An encryption transmission method, device and equipment for Internet of Things data and a medium

Abstract

The application provides an encryption transmission method, device and equipment of Internet of Things data and medium, and is used in the field of Internet of Things data security technology, comprising: determining a plurality of risk levels corresponding to the target data according to the device identifier, the preset keyword, the target model and the security label corresponding to the target data respectively, and determining the target risk level corresponding to the target data according to the highest risk level; based on the target risk level, querying the corresponding level mapping table to obtain the target quantum key and the target encryption algorithm; according to the data category corresponding to the target data, the target quantum key and the target encryption algorithm, the target data is encrypted and packaged to obtain the corresponding encrypted data; the encrypted data is sent to the corresponding data receiver; in this way, the security of the Internet of Things data transmission is improved, the implementation evaluation effect of the data security risk is improved, and the consumption of encryption resources is reduced.

Description

Technical Field

[0001] This application relates to the field of Internet of Things (IoT) data security technology, and in particular to a method, apparatus, device, and medium for encrypted transmission of IoT data. Background Technology

[0002] The Internet of Things (IoT) technology enables the deep integration of the physical and digital worlds through the connection of massive numbers of smart devices with the Internet. With the explosive growth in the number of IoT devices, the amount of data generated by these devices is increasing exponentially. This includes not only ordinary sensor data, but also sensitive content such as key control commands, personal privacy, and alarm information. Encrypting transmitted data is the main means of ensuring the security of the IoT.

[0003] Existing methods for encrypting IoT data generally employ a uniform, highest-strength encryption strategy, failing to distinguish between the large amount of low-security data (such as periodic sensor readings) and the limited amount of high-security data (such as control commands) present in IoT scenarios. This forces edge gateways and resource-constrained terminal devices to perform high-strength encryption calculations for all data, resulting in a huge waste of computing resources and a sharp increase in device energy consumption. Furthermore, the need to provide keys at the same rate for massive data streams makes the cost and complexity of building large-scale IoT security networks prohibitive. In addition, the security strategies (including encryption algorithms and key strategies) of existing IoT data encryption methods are usually pre-configured statically, bound to device type or fixed rules, lacking real-time perception and intelligent analysis capabilities of the data content itself. This results in critical event data failing to receive enhanced protection commensurate with its risks, leading to a disconnect between security protection and actual business risks.

[0004] Therefore, existing methods for encrypting and transmitting IoT data suffer from high encryption resource consumption and poor data encryption security and adaptability. Summary of the Invention

[0005] This application provides a method, apparatus, device, and medium for encrypted transmission of IoT data, which addresses the problems of high encryption resource consumption and poor security and adaptability of existing encrypted transmission methods for IoT data.

[0006] Firstly, this application provides a method for encrypted transmission of IoT data, applied to the data sender, the method comprising: Based on the device identifier, preset keywords, target model, and security label corresponding to the target data, multiple risk levels are determined, and the target risk level corresponding to the target data is determined based on the highest risk level. Based on the target risk level, the corresponding level mapping table is queried to obtain the target quantum key and the target encryption algorithm; Based on the data category, target quantum key, and target encryption algorithm corresponding to the target data, the target data is encrypted and encapsulated to obtain the corresponding encrypted data. Send encrypted data to the corresponding data recipient.

[0007] In some embodiments of this application, multiple risk levels are determined based on the device identifier, preset keywords, target model, and security tag corresponding to the target data, including: Based on the raw data sent by the target device, and after standardizing and preprocessing the raw data, the target data is obtained; Based on the device identifier corresponding to the target data, the corresponding device level database is queried to obtain the first risk level, and based on multiple preset keywords, keyword matching is performed on the target data to obtain the corresponding matching results; If the matching result shows that there is at least one preset keyword in the target data, then the highest risk level is determined as the second risk level based on the risk level corresponding to each keyword. If the matching result indicates that the preset keyword does not exist in the target data, then it is determined that the second risk level does not exist; Based on the target model, content recognition is performed on the target data to obtain the third risk level, and security label verification is performed on the target data to obtain the corresponding verification results; If the test result indicates the presence of a safety label, then the fourth safety level is determined based on the risk level corresponding to the safety label. If the test result indicates that there is no security label in the target data, then it is determined that the fourth security level does not exist; Multiple risk levels are determined based on the first, second, third, and fourth security levels.

[0008] In some embodiments of this application, the target data is encrypted and encapsulated according to the data category corresponding to the target data, the target quantum key, and the target encryption algorithm to obtain the corresponding encrypted data, including: Determine the data category; If the data type is real-time streaming data, then the target data is stream encrypted based on the target quantum key and the target encryption algorithm; If the data type is block data, then the target data is encrypted in blocks based on the target quantum key and the target encryption algorithm; The encrypted target data is then encapsulated to obtain the corresponding encrypted data.

