulation format). The cloud encapsulates the downlink message according to the preset message encapsulation format before sending it to the IoT device. The IoT device decrypts the downlink message. Similarly, the IoT device encapsulates the uplink message according to the preset message encapsulation format before uploading it to the cloud. The cloud uses a corresponding algorithm to decrypt the uplink message. In other words, both the cloud's message sending and the IoT device's message uploading follow this format. Because the message header uses algorithm mapping, the compressed message header is a lightweight message transmission, incurring virtually no extra overhead. This message encapsulation effectively improves the system's flexibility and compatibility.

[0046] After completing the encryption and decryption at the content layer, the system will finally package the message body according to a preset, unified message encapsulation format. This format typically includes: a message header (containing metadata such as version number, algorithm identifier, key version, and sequence number) and a message body (encrypted ciphertext or plaintext data). The encapsulated complete data packet is then published to the cloud via the MQTT protocol.

[0047] This approach enables self-describing messages: the receiver can obtain all the parameters needed for decryption solely from the message header, simplifying the parsing and processing flow. It enhances system compatibility and scalability: the unified encapsulation format facilitates interoperability between devices of different versions and models and the cloud. It ensures data integrity and authenticity, especially by encapsulating and transmitting authentication tags together, effectively preventing data tampering during transmission.

[0048] In this invention, when an IoT device establishes a connection with the cloud, the IoT device sends a security context structure as the first MQTT connection packet to the cloud. The cloud returns an optimized security configuration to the IoT device. After receiving the security configuration, the IoT device updates its local configuration in real time, establishing a dynamic security baseline. The IoT device reads its locally built-in configuration file based on the algorithm configuration field negotiated with the cloud. When the negotiated content is in encrypted mode, it retrieves the corresponding algorithm type, working mode, and padding scheme; when the negotiated content is in plaintext mode, it directly selects plaintext transmission. The IoT device dynamically selects a key derivation algorithm. If the current time exceeds the update time period, key derivation is performed; if the current time does not exceed the update time period, the cached key is read, imported, and encryption / decryption operations are performed. The network device parses the security context, reads the configuration file, and if encryption is required, obtains the key and message algorithm configuration, updates the encryption / decryption parameter set, and performs encryption / decryption operations. If encryption is not required, it transmits the message in plaintext. When the IoT device receives a downlink message from the cloud and the security context changes, it updates the decryption algorithm adapter and synchronizes the security context change information to the uplink message processing flow. When the uplink message completes the encryption of the previous message, it immediately updates the encryption algorithm adapter and uses the latest encryption algorithm from the next message onwards. The cloud encapsulates the downlink message according to a preset message encapsulation format and sends it to the IoT device. The IoT device decrypts the downlink message. The IoT device encapsulates the uplink message according to a preset message encapsulation format and uploads it to the cloud. The cloud uses the corresponding algorithm to decrypt the uplink message.

[0049] The technical effects that this invention can bring are as follows: (1) Achieving dynamic adaptive security and improving overall security level: Through first-packet negotiation and cloud-based intelligent decision-making, appropriate security policies are dynamically allocated for different devices and scenarios, establishing a "dynamic security baseline." This avoids the waste or inadequacy of security capabilities. High-strength encryption can be enabled for high-performance devices, while devices with limited resources or transmitting non-sensitive data can be downgraded to lightweight encryption or even plaintext, achieving the best balance between security and resource consumption. At the same time, new security configurations can be issued by the cloud at any time to deal with new threats, enabling the entire system to have continuously evolving security capabilities.

[0050] (2) Decoupling security policies from business logic significantly improves system flexibility and maintainability: Specific parameters such as encryption algorithms and working modes are separated from the device firmware code and placed in configurable files. When it is necessary to update or add encryption algorithms, there is no need to modify and re-flash the device firmware. The algorithm upgrade of the entire network can be completed simply by updating the configuration file in the cloud, which greatly reduces maintenance costs and improves the system's adaptability to future cryptographic developments.

