Home device local area network communication method and system based on multi-link authentication

Abstract

The application discloses a kind of based on multi-link authentication's home equipment local area network communication method and system, the method includes: obtaining the data to be transmitted of home equipment in local area network and target receiving device;According to the historical data communication record of the local area network and the target receiving device, device security authentication is carried out;When the device security authentication passes, according to the data to be transmitted and preset data analysis algorithm, data security authentication is carried out;When the data security authentication passes, based on the authentication process parameters of the device security authentication and the data security authentication, the data transmission path of the data to be transmitted is determined;The data transmission path is used to indicate that the data to be transmitted is transmitted to the target receiving device via at least one intermediate device.It can be seen that the present application can realize accurate data security transmission based on multi-level authentication and path optimization, improve the security and reliability of local area network home equipment communication.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a home appliance local area network communication method and system based on multi-stage authentication. Background Technology

[0002] With the rapid growth in demand for communication security in smart home LANs, users and enterprises are increasingly emphasizing the protection of privacy data and network security through precise transmission mechanisms. A key technical issue is how to achieve secure device and data verification and optimize transmission paths to reduce the risk of leakage. Existing technologies typically acquire the data to be transmitted from home devices and the target receiving device, perform initial authentication using fixed keys or simple historical verification methods, and select transmission paths based on standard routing rules to support LAN data exchange. However, existing solutions lack dynamic device authentication based on historical communication records, subsequent secure data verification, and path optimization analysis based on authentication parameters. This makes it difficult to ensure comprehensive security during transmission. Commonly used single authentication or static path strategies are unsuitable for complex home network environments, resulting in insufficient communication security and reliability. This makes them susceptible to privacy leaks due to device spoofing or data tampering, limiting the overall protection capabilities of LAN-based home devices and user trust. Therefore, existing technologies have shortcomings that urgently need to be addressed. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide a home device local area network communication method and system based on multi-level authentication, which can realize accurate and secure data transmission based on multi-level authentication and path optimization, improve the security and reliability of local area network home device communication, and reduce the risk of privacy leakage caused by device forgery or data tampering.

[0004] To address the aforementioned technical problems, the first aspect of this invention discloses a home device local area network communication method based on multi-stage authentication, the method comprising: Acquire the data to be transmitted from home devices on the local area network and the target receiving device; Based on the historical data communication records of the local area network and the target receiving device, device security authentication is performed; When the device security authentication is passed, data security authentication is performed based on the data to be transmitted and a preset data analysis algorithm; When the data security authentication is passed, the data transmission path of the data to be transmitted is determined based on the authentication process parameters of the device security authentication and the data security authentication; the data transmission path is used to indicate that the data to be transmitted is transmitted to the target receiving device via at least one intermediate device.

[0005] As an optional implementation, in the first aspect of the present invention, the step of performing device security authentication based on the historical data communication records of the local area network and the target receiving device includes: Determine the first equipment parameters of the home appliance; Determine the second device parameters of the target receiving device; Based on the first device parameters and the second device parameters, multiple matching communication records are identified from the historical data communication records of the local area network. Device security authentication is performed based on the matched communication records.

[0006] As an optional implementation, in the first aspect of the present invention, the step of matching multiple matching communication records in the historical data communication records of the local area network according to the first device parameters and the second device parameters includes: For each historical data communication record of the local area network, calculate the first parameter similarity between the initiating communication device of the historical data communication record and the parameters of the first device. When the first parameter similarity is greater than the first similarity threshold, the second parameter similarity between the final device of the historical data communication record and the second device parameter is calculated; When the similarity of the second parameter is greater than the second similarity threshold, the historical data communication record is determined as a matching communication record; When the similarity of the second parameter is less than the second similarity threshold, calculate the similarity of the third parameter between each intermediate device in the historical data communication record and the second device parameter; Intermediate devices with a similarity greater than the third similarity threshold are selected to obtain multiple similar intermediate devices; Calculate the weighted summation average of the third parameter similarity of all the similar intermediate devices to obtain the intermediate device similarity parameter; When the similarity parameter of the intermediate device is greater than the fourth similarity threshold, the historical data communication record is determined as a matching communication record; Otherwise, the historical data communication record will not be identified as a matching communication record.

[0007] As an optional implementation, in the first aspect of the present invention, when calculating the similarity parameters of the intermediate devices, the calculation weight corresponding to each of the third parameter similarities is inversely proportional to the device distance between the corresponding similar intermediate device and the final device on the communication link; the device distance is the product of the number of inter-device devices and the data transmission duration.

[0008] As an optional implementation, in the first aspect of the invention, the step of performing device security authentication based on the matching communication records includes: The security parameter is obtained by calculating the reciprocal of the product of the communication interruption rate and the communication security incident rate in all the matched communication records. Determine whether the safety parameter is greater than a preset parameter threshold to obtain a first determination result; If the first judgment result is yes, the device security authentication is determined to be passed.