[0009] Secondly, this application provides a method for encrypted transmission of IoT data, applied to a data receiver, the method comprising: Receive encrypted data sent by the data sender, perform integrity verification on the encrypted data, and obtain the target encrypted data; Parse the header of the target encrypted data packet to obtain the corresponding target risk level; Based on the target risk level and the corresponding level mapping table, determine the corresponding target quantum key and target encryption algorithm; Based on the target quantum key and the target encryption algorithm, the target encrypted data is symmetrically decrypted to obtain the corresponding target data.

[0010] In some embodiments of this application, integrity verification is performed on the encrypted data to obtain the target encrypted data, including: Based on the encrypted data, the corresponding data length is determined, and the data length is compared with the preset verification length to obtain the corresponding verification result. If the verification result shows that the lengths are consistent, then the encrypted data is determined to be the target encrypted data; If the verification result indicates a length discrepancy, a corresponding prompt message will be output to indicate that the current data is abnormal.

[0011] In some embodiments of this application, after symmetrically decrypting the target encrypted data based on the target quantum key and the target encryption algorithm to obtain the corresponding target data, the method further includes: Determine whether the target quantum key has been used a preset number of times; If so, then destroy the target quantum key; If not, the target quantum key will not be destroyed.

[0012] Thirdly, this application provides an encrypted transmission device for Internet of Things (IoT) data, applied to the data sender, the device comprising: The determination module is used to determine multiple risk levels based on the device identifier, preset keywords, target model, and security label corresponding to the target data, and to determine the target risk level corresponding to the target data based on the highest risk level. The query module is used to query the corresponding level mapping table based on the target risk level to obtain the target quantum key and the target encryption algorithm. The encryption module is used to encrypt and encapsulate the target data according to the data category, target quantum key and target encryption algorithm to obtain the corresponding encrypted data; The sending module is used to send encrypted data to the corresponding data receiver.

[0013] Fourthly, this application provides an encrypted transmission device for Internet of Things (IoT) data, applied to a data receiver, the device comprising: The verification module is used to receive encrypted data sent by the data sender, and to perform integrity verification on the encrypted data to obtain the target encrypted data. The parsing module is used to parse the header of the target encrypted data to obtain the corresponding target risk level; The algorithm determination module is used to determine the corresponding target quantum key and target encryption algorithm based on the target risk level and the corresponding level mapping table; The decryption module is used to perform symmetric decryption of the target encrypted data based on the target quantum key and the target encryption algorithm to obtain the corresponding target data.

[0014] Fifthly, this application provides a computer device, including: a processor, and a memory communicatively connected to the processor; The memory stores instructions that the computer executes; The processor executes computer execution instructions stored in memory to implement the method of this application.

[0015] Sixthly, this application provides a computer-readable storage medium storing program code, which, when executed by a processor, is used to implement the method of this application.

[0016] Compared with existing technologies, the method in this application achieves end-to-end resource optimization, significantly reducing system operating costs. Based on security level identifiers, it selects lightweight encryption algorithms with lower computational overhead for a large amount of low-security-level data. This directly reduces the processing load on edge gateways, enabling the access and processing of more IoT devices with the same hardware resources, effectively delaying hardware upgrade cycles. Simultaneously, it drastically reduces quantum key consumption. Through level-based key mapping, only high-security-level data is allocated quantum keys requiring frequent updates, while low-security-level data, which accounts for the majority of data traffic, is handled with a strategy of lower key update frequency. This differentiated management greatly alleviates the pressure on network key generation rates, allowing for the selection of more cost-effective QKD (Quantum Key Distribution) devices when building large-scale IoT networks, or supporting larger-scale IoT applications on the basis of existing QKD networks. It also improves system real-time performance, ensuring the responsiveness of critical services by using lightweight encryption algorithms for low-security-level data in the data processing flow, avoiding processing delays caused by complex encryption algorithms. For services requiring real-time performance, such as vehicle status information in intelligent transportation and periodic sensor data in the Industrial Internet of Things, encrypted transmission latency is significantly improved. By employing appropriate lightweight encryption algorithms, the power consumption of a single data report is effectively reduced, thereby significantly extending the continuous working time of battery-powered equipment in outdoor and other scenarios. Attached Figure Description

