Data security access control method based on IoT platform

Abstract

This invention discloses a data security access control method based on an IoT platform, relating to the field of secure access technology. It includes a dynamic threat assessment step, which determines data risk by analyzing the behavioral sequence of the data parsing process. Specifically, for a specified data type, based on the parsing behavior of historical harmless data samples, a baseline of normal behavior sequence is constructed and its corresponding normal behavior ratio range is determined. Then, the current data to be assessed is parsed, and the real-time behavioral sequence generated during the parsing process is monitored and recorded. This invention overcomes the limitation of traditional access control that only manages who can access the data. By introducing a dynamic threat assessment engine into the access link, it performs in-depth behavioral analysis on the accessed data content itself, constructing a subject-object two-way security system that can effectively defend against data reverse intrusion attacks launched using legitimate data channels.

Description

Technical Field

[0001] This invention belongs to the field of data security technology, specifically a data security access control method based on an Internet of Things (IoT) platform. Background Technology

[0002] The rapid development of IoT technology has enabled massive numbers of devices to connect to the network, generating and exchanging data in real time, laying the foundation for applications such as smart cities and the Industrial Internet. However, the inherent openness of the IoT environment, the limited device resources, and the massive and real-time nature of data flows also bring severe data security challenges. Traditional access control methods, such as role-based access control or attribute-based access control, mainly focus on authenticating the identity and verifying the permissions of the access request subject, which is a one-way security control on the subject side.

[0003] As attack methods evolve, a new threat is emerging: attackers may use physical intrusion, firmware tampering, or supply chain contamination to control legitimate IoT devices such as sensors and actuators. They may make the data transmitted appear legitimate in terms of format and value, conforming perfectly to protocol specifications, but actually embedding carefully crafted malicious payloads within the data packets. This data reverse intrusion attack aims to exploit parsing vulnerabilities, such as buffer overflows and logical flaws, inherent in upper-layer data processing and analysis applications (e.g., AI models) and business logic systems. These vulnerabilities are triggered during data parsing and processing, allowing attackers to intrude into and control the upper-layer application systems.

[0004] Traditional security systems are clearly inadequate in the face of such attacks: Network layer firewalls and intrusion detection systems (IDS) are typically based on signature databases or traffic anomaly detection, making it difficult to identify attack payloads that target specific application vulnerabilities and are encapsulated within compliant data formats. Static, policy-based access control mechanisms cannot assess the risk of the data content itself; as long as the requesting entity has the right to access, malicious data will be allowed to pass through. While some solutions incorporate sandbox technology, they often rely on known malware signatures or simple rule matching, offering limited detection capabilities against unknown, zero-day attacks or covert attacks employing complex legitimate logic. Furthermore, they lack quantitative modeling of normal business behavior patterns, easily leading to false positives or false negatives. Therefore, how to dynamically and intelligently assess and block security threats hidden within the data itself while ensuring legitimate data flow and business continuity has become a critical issue that urgently needs to be addressed in the field of IoT platform data security. Summary of the Invention

[0005] This invention aims to solve at least one of the technical problems existing in the prior art; To address this, the present invention proposes a data security access control method based on an IoT platform, including a dynamic threat assessment step. This method determines data risks by analyzing the behavioral sequence of the data parsing process, specifically including: A. For a given data type, based on the analysis behavior of historical harmless data samples, construct a baseline of normal behavior sequence and determine its corresponding normal behavior proportion range; B. Analyze the current data to be evaluated, monitor and record the real-time behavior sequence generated during the analysis process; C. Compare the real-time behavior sequence with the baseline of the normal behavior sequence, and calculate a quantitative index to characterize the degree of deviation from the normal behavior pattern; D. Based on whether the quantitative indicators exceed the normal behavior ratio range, classify the threat level of the current data to be evaluated.

[0006] Furthermore, in step A, the parsing behavior includes at least one of system call sequence, library function call chain, and resource operation mode.

[0007] Furthermore, the resource operation modes include memory allocation and file descriptor operations.

[0008] Further, in step A, the construction of the normal behavior sequence baseline specifically involves aggregating the original behavior sequences generated during the parsing of multiple harmless data samples under this data type to generate a comprehensive behavior sequence that characterizes the normal parsing path of this type of data.