[0009] As an optional implementation, in the first aspect of the present invention, the step of performing data security authentication based on the data to be transmitted and a preset data analysis algorithm includes: The data to be transmitted is input into the trained injection attack identification model to obtain the predicted probability of belonging to an injection attack. Based on the historical communication records of the home appliances, the data integrity of the data to be transmitted is determined. When the predicted probability is lower than a preset probability threshold and the data integrity is greater than a preset integrity threshold, the data security authentication is determined to be passed.

[0010] As an optional implementation, in the first aspect of the present invention, determining the data integrity corresponding to the data to be transmitted based on the historical communication records of the home device includes: Calculate the data similarity between the data to be transmitted and each historical transmission data in the historical communication records of the home device; Historical transmission data with a similarity greater than a preset threshold are filtered out to obtain multiple similar historical data; The data integrity of the data to be transmitted is obtained by calculating the average number of intersection identifiers between the set of data segment identifiers in the data to be transmitted and the set of data segment identifiers in each of the similar historical data.

[0011] As an optional implementation, in the first aspect of the present invention, determining the data transmission path of the data to be transmitted based on the authentication process parameters of the device security authentication and the data security authentication includes: Calculate the intersection of the relay device sets of all the matching communication records to obtain multiple candidate relay devices; the relay device set includes at least one home device located in the communication link between the initiating communication device and the final device of the corresponding matching communication record; Randomly combine any number of candidate relay devices, home appliances, and target receiving devices to obtain multiple transmission device sequences; the first device in each transmission device sequence is the home appliance, and the last device is the target receiving device; Each transmission device sequence, the data to be transmitted, and the corresponding data integrity are input into a trained transmission security prediction model to obtain the transmission security corresponding to each transmission device sequence; the transmission security prediction model is trained using a training dataset that includes multiple training device transmission sequences and corresponding transmission data labels and data integrity labels; The sequence of transmission devices with the highest transmission security is determined as the data transmission path for the data to be transmitted.

[0012] A second aspect of this invention discloses a home device local area network communication system based on multi-stage authentication, the system comprising: The acquisition module is used to acquire the data to be transmitted from home devices on the local area network and the target receiving device; The first authentication module is used to perform device security authentication based on the historical data communication records of the local area network and the target receiving device; The second authentication module is used to perform data security authentication based on the data to be transmitted and a preset data analysis algorithm when the device security authentication is passed. The transmission module is used to determine the data transmission path of the data to be transmitted based on the device security authentication and the authentication process parameters of the data security authentication when the data security authentication is passed; the data transmission path is used to indicate that the data to be transmitted is transmitted to the target receiving device via at least one intermediate device.

[0013] As an optional implementation, in a second aspect of the present invention, the specific method by which the first authentication module performs device security authentication based on the historical data communication records of the local area network and the target receiving device includes: Determine the first equipment parameters of the home appliance; Determine the second device parameters of the target receiving device; Based on the first device parameters and the second device parameters, multiple matching communication records are identified from the historical data communication records of the local area network. Device security authentication is performed based on the matched communication records.

[0014] As an optional implementation, in a second aspect of the invention, the specific method by which the first authentication module matches multiple matching communication records in the historical data communication records of the local area network based on the first device parameters and the second device parameters includes: For each historical data communication record of the local area network, calculate the first parameter similarity between the initiating communication device of the historical data communication record and the parameters of the first device. When the first parameter similarity is greater than the first similarity threshold, the second parameter similarity between the final device of the historical data communication record and the second device parameter is calculated; When the similarity of the second parameter is greater than the second similarity threshold, the historical data communication record is determined as a matching communication record; When the similarity of the second parameter is less than the second similarity threshold, calculate the similarity of the third parameter between each intermediate device in the historical data communication record and the second device parameter; Intermediate devices with a similarity greater than the third similarity threshold are selected to obtain multiple similar intermediate devices; Calculate the weighted summation average of the third parameter similarity of all the similar intermediate devices to obtain the intermediate device similarity parameter; When the similarity parameter of the intermediate device is greater than the fourth similarity threshold, the historical data communication record is determined as a matching communication record; Otherwise, the historical data communication record will not be identified as a matching communication record.

[0015] As an optional implementation, in a second aspect of the invention, when calculating the similarity parameters of the intermediate devices, the calculation weight corresponding to each of the third parameter similarities is inversely proportional to the device distance between the corresponding similar intermediate device and the final device on the communication link; the device distance is the product of the number of inter-device devices and the data transmission duration.

[0016] As an optional implementation, in a second aspect of the present invention, the specific method by which the first authentication module performs device security authentication based on the matching communication record includes: The security parameter is obtained by calculating the reciprocal of the product of the communication interruption rate and the communication security incident rate in all the matched communication records. Determine whether the safety parameter is greater than a preset parameter threshold to obtain a first determination result; If the first judgment result is yes, the device security authentication is determined to be passed.

