Internet of things multi-tenant security transparent transmission platform and method using national secret algorithm

Abstract

The application belongs to the technical field of Internet of Things security communication, and discloses an Internet of Things multi-tenant security transparent transmission platform and method applying a national secret algorithm; comprising: S1, performing bidirectional identity authentication on a connection request of an Internet of Things device, mapping data flow of the Internet of Things device to a logical isolation environment of a corresponding tenant based on a device identity identifier, and simultaneously establishing an encrypted transmission channel based on a temporary session key; S2, acquiring device distribution thermal power data and a load state of each service node, generating an encryption decision result in combination with a security level of data flow, and further initializing a trusted execution environment in a target service node; S3, performing encryption processing on the data flow based on an encryption algorithm combination, generating encrypted data flow and a corresponding integrity check value; S4, transparently transmitting the encrypted data flow and the corresponding integrity check value to a backend application service, and encapsulating an operation log for on-chain notarization after transmission is completed, so as to realize fine balance of security strength and system performance.

Description

Technical Field

[0001] This invention relates to the field of secure communication technology for the Internet of Things (IoT), and more specifically, to a secure transparent transmission platform and method for multi-tenant IoT using national cryptographic algorithms. Background Technology

[0002] With the large-scale implementation of the Industrial Internet and the popularization of cloud-edge collaborative architecture, the multi-tenant mode has become the mainstream deployment form of IoT platforms. Relying on a single physical platform, it provides multiple different entities with the ability to access devices, process data and provide application services, which can effectively reduce the platform construction and maintenance costs and adapt to the centralized management needs of distributed IoT devices.

[0003] Existing IoT multi-tenant pass-through technologies typically rely on static access control lists (ACLs) to establish fixed encryption / decryption tunnels at the transport layer when encrypting data streams. This provides a preliminary security boundary for IoT data uploading to the cloud, thus meeting the basic transmission and security protection needs of IoT multi-tenant data in conventional scenarios. However, in practical applications of complex multi-tenant business scenarios, ACLs are usually statically fixed during the device access phase, making it impossible to dynamically adjust encryption strength and resource allocation based on real-time changes in the data stream attributes. This one-size-fits-all static configuration mode makes it difficult for the platform to achieve an optimal balance between hardware isolation strength, encryption / decryption computational overhead, and transmission latency when facing high-security transaction data and highly real-time industrial control commands. This results in a conflict between security redundancy and performance loss, making it difficult to meet the differentiated and dynamic security requirements in IoT multi-tenant environments.

[0004] In view of this, the present invention proposes an IoT multi-tenant secure transparent transmission platform and method using national cryptographic algorithms to solve the above problems. Summary of the Invention

[0005] To overcome the aforementioned deficiencies of the prior art and to achieve the above objectives, the present invention provides the following technical solution: a secure transparent transmission method for multi-tenant IoT applications using national cryptographic algorithms, comprising:

[0006] S1. Perform two-way authentication on the connection request of IoT devices. If the authentication is successful, map the data stream of the IoT device to the logical isolation environment of the corresponding tenant based on the device identity. At the same time, establish an encrypted transmission channel based on the temporary session key.

[0007] S2. Obtain the thermal data of the device distribution and the load status of each service node, and generate an encryption decision result that includes the target service node, trusted execution environment decision and encryption algorithm combination based on the security level of the data stream. Route the data stream to the target service node, and further initialize the trusted execution environment in the target service node according to the trusted execution environment decision.

[0008] S3. Encrypt the data stream based on a combination of encryption algorithms, and dynamically divide the encryption process into multiple parallel micro-tasks according to the amount of data, generating encrypted data streams and corresponding integrity verification values.

[0009] S4. Transmit the encrypted data stream and the corresponding integrity verification value to the backend application service, and encapsulate the operation log for on-chain evidence storage after the transmission is completed.

[0010] Furthermore, methods for two-way authentication of connection requests from IoT devices include:

[0011] Receive connection requests from IoT devices, parse and obtain device identifiers and device random numbers; retrieve device public keys from a pre-stored identity information database based on device identifiers, and synchronously generate platform random numbers;

[0012] The platform sends a random number to the IoT device and receives the device signature value generated based on the device's private key. The device signature value is verified using the device's public key. The device identifier that passes the verification is recorded as the device identity identifier, and a temporary session key is generated.

[0013] The device encrypts the temporary session key with its public key to obtain the key ciphertext; at the same time, it signs the hash value of the platform random number and the temporary session key with the platform private key to generate the platform signature value; the IoT device verifies the platform signature value with the platform public key, and after the verification is successful, it decrypts the key ciphertext with its private key to complete two-way identity authentication and establish the temporary session key.

[0014] Furthermore, methods for mapping data streams from IoT devices to the logically isolated environments of corresponding tenants include:

[0015] Based on the device identity identifier, the multi-tenant affiliation table in the identity information database is retrieved to determine the tenant identifier to which the IoT device belongs; according to the tenant identifier, the namespace isolation parameters are called to map the data stream of the IoT device to the logical isolation environment of the corresponding tenant.

[0016] Furthermore, methods for establishing encrypted transmission channels based on temporary session keys include:

[0017] Create an encrypted proxy forwarding instance in the logically isolated environment and inject a temporary session key into the protected memory area of ​​the encrypted proxy forwarding instance; perform symmetric encryption and decryption on the bidirectional data stream between the protocol access gateway cluster and the logically isolated environment based on the temporary session key to complete the establishment of the encrypted transmission channel.

[0018] Furthermore, the method for generating an encrypted decision result that includes the target service node, trusted execution environment decision, and combination of encryption algorithms includes:

[0019] Collect the geographical location information of each connected IoT device and the load status of each service node, and perform correlation matching to determine the target service node; parse the metadata tags in the data stream, and determine the security level of the data stream based on the data attribute fields in the metadata tags; retrieve the corresponding encryption algorithm combination by searching the pre-stored encryption policy mapping table through the security level.