[0051] (3) Automated key lifecycle management enhances forward security and system robustness: The key derivation mechanism triggered by time periods enables regular automatic key rotation. Even if a session key is leaked, its impact is limited to a time period, making it impossible to decrypt historical communication data, thus providing forward security. At the same time, the automated "derivation-caching-reading" process reduces the computational overhead of frequent derivations and avoids the accumulation of risks caused by long-term use of fixed keys.

[0052] (4) Achieve seamless hot switching of algorithms to ensure high availability of communication and business continuity: When the security context changes, the uplink and downlink decryption or encryption adapters can be updated immediately and in an orderly manner. This mechanism ensures that message loss, decryption failure or connection interruption will not occur during algorithm switching.

[0053] (5) Optimize communication process and message structure to improve communication efficiency and interoperability: The first packet completes security negotiation, reducing the number of handshake interactions and lowering connection establishment latency. The standardized message encapsulation format makes each data packet self-describing. The receiver (cloud or IoT device) can directly parse and process the metadata (such as algorithm ID and key version) in the message header, simplifying the decryption logic and enhancing interoperability between different devices and the cloud. The unified format also lays the foundation for subsequent function expansion.

[0054] Furthermore, such as Figure 4 As shown, based on the above-described adaptive secure communication method for IoT devices based on dynamic negotiation, the present invention also provides a corresponding adaptive secure communication system for IoT devices based on dynamic negotiation, wherein the adaptive secure communication system for IoT devices based on dynamic negotiation includes: The initial connection and negotiation module 51 is used for IoT devices to establish a connection with the cloud, exchange security context through the first packet, receive and update the security configuration issued by the cloud in real time, so as to establish a dynamic security baseline; The transmission mode selection module 52 is used by IoT devices to read and enable the corresponding encryption algorithm from the local storage or directly select the plaintext transmission mode according to the negotiated algorithm configuration. The key dynamic management module 53 is used to dynamically manage keys for IoT devices. It determines whether to perform key derivation or read cached keys based on the update cycle for encryption and decryption operations. The message processing and execution module 54 is used by IoT devices to parse the security context, obtain the corresponding key and algorithm parameters according to the configuration requirements, and perform encrypted or plaintext transmission. The algorithm dynamic update module 55 is used to immediately update the encryption and decryption algorithm adapter of uplink and downlink messages when the security context changes. The message encapsulation and upload module 56 is used to encapsulate downlink messages in the cloud according to a preset message encapsulation format and send them to IoT devices. The IoT devices decrypt the downlink messages. The IoT devices also encapsulate uplink messages in the cloud according to a preset message encapsulation format and upload them to the cloud. The cloud uses a corresponding algorithm to decrypt the uplink messages.

[0055] Furthermore, such as Figure 5 As shown, based on the above-mentioned adaptive secure communication method and system for IoT devices based on dynamic negotiation, the present invention also provides an IoT device, which includes a processor 10, a memory 20 and a display 30. Figure 5 Only some components of the IoT device are shown; however, it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0056] In some embodiments, the memory 20 may be an internal storage unit of the IoT device, such as a hard drive or memory. In other embodiments, the memory 20 may be an external storage device of the IoT device, such as a plug-in hard drive, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the IoT device. Further, the memory 20 may include both internal and external storage units of the IoT device. The memory 20 is used to store application software and various types of data installed on the IoT device, such as the program code installed on the IoT device. The memory 20 can also be used to temporarily store data that has been output or will be output. In one embodiment, the memory 20 stores a dynamically negotiated IoT device adaptive secure communication program 40, which can be executed by the processor 10 to implement the dynamically negotiated IoT device adaptive secure communication method of this application.