[0009] Further, in step A, determining the normal behavior ratio range includes: statistically analyzing the execution ratio of the parsing path of historical harmless data samples to the baseline of the normal behavior sequence, and obtaining the normal behavior ratio range by filtering and statistically analyzing the set of execution ratios.

[0010] Further, in step C, the quantitative indicators include at least one of action coverage ratio and abnormal action index. The action coverage ratio is used to measure the degree of overlap between the real-time behavior sequence and the baseline of the normal behavior sequence, and the abnormal action index is used to measure the proportion of novel behaviors contained in the real-time behavior sequence.

[0011] Furthermore, the action coverage ratio is obtained by matching the real-time behavior sequence with the baseline of the normal behavior sequence and calculating the ratio of the number of successfully matched atomic actions to the total number of atomic actions in the baseline of the normal behavior sequence.

[0012] Furthermore, in step D, the threat classification includes at least a high-risk level. When a high-risk level is determined, at least one of the following operations is performed: blocking the current data access request and isolating the data source.

[0013] Furthermore, the dynamic threat assessment step is executed in the security access control gateway of the IoT platform. Before forwarding the access request from the upper-layer application to the IoT device data, steps A to D are performed on the target data.

[0014] Furthermore, the data type is identified based on the data's protocol type, source device model, and service function metadata.

[0015] Compared with the prior art, the beneficial effects of the present invention are: This invention breaks through the limitation of traditional access control that only manages who can access the data. By introducing a dynamic threat assessment engine into the access link, it performs in-depth behavioral analysis on the accessed data content itself, and constructs a two-way security system between the subject and object, which can effectively defend against data reverse intrusion attacks launched using legitimate data channels. Furthermore, by employing methods based on historical behavioral sequences, such as constructing a Comprehensive Action Sequence (SAS) and Baseline Action Proportion (BAP) model, this invention does not rely on known attack signature databases. As long as malicious data causes the behavioral patterns of the parsing process, such as system call sequences and resource operation habits, to significantly deviate from the historical normal baseline, they can be identified, thereby effectively detecting zero-day attacks and advanced persistent threats. Attached Figure Description

[0016] Figure 1 The method flowchart provided by the present invention. Detailed Implementation

[0017] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Please refer to the figure; this application provides a data security access control method based on an Internet of Things platform. As an embodiment of this application, a dynamic threat assessment step is included. This method determines data risk by analyzing the behavioral sequence of the data parsing process, specifically including: A. For a given data type, based on the analysis behavior of historical harmless data samples, construct a baseline of normal behavior sequence and determine its corresponding normal behavior proportion range; B. Analyze the current data to be evaluated, monitor and record the real-time behavior sequence generated during the analysis process; C. Compare the real-time behavior sequence with the baseline of the normal behavior sequence, and calculate a quantitative index to characterize the degree of deviation from the normal behavior pattern; D. Based on whether the quantitative indicators exceed the normal behavior ratio range, classify the threat level of the current data to be evaluated.

[0019] As a second embodiment of this application, this embodiment is implemented based on the first embodiment, with the following differences: This embodiment uses the pipeline monitoring system of a smart urban water management platform as an application scenario to explain in detail how the present invention prevents attackers from using contaminated sensor data to conduct reverse interference on the upper-level analysis system.

[0020] System Composition: The city's water supply network is equipped with thousands of smart pressure sensors (PT-101 series), which send pressure readings to the IoT platform every minute. The intelligent leak analysis model on the platform accesses these data streams in real time to locate and warn of leaks.

[0021] Attack Method: The attacker physically compromised a pressure sensor PT-101-58 located in an older residential community and tampered with its firmware. The data packets sent by the compromised sensor, while conforming to a standard format (containing the correct timestamp, device ID, and pressure value), periodically embedded malicious attack payloads targeting the intelligent pipeline leak analysis model in reserved fields or using specific encoding methods. These payloads were carefully designed to trigger a known memory overflow vulnerability in the analysis model's underlying parsing library, thereby gaining control of the model's server.

[0022] The defensive process of the method of this invention; When the intelligent analysis model for pipeline leakage initiates an access request to the real-time data stream of sensor PT-101-58, the system of this invention operates according to the following process: Step S1: Request to reach the secure access proxy gateway described in this invention through the API gateway; S2: The gateway first verifies the identity and permissions of the analysis model, confirms that it has the right to access the stress data, and the verification is successful.