[0020] The security level is compared with the preset hardware isolation threshold. If the security level is greater than the hardware isolation threshold, the trusted execution environment enable decision is determined to be enabled; otherwise, it is disabled. The target service node, encryption algorithm combination and trusted execution environment enable decision are logically encapsulated to form the encryption decision result.

[0021] Furthermore, the methods for determining the target service node include:

[0022] The geographic location information of IoT devices is divided into grid cells, the density of IoT devices in each grid cell is calculated, and device thermal distribution data is generated; the grid cell with the highest IoT device density in the device thermal distribution data is marked as a high-density area;

[0023] Filter service nodes located in high-density areas to form a candidate service node list; calculate the comprehensive score of the load status of each service node in the candidate service node list, and determine the service node with the highest comprehensive score as the target service node.

[0024] Furthermore, methods for further initializing the trusted execution environment include:

[0025] Parse the encryption decision result and route the data stream to the selected target service node; if the trusted execution environment is enabled in the encryption decision result, then start the trusted execution environment in the target service node;

[0026] The Trusted Execution Environment (TEE) extracts the root key from the underlying hardware to generate a measurement report and sends it to the remote authentication platform for verification. After successful verification, the TEE returns a verification result containing a successful authentication status bit and a digital signature to the TEE to complete the initialization of the TEE.

[0027] Furthermore, the methods for generating encrypted data streams and corresponding integrity verification values ​​include:

[0028] Obtain the total number of bytes in the data stream and compare it with a preset splitting threshold. If the total number of bytes is greater than the splitting threshold, dynamically divide the data stream into multiple data slices to be processed and assign a unique sequence number to each data slice to form a corresponding microtask.

[0029] Multiple microtasks are simultaneously distributed to the parallel computing channel of the trusted execution environment, and the encryption operators in the encryption algorithm combination are called to encrypt the data slices to be processed, generating corresponding encrypted sub-blocks.

[0030] The encrypted sub-blocks are arranged and assembled in ascending order of their sequence numbers to generate an encrypted data stream; the local check values ​​of each encrypted sub-block are calculated in parallel, and a cascaded hash operation is performed on all local check values ​​to generate an integrity check value for the encrypted data stream.

[0031] Furthermore, methods for encapsulating operation logs for on-chain evidence storage include:

[0032] The encrypted data stream is associated and encapsulated with the integrity verification value, and sent to the backend application service corresponding to the tenant identifier through an encrypted transmission channel for real-time monitoring. Based on the detected successful transmission response code, the timestamp of the target service node is obtained, and the encrypted data stream and integrity verification value are encapsulated into an operation log. The operation log is digested to generate a log hash value. The operation log hash value and the digital signature of the trusted execution environment are sent to the blockchain node to complete the on-chain storage of the operation log.

[0033] Furthermore, the IoT multi-tenant secure transparent transmission platform applying national cryptographic algorithms includes:

[0034] The authentication mapping module is used to perform two-way authentication of connection requests from IoT devices. If the authentication is successful, the data stream of the IoT device is mapped to the logical isolation environment of the corresponding tenant based on the device identity, and an encrypted transmission channel is established based on the temporary session key.

[0035] The decision routing module is used to obtain thermal data of device distribution and load status of each service node, and generate an encrypted decision result that includes the target service node, trusted execution environment decision and encryption algorithm combination based on the security level of the data stream. The data stream is routed to the target service node, and the trusted execution environment is further initialized in the target service node according to the trusted execution environment decision.

[0036] The encryption processing module is used to encrypt the data stream based on a combination of encryption algorithms, and dynamically divides the encryption process into multiple parallel micro-tasks according to the amount of data, generating encrypted data streams and corresponding integrity verification values.

[0037] The transparent transmission and evidence preservation module is used to transmit the encrypted data stream and the corresponding integrity verification value to the backend application service, and encapsulate the operation log for on-chain evidence preservation after the transmission is completed.

[0038] The technical effects and advantages of the IoT multi-tenant secure transparent transmission platform and method using national cryptographic algorithms as described in this invention are as follows:

[0039] 1. This invention correlates and matches distributed thermal data of devices with the load status of each service node, and simultaneously parses metadata tags in the data stream to determine the security level of the data stream. This dynamically generates an encrypted decision result that includes the target service node, trusted execution environment decision, and a combination of encryption algorithms, achieving a leapfrog transformation of security resource scheduling from static configuration to business awareness. Based on the real-time security requirements of different tenants and specific business scenarios, it accurately locates the target service node among a massive number of service nodes and intelligently determines whether to invoke the trusted execution environment decision. This greatly improves the adaptive capability and resource utilization efficiency of security protection. While ensuring that high-level data receives hardware-level confidential computing protection, it ensures that low-sensitivity services can complete transparent transmission with lower latency, achieving a refined balance between security strength and system performance in a multi-tenant environment.

[0040] 2. By comparing the total number of bytes in a large data stream with a splitting threshold and distributing data slices carrying unique sequence numbers to the parallel computing channel of a trusted execution environment, the heavy single-threaded encryption workload is discretized. Multiple parallel computing units within a protected memory area process micro-tasks simultaneously, significantly eliminating the computational bottleneck of the national cryptographic algorithm in the transmission of massive IoT data and drastically shortening the time required for high-strength encryption. The national cryptographic encryption operator is called to generate encrypted sub-blocks, which are then reassembled in ascending order of sequence numbers and supplemented with cascaded hash operations to generate the integrity verification value of the encrypted data stream. This achieves high-performance parallel throughput of complex national cryptographic algorithms in a high-security isolation environment. Discretizing the originally heavy single-threaded encryption workload and using multiple parallel computing units within a protected memory area to process micro-tasks simultaneously, along with the use of sequence numbers and cascaded hash mechanisms, ensures the logical consistency and tamper-resistance of data after parallel processing. This not only guarantees the end-to-end integrity of the encrypted data stream but also enhances the sensitivity to detecting subtle data tampering, providing high-performance and high-reliability dual quality assurance for the transmission of sensitive IoT data under multi-tenant concurrent access. Attached Figure Description

[0041] Figure 1 This is a schematic diagram of the IoT multi-tenant secure transparent transmission platform and method using national cryptographic algorithms according to the present invention.