[0057] In some embodiments, the processor 10 may be a central processing unit (CPU), a microprocessor, or other data processing chip, used to run program code stored in the memory 20 or process data, such as executing the adaptive secure communication method for IoT devices based on dynamic negotiation.

[0058] In some embodiments, the display 30 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an OLED (Organic Light-Emitting Diode) touchscreen. The display 30 is used to display information from the IoT device and to display a visual user interface. The processor 10, memory 20, and display 30 of the IoT device communicate with each other via a system bus.

[0059] In one embodiment, when the processor 10 executes the dynamically negotiated IoT device adaptive secure communication program 40 in the memory 20, the following steps are performed: IoT devices establish a connection with the cloud, exchange security contexts through the first packet, receive and update security configurations issued by the cloud in real time, in order to establish a dynamic security baseline; IoT devices can read and enable the corresponding encryption algorithm from the local storage or directly select plaintext transmission mode based on the negotiated algorithm configuration. The IoT device dynamically manages the key, and decides whether to perform key derivation or read the cached key based on the update cycle for encryption and decryption operations; IoT devices parse the security context, obtain the corresponding key and algorithm parameters according to the configuration requirements, and perform encrypted or plaintext transmission. When the security context changes, IoT devices immediately update the encryption and decryption algorithm adapters for uplink and downlink messages; The cloud encapsulates downlink messages according to a preset message encapsulation format and sends them to IoT devices. The IoT devices decrypt the downlink messages. The IoT devices also encapsulate uplink messages according to a preset message encapsulation format and upload them to the cloud. The cloud uses a corresponding algorithm to decrypt the uplink messages.

[0060] The IoT device establishes a connection with the cloud, exchanges security context through the first packet, receives and updates the security configuration issued by the cloud in real time to establish a dynamic security baseline, specifically including: When the IoT device establishes a connection with the cloud, the IoT device sends a security context structure as the first MQTT connection packet to the cloud. When the cloud returns the optimized security configuration to the IoT device, the IoT device receives the security configuration and updates its local configuration in real time to establish a dynamic security baseline.

[0061] The security context structure includes: algorithm configuration identifier, business scenario identifier, and protocol version number.

[0062] The IoT device, based on the negotiated algorithm configuration, reads and enables the corresponding encryption algorithm locally or directly selects the plaintext transmission mode, specifically including: The IoT device reads the locally built-in configuration file according to the algorithm configuration fields negotiated with the cloud; When the negotiation content is in encryption mode, the corresponding algorithm type, working mode and padding scheme are retrieved, and the matching algorithm is called to complete the decryption of the ciphertext; When the negotiation content is in plaintext mode, plaintext transmission is selected directly.

[0063] The IoT device's dynamic management key, based on its update cycle, determines whether to perform key derivation or read the cached key for encryption / decryption operations, specifically including: The IoT device dynamically selects a key derivation algorithm and determines whether the current time exceeds the update time period. If the current time exceeds the update time period, key derivation will be performed. If the current time has not exceeded the update time period, read the cached key; Import the key and perform encryption / decryption operations.

[0064] Specifically, the IoT device parses the security context, obtains the corresponding key and algorithm parameters according to the configuration requirements, and performs encrypted or plaintext transmission, including: The IoT device parses the security context, reads the configuration file, and determines whether encryption is required. If encryption is required, obtain the key and message algorithm configuration, update the encryption / decryption parameter set, and perform encryption / decryption operations. If encryption is not required, transmit in plaintext.

[0065] Specifically, when the security context changes, the IoT device immediately updates the encryption / decryption algorithm adapter for uplink and downlink messages, including: When the IoT device receives a downlink message from the cloud and the security context changes, it updates the decryption algorithm adapter and synchronizes the security context change information to the uplink message processing flow. The uplink message updates the encryption algorithm adapter immediately after encrypting the previous message, and starts using the latest encryption algorithm from the next message.