[0023] Step S3: The gateway does not forward the data immediately, but intercepts the most recent batch of data samples from PT-101-58 that will be accessed soon. The most recent batch of data samples can be data packets from the past 5 minutes, which are then sent to the data threat dynamic assessment engine for Level 3 quarantine. S31: The engine parses the data packet format, stress value, timestamp, etc., and they are all normal. No obvious malicious strings or code snippets were found. The first layer passed. S32: The engine launches a lightweight sandbox consistent with the real pipeline leak analysis model environment and loads the same data parsing library used by the analysis model into the sandbox. Subsequently, the engine inputs data samples from PT-101-58 into the sandbox for simulation analysis; When the parsing library in the sandbox processes a specific sequence of data packets, the sandbox monitoring module detects an abnormal heap memory allocation operation, followed by an unexpected system call attempting to write data to a specific memory address; this behavior pattern highly matches known buffer overflow attack characteristics. The data sample exhibited clear malicious intent during dynamic execution, and its threat level was marked as high. S33: At the same time, the engine checked the pressure readings and found that the values ​​were all within the normal municipal water supply pressure range (0.2-0.6MPa) and there was no significant statistical deviation from the historical data pattern. No alarm was issued at the semantic layer. However, according to the strategy, as long as any layer detects a high risk, the final threat level will be based on the high risk. Step S4: The dynamic permission arbiter receives a high threat level assessment report; The adjudicator immediately executes the preset high-risk handling strategy: Blocking and Isolation: Immediately block the current access request for the original data stream; at the same time, automatically issue an instruction to the IoT device management platform to mark the logical status of sensor PT-101-58 as suspicious / isolated. The platform will suspend receiving business data from the sensor and restrict its network access to a minimum, allowing only the management and maintenance channel. At the same time, an emergency alert is sent to the Security Operations Center (SOC), which includes a detailed threat report, data source ID, and attack signature.

[0024] Meanwhile, the arbitrator triggers a business continuity strategy. Since the leak analysis model still requires data from this area, the gateway automatically retrieves verified normal pressure data from the PT-101-58 sensor before the time point marked as suspicious from the historical database, or calls real-time data from nearby sensors (such as PT-101-57 and PT-101-59). After aggregation, the data is provided to the analysis model as temporary input. This ensures that the leak monitoring service is not interrupted, although the analysis accuracy may be slightly affected.

[0025] Through this embodiment, the present invention successfully defended against a targeted attack that exploited a legitimate data format to conceal vulnerabilities in upper-layer applications. Such attacks are extremely difficult for traditional firewalls or intrusion detection systems to detect because the network layer data packets are completely legitimate. Moreover, it not only prevented a single attack but also prevented the attack from continuing and spreading by automatically isolating the source of the attack (sensor PT-101-58). At the same time, by providing clean alternative data, it ensured that the core business pipeline leakage monitoring could still operate during the attack, achieving a balance between security and business operations.

[0026] Example 3: A dynamic threat assessment method based on behavioral sequence modeling and anomaly ratio analysis; This embodiment is a deepening and innovation of the judgment method in step S32 of embodiment one, proposing an anomaly detection method that does not rely on known attack characteristics and is based on historical behavior modeling. The core of this method is to build a dynamic normal behavior baseline library by learning the behavior habits of various types of data when they are parsed normally over a long period of time, and to discover hidden threats by comparing the deviation of behavior in real time.

[0027] The specific process of this embodiment is as follows: Step A: Behavioral sequence learning and baseline library construction; SS1: Data Classification: The system automatically labels the data flowing through the sandbox with data type tags based on the data's protocol type, source device model, and business function such as read, write, and diagnostics. For example, "Type_A: Siemens_S7-1200_DataBlock_Read".