[0017] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0018] Figure 1 A flowchart illustrating an encrypted data transmission method for the Internet of Things (IoT) provided in this application embodiment; Figure 2 A flowchart illustrating another method for encrypted transmission of IoT data provided in an embodiment of this application; Figure 3 A system schematic diagram of an encrypted transmission method for Internet of Things (IoT) data provided in an embodiment of this application; Figure 4 This is a schematic diagram of an encrypted transmission method for IoT data provided in an embodiment of this application; Figure 5 A schematic diagram of the structure of an encrypted transmission device for Internet of Things (IoT) data provided in this application embodiment; Figure 6 A schematic diagram of another IoT data encryption transmission device provided in the embodiments of this application; Figure 7 This is a structural block diagram of a device for performing an encrypted transmission method for Internet of Things data according to an embodiment of this application. Detailed Implementation

[0019] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0020] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0021] Figure 1 This is a flowchart illustrating an encrypted data transmission method for the Internet of Things (IoT) provided in an embodiment of this application. Figure 1 As shown, this method for encrypted transmission of IoT data, applied to the data sender, may include the following steps: S110. Based on the device identifier, preset keywords, target model and security label corresponding to the target data, determine the corresponding multiple risk levels, and determine the target risk level corresponding to the target data based on the highest risk level.

[0022] Target data refers to standard data that needs to be encrypted and transmitted after being collected and uploaded by IoT terminal devices. In practical applications, the Internet of Things connects to the Internet through a massive number of smart devices. The data generated by these devices includes not only ordinary sensor data, but also sensitive content such as key control commands, personal privacy, and alarm information. Encrypting the transmitted data is the main means of ensuring the security of the Internet of Things.

[0023] Device identifier is an identity code assigned to each IoT terminal device, also known as device ID or device number, used to distinguish different terminal devices within the network.

[0024] Preset keywords refer to a pre-determined set of sensitive words, instruction characters, and alarm fields stored in a keyword database. They are characteristic texts used to identify the risk of target data content and can include high-risk keywords such as shutdown, startup, emergency alarm, fault, password, permission, instruction, and lockout (high-risk content related to control and alarms); medium-risk keywords such as warning, abnormal, reminder, and exceeding limits (ordinary abnormal content); and low-risk / no-risk keywords such as normal values, time, and normal status (no sensitive words).

[0025] A target model refers to a lightweight neural network AI model used for intelligent content recognition of unstructured target data without explicit keywords. In practical applications, for data where keyword matching fails, such as unstructured data like video streams, image data, long text logs, voice data, and complex operational messages, the target AI model can use image recognition, behavior analysis, and anomaly detection capabilities to determine whether the data content poses a risk. For example, in camera video streams, it can identify high-risk scenarios such as intrusion, fire, and abnormal footage; in equipment operation logs, it can identify hidden faults and abnormal operating states through semantic analysis.

[0026] Security tags refer to API tags, which are custom identification fields added to the header of target data messages by upper-layer business systems. These tags are assigned by the business side based on data importance and represent business-level risk labeling. In practical applications, business systems best understand the business value of data. For core business data that cannot be precisely defined by device, keyword, or AI model, the business side pre-labels it with security tags. The data sender then checks whether the target data carries a tag and the tag level.

[0027] Risk level refers to the security assessment result of target data, thereby unifying and quantifying security judgments from different dimensions into comparable level values. For example, it can include four independent risk levels: the device identification dimension corresponds to the first risk level; the preset keyword dimension corresponds to the second risk level; the target model dimension corresponds to the third risk level; and the security label dimension corresponds to the fourth risk level.

[0028] The target risk level is a global risk level obtained by comprehensively comparing various independent risk levels. That is, if the target data is judged to be high risk in any dimension, it will be protected according to the highest risk standard. The higher the target risk level, the more important the target data is and the more likely it is to be attacked. Therefore, it needs to be protected with high-level encryption.

[0029] Therefore, in practical applications, relying solely on device type to determine the security level is not very secure, as the same device may generate both ordinary and high-risk data simultaneously. By using four dimensions—device identification, keywords, AI models, and security tags—risks can be assessed from different perspectives, reducing the probability of missed or incorrect risk assessments.

[0030] S120. Based on the target risk level, query the corresponding level mapping table to obtain the target quantum key and the target encryption algorithm.

[0031] The risk level mapping table is a predefined set of data tables that establishes a one-to-one correspondence between the target risk level, encryption algorithm parameters, and quantum key strategy. This data is used to determine what type of key and what strength of algorithm should be assigned to a piece of data when it is assessed as having a certain risk level.

[0032] A target quantum key refers to a symmetric key allocated from the quantum key pool based on the target risk level, after querying a level mapping table, and used to encrypt data of that level. This key is generated by a quantum key distribution (QKD) network. In practical applications, low-risk keys have shorter key lengths, lower update frequencies, and a higher number of allowed reuses, resulting in minimal computational power and bandwidth consumption. Medium-risk keys have standard key lengths, moderate update frequencies, and regular usage limits, balancing security and efficiency. High-risk keys have even longer key lengths, extremely high update frequencies, and fewer single-use uses, making them nearly impossible to crack and providing the highest security level. This allows for the allocation of different specifications of quantum keys to data of different security levels, reducing the burden on QKD network key capacity for low-risk data, alleviating hardware pressure, and lowering operating costs. Furthermore, high-specification keys are configured for high-risk core data to maximize protection strength.