[0042] Figure 2 This is a flowchart illustrating how the encryption decision results are obtained in this invention.

[0043] Figure 3 This is a system schematic diagram of the IoT multi-tenant secure transparent transmission platform and method that applies national cryptographic algorithms according to the present invention. Detailed Implementation

[0044] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0045] Example 1, please refer to Figure 1 , Figure 3 As shown in this embodiment, the IoT multi-tenant secure transparent transmission method using national cryptographic algorithms includes:

[0046] S1. Perform two-way authentication on the connection request of IoT devices. If the authentication is successful, map the data stream of the IoT device to the logical isolation environment of the corresponding tenant based on the device identity, and establish an encrypted transmission channel based on the temporary session key.

[0047] Methods for two-way authentication of connection requests from IoT devices include:

[0048] Receive connection requests from IoT devices (forwarded via protocol access gateway cluster adaptation), parse and obtain device identifiers (used to store the unique identity code of IoT devices) and device random numbers (device random numbers are temporary random numbers generated by IoT devices each time they connect, used to participate in signature verification of device identity, prevent replay attacks of historical authentication messages, and ensure the uniqueness of each session key).

[0049] The protocol access gateway cluster is used to adapt to and receive data connection requests and data streams from IoT devices using different network protocols (including TCP / IP and MQTT protocols).

[0050] The device public key is retrieved from a pre-stored identity information database based on the device identifier, and a platform random number is generated simultaneously. The identity information database stores core credentials related to IoT device identity verification and encrypted communication. It includes fields for device identifier, device public key, root key fingerprint, and multi-tenant ownership table. The system uses the device identifier as an index to search the stored device identity information database, retrieving the corresponding device public key (e.g., the SM2 public key) from the matching records. Simultaneously, a platform random number (a one-time-use random value) is generated in real-time using a secure random number generator.

[0051] The platform sends a random number to the IoT device and receives the device signature value generated based on the device's private key from the IoT device. The platform random number is then transmitted back to the IoT device that initiated the connection request via the access gateway cluster through the protocol. After receiving the platform random number, the IoT device calls its own stored device private key (e.g., SM2 private key) to digitally sign the concatenation value of the platform random number and the device random number, generating the corresponding device signature value.

[0052] The device signature value is verified using the device's public key. The device identifier that passes verification is recorded as the device identity identifier, and a temporary session key is generated. Verification uses a concatenation of the platform's random number and the device's random number as the verification basis to confirm whether the device signature value was generated by the device holding the corresponding device's private key. If the verification passes, the IoT device's identity is proven legitimate, and the device identifier is recorded as the device identity identifier for subsequent data flow mapping, tenant isolation, and routing decisions. If the verification fails, the IoT device's connection request is rejected, and no further operations are performed. After successful verification, a secure random number generator is used to generate a temporary session key (a fixed-length symmetric encryption key used for encryption protection of subsequent communication data) for data transmission encryption.

[0053] The temporary session key is encrypted using the device's public key to obtain the key ciphertext; at the same time, the platform's random number and the hash value of the temporary session key are signed using the platform's private key to generate the platform signature value.

[0054] For example, a 16-byte SM4 temporary session key is generated using a secure random number generator, and an SM2 encryption operation is performed using the device's public key to obtain a 128-byte key ciphertext. The 16-byte platform random number and the 16-byte temporary session key are concatenated into 32 bytes of data, and an SM3 hash operation is performed on this 32-byte data to obtain a 32-byte hash value. An SM2 signature operation is performed on this 32-byte hash value using the platform's private key to generate a 64-byte platform signature value.

[0055] IoT devices verify the platform's signature value using the platform's public key. Upon successful verification, the device decrypts the ciphertext using its private key, completing two-way authentication and establishing a temporary session key. The IoT device then uses its stored private key to decrypt the received ciphertext, obtaining a temporary session key identical to the platform's. After obtaining the temporary session key, the IoT device sends a confirmation message to the platform. Upon receiving this message, the platform confirms that both parties have successfully established the same temporary session key, completing two-way authentication and establishing this temporary session key for subsequent encrypted protection of communication data.

[0056] Methods for mapping data streams from IoT devices to the logically isolated environment of the corresponding tenant include:

[0057] The multi-tenant affiliation table in the identity information database is retrieved based on the device identity to determine the tenant identifier to which the IoT device belongs. The multi-tenant affiliation table is stored in a structured key-value pair format, and the device identity field is matched and aligned with the tenant identifier field. The successfully matched tenant identifier is extracted and confirmed (used to guide data flow into a specific logically isolated environment).

[0058] For example, if the device identification is "DEV_001", the multi-tenant affiliation table is retrieved using "DEV_001" as the index, and the corresponding record is found with the tenant identification field value being "TENANT_A".

[0059] Based on the tenant identifier, namespace isolation parameters are invoked to map the data stream of IoT devices to the logically isolated environment of the corresponding tenant. Namespace isolation parameters include network definition parameters (used to allocate an independent virtual network address space and network access control rules for the corresponding tenant) and storage quota parameters (used to allocate an independent logical storage area and storage capacity limit for the tenant). By assigning corresponding virtual network address translation rules and logical storage paths to the data stream of IoT devices through namespace isolation parameters, the data stream is imported into the logically isolated environment corresponding to the tenant identifier, achieving physical or logical isolation from the data streams of other tenants.