[0066] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a dynamic negotiation-based adaptive secure communication program for Internet of Things (IoT) devices, and the dynamic negotiation-based adaptive secure communication program for IoT devices, when executed by a processor, implements the steps of the dynamic negotiation-based adaptive secure communication method for IoT devices as described above.

[0067] In summary, this invention provides an adaptive secure communication method, system, IoT device, and computer-readable storage medium for IoT devices based on dynamic negotiation. The method includes: the IoT device establishing a connection with the cloud, exchanging security contexts via the first packet, receiving and updating security configurations issued by the cloud in real time to establish a dynamic security baseline; the IoT device reading and enabling the corresponding encryption algorithm locally or directly selecting a plaintext transmission mode according to the negotiated algorithm configuration; the IoT device dynamically managing keys, deciding whether to perform key derivation or read cached keys based on the update cycle for encryption and decryption operations; the IoT device parsing the security context, obtaining the corresponding key and algorithm parameters according to configuration requirements, and performing encryption or plaintext transmission; the IoT device immediately updating the encryption and decryption algorithm adapters for uplink and downlink messages when the security context changes; the cloud encapsulating downlink messages according to a preset message encapsulation format and sending them to the IoT device; the IoT device decrypting the downlink messages; the IoT device encapsulating uplink messages according to a preset message encapsulation format and uploading them to the cloud; and the cloud decrypting the uplink messages using the corresponding algorithm. This invention optimizes the communication process, improves communication efficiency and interoperability, and significantly enhances system performance, availability, and scalability while ensuring communication security.

[0068] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or IoT device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or IoT device. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or IoT device that includes that element.

[0069] Of course, those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware (such as a processor, controller, etc.). The program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The computer-readable storage medium can be a memory, magnetic disk, optical disk, etc.

[0070] It should be understood that the application of the present invention is not limited to the examples above. Those skilled in the art can make improvements or modifications based on the above description, and all such improvements and modifications should fall within the protection scope of the appended claims.

Claims

1. An adaptive secure communication method for IoT devices based on dynamic negotiation, characterized in that, The adaptive secure communication method for IoT devices based on dynamic negotiation includes: IoT devices establish a connection with the cloud, exchange security contexts through the first packet, receive and update security configurations issued by the cloud in real time, in order to establish a dynamic security baseline; IoT devices can read and enable the corresponding encryption algorithm from the local storage or directly select plaintext transmission mode based on the negotiated algorithm configuration. The IoT device dynamically manages the key, and decides whether to perform key derivation or read the cached key based on the update cycle for encryption and decryption operations; IoT devices parse the security context, obtain the corresponding key and algorithm parameters according to the configuration requirements, and perform encrypted or plaintext transmission. When the security context changes, IoT devices immediately update the encryption and decryption algorithm adapters for uplink and downlink messages; The cloud encapsulates downlink messages according to a preset message encapsulation format and sends them to IoT devices. The IoT devices decrypt the downlink messages. The IoT devices also encapsulate uplink messages according to a preset message encapsulation format and upload them to the cloud. The cloud uses a corresponding algorithm to decrypt the uplink messages.

2. The adaptive secure communication method for IoT devices based on dynamic negotiation according to claim 1, characterized in that, The IoT device establishes a connection with the cloud, exchanges security contexts through the first packet, receives and updates security configurations issued by the cloud in real time to establish a dynamic security baseline, specifically including: When the IoT device establishes a connection with the cloud, the IoT device sends a security context structure as the first MQTT connection packet to the cloud. When the cloud returns the optimized security configuration to the IoT device, the IoT device receives the security configuration and updates its local configuration in real time to establish a dynamic security baseline.

3. The adaptive secure communication method for IoT devices based on dynamic negotiation according to claim 2, characterized in that, The security context structure includes: algorithm configuration identifier, business scenario identifier, and protocol version number.