[0033] The target encryption algorithm is a cryptographic algorithm that is matched according to the level mapping table and used to perform encryption operations on the current target data. It is based on symmetric encryption algorithms and is divided into multiple levels according to security strength and computing power overhead to adapt to different types of IoT data.

[0034] Based on this, according to the security level identifier, lightweight encryption algorithms with lower computational overhead are selected for large amounts of low-security data.

[0035] S130. Based on the data category, target quantum key, and target encryption algorithm corresponding to the target data, encrypt and encapsulate the target data to obtain the corresponding encrypted data.

[0036] Data category refers to the type of data classified according to factors such as the generation method, time characteristics, and length characteristics of the target data. It includes real-time streaming data and block data. Real-time streaming data is a continuously generated, uninterrupted data stream with an unpredictable length. It is usually transmitted in a streaming manner, such as video surveillance streams, audio streams, high-frequency sensor data streams, and continuous GPS location reporting. Block data is a data unit that is generated once, has a fixed or finite length, and has clear boundaries, such as single sensor readings, control commands, configuration files, log entries, and alarm messages.

[0037] Encrypted data refers to ciphertext data generated after the target data has been processed by an encryption algorithm.

[0038] Therefore, in the data processing flow, low-security-level data uses a lightweight encryption algorithm to avoid the processing delay caused by complex encryption algorithms.

[0039] S140. Send the encrypted data to the corresponding data recipient.

[0040] The data sender refers to the party used for data collection, security assessment, encryption processing, and encapsulation transmission. Located between the IoT sensing terminal and the cloud platform, it is the first-level aggregation and processing node for terminal data, as well as the execution terminal on the encryption side of the entire encryption process. It receives the raw data from the front-end IoT terminal, completes a series of security processing steps, and actively sends the encrypted data to the designated receiving node. For example, it can be a terminal device deployed in the edge area of ​​the IoT field, close to sensors, industrial controllers, smart cameras, etc. It can include a data preprocessing module, a multi-dimensional risk classification module, a level mapping query module, an encryption engine, a data packet encapsulation module, and a network transmission module. It also connects to a local policy library and encryption algorithm library, and can initiate key requests to the quantum key management server.

[0041] The data receiver is the party responsible for receiving secure data packets, verifying their integrity, decrypting them, and distributing them in plaintext, thereby restoring ciphertext to usable plaintext to support the operation of various IoT services at the upper layer. It can be deployed in cloud environments such as public clouds, private clouds, and local server clusters, and belongs to the backend server, far away from the front-end physical devices. It also has built-in data receiving modules, integrity verification modules, data packet parsing modules, decryption engines, service distribution modules, audit log modules, and access control modules. It can also initiate key call requests to the quantum key management server.

[0042] Based on this, in practical applications, encrypted data packets can be transmitted to the data receiver through classic communication channels, such as cloud platforms. The transmission adopts link-layer encryption and integrity protection mechanisms, and the transport layer protocol ensures reliable transmission of data packets, supporting breakpoint resumption and error retransmission mechanisms.

[0043] Based on the feasible implementation of S110 described above, this application further provides methods for determining multiple risk levels based on the device identifier, preset keywords, target model, and security label corresponding to the target data, including: Based on the raw data sent by the target device, and after standardizing and preprocessing the raw data, the target data is obtained; Based on the device identifier corresponding to the target data, the corresponding device level database is queried to obtain the first risk level, and based on multiple preset keywords, keyword matching is performed on the target data to obtain the corresponding matching results; If the matching result shows that there is at least one preset keyword in the target data, then the highest risk level is determined as the second risk level based on the risk level corresponding to each keyword. If the matching result indicates that the preset keyword does not exist in the target data, then it is determined that the second risk level does not exist; Based on the target model, content recognition is performed on the target data to obtain the third risk level, and security label verification is performed on the target data to obtain the corresponding verification results; If the test result indicates the presence of a safety label, then the fourth safety level is determined based on the risk level corresponding to the safety label. If the test result indicates that there is no security label in the target data, then it is determined that the fourth security level does not exist; Multiple risk levels are determined based on the first, second, third, and fourth security levels.

[0044] Among them, target devices are IoT terminal hardware devices deployed in the IoT sensing layer that can autonomously collect information such as physical environment, equipment operation, and business status, and actively send data outward, such as sensor devices; control devices such as irrigation controllers, smart switches, PLC controllers, and motor drivers; receiving control commands and executing key operations; data collection devices such as AI cameras, smart meters, smart water meters, and GPS locators, which have large data volumes and may have real-time requirements; wearable devices such as smart bracelets, health monitors, and personnel positioning tags; and industrial equipment such as industrial robots, CNC machine tools, and AGVs.