[0017] As an optional implementation, in a second aspect of the present invention, the specific method by which the second authentication module performs data security authentication based on the data to be transmitted and a preset data analysis algorithm includes: The data to be transmitted is input into the trained injection attack identification model to obtain the predicted probability of belonging to an injection attack. Based on the historical communication records of the home appliances, the data integrity of the data to be transmitted is determined. When the predicted probability is lower than a preset probability threshold and the data integrity is greater than a preset integrity threshold, the data security authentication is determined to be passed.

[0018] As an optional implementation, in a second aspect of the invention, the second authentication module determines the specific method by which it determines the data integrity of the data to be transmitted based on the historical communication records of the home device, including: Calculate the data similarity between the data to be transmitted and each historical transmission data in the historical communication records of the home device; Historical transmission data with a similarity greater than a preset threshold are filtered out to obtain multiple similar historical data; The data integrity of the data to be transmitted is obtained by calculating the average number of intersection identifiers between the set of data segment identifiers in the data to be transmitted and the set of data segment identifiers in each of the similar historical data.

[0019] As an optional implementation, in a second aspect of the invention, the transmission module determines the specific method of the data transmission path of the data to be transmitted based on the authentication process parameters of the device security authentication and the data security authentication, including: Calculate the intersection of the relay device sets of all the matching communication records to obtain multiple candidate relay devices; the relay device set includes at least one home device located in the communication link between the initiating communication device and the final device of the corresponding matching communication record; Randomly combine any number of candidate relay devices, home appliances, and target receiving devices to obtain multiple transmission device sequences; the first device in each transmission device sequence is the home appliance, and the last device is the target receiving device; Each transmission device sequence, the data to be transmitted, and the corresponding data integrity are input into a trained transmission security prediction model to obtain the transmission security corresponding to each transmission device sequence; the transmission security prediction model is trained using a training dataset that includes multiple training device transmission sequences and corresponding transmission data labels and data integrity labels; The sequence of transmission devices with the highest transmission security is determined as the data transmission path for the data to be transmitted.

[0020] A third aspect of this invention discloses another home device local area network communication system based on multi-stage authentication, the system comprising: Memory containing executable program code; A processor coupled to the memory; The processor calls the executable program code stored in the memory to execute some or all of the steps in the home device local area network communication method based on multi-stage authentication disclosed in the first aspect of the present invention.

[0021] The fourth aspect of the present invention discloses a computer storage medium storing computer instructions, which, when invoked, are used to execute some or all of the steps in the home device local area network communication method based on multi-stage authentication disclosed in the first aspect of the present invention.

[0022] Compared with the prior art, the embodiments of the present invention have the following beneficial effects: This invention acquires the data to be transmitted from home network devices and the target receiving device, performs device security authentication based on historical communication records, and performs data security authentication upon successful authentication. After successful authentication, the optimal data transmission path is determined based on the parameters of the dual authentication process. This enables precise and secure data transmission based on multi-level authentication and path optimization, improving the security and reliability of communication between home network devices and reducing the risk of privacy leaks caused by device forgery or data tampering. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a flowchart illustrating a home device local area network communication method based on multi-stage authentication disclosed in an embodiment of the present invention.

[0025] Figure 2 This is a schematic diagram of a home device local area network communication system based on multi-stage authentication disclosed in an embodiment of the present invention.

[0026] Figure 3 This is a schematic diagram of another home device local area network communication system based on multi-stage authentication disclosed in an embodiment of the present invention. Detailed Implementation

[0027] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0028] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, apparatus, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices.

[0029] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0030] This invention discloses a home appliance local area network (LAN) communication method and system based on multi-stage authentication. By acquiring the data to be transmitted from the home appliance devices on the LAN and the target receiving device, it performs device security authentication based on historical communication records and performs data security authentication upon successful authentication. After successful authentication, it determines the optimal data transmission path based on the parameters of the dual authentication process. This enables precise and secure data transmission based on multi-level authentication and path optimization, improving the security and reliability of LAN home appliance communication and reducing the risk of privacy leaks due to device forgery or data tampering. Detailed explanations follow.

[0031] Example 1 Please see Figure 1 , Figure 1 This is a flowchart illustrating a home device local area network communication method based on multi-stage authentication, as disclosed in an embodiment of the present invention. Wherein, Figure 1 The described multi-stage authentication-based home device LAN communication method can be applied to data processing systems / data processing devices / data processing servers (wherein, the server includes a local processing server or a cloud processing server). For example... Figure 1 As shown, this home device LAN communication method based on multi-stage authentication may include the following operations: 101. Obtain the data to be transmitted from home devices on the local area network and the target receiving device.

[0032] Optionally, the data to be transmitted may be the temperature sensor reading of the smart refrigerator, the user query record of the voice assistant, the camera video frame, or the door lock unlocking log; this invention does not limit the data.

[0033] Optionally, the target receiving device can be a central gateway, a smart speaker, a cloud server, or a mobile app; this invention does not impose any limitations.