[0060] For example, if the tenant identifier is "TENANT_A", the corresponding namespace isolation parameters are called, the network definition parameters are the "192.168.10.0 / 24" network segment and the corresponding firewall rules, and the storage quota parameters are the "500GB" logical storage area and the corresponding access permissions.

[0061] Assign a virtual IP address “192.168.10.101” to the data stream of device “DEV_001” and specify the storage path as “data / tenant_a / dev_001” to import the data stream of this device into the logical isolation environment of tenant “TENANT_A”.

[0062] Methods for establishing encrypted transmission channels based on temporary session keys include:

[0063] Create an encrypted proxy forwarding instance in the logically isolated environment and inject the temporary session key into the protected memory area of ​​the encrypted proxy forwarding instance. Call the virtualization layer interface to create an encrypted proxy forwarding instance within the defined logically isolated environment (as the entity responsible for forwarding and encrypting data flows between the protocol access gateway cluster and the logically isolated environment). After the encrypted proxy forwarding instance starts, request a protected memory area within it (allowing only the encrypted proxy forwarding instance itself to read and write access; other processes or instances cannot access it).

[0064] The temporary session key is encapsulated in ciphertext and sent to the logically isolated environment using an inter-process communication mechanism. After receiving the ciphertext encapsulation, the encrypted proxy forwarding instance performs decryption and restoration within the protected memory area, so that the temporary session key resides in the protected memory area of ​​the encrypted proxy forwarding instance.

[0065] A temporary session key is used to perform symmetric encryption and decryption on the bidirectional data stream between the protocol access gateway cluster and the logical isolation environment to establish an encrypted transmission channel. The protocol access gateway cluster forwards the raw uplink data stream received from IoT devices to the encrypted proxy forwarding instance. The encrypted proxy forwarding instance uses the temporary session key and a national standard symmetric encryption algorithm to decrypt the raw uplink data stream, converting it into plaintext data before sending it to the logical isolation environment for business processing. The encrypted proxy forwarding instance intercepts the downlink business data stream generated by the logical isolation environment, again uses the temporary session key, and employs a national standard symmetric encryption algorithm to encrypt and encapsulate the downlink business data stream, generating an ciphertext downlink data stream which is then sent back to the protocol access gateway cluster, which then distributes it to the IoT devices. This completes the establishment of the encrypted transmission channel.

[0066] S2. Obtain the thermal data of the device distribution and the load status of each service node, and generate an encrypted decision result that includes the target service node, trusted execution environment decision and encryption algorithm combination based on the security level of the data stream. Route the data stream to the target service node, and further initialize the trusted execution environment in the target service node according to the trusted execution environment decision.

[0067] Methods for generating cryptographic decision results that include the target service node, trusted execution environment decision, and combination of cryptographic algorithms include:

[0068] Collect the geographical location information of each connected IoT device and the load status of each service node, and perform correlation matching to determine the target service node.

[0069] The metadata tags in the data stream are parsed, and the security level of the data stream is determined based on the data attribute fields in the metadata tags. Before the data stream sent by the IoT device enters the encrypted transmission channel, metadata tags (used to describe the relevant attributes of the data stream) are extracted from a fixed offset position in the header of the data packet. Data attribute fields (including data confidentiality level, business sensitivity classification, and device authentication strength level) are read from the metadata tags according to the tag format specification. Based on the security coefficient values ​​corresponding to the data confidentiality level, business sensitivity classification, and device authentication strength level, the security coefficient with the largest value is selected as the basis for determining the security level of the data stream. The security level at which the largest security coefficient is located is determined as the security level of the data stream.

[0070] For example, after the metadata tag is decoded, the first and second bits represent the data confidentiality level ("11", corresponding to a security factor of nine), the third and fifth bits represent the business sensitivity ("101", corresponding to a security factor of eight), and the sixth and eighth bits represent the device authentication strength level ("100", corresponding to a security factor of seven). If the maximum security factor of nine is selected, and the interval in which the maximum security factor of nine falls corresponds to a security level of one, then the security level of the data stream is determined to be level one.

[0071] The system retrieves the corresponding encryption algorithm combination by searching a pre-stored encryption policy mapping table based on the security level. The encryption policy mapping table defines corresponding records between different security levels and encryption algorithm combinations. Each record contains a security level field and an encryption algorithm combination field. The system searches the encryption policy mapping table for a record that exactly matches the input security level and retrieves the encryption algorithm combination field corresponding to that security level (which includes at least the symmetric encryption algorithm identifier, asymmetric signature algorithm identifier, and hash algorithm identifier).

[0072] For example, the encryption policy mapping table stores the following records:

[0073] Security level "Level 1" corresponds to the following encryption algorithm combinations: symmetric encryption algorithm is identified as "SM4", asymmetric signature algorithm is identified as "SM2", and hash algorithm is identified as "SM3".

[0074] Security level "Level 2" corresponds to the following encryption algorithm combinations: symmetric encryption algorithm is identified as "SM4", asymmetric signature algorithm is identified as "SM2", and hash algorithm is identified as "SM3".

[0075] Security level "Level 3" corresponds to the following encryption algorithm combinations: symmetric encryption algorithm is identified as "SM4", asymmetric signature algorithm is identified as "none", and hash algorithm is identified as "SM3".

[0076] The security level is compared with the preset hardware isolation threshold. If the security level is greater than the hardware isolation threshold (indicating that the security requirements of the data flow are high and that a trusted execution environment is required for hardware-level isolation protection), the trusted execution environment is enabled; otherwise, it is disabled (indicating that the security requirements of the data flow have not reached the level that requires hardware isolation and that a trusted execution environment is not required).