[0045] Raw data refers to the data reported by the target device after collection without any standardized processing. It is the most original information carrier directly generated by the IoT terminal device, retaining the original format and content when the device collected the data.

[0046] Standardized preprocessing refers to the process of receiving raw data from different target devices and performing a series of processing operations such as protocol conversion, format unification, and metadata addition to convert heterogeneous raw data into target data in a unified format.

[0047] The device level library is a pre-defined structured database that stores the mapping relationship between device identifiers and corresponding basic risk levels. This allows devices to be pre-entered with their levels before being connected to the network. Each device identifier uniquely corresponds to a basic risk level. By extracting the device identifier from the target data and searching the device level library, the basic risk level (first risk level) corresponding to the device can be obtained directly. The operation is simple and extremely fast, making it suitable for concurrent processing of massive IoT data.

[0048] Pre-defined keywords are words, phrases, or regular expressions that are pre-selected and stored in a sensitive keyword database. They are used to detect whether the target data payload contains sensitive content, thereby identifying explicit risks in the data content. The risk can be completely different for different data content from the same device. For example, a normal reading from an ordinary sensor poses no risk, but once the keyword "fault alarm" is reported, the risk level is immediately increased.

[0049] Based on this, in practical applications, data needs to undergo multi-dimensional security assessment; device type identification can query the local policy library based on the source device identifier to determine the basic security level; data content keyword matching can use multi-pattern matching algorithms to scan the data load and identify preset sensitive keywords; AI content analysis can call a lightweight neural network model to perform real-time analysis on unstructured data to detect abnormal scenarios or sensitive content; API tag injection verifies whether the data packet contains application-layer preset security tags; thus, by comprehensively considering the risk levels corresponding to each dimension, the highest level is selected to generate the final security level identifier.

[0050] Based on the feasible implementation of S130 described above, this application further provides a method for encrypting and encapsulating target data according to the data category corresponding to the target data, the target quantum key, and the target encryption algorithm to obtain corresponding encrypted data, including: Determine the data category; If the data type is real-time streaming data, then the target data is stream encrypted based on the target quantum key and the target encryption algorithm; If the data type is block data, then the target data is encrypted in blocks based on the target quantum key and the target encryption algorithm; The encrypted target data is then encapsulated to obtain the corresponding encrypted data.

[0051] Stream cipher is a symmetric encryption method that performs a bitwise (or bytewise) XOR operation on plaintext data with a pseudo-random key stream to generate ciphertext. This allows for bitwise data processing without waiting for complete data blocks to arrive, making it suitable for real-time streaming data of unpredictable length that is continuously generated.

[0052] Block cipher is a symmetric encryption method that divides plaintext data into fixed-length blocks (such as 128 bits), and then encrypts each block independently or in association to generate ciphertext blocks of the same length. Block cipher requires waiting for a complete data block before it can begin encryption, and is suitable for blocks of data with fixed or finite length and well-defined boundaries.

[0053] Based on this, quantum keys and algorithms are used to perform encryption operations on the data. An appropriate working mode is selected according to the characteristics of the data type. That is, real-time streaming data adopts streaming encryption mode, and block data adopts block encryption mode. After encryption, the ciphertext and metadata such as security level identifier, algorithm identifier, and key identifier are encapsulated into a standard data packet. After adding an integrity check code, it is transmitted to the data receiver such as the cloud platform through a classic communication channel.

[0054] Based on the above steps, it can be seen that this application selects lightweight encryption algorithms with lower computational overhead for a large amount of low-security-level data according to the security level identifier. This directly reduces the processing load of the edge gateway, enabling more IoT devices to be connected and processed with the same hardware resources, effectively delaying the hardware upgrade cycle; at the same time, it achieves a sharp reduction in quantum key consumption. Through level key mapping, only high-security-level data is allocated quantum keys that require high-frequency updates, while low-security-level data, which accounts for the majority of data traffic, adopts a strategy with a lower key update frequency. This differentiated management greatly reduces the pressure on the network key generation rate, allowing for the selection of more cost-effective QKD (Quantum Key Distribution) devices when building large-scale IoT networks, or supporting larger-scale IoT applications on the basis of existing QKD networks.

[0055] Figure 2 This is a flowchart illustrating another method for encrypted transmission of IoT data provided in an embodiment of this application. Figure 2 As shown, this method for encrypted transmission of IoT data, applied to the data receiver, may include the following steps: S210: Receive encrypted data sent by the data sender, and perform integrity verification on the encrypted data to obtain the target encrypted data.