[0034] 102. Perform device security authentication based on the historical data communication records of the local area network and the target receiving device. 103. When the device security authentication is passed, data security authentication is performed based on the data to be transmitted and the preset data analysis algorithm. Optionally, the data analysis algorithm can be an anomaly detection + integrity verification algorithm, which is not limited in this invention.

[0035] 104. When data security authentication is passed, the data transmission path of the data to be transmitted is determined based on the authentication process parameters of device security authentication and data security authentication.

[0036] Optionally, the authentication process parameters include authentication time, average similarity, and number of matched records; this invention does not impose any limitations on these parameters.

[0037] Optionally, the data transmission path is used to indicate that the data to be transmitted is transmitted to the target receiving device via at least one intermediate device.

[0038] Optionally, the intermediate device can be a router, smart socket, bridge, or relay node; this invention does not limit the scope of the invention.

[0039] As can be seen, the above-described embodiments of the invention acquire the data to be transmitted from the local area network home devices and the target receiving device, perform device security authentication based on historical communication records, and perform data security authentication upon successful authentication. After successful authentication, the optimal data transmission path is determined based on the parameters of the dual authentication process. This enables precise data security transmission based on multi-level authentication and path optimization, improves the security and reliability of communication between local area network home devices, and reduces the risk of privacy leakage caused by device forgery or data tampering.

[0040] As an optional embodiment, the above steps, including performing device security authentication based on historical data communication records of the local area network and the target receiving device, include: Determine the initial equipment parameters for home appliances; Determine the second device parameters of the target receiving device; Based on the first device parameters and the second device parameters, multiple matching communication records are identified from the historical data communication records of the local area network. Device security authentication is performed based on matching communication records.

[0041] Optionally, the first device parameter may include MAC address, device type, firmware version, historical transmission success rate, or power level, which is not limited in this invention.

[0042] Optionally, the second device parameters may include IP address, protocol version, receive buffer size, or security certificate fingerprint, which is not limited in this invention.

[0043] Optionally, the matching communication record can be the communication log of similar initiators / receivers within the past 7 days, which is not limited in this invention.

[0044] As can be seen, through the above optional embodiments, communication records are selected by filtering and matching based on device parameters and historical communication records, and device security authentication is achieved based on the matching communication records, so as to realize accurate device security authentication based on device record matching and improve the comprehensiveness of authentication.

[0045] As an optional embodiment, the step described above, matching multiple matching communication records in the historical data communication records of the local area network based on the first device parameters and the second device parameters, includes: For each historical data communication record in the local area network, calculate the first parameter similarity between the initiating communication device of the historical data communication record and the first device parameter; When the first parameter similarity is greater than the first similarity threshold, the second parameter similarity between the final device and the second device parameter of the historical data communication record is calculated; When the similarity of the second parameter is greater than the second similarity threshold, the historical data communication record is identified as a matching communication record; When the second parameter similarity is less than the second similarity threshold, the third parameter similarity between each intermediate device in the historical data communication record and the second device parameter is calculated. Intermediate devices with a similarity score greater than the third similarity threshold are selected to obtain multiple similar intermediate devices; Calculate the weighted summation of the third parameter similarity of all similar intermediate devices to obtain the intermediate device similarity parameter; When the similarity parameter of the intermediate device is greater than the fourth similarity threshold, the historical data communication record is identified as a matching communication record. Otherwise, the historical data communication record will not be identified as a matching communication record.

[0046] Optionally, the calculation of the above parameter similarity can be achieved by algorithms such as multidimensional vector cosine similarity, Jaccard coefficient, or reciprocal Manhattan distance, and this invention does not limit it.

[0047] Optionally, the above similarity threshold can be determined by the operator based on experimental data or experience, and this invention does not limit it.

[0048] As can be seen, through the above optional embodiments, by calculating the first similarity between the initiating device and the current device in historical communication records and the second / third similarity between the final / intermediate device and the target device to filter and match communication records, accurate device security authentication based on multi-path similarity matching is achieved, improving the comprehensiveness and anti-confusion capability of authentication, and reducing the risk of device authentication failure due to communication path forgery.

[0049] As an optional embodiment, in the above steps, when calculating the similarity parameters of intermediate devices, the calculation weight corresponding to each third parameter similarity is inversely proportional to the device distance between the corresponding similar intermediate device and the final device on the communication link.

[0050] Optionally, the device distance is the product of the number of interval devices and the data transmission duration.

[0051] As can be seen, through the above optional embodiments, by calculating the weighted average similarity parameters of intermediate devices with an inverse weight of the communication link distance between intermediate devices and the final device (the product of the number of intermediate devices and the transmission time), the accurate identification and authentication of data obfuscation paths can be achieved, thereby improving the device security authentication's ability to detect complex forged paths and reducing the risk of authentication bypass caused by path spoofing.

[0052] As an optional embodiment, the step of performing device security authentication based on matching communication records in the above steps includes: The security parameter is obtained by calculating the reciprocal of the product of the communication interruption rate and the communication security incident rate in all matching communication records. Determine whether the safety parameter is greater than the preset parameter threshold to obtain the first judgment result; If the first judgment result is yes, the equipment safety certification is determined to be passed.