[0077] It should be explained that the hardware isolation threshold is used to determine whether a data stream needs to be isolated and processed within a trusted execution environment. The hardware isolation threshold is set based on the platform's overall security policy requirements, the sensitivity distribution of tenant business scenarios, and the statistical characteristics of historical data streams.

[0078] The decision to enable the target service node, the combination of encryption algorithms, and the trusted execution environment is logically encapsulated to form an encrypted decision result.

[0079] Methods for determining the target service node include:

[0080] The geographic location information of IoT devices is divided into grid cells, and the density of IoT devices within each grid cell is calculated to generate device thermal distribution data. Geographic location information includes longitude and latitude coordinates. Using the longitude and latitude coordinate system as a reference, the geographic area where the geographic location information of the IoT devices is located is rectangularly divided into multiple rectangular grid cells of the same size according to a set longitude and latitude step size (e.g., 0.01 degrees). For each IoT device, the grid cell to which the device belongs is calculated based on its longitude and latitude coordinates, and a counter in that grid cell is incremented by one; after traversing all grid cells, the IoT device density of each grid cell is obtained.

[0081] For example, by setting the grid division granularity to 0.01 degrees × 0.01 degrees, the geographical area from 116.20 degrees east longitude to 116.40 degrees east longitude and from 39.80 degrees north latitude to 40.00 degrees north latitude can be divided into 20 rows × 20 columns of grid units.

[0082] Device A has coordinates (116.235, 39.876), and it is calculated to belong to the grid cell in the 12th row and 8th column; Device B has coordinates (116.245, 39.885), and it also belongs to the 12th row and 8th column; traversing the grid cell in the 12th row and 8th column, the count value is determined to be 35, that is, there are 35 IoT devices in this grid cell.

[0083] The grid cell with the highest density of IoT devices in the device thermal distribution data is marked as a high-density area; service nodes located in the high-density area are filtered to form a candidate service node list.

[0084] Calculate the comprehensive score for the load status of each service node in the candidate service node list, and determine the service node with the highest comprehensive score as the target service node. Extract the real-time load status (including node computational load percentage, memory utilization percentage, and current network bandwidth utilization) of each service node in the candidate service node list from the intelligent routing and load balancing scheduler. Perform inverse normalization on the extracted node computational load percentage, memory utilization percentage, and network bandwidth utilization, convert the percentage values ​​into scores representing idle time, and then perform weighted summation to obtain the comprehensive score for the load status of each service node.

[0085] For example, the candidate service node list includes service node A and service node B;

[0086] Service Node A: Node computing load is 30%, memory utilization is 40%, and network bandwidth utilization is 20%; Service Node B: Node computing load is 60%, memory utilization is 50%, and network bandwidth utilization is 40%.

[0087] After reverse normalization, service node A has an idle score of 70, a memory idle score of 60, and a network idle score of 80; service node B has an idle score of 40, a memory idle score of 50, and a network idle score of 60.

[0088] Based on resource priority settings, the load weight is set to 0.5, the memory utilization weight to 0.3, and the network bandwidth utilization weight to 0.2. Service node A receives a comprehensive score of 80 points, and service node B receives a score of 75 points; therefore, service node A is selected as the target service node.

[0089] Further methods for initializing the trusted execution environment include:

[0090] Parse the encryption decision result and route the data stream to the selected target service node. Query the service node routing table based on the target service node's identifier to obtain its network address and communication port. Modify the data stream's destination address to the target service node's network address and communication port, and then send the data stream to the target service node via the underlying network protocol stack.

[0091] If the Trusted Execution Environment (TEE) enable decision in the encryption decision result is "Enabled," then the TEE is started in the target service node. After the data stream is successfully sent to the target service node, the TEE enable decision is read from the encryption decision result; if it is "Enabled," a hardware isolation request instruction is sent to the central processing unit of the target service node, triggering the hardware abstraction layer interface of the target service node; if it is "Disabled," the target service node maintains the general computing mode, directly distributing the data stream from the IoT device to the ordinary memory area for processing, skipping the initialization process of starting the TEE.

[0092] The Trusted Execution Environment (TEE) extracts the root key from the underlying hardware to generate a measurement report, which is then sent to a remote authentication platform for verification. After the TEE instance starts, it calls the hardware abstraction layer interface of the target service node; it extracts the unique, permanently stored root key from the underlying hardware and performs a digest operation on the current static measurement values ​​of the TEE to generate a measurement report. The TEE then sends an authentication request containing the measurement report and device identity to the remote authentication platform via an encrypted transmission channel, requesting security verification of the TEE in the target service node.

[0093] After receiving an authentication request, the remote authentication platform retrieves pre-stored standard measurement parameters from the identity information database and matches the measurement report with the standard measurement parameters. If the match is consistent, the verification is deemed successful, and a verification result containing an authentication success status bit and a digital signature is generated. If the match is inconsistent, the verification is deemed unsuccessful, the remote authentication platform sets the authentication success status bit to an invalid logical value representing a disabled state, and simultaneously triggers security audit log recording, generating a verification result containing authentication failure information.

[0094] For example, the remote authentication platform reads the hexadecimal sequence of the measurement report from the authentication request and aligns it with the valid mirror hash value recorded in the identity information database. After confirming that the measurement report is correct, it sets the authentication success status bit to binary "1" and uses the SM2 private key to digitally sign and encapsulate the verification result, forming a complete verification result data packet. If a deviation is found between the value in the measurement report and the standard measurement parameters, the authentication success status bit is set to binary "0," and the abnormal measurement event of the target service node is recorded in the security audit log.

[0095] After successful verification, a verification result containing a successful authentication status bit and a digital signature is returned to the trusted execution environment to complete the initialization of the trusted execution environment.