[0056] Integrity verification is a security verification operation performed by the data receiver on the received encrypted data. It compares the characteristic values ​​before and after data transmission. For example, after the data sender completes encryption, it generates a fixed-length integrity verification code based on the complete ciphertext. Based on the integrity verification code, it can determine whether the encrypted data has been tampered with, lost, interfered with, or forged during network transmission.

[0057] Target encrypted data refers to secure data packets that have been verified as complete and untampered after passing integrity checks.

[0058] Based on this, the receiving end performs integrity verification on the data packets to verify that the data packets have not been tampered with during transmission.

[0059] S220. Parse the header of the target encrypted data packet to obtain the corresponding target risk level.

[0060] The packet header is a crucial component of a secure data packet, located at the very beginning of the packet. It stores metadata information describing the data packet itself. This metadata includes security level identifiers, algorithm identifiers, key identifiers, data category identifiers, etc. The receiver obtains all the parameter information needed for decryption by parsing the packet header.

[0061] Based on this, the data receiver can extract the security level identifier and related metadata by parsing the header information of the data packet.

[0062] S230. Based on the target risk level and the corresponding level mapping table, determine the corresponding target quantum key and target encryption algorithm.

[0063] S240. Based on the target quantum key and the target encryption algorithm, the target encrypted data is symmetrically decrypted to obtain the corresponding target data.

[0064] Based on this, the cloud platform's decryption engine requests the corresponding quantum key from the key management server according to the security level identifier obtained from the parsing. After verifying the cloud platform's identity and permissions, the key management server distributes the corresponding quantum key. After obtaining the key, the decryption engine uses the same algorithm as the encryption end to decrypt the ciphertext and verifies the correctness of the decryption result through a verification mechanism.

[0065] Based on the feasible implementation of S210 described above, this application further provides a method for performing integrity verification on encrypted data to obtain target encrypted data, including: Based on the encrypted data, the corresponding data length is determined, and the data length is compared with the preset verification length to obtain the corresponding verification result. If the verification result shows that the lengths are consistent, then the encrypted data is determined to be the target encrypted data; If the verification result indicates a length discrepancy, a corresponding prompt message will be output to indicate that the current data is abnormal.

[0066] The preset verification length refers to a pre-determined standard length value used to determine whether the encrypted data packet is complete. It is a reference value agreed upon in advance by the data sender and the data receiver. By comparing the actual length of the received encrypted data with this preset value, it is initially determined whether the data packet is complete and whether there are any abnormalities such as packet loss, truncation, or illegal splicing.

[0067] Therefore, IoT wireless communication (LoRa, Zigbee, 5G) is highly susceptible to weak signals, interference, and link interruptions, resulting in incomplete data packet transmission and fragmented messages. The actual length of such incomplete data is inevitably less than the preset verification length. By comparing the lengths, it can be intercepted immediately, preventing incomplete data from entering the parsing and decryption process and wasting cloud computing power.

[0068] Based on the feasible implementation of S240 described above, this application further provides a method that, after symmetrically decrypting the target encrypted data based on the target quantum key and the target encryption algorithm to obtain the corresponding target data, also includes: Determine whether the target quantum key has been used a preset number of times; If so, then destroy the target quantum key; If not, the target quantum key will not be destroyed.

[0069] The preset usage count refers to a pre-determined maximum threshold for the number of times a key can be used. When the actual usage count of a key reaches or exceeds this preset value, the key will be destroyed to ensure it is no longer used. In practical applications, the preset usage count for keys corresponding to low-risk data is high, allowing for more reuses. The impact of low-risk data leakage is minimal, and appropriately increasing the reuse count can reduce the pressure on the QKD network to generate new keys and lower operating costs. The preset usage count for keys corresponding to medium-risk data is an intermediate value, balancing security and key resource consumption. The preset usage count for keys corresponding to high-risk data is the lowest, allowing for very few reuses. High-risk data is mostly control commands and emergency alarms, with the highest security priority. Strictly limiting key reuse minimizes the risk of key leakage.

[0070] Based on this, by continuously monitoring the lifecycle of all distributed keys, automatic destruction is performed on keys that have reached their expiration date or usage limit, and the key usage status record is updated. The system periodically executes a key update policy to ensure the forward security of quantum keys.

[0071] Please refer to Figure 3 , Figure 3 This application provides a system schematic diagram of an encrypted data transmission method for the Internet of Things (IoT) according to an embodiment of the present application; as shown below. Figure 3 As shown, the network architecture is based on the traditional IoT cloud-edge-device architecture. The IoT sensing layer, serving as the system's data source, is composed of heterogeneous terminal devices. This layer includes both "pure" sensing terminals with limited functions and resources (such as temperature and humidity sensors and smart meters) and intelligent terminals with certain computing power (such as cameras with AI recognition and industrial PLCs). These devices use various near-field or long-range communication protocols to uniformly upload the collected raw data and control commands to the access gateway of the next layer, forming a complete data acquisition ecosystem.