[0053] Optionally, the communication interruption rate is the number of interruptions divided by the total number of interruptions.

[0054] Optionally, the proportion of communication security incidents is the number of incidents divided by the total number of incidents; this invention does not impose a limitation on this.

[0055] As can be seen, through the above optional embodiments, by calculating the reciprocal of the product of the communication interruption ratio and the security incident ratio of the matching communication records as a security parameter and using the threshold to determine the device security certification result, accurate certification decision based on historical reliability quantification is achieved, improving the objectivity and risk sensitivity of certification, and reducing the risk of improper certification due to the neglect of historical incidents.

[0056] As an optional embodiment, the above steps, including performing data security authentication based on the data to be transmitted and a preset data analysis algorithm, include: The data to be transmitted is input into the trained injection attack identification model to obtain the predicted probability of belonging to an injection attack. Determine the data integrity of the data to be transmitted based on the historical communication records of home devices; When the predicted probability is lower than a preset probability threshold and the data integrity is higher than a preset integrity threshold, the data security authentication is determined to be passed.

[0057] Optionally, the injection attack identification model can be a 4-layer CNN (filters 64-128-256-512, kernel=3) + global average pooling + 2 fully connected layers (512-1 sigmoid output), trained on 250,000 labeled transmission data, achieving an F1 score of 0.98. This invention does not impose any limitations.

[0058] Optionally, the data completeness score can be 0-1, and this invention does not limit it.

[0059] As can be seen, through the above optional embodiments, by inputting the data to be transmitted into the injection attack identification model to predict the probability and combining it with historical communication records to calculate the data integrity for data security authentication, a precise data security assessment based on dual verification of attack detection and integrity is achieved, thereby improving the anti-tampering capability of transmitted data and reducing the risk of security vulnerabilities caused by injection attacks or data loss.

[0060] As an optional embodiment, the step above, determining the data integrity corresponding to the data to be transmitted based on the historical communication records of the home device, includes: Calculate the data similarity between the data to be transmitted and each historical transmission data in the historical communication records of the home device; Historical transmission data with a similarity greater than a preset threshold are filtered out to obtain multiple similar historical data. The data integrity of the data to be transmitted is obtained by calculating the average number of intersection identifiers between the set of data segment identifiers in the data to be transmitted and the set of data segment identifiers in each similar historical data.

[0061] Optionally, the data similarity can be the reciprocal of the Levenshtein edit distance or the CRC checksum matching degree; this invention does not limit this.

[0062] Optionally, the data segment identifier can be a segment header CRC or a sequence number; this invention does not impose any limitations.

[0063] As can be seen, through the above optional embodiments, by calculating the similarity between the data to be transmitted and the historical data, filtering similar historical data, and taking the average value of the intersection of data segment identifiers as the data integrity, a precise integrity measurement based on content consistency is achieved, which improves the accuracy and credibility of data security authentication and reduces the risk of misjudgment of integrity due to data segment tampering.

[0064] As an optional embodiment, the step above, determining the data transmission path of the data to be transmitted based on the authentication process parameters of device security authentication and data security authentication, includes: Calculate the intersection of the relay device sets of all matching communication records to obtain multiple candidate relay devices; optionally, the relay device set includes at least one home device that is in the middle of the communication link between the initiating communication device and the final device of the corresponding matching communication record. Randomly combine any number of candidate relay devices, home devices, and target receiving devices to obtain multiple transmission device sequences; input each transmission device sequence, the data to be transmitted, and the corresponding data integrity into a trained transmission security prediction model to obtain the transmission security corresponding to each transmission device sequence; determine the transmission device sequence with the highest transmission security as the data transmission path for the data to be transmitted.

[0065] Optionally, the first device in the transmission device sequence is the home device, and the last device is the target receiving device.

[0066] Optionally, the transmission security prediction model is trained using a training dataset that includes transmission sequences from multiple training devices and corresponding transmission data annotations and data integrity annotations.

[0067] Optionally, the transmission security prediction model can be a GNN model (3-layer GAT, 8-head attention, 256-dimensional hidden) + regression head, with input path graph + data integrity embedding, and output security score of 0-1, trained on 400,000 simulated path labeled data. This invention does not limit the model.

[0068] As can be seen, through the above optional embodiments, candidate relay devices are generated by matching the intersection of communication record relay devices and randomly combining transmission sequences. The transmission security prediction model is input, the security is output, and the sequence with the highest security is selected as the transmission path. This achieves accurate path optimization based on historical security prediction, improves the security and efficiency of data transmission, and reduces the risk of data leakage or interruption caused by improper path selection.