[0096] S3. Encrypt the data stream based on a combination of encryption algorithms, and dynamically split the encryption process into multiple parallel micro-tasks according to the amount of data, generating encrypted data streams and corresponding integrity verification values.

[0097] Methods for generating encrypted data streams and corresponding integrity verification values ​​include:

[0098] Obtain the total number of bytes in the data stream and compare it with a preset splitting threshold. Call a streaming media monitoring tool to perform real-time length detection on the data stream of IoT devices entering the logically isolated environment, and sum the payload lengths of all data packets in the IoT device's data stream to obtain the total number of bytes in the data stream.

[0099] It should be explained that the splitting threshold is a fixed value used to determine whether the data stream needs to be split into multiple data slices for parallel processing. The splitting threshold is set based on the upper limit of the single encryption processing capability of the trusted execution environment, the hardware memory page size limit, and the statistical characteristics of typical business data streams.

[0100] If the total number of bytes exceeds the splitting threshold, the data stream is dynamically divided into multiple data slices to be processed, and a unique sequence number is assigned to each data slice to form a corresponding microtask. Starting from the beginning of the data stream, data blocks are sequentially extracted according to the splitting size (such as the splitting threshold as the step size) until the end of the data stream.

[0101] If the total number of bytes is not greater than the splitting threshold, the entire data stream will be processed as a single data slice.

[0102] Multiple microtasks are simultaneously distributed to parallel computing channels within the Trusted Execution Environment (TEE). Encryption operators from the encryption algorithm combination are invoked to encrypt the data slices to be processed, generating corresponding encrypted sub-blocks. The TEE's internal hardware resource scheduling interface is invoked to activate the corresponding number of parallel computing channels within the TEE's protected memory region, based on the total number of microtasks. Microtasks are sequentially allocated to available parallel computing channels in a first-in, first-out (FIFO) order. Within each parallel computing channel, a symmetric encryption algorithm identifier is extracted from the encryption algorithm combination; the encryption operator corresponding to that symmetric encryption algorithm identifier within the TEE is invoked. The data slice to be processed from the microtask assigned to the current channel is used as input, and a temporary session key is used to perform encryption operations on the data slice to be processed, generating encrypted sub-blocks.

[0103] For example, if the encryption algorithm combination is "SM4, SM2, SM3", the symmetric encryption algorithm identifier "SM4" is extracted, the SM4 encryption operator is called, and a 1MB data slice to be processed is encrypted using a 16-byte temporary session key to generate a 1MB encrypted sub-block.

[0104] The encrypted sub-blocks are arranged and assembled in ascending order of their sequence numbers to generate an encrypted data stream. The end of the previous encrypted sub-block is directly connected to the beginning of the next encrypted sub-block in sequence.

[0105] The system computes local checksums for each encrypted sub-block in parallel, performs cascaded hash operations on all local checksums, and generates an integrity checksum for the encrypted data stream. For each encrypted sub-block, it calls the hash operator corresponding to the hash algorithm identifier in the encryption algorithm combination, uses the encrypted sub-block as input to perform a hash operation, and generates a local checksum for the encrypted sub-block. The local checksums of all encrypted sub-blocks are concatenated in sequence, and the same hash operator is called again for a second hash operation to generate an integrity checksum for the encrypted data stream (used to verify whether the entire encrypted data stream has been tampered with during transmission or storage).

[0106] S4. Transmit the encrypted data stream and the corresponding integrity verification value to the backend application service, and encapsulate the operation log for on-chain evidence storage after the transmission is completed.

[0107] Methods for encapsulating operation logs for on-chain evidence storage include:

[0108] The encrypted data stream and integrity check value are associated and encapsulated (forming a data unit to be transmitted, which includes the encrypted data stream itself, the integrity check value, and a data unit length field). This data unit is then sent to the backend application service corresponding to the tenant identifier through an encrypted transmission channel and monitored in real time. The network address and communication port of the corresponding backend application service are retrieved based on the tenant identifier. The encapsulated data unit is then sent to the backend application service (using the HTTP POST protocol, with the data unit as the request body, and content type and length fields added to the HTTP header); simultaneously, a timer is started to monitor the data transmission status.

[0109] Based on the detected successful transmission response code, the timestamp of the target service node is obtained, and the encrypted data stream and integrity verification value are encapsulated into an operation log. After confirming successful data transmission, the local timestamp of the target service node (used to record the generation time of the operation log) is obtained; the encrypted data stream, integrity verification value, tenant identifier, device identity identifier, target service node identifier, data transmission timestamp, and receipt confirmation timestamp are combined and encapsulated to generate an operation log.

[0110] For example, the operation log content is: "Device ID: DEV_001; Tenant ID: TENANT_A; Target Service Node: NODE_C; Encrypted Data Stream Length: 5MB; Integrity Check Value: 3f5a; Data Transmission Time: 2025-03-19T10:29:58Z; Receipt Confirmation Time: 2025-03-19T10:30:00Z".

[0111] It should be explained that if a success response with status code 200 is received, the data transmission is considered successful, and the receipt confirmation timestamp returned by the backend application service is extracted from the response; if other status codes are received or no response is received within a timeout period, the transmission is considered to have failed, and a retry is performed according to the preset retry policy.

[0112] The operation log is digested to generate a log hash value. The hash operator corresponding to the hash algorithm in the encryption algorithm combination is called. The complete content of the operation log is used as input to perform the hash operation and generate a fixed-length log hash value (used to uniquely identify the operation log and is irreversible).