4. The adaptive secure communication method for IoT devices based on dynamic negotiation according to claim 1, characterized in that, The IoT device, based on the negotiated algorithm configuration, reads and enables the corresponding encryption algorithm locally or directly selects the plaintext transmission mode, specifically including: The IoT device reads the locally built-in configuration file according to the algorithm configuration fields negotiated with the cloud; When the negotiation content is in encryption mode, the corresponding algorithm type, working mode and padding scheme are retrieved, and the matching algorithm is called to complete the decryption of the ciphertext; When the negotiation content is in plaintext mode, plaintext transmission is selected directly.

5. The adaptive secure communication method for IoT devices based on dynamic negotiation according to claim 1, characterized in that, The IoT device dynamically manages the key, and determines whether to perform key derivation or read the cached key based on the update cycle for encryption and decryption operations, specifically including: The IoT device dynamically selects a key derivation algorithm and determines whether the current time exceeds the update time period. If the current time exceeds the update time period, key derivation will be performed. If the current time has not exceeded the update time period, read the cached key; Import the key and perform encryption / decryption operations.

6. The adaptive secure communication method for IoT devices based on dynamic negotiation according to claim 1, characterized in that, The IoT device parses the security context, obtains the corresponding key and algorithm parameters according to the configuration requirements, and performs encrypted or plaintext transmission, specifically including: The IoT device parses the security context, reads the configuration file, and determines whether encryption is required. If encryption is required, obtain the key and message algorithm configuration, update the encryption / decryption parameter set, and perform encryption / decryption operations. If encryption is not required, transmit in plaintext.

7. The adaptive secure communication method for IoT devices based on dynamic negotiation according to claim 1, characterized in that, When the security context changes, the IoT device immediately updates the encryption / decryption algorithm adapter for uplink and downlink messages, specifically including: When the IoT device receives a downlink message from the cloud and the security context changes, it updates the decryption algorithm adapter and synchronizes the security context change information to the uplink message processing flow. The uplink message updates the encryption algorithm adapter immediately after encrypting the previous message, and starts using the latest encryption algorithm from the next message.

8. An adaptive secure communication system for Internet of Things (IoT) devices based on dynamic negotiation, characterized in that, The IoT device adaptive secure communication system based on dynamic negotiation includes: The initial connection and negotiation module is used for IoT devices to establish a connection with the cloud. It exchanges security context through the first packet, receives and updates the security configuration issued by the cloud in real time, so as to establish a dynamic security baseline. The transmission mode selection module is used by IoT devices to read and enable the corresponding encryption algorithm from the local storage or directly select the plaintext transmission mode based on the negotiated algorithm configuration. The key dynamic management module is used to dynamically manage keys for IoT devices. It determines whether to perform key derivation or read cached keys based on the update cycle for encryption and decryption operations. The message processing and execution module is used by IoT devices to parse the security context, obtain the corresponding key and algorithm parameters according to the configuration requirements, and perform encrypted or plaintext transmission. The algorithm dynamic update module is used to immediately update the encryption and decryption algorithm adapters of uplink and downlink messages when the security context changes in IoT devices; The message encapsulation and upload module is used to encapsulate downlink messages in a preset message encapsulation format in the cloud and send them to IoT devices. The IoT devices decrypt the downlink messages. The IoT devices also encapsulate uplink messages in a preset message encapsulation format and upload them to the cloud. The cloud uses a corresponding algorithm to decrypt the uplink messages.

9. An Internet of Things (IoT) device, characterized in that, The IoT device includes: a memory, a processor, and a dynamically negotiated IoT device adaptive secure communication program stored in the memory and executable on the processor. When the dynamically negotiated IoT device adaptive secure communication program is executed by the processor, it implements the steps of the dynamically negotiated IoT device adaptive secure communication method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a dynamically negotiated adaptive secure communication program for Internet of Things (IoT) devices, which, when executed by a processor, implements the steps of the dynamically negotiated adaptive secure communication method for IoT devices as described in any one of claims 1-7.

Images