[0069] Example 2 Please see Figure 2 , Figure 2 This is a schematic diagram of a home device local area network communication system based on multi-stage authentication, as disclosed in an embodiment of the present invention. Figure 2 The described multi-stage authentication-based home device LAN communication system can be applied to data processing systems / data processing devices / data processing servers (wherein, the server includes a local processing server or a cloud processing server). For example... Figure 2 As shown, the home device LAN communication system based on multi-stage authentication may include: The acquisition module 201 is used to acquire the data to be transmitted from home devices in the local area network and the target receiving device.

[0070] The first authentication module 202 is used to perform device security authentication based on the historical data communication records of the local area network and the target receiving device. The second authentication module 203 is used to perform data security authentication based on the data to be transmitted and a preset data analysis algorithm when the device security authentication is passed. The transmission module 204 is used to determine the data transmission path of the data to be transmitted based on the authentication process parameters of device security authentication and data security authentication when the data security authentication is passed.

[0071] Optionally, the data transmission path is used to indicate that the data to be transmitted is transmitted to the target receiving device via at least one intermediate device.

[0072] As can be seen, the above-described embodiments of the invention acquire the data to be transmitted from the local area network home devices and the target receiving device, perform device security authentication based on historical communication records, and perform data security authentication upon successful authentication. After successful authentication, the optimal data transmission path is determined based on the parameters of the dual authentication process. This enables precise data security transmission based on multi-level authentication and path optimization, improves the security and reliability of communication between local area network home devices, and reduces the risk of privacy leakage caused by device forgery or data tampering.

[0073] As an optional embodiment, the first authentication module performs device security authentication based on historical data communication records of the local area network and the target receiving device, including the following specific methods: Determine the initial equipment parameters for home appliances; Determine the second device parameters of the target receiving device; Based on the first device parameters and the second device parameters, multiple matching communication records are identified from the historical data communication records of the local area network. Device security authentication is performed based on matching communication records.

[0074] As can be seen, through the above optional embodiments, communication records are selected by filtering and matching based on device parameters and historical communication records, and device security authentication is achieved based on the matching communication records, so as to realize accurate device security authentication based on device record matching and improve the comprehensiveness of authentication.

[0075] As an optional embodiment, the first authentication module matches multiple matching communication records in the historical data communication records of the local area network based on the first device parameters and the second device parameters, including: For each historical data communication record in the local area network, calculate the first parameter similarity between the initiating communication device of the historical data communication record and the first device parameter; When the first parameter similarity is greater than the first similarity threshold, the second parameter similarity between the final device and the second device parameter of the historical data communication record is calculated; When the similarity of the second parameter is greater than the second similarity threshold, the historical data communication record is identified as a matching communication record; When the second parameter similarity is less than the second similarity threshold, the third parameter similarity between each intermediate device in the historical data communication record and the second device parameter is calculated. Intermediate devices with a similarity score greater than the third similarity threshold are selected to obtain multiple similar intermediate devices; Calculate the weighted summation of the third parameter similarity of all similar intermediate devices to obtain the intermediate device similarity parameter; When the similarity parameter of the intermediate device is greater than the fourth similarity threshold, the historical data communication record is identified as a matching communication record. Otherwise, the historical data communication record will not be identified as a matching communication record.

[0076] As can be seen, through the above optional embodiments, by calculating the first similarity between the initiating device and the current device in historical communication records and the second / third similarity between the final / intermediate device and the target device to filter and match communication records, accurate device security authentication based on multi-path similarity matching is achieved, improving the comprehensiveness and anti-confusion capability of authentication, and reducing the risk of device authentication failure due to communication path forgery.

[0077] As an optional embodiment, when calculating the similarity parameters of intermediate devices, the calculation weight corresponding to each third parameter similarity is inversely proportional to the device distance between the corresponding similar intermediate device and the final device on the communication link; the device distance is the product of the number of intermediate devices and the data transmission time.

[0078] As can be seen, through the above optional embodiments, by calculating the weighted average similarity parameters of intermediate devices with an inverse weight of the communication link distance between intermediate devices and the final device (the product of the number of intermediate devices and the transmission time), the accurate identification and authentication of data obfuscation paths can be achieved, thereby improving the device security authentication's ability to detect complex forged paths and reducing the risk of authentication bypass caused by path spoofing.

[0079] As an optional embodiment, the specific method by which the first authentication module performs device security authentication based on matching communication records includes: The security parameter is obtained by calculating the reciprocal of the product of the communication interruption rate and the communication security incident rate in all matching communication records. Determine whether the safety parameter is greater than the preset parameter threshold to obtain the first judgment result; If the first judgment result is yes, the equipment safety certification is determined to be passed.

[0080] As can be seen, through the above optional embodiments, by calculating the reciprocal of the product of the communication interruption ratio and the security incident ratio of the matching communication records as a security parameter and using the threshold to determine the device security certification result, accurate certification decision based on historical reliability quantification is achieved, improving the objectivity and risk sensitivity of certification, and reducing the risk of improper certification due to the neglect of historical incidents.