[0113] The operation log hash value and the trusted execution environment's identity digital signature are sent to the blockchain node to complete the on-chain notarization of the operation log. The log hash value and the trusted execution environment's identity digital signature are combined to form a notarization request; this request is sent to the blockchain node through a secure communication channel. Upon receiving the notarization request, the blockchain node uses the trusted execution environment's public key to verify the identity digital signature, confirming that the notarization request indeed originates from a legitimate trusted execution environment instance. After successful verification, the blockchain node packages the log hash value into a new block, confirms it through the consensus mechanism, and writes it into the blockchain ledger. After completing the write, the blockchain node returns a notarization receipt containing the block height and transaction identifier; the notarization receipt is then associated with and stored in conjunction with the corresponding operation log, completing the entire on-chain notarization process of the operation log.

[0114] Example 2, please refer to Figure 2 As shown in this embodiment, the IoT multi-tenant secure transparent transmission platform using national cryptographic algorithms includes:

[0115] The authentication mapping module is used to perform two-way authentication of connection requests from IoT devices. If the authentication is successful, the data stream of the IoT device is mapped to the logical isolation environment of the corresponding tenant based on the device identity, and an encrypted transmission channel is established based on the temporary session key.

[0116] The decision routing module is used to obtain thermal data of device distribution and load status of each service node, and generate an encrypted decision result that includes the target service node, trusted execution environment decision and encryption algorithm combination based on the security level of the data stream. The data stream is routed to the target service node, and the trusted execution environment is further initialized in the target service node according to the trusted execution environment decision.

[0117] The encryption processing module is used to encrypt the data stream based on a combination of encryption algorithms, and dynamically divides the encryption process into multiple parallel micro-tasks according to the amount of data, generating encrypted data streams and corresponding integrity verification values.

[0118] The transparent transmission and evidence preservation module is used to transmit the encrypted data stream and the corresponding integrity verification value to the backend application service, and encapsulate the operation log for on-chain evidence preservation after the transmission is completed.

[0119] In this embodiment, by associating and matching the distributed thermal data of devices with the load status of each service node, and simultaneously parsing the metadata tags in the data stream to determine the security level of the data stream, an encryption decision result containing the target service node, trusted execution environment decision, and encryption algorithm combination is dynamically generated. This achieves a leapfrog transformation of security resource scheduling from static configuration to business awareness. Based on the real-time security requirements of different tenants and specific business scenarios, the target service node is accurately located among a massive number of service nodes, and the trusted execution environment decision is intelligently determined. This greatly improves the adaptive capability and resource utilization efficiency of security protection. While ensuring that high-level data receives hardware-level confidential computing protection, it also ensures that low-sensitivity services can complete transparent transmission with lower latency, achieving a fine balance between security strength and system performance in a multi-tenant environment.

[0120] By comparing the total number of bytes in a large data stream with a splitting threshold and distributing data slices carrying unique sequence numbers to parallel computing channels in a trusted execution environment, the heavy single-threaded encryption workload is discretized. Multiple parallel computing units within a protected memory area process micro-tasks simultaneously, significantly eliminating the computational bottleneck of the national cryptographic algorithm in the transmission of massive IoT data and drastically shortening the time required for high-strength encryption. The algorithm calls national cryptographic encryption operators to generate encrypted sub-blocks, which are then reassembled in ascending order of sequence numbers and supplemented with cascaded hash operations to generate an integrity verification value for the encrypted data stream. This achieves high-performance parallel throughput of complex national cryptographic algorithms in a high-security isolation environment. By discretizing the originally heavy single-threaded encryption workload and utilizing multiple parallel computing units within a protected memory area to process micro-tasks simultaneously, the sequence number and cascaded hash mechanism ensure the logical consistency and tamper-resistance of data after parallel processing. This not only guarantees the end-to-end integrity of the encrypted data stream but also enhances the sensitivity to detecting subtle data tampering, providing high-performance and high-reliability dual quality assurance for the transmission of sensitive IoT data under multi-tenant concurrent access.

[0121] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0122] In the several embodiments provided by this invention, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only one method, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0123] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

[0124] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A secure transparent transmission method for multi-tenant IoT using national cryptographic algorithms, characterized in that: The IoT multi-tenant secure transparent transmission method using national cryptographic algorithms includes: S1. Perform two-way authentication on the connection request of IoT devices. If the authentication is successful, map the data stream of the IoT device to the logical isolation environment of the corresponding tenant based on the device identity. At the same time, establish an encrypted transmission channel based on the temporary session key. S2. Obtain the thermal data of the device distribution and the load status of each service node, and generate an encryption decision result that includes the target service node, trusted execution environment decision and encryption algorithm combination based on the security level of the data stream. Route the data stream to the target service node, and further initialize the trusted execution environment in the target service node according to the trusted execution environment decision. S3. Encrypt the data stream based on a combination of encryption algorithms, and dynamically divide the encryption process into multiple parallel micro-tasks according to the amount of data, generating encrypted data streams and corresponding integrity verification values. S4. Transmit the encrypted data stream and the corresponding integrity verification value to the backend application service, and encapsulate the operation log for on-chain evidence storage after the transmission is completed.

2. The IoT multi-tenant secure transparent transmission method using national cryptographic algorithms according to claim 1, characterized in that, The method for performing two-way authentication of connection requests from IoT devices includes: Receive connection requests from IoT devices, parse and obtain device identifiers and device random numbers; retrieve device public keys from a pre-stored identity information database based on device identifiers, and synchronously generate platform random numbers; The platform sends a random number to the IoT device and receives the device signature value generated based on the device's private key. The device signature value is verified using the device's public key. The device identifier that passes the verification is recorded as the device identity identifier, and a temporary session key is generated. The device encrypts the temporary session key with its public key to obtain the key ciphertext; at the same time, it signs the hash value of the platform random number and the temporary session key with the platform private key to generate the platform signature value; the IoT device verifies the platform signature value with the platform public key, and after the verification is successful, it decrypts the key ciphertext with its private key to complete two-way identity authentication and establish the temporary session key.