[0072] The edge computing / access layer is the core processing area of ​​this invention, undertaking the critical tasks of data security classification and encryption. This layer, with the access gateway / aggregation node as its core hub, integrates two major innovative modules: a data security classification module responsible for performing multi-dimensional intelligent analysis of uploaded raw data to generate security level identifiers; and a classification encryption engine that executes differentiated encryption strategies based on these identifiers. Simultaneously, this layer also includes a local policy library and an encryption algorithm library, providing real-time, local resource support for classification and encryption decisions. In terms of connectivity, this layer receives data from the perception layer and interacts with the quantum security infrastructure to obtain keys, ultimately sending encrypted data packets to the cloud platform.

[0073] Quantum-safe infrastructure provides an unconditional security foundation for the entire system. The quantum key distribution network (QKD) generates raw keys and stores them in a quantum key pool. The core key management server, through its internal hierarchical key mapping and key scheduler, responds to requests from the edge layer and implements differentiated key distribution strategies based on security level identifiers. Through the key distribution interface, it simultaneously provides precise quantum key services to both the edge layer's encryption engine and the cloud platform's decryption engine.

[0074] The cloud platform / control center serves as the final destination for data. After the receiving gateway acquires encrypted data packets, the decryption engine requests the corresponding key from the key management server for decryption. The recovered plaintext data is ultimately used by application servers to support various business applications. Thus, the data completes a closed-loop process from acquisition to perception, secure processing, and final application.

[0075] Please refer to Figure 4 , Figure 4 This is a schematic diagram of an encrypted transmission method for IoT data provided in an embodiment of this application; as shown below. Figure 4 As shown, after the raw data is transmitted to the access gateway of the edge computing layer, it undergoes security processing steps such as data security classification, encryption algorithm selection, quantum key application, and data encryption and encapsulation to generate an encrypted data packet. The encrypted data packet is then sent to the cloud platform. After receiving it, the cloud platform applies for a quantum key again and performs data decryption. Finally, the decrypted data is delivered to the application layer for business processing, thus completing the full-link security closed loop from data collection, hierarchical encryption to cloud decryption and application.

[0076] Based on the above steps, it can be seen that this application avoids the processing delays caused by complex encryption algorithms by using lightweight encryption algorithms for low-security-level data in the data processing flow. For services with real-time requirements, such as vehicle status information in intelligent transportation and periodic sensor data in the Industrial Internet of Things, the encrypted transmission delay is significantly improved. By using appropriate lightweight encryption algorithms, the power consumption of a single data report is effectively reduced, thereby significantly extending the continuous working time of battery-powered equipment in scenarios such as the field.

[0077] Figure 5 This is a schematic diagram of the structure of an encrypted data transmission device for the Internet of Things (IoT) provided in an embodiment of this application, applied to the data sender. For example... Figure 5 As shown, this type of IoT data encryption transmission device includes: a determination module, a query module, an encryption module, and a sending module; wherein: The determination module is used to determine multiple risk levels based on the device identifier, preset keywords, target model, and security label corresponding to the target data, and to determine the target risk level corresponding to the target data based on the highest risk level. The query module is used to query the corresponding level mapping table based on the target risk level to obtain the target quantum key and the target encryption algorithm. The encryption module is used to encrypt and encapsulate the target data according to the data category, target quantum key and target encryption algorithm to obtain the corresponding encrypted data; The sending module is used to send encrypted data to the corresponding data receiver.

[0078] In this embodiment of the application, the determining module can also be specifically used for: Based on the raw data sent by the target device, and after standardizing and preprocessing the raw data, the target data is obtained; Based on the device identifier corresponding to the target data, the corresponding device level database is queried to obtain the first risk level, and based on multiple preset keywords, keyword matching is performed on the target data to obtain the corresponding matching results; If the matching result shows that there is at least one preset keyword in the target data, then the highest risk level is determined as the second risk level based on the risk level corresponding to each keyword. If the matching result indicates that the preset keyword does not exist in the target data, then it is determined that the second risk level does not exist; Based on the target model, content recognition is performed on the target data to obtain the third risk level, and security label verification is performed on the target data to obtain the corresponding verification results; If the test result indicates the presence of a safety label, then the fourth safety level is determined based on the risk level corresponding to the safety label. If the test result indicates that there is no security label in the target data, then it is determined that the fourth security level does not exist; Multiple risk levels are determined based on the first, second, third, and fourth security levels.