[0081] As an optional embodiment, the second authentication module performs data security authentication based on the data to be transmitted and a preset data analysis algorithm, including the following specific methods: The data to be transmitted is input into the trained injection attack identification model to obtain the predicted probability of belonging to an injection attack. Determine the data integrity of the data to be transmitted based on the historical communication records of home devices; When the predicted probability is lower than a preset probability threshold and the data integrity is higher than a preset integrity threshold, the data security authentication is determined to be passed.

[0082] As can be seen, through the above optional embodiments, by inputting the data to be transmitted into the injection attack identification model to predict the probability and combining it with historical communication records to calculate the data integrity for data security authentication, a precise data security assessment based on dual verification of attack detection and integrity is achieved, thereby improving the anti-tampering capability of transmitted data and reducing the risk of security vulnerabilities caused by injection attacks or data loss.

[0083] As an optional embodiment, the second authentication module determines the specific method for verifying the data integrity of the data to be transmitted based on the historical communication records of the home device, including: Calculate the data similarity between the data to be transmitted and each historical transmission data in the historical communication records of the home device; Historical transmission data with a similarity greater than a preset threshold are filtered out to obtain multiple similar historical data. The data integrity of the data to be transmitted is obtained by calculating the average number of intersection identifiers between the set of data segment identifiers in the data to be transmitted and the set of data segment identifiers in each similar historical data.

[0084] As can be seen, through the above optional embodiments, by calculating the similarity between the data to be transmitted and the historical data, filtering similar historical data, and taking the average value of the intersection of data segment identifiers as the data integrity, a precise integrity measurement based on content consistency is achieved, which improves the accuracy and credibility of data security authentication and reduces the risk of misjudgment of integrity due to data segment tampering.

[0085] As an optional embodiment, the transmission module determines the specific method of the data transmission path for the data to be transmitted based on the authentication process parameters of device security authentication and data security authentication, including: Calculate the intersection of the relay device sets of all matching communication records to obtain multiple candidate relay devices; optionally, the relay device set includes at least one home device that is in the middle of the communication link between the initiating communication device and the final device of the corresponding matching communication record. Randomly combine any number of candidate relay devices, home devices, and target receiving devices to obtain multiple transmission device sequences; optionally, the first device in the transmission device sequence is a home device, and the last device is the target receiving device; Each transmission device sequence, the data to be transmitted, and the corresponding data integrity are input into the trained transmission security prediction model to obtain the transmission security corresponding to each transmission device sequence; optionally, the transmission security prediction model is trained using a training dataset that includes multiple training device transmission sequences and corresponding transmission data labels and data integrity labels. The sequence of transmission devices with the highest transmission security is selected as the data transmission path for the data to be transmitted.

[0086] As can be seen, through the above optional embodiments, candidate relay devices are generated by matching the intersection of communication record relay devices and randomly combining transmission sequences. The transmission security prediction model is input, the security is output, and the sequence with the highest security is selected as the transmission path. This achieves accurate path optimization based on historical security prediction, improves the security and efficiency of data transmission, and reduces the risk of data leakage or interruption caused by improper path selection.

[0087] Example 3 Please see Figure 3 , Figure 3 This is another home device local area network communication system based on multi-stage authentication disclosed in the embodiments of the present invention. Figure 3 The described multi-stage authentication-based home appliance LAN communication system is applied in a data processing system / data processing device / data processing server (wherein, the server includes a local processing server or a cloud processing server). For example... Figure 3 As shown, the home device LAN communication system based on multi-stage authentication may include: Memory 301 storing executable program code; Processor 302 coupled to memory 301; The processor 302 calls the executable program code stored in the memory 301 to execute the steps of the home device local area network communication method based on multi-stage authentication described in Embodiment 1.

[0088] Example 4 This invention discloses a computer read storage medium that stores a computer program for electronic data interchange, wherein the computer program causes a computer to execute the steps of the home device local area network communication method based on multi-stage authentication described in Embodiment 1.

[0089] Example 5 This invention discloses a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to perform the steps of the home device local area network communication method based on multi-stage authentication described in Embodiment 1.

[0090] The foregoing has described specific embodiments of this specification; other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims may be performed in a different order than those shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily have to follow the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0091] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0092] For ease of description, the above devices are described in terms of function, divided into various units. Of course, in implementing this specification, the functions of each unit can be implemented in one or more software and / or hardware components.