[0028] SS2: In the sandbox, the monitoring module records the entire process of the parsing library processing each frame of data with extremely high granularity. This recording is not simply about reading memory, but includes: System call sequences, such as the order and parameters of calls to "open", "read", "mmap", and "brk"; Library function call chains, such as the function call tree within a specific parsing library; Resource operation patterns, such as the size and frequency of memory allocation, and the order in which file descriptors are created; These records are encoded into an ordered atomic action string, called the RawActionString, which is uniformly labeled as RAS for easier contextual description; SS3: Generate Comprehensive Action String (SAS): For the same data type Type_A, the system collects massive amounts of data, such as thousands of harmless historical data parsings, to generate RAS1, RAS2, ..., RASn, which is RASi, i=1, ..., n; By comparing sequences, all normal parsing paths for this type are read, and then a SynthesizedActionString (SAS_A) containing all normal parsing paths for this type is generated; SAS_A can be regarded as a map of main roads that allow branches; SS4: While generating SAS_A, the system statistically analyzes the coverage of SAS_A by the actual action strings that occurred during all historical normal parsing processes; specifically: Once the parsing path for each type of data is obtained, the proportion of actions in SAS_A executed for that parsing path is automatically obtained and marked as the parsing ratio, resulting in several parsing ratios; The resolution ratio is denoted as Bsi, i=1,...,n, where Bsi and RASi have a one-to-one correspondence. The system automatically identifies the action execution ratios, with the percentage exceeding 85%. This is achieved by automatically calculating the discrete values ​​of the corresponding resolution ratios. The specific calculation formula is as follows: Discrete value = In the above formula, BSp refers to the mean of BSi. A discrete upper limit is set. The calculated discrete values ​​are compared with the discrete upper limit. When a discrete value is greater than the discrete upper limit, a filtering action is performed. Specifically, the corresponding BSi is selected in descending order of |BSi-BSp|, and then deleted. The mean BSi and the corresponding discrete values ​​are recalculated, and the discrete values ​​are compared with the discrete upper limit again. If they are still greater than the discrete upper limit, BSi is selected and deleted in the same order until the corresponding discrete value is less than or equal to the discrete upper limit. The discrete upper limit is preset by the administrator to control and filter out a suitable range of resolution ratios. The remaining range of resolution ratios from minimum to maximum is marked as the baseline action ratio (BAP). For example, after the above calculations, the baseline action percentage (BAP) range is found to be within the range of [85%, 100%]. This statistical distribution is the baseline action percentage (BAP) model for this data type; BAP defines the normal range. Step B: Real-time analysis of behavior and threat classification, which is the online detection phase; SS01: When a new data frame with the tag Type_A enters the sandbox for parsing, the monitoring module records its parsing process in real time and generates the real-time action string RAS_c for this instance. SS02: The system performs sequence alignment and matching between RAS_c and SAS_A in the baseline library. Two core metrics are calculated: SS03: The action coverage ratio is calculated using the formula CP = (number of atomic actions in RAS_c that match SAS_A) / (total number of atomic actions in SAS_A). This metric measures the degree of overlap between the current analysis behavior and the main road.

[0029] SS04: The Abnormal Action Index (AAI) is calculated using the formula: AAI = (number of novel atomic actions in RAS_c that do not appear in any historical normal RAS) / (total number of atomic actions in RAS_c). This index measures the novelty of behavior. SS05: Dynamic Threat Classification, which substitutes the values ​​of CP and AAI into the BAP statistical model of data type Type_A for determination: Low risk is considered normal operation: CP value falls within the main concentration range of BAP (e.g., [85%, 100%]) and AAI is close to 0; this is considered normal.

[0030] Medium risk indicates a suspected deviation: the CP value is significantly lower than the baseline action ratio range, such as falling within [60%, 85%), or the AAI value is low, which is generally (0%, 5%); this indicates that the parsing process has taken many detours or done some unusual things, possibly caused by complex but legitimate data, or by a preliminary probing attack.

[0031] High Risk (Highly Anomaly): A CP value significantly lower than the baseline action ratio range (e.g., <60%), or a high AAI value (e.g., >5%), indicates that the parsing behavior deviates severely from historical normal patterns or contains a large number of never-before-seen operations. This is highly likely a malicious attack.

[0032] Specific application examples are as follows: Defending against nested attacks targeting project files Attack simulation: The attacker uploads a grammatically correct DeviceDescription file to the project configuration management system; this file takes advantage of the parser's recursive parsing feature and contains extremely deep nesting levels. Legitimate files are usually nested less than 10 levels, but this file is nested 200 levels. Testing process: This file is identified as Type_B: DeviceDescription_XML.

[0033] During sandbox parsing, the monitoring module found that its action string was unusually long; a large number of duplicate xmlParseElement and malloc call pairs appeared in RAS_c.

[0034] Upon comparison, its CP value is only 45%, because most of the actions are consumed in repetitive recursion, which is significantly different from the linear trunk of SAS_B, while AAI is not high.