3. The IoT multi-tenant secure transparent transmission method using national cryptographic algorithms according to claim 2, characterized in that, The method for mapping data streams from IoT devices to the logically isolated environment of the corresponding tenant includes: Based on the device identity identifier, the multi-tenant affiliation table in the identity information database is retrieved to determine the tenant identifier to which the IoT device belongs; according to the tenant identifier, the namespace isolation parameters are called to map the data stream of the IoT device to the logical isolation environment of the corresponding tenant.

4. The IoT multi-tenant secure transparent transmission method using national cryptographic algorithms according to claim 3, characterized in that, The method for establishing an encrypted transmission channel based on a temporary session key includes: Create an encrypted proxy forwarding instance in the logically isolated environment and inject a temporary session key into the protected memory area of ​​the encrypted proxy forwarding instance; perform symmetric encryption and decryption on the bidirectional data stream between the protocol access gateway cluster and the logically isolated environment based on the temporary session key to complete the establishment of the encrypted transmission channel.

5. The IoT multi-tenant secure transparent transmission method using national cryptographic algorithms according to claim 4, characterized in that, The method for generating an encrypted decision result that includes the target service node, trusted execution environment decision, and combination of encryption algorithms includes: Collect the geographical location information of each connected IoT device and the load status of each service node, and perform correlation matching to determine the target service node; parse the metadata tags in the data stream, and determine the security level of the data stream based on the data attribute fields in the metadata tags; retrieve the corresponding encryption algorithm combination by searching the pre-stored encryption policy mapping table through the security level. The security level is compared with the preset hardware isolation threshold. If the security level is greater than the hardware isolation threshold, the trusted execution environment enable decision is determined to be enabled; otherwise, it is disabled. The target service node, encryption algorithm combination and trusted execution environment enable decision are logically encapsulated to form the encryption decision result.

6. The IoT multi-tenant secure transparent transmission method using national cryptographic algorithms according to claim 5, characterized in that, The method for determining the target service node includes: The geographic location information of IoT devices is divided into grid cells, the density of IoT devices in each grid cell is calculated, and device thermal distribution data is generated; the grid cell with the highest IoT device density in the device thermal distribution data is marked as a high-density area; Filter service nodes located in high-density areas to form a candidate service node list; calculate the comprehensive score of the load status of each service node in the candidate service node list, and determine the service node with the highest comprehensive score as the target service node.

7. The IoT multi-tenant secure transparent transmission method using national cryptographic algorithms according to claim 5, characterized in that, The method for further initializing the trusted execution environment includes: Parse the encryption decision result and route the data stream to the selected target service node; if the trusted execution environment is enabled in the encryption decision result, then start the trusted execution environment in the target service node; The Trusted Execution Environment (TEE) extracts the root key from the underlying hardware to generate a measurement report and sends it to the remote authentication platform for verification. After successful verification, the TEE returns a verification result containing a successful authentication status bit and a digital signature to the TEE to complete the initialization of the TEE.

8. The IoT multi-tenant secure transparent transmission method using national cryptographic algorithms according to claim 7, characterized in that, The method for generating the encrypted data stream and the corresponding integrity verification value includes: Obtain the total number of bytes in the data stream and compare it with a preset splitting threshold. If the total number of bytes is greater than the splitting threshold, dynamically divide the data stream into multiple data slices to be processed and assign a unique sequence number to each data slice to form a corresponding microtask. Multiple microtasks are simultaneously distributed to the parallel computing channel of the trusted execution environment, and the encryption operators in the encryption algorithm combination are called to encrypt the data slices to be processed, generating corresponding encrypted sub-blocks. The encrypted sub-blocks are arranged and assembled in ascending order of their sequence numbers to generate an encrypted data stream; the local check values ​​of each encrypted sub-block are calculated in parallel, and a cascaded hash operation is performed on all local check values ​​to generate an integrity check value for the encrypted data stream.

9. The IoT multi-tenant secure transparent transmission method using national cryptographic algorithms according to claim 8, characterized in that, The method for on-chain evidence storage of the encapsulation operation log includes: The encrypted data stream is associated and encapsulated with the integrity verification value, and sent to the backend application service corresponding to the tenant identifier through an encrypted transmission channel for real-time monitoring. Based on the detected successful transmission response code, the timestamp of the target service node is obtained, and the encrypted data stream and integrity verification value are encapsulated into an operation log. The operation log is digested to generate a log hash value. The operation log hash value and the digital signature of the trusted execution environment are sent to the blockchain node to complete the on-chain storage of the operation log.

10. An IoT multi-tenant secure transparent transmission platform using national cryptographic algorithms, used to implement the IoT multi-tenant secure transparent transmission method using national cryptographic algorithms as described in any one of claims 1 to 9, characterized in that, include: The authentication mapping module is used to perform two-way authentication of connection requests from IoT devices. If the authentication is successful, the data stream of the IoT device is mapped to the logical isolation environment of the corresponding tenant based on the device identity, and an encrypted transmission channel is established based on the temporary session key. The decision routing module is used to obtain thermal data of device distribution and load status of each service node, and generate an encrypted decision result that includes the target service node, trusted execution environment decision and encryption algorithm combination based on the security level of the data stream. The data stream is routed to the target service node, and the trusted execution environment is further initialized in the target service node according to the trusted execution environment decision. The encryption processing module is used to encrypt the data stream based on a combination of encryption algorithms, and dynamically divides the encryption process into multiple parallel micro-tasks according to the amount of data, generating encrypted data streams and corresponding integrity verification values. The transparent transmission and evidence preservation module is used to transmit the encrypted data stream and the corresponding integrity verification value to the backend application service, and encapsulate the operation log for on-chain evidence preservation after the transmission is completed.

Images