[0093] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, the embodiments of this specification can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the embodiments of this specification can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0094] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0095] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0096] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0097] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0098] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0099] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0100] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0101] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0102] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0103] Finally, it should be noted that the home device local area network communication method and system based on multi-stage authentication disclosed in the embodiments of the present invention are merely preferred embodiments of the present invention, and are only used to illustrate the technical solutions of the present invention, not to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for home device LAN communication based on multi-link authentication, characterized in that, The method includes: Acquire the data to be transmitted from home devices on the local area network and the target receiving device; Based on the historical data communication records of the local area network and the target receiving device, device security authentication is performed, including: Determine the first equipment parameters of the home appliance; Determine the second device parameters of the target receiving device; Based on the first device parameters and the second device parameters, multiple matching communication records are identified from the historical data communication records of the local area network. The security parameter is obtained by calculating the reciprocal of the product of the communication interruption rate and the communication security incident rate in all the matched communication records. Determine whether the safety parameter is greater than a preset parameter threshold to obtain a first determination result; If the first judgment result is yes, the device security authentication is determined to be passed; When the device security authentication is passed, data security authentication is performed based on the data to be transmitted and a preset data analysis algorithm; Upon successful data security authentication, the data transmission path of the data to be transmitted is determined based on the authentication process parameters of the device security authentication and the data security authentication, including: Calculate the intersection of the relay device sets of all the matching communication records to obtain multiple candidate relay devices; the relay device set includes at least one home device located in the communication link between the initiating communication device and the final device of the corresponding matching communication record; Randomly combine any number of candidate relay devices, home appliances, and target receiving devices to obtain multiple transmission device sequences; the first device in each transmission device sequence is the home appliance, and the last device is the target receiving device; Each transmission device sequence, the data to be transmitted, and the corresponding data integrity are input into a trained transmission security prediction model to obtain the transmission security corresponding to each transmission device sequence; the transmission security prediction model is trained using a training dataset that includes multiple training device transmission sequences and corresponding transmission data labels and data integrity labels; The sequence of transmission devices with the highest transmission security is determined as the data transmission path for the data to be transmitted; the data transmission path is used to indicate that the data to be transmitted is transmitted to the target receiving device via at least one intermediate device.

2. The multi-hop authentication based home device LAN communication method of claim 1, wherein, The step of matching multiple matching communication records in the historical data communication records of the local area network based on the first device parameters and the second device parameters includes: For each historical data communication record of the local area network, calculate the first parameter similarity between the initiating communication device of the historical data communication record and the parameters of the first device. When the first parameter similarity is greater than the first similarity threshold, the second parameter similarity between the final device of the historical data communication record and the second device parameter is calculated; When the similarity of the second parameter is greater than the second similarity threshold, the historical data communication record is determined as a matching communication record; When the similarity of the second parameter is less than the second similarity threshold, calculate the similarity of the third parameter between each intermediate device in the historical data communication record and the second device parameter; Intermediate devices with a similarity greater than the third similarity threshold are selected to obtain multiple similar intermediate devices; Calculate the weighted summation average of the third parameter similarity of all the similar intermediate devices to obtain the intermediate device similarity parameter; When the similarity parameter of the intermediate device is greater than the fourth similarity threshold, the historical data communication record is determined as a matching communication record; Otherwise, the historical data communication record will not be identified as a matching communication record.

3. The home device local area network communication method based on multi-stage authentication according to claim 2, characterized in that, When calculating the similarity parameters of the intermediate devices, the calculation weight corresponding to each of the third parameter similarities is inversely proportional to the device distance between the corresponding similar intermediate device and the final device on the communication link; the device distance is the product of the number of intermediate devices and the data transmission time.

4. The home device local area network communication method based on multi-stage authentication according to claim 1, characterized in that, The step of performing data security authentication based on the data to be transmitted and a preset data analysis algorithm includes: The data to be transmitted is input into the trained injection attack identification model to obtain the predicted probability of belonging to an injection attack. Based on the historical communication records of the home appliances, the data integrity of the data to be transmitted is determined. When the predicted probability is lower than a preset probability threshold and the data integrity is greater than a preset integrity threshold, the data security authentication is determined to be passed.

5. The home device local area network communication method based on multi-stage authentication according to claim 4, characterized in that, The step of determining the data integrity of the data to be transmitted based on the historical communication records of the home device includes: Calculate the data similarity between the data to be transmitted and each historical transmission data in the historical communication records of the home device; Historical transmission data with a similarity greater than a preset threshold are filtered out to obtain multiple similar historical data; The data integrity of the data to be transmitted is obtained by calculating the average number of intersection identifiers between the set of data segment identifiers in the data to be transmitted and the set of data segment identifiers in each of the similar historical data.

6. A home appliance local area network communication system based on multi-stage authentication, characterized in that, The system executes the home device local area network communication method based on multi-stage authentication as described in any one of claims 1-5, and the system includes: The acquisition module is used to acquire the data to be transmitted from home devices on the local area network and the target receiving device; The first authentication module is used to perform device security authentication based on the historical data communication records of the local area network and the target receiving device; The second authentication module is used to perform data security authentication based on the data to be transmitted and a preset data analysis algorithm when the device security authentication is passed. The transmission module is used to determine the data transmission path of the data to be transmitted based on the device security authentication and the authentication process parameters of the data security authentication when the data security authentication is passed; the data transmission path is used to indicate that the data to be transmitted is transmitted to the target receiving device via at least one intermediate device.

7. A home appliance local area network communication system based on multi-stage authentication, characterized in that, The system includes: Memory containing executable program code; A processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the home device local area network communication method based on multi-stage authentication as described in any one of claims 1-5.

Images