[0035] The system query of the BAP model for Type_B revealed that normal CP values ​​are concentrated in the range of [88%, 99%]. The 45% CP value in this instance far exceeds the normal range and is therefore classified as high-risk.

[0036] Action taken: Upon receiving a high-risk signal, the dynamic adjudicator immediately blocks the upload and application of the file and alerts the server to a suspected resource exhaustion attack. This prevents the attack from exhausting the server's memory before it takes effect.

[0037] The advantage of this embodiment lies in its ability to detect unknown, zero-day attacks, as long as they cause statistical deviations in parsing behavior. Furthermore, the baseline library (SAS, BAP) can be continuously updated as business and data formats evolve, exhibiting adaptive capabilities. Moreover, quantitative indicators such as CP and AAI can replace subjective judgment, making threat classification more objective and easier to link with automated response strategies. By establishing a habitual action model based on big data, it demonstrates higher tolerance for legitimate but complex data, effectively reducing false positives compared to methods based on simple rules.

[0038] This embodiment clearly demonstrates that by introducing data threat assessment as a core component, the present invention upgrades access control from simple permission management to a two-way security system that can proactively immunize against the risks inherent in the data itself, effectively solving the emerging security challenge of data reverse intrusion that is becoming increasingly prominent in the Internet of Things environment.

[0039] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A data security access control method based on an Internet of Things (IoT) platform, characterized in that: This includes a dynamic threat assessment step, which determines data risk by analyzing the behavioral sequence of the data parsing process, specifically including: A. For a given data type, based on the analysis behavior of historical harmless data samples, construct a baseline of normal behavior sequence and determine its corresponding normal behavior proportion range; B. Analyze the current data to be evaluated, monitor and record the real-time behavior sequence generated during the analysis process; C. Compare the real-time behavior sequence with the baseline of the normal behavior sequence, and calculate a quantitative index to characterize the degree of deviation from the normal behavior pattern; D. Based on whether the quantitative indicators exceed the normal behavior ratio range, classify the threat level of the current data to be evaluated.

2. The data security access control method based on an IoT platform according to claim 1, characterized in that, In step A, the parsing behavior includes at least one of system call sequence, library function call chain, and resource operation mode.

3. The data security access control method based on an IoT platform according to claim 2, characterized in that, The resource operation modes include memory allocation and file descriptor operations.

4. The data security access control method based on an IoT platform according to claim 1, characterized in that, In step A, the construction of the normal behavior sequence baseline specifically involves aggregating the original behavior sequences generated during the parsing of multiple harmless data samples under this data type to generate a comprehensive behavior sequence that characterizes the normal parsing path of this type of data.

5. The data security access control method based on an IoT platform according to claim 1 or 4, characterized in that, In step A, determining the normal behavior ratio range includes: calculating the execution ratio of the parsing path of the historical harmless data sample to the baseline of the normal behavior sequence, and obtaining the normal behavior ratio range by filtering and statistically analyzing the set of execution ratios.

6. The data security access control method based on an IoT platform according to claim 1, characterized in that, In step C, the quantitative indicators include at least one of action coverage ratio and abnormal action index. The action coverage ratio is used to measure the overlap between the real-time behavior sequence and the baseline of the normal behavior sequence, and the abnormal action index is used to measure the proportion of novel behaviors contained in the real-time behavior sequence.

7. The data security access control method based on an IoT platform according to claim 6, characterized in that, The action coverage ratio is obtained by matching the real-time behavior sequence with the baseline of the normal behavior sequence and calculating the ratio of the number of successfully matched atomic actions to the total number of atomic actions in the baseline of the normal behavior sequence.

8. The data security access control method based on an Internet of Things platform according to claim 1, characterized in that, In step D, the threat classification includes at least a high-risk level. When a high-risk level is determined, at least one of the following operations is performed: blocking the current data access request and isolating the data source.

9. The data security access control method based on an Internet of Things platform according to claim 1, characterized in that, The dynamic threat assessment step is executed in the security access control gateway of the IoT platform. Before forwarding the access request from the upper layer application to the IoT device data, steps A to D are performed on the target data.

10. The data security access control method based on an Internet of Things platform according to claim 1, characterized in that, The data type is identified based on the data's protocol type, source device model, and service function metadata.

Images