[0079] In this embodiment of the application, the encryption module can also be specifically used for: Determine the data category; If the data type is real-time streaming data, then the target data is stream encrypted based on the target quantum key and the target encryption algorithm; If the data type is block data, then the target data is encrypted in blocks based on the target quantum key and the target encryption algorithm; The encrypted target data is then encapsulated to obtain the corresponding encrypted data.

[0080] Figure 6 This is a schematic diagram of another IoT data encryption transmission device provided in an embodiment of this application, applied to a data receiver. Figure 6As shown, this IoT data encryption transmission device includes: a verification module, a parsing module, an algorithm determination module, and a decryption module; wherein: The verification module is used to receive encrypted data sent by the data sender, and to perform integrity verification on the encrypted data to obtain the target encrypted data. The parsing module is used to parse the header of the target encrypted data to obtain the corresponding target risk level; The algorithm determination module is used to determine the corresponding target quantum key and target encryption algorithm based on the target risk level and the corresponding level mapping table; The decryption module is used to perform symmetric decryption of the target encrypted data based on the target quantum key and the target encryption algorithm to obtain the corresponding target data.

[0081] In this embodiment of the application, the verification module can also be specifically used for: Based on the encrypted data, the corresponding data length is determined, and the data length is compared with the preset verification length to obtain the corresponding verification result. If the verification result shows that the lengths are consistent, then the encrypted data is determined to be the target encrypted data; If the verification result indicates a length discrepancy, a corresponding prompt message will be output to indicate that the current data is abnormal.

[0082] In this embodiment of the application, the other modules included in the encrypted transmission device for IoT data can also be specifically used for: Determine whether the target quantum key has been used a preset number of times; If so, then destroy the target quantum key; If not, the target quantum key will not be destroyed.

[0083] Figure 7 This is a schematic diagram of the structure of a device for performing an encrypted transmission method for Internet of Things (IoT) data according to an embodiment of this application. Figure 7 As shown, the device includes: The device may include one or more processors with processing cores, one or more computer-readable storage media such as memory, communication components, etc. The processor, memory, and communication components are connected via a bus.

[0084] In the specific implementation process, at least one processor executes computer execution instructions stored in memory, causing at least one processor to execute the above-described method for encrypted transmission of IoT data.

[0085] The specific implementation process of the processor can be found in the above method embodiments, and its implementation principle and technical effect are similar, so it will not be repeated here.

[0086] Furthermore, the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0087] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0088] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0089] In some embodiments, a computer program product is also provided, including a computer program or instructions that, when executed by a processor, implement the steps in any of the above-described methods for encrypted transmission of IoT data.

[0090] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0091] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor.

[0092] Therefore, embodiments of this application provide a computer-readable storage medium storing a plurality of program codes that can be loaded by a processor to execute the steps in any of the IoT data encryption transmission methods provided in embodiments of this application.

[0093] The storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0094] According to one aspect of this application, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium.

[0095] Since the instructions stored in the storage medium can execute the steps in any of the IoT data encryption transmission methods provided in the embodiments of this application, the beneficial effects that any of the IoT data encryption transmission methods provided in the embodiments of this application can achieve can be realized. For details, please refer to the previous embodiments, which will not be repeated here.

[0096] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope of this application is indicated by the appended claims.

[0097] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope.

Claims

1. A method for encrypted transmission of Internet of Things (IoT) data, characterized in that, Applied to the data sender, the method includes: Based on the device identifier, preset keywords, target model, and security label corresponding to the target data, multiple risk levels are determined, and the target risk level corresponding to the target data is determined based on the highest risk level. Based on the target risk level, the corresponding level mapping table is queried to obtain the target quantum key and the target encryption algorithm; Based on the data category corresponding to the target data, the target quantum key, and the target encryption algorithm, the target data is encrypted and encapsulated to obtain the corresponding encrypted data. The encrypted data is sent to the corresponding data recipient.

2. The method according to claim 1, characterized in that, The process involves determining multiple risk levels based on the device identifier, preset keywords, target model, and security label corresponding to the target data, including: Based on the raw data sent by the target device, and after standardizing and preprocessing the raw data, the target data is obtained; Based on the device identifier corresponding to the target data, the corresponding device level database is queried to obtain the first risk level, and based on multiple preset keywords, keyword matching is performed on the target data to obtain the corresponding matching results; If the matching result indicates that at least one of the preset keywords exists in the target data, then the highest risk level is determined as the second risk level based on the risk level corresponding to each keyword. If the matching result indicates that the preset keyword does not exist in the target data, then it is determined that the second risk level does not exist; Based on the target model, content recognition is performed on the target data to obtain a third risk level, and security label verification is performed on the target data to obtain the corresponding verification results; If the test result indicates the presence of the security label, then a fourth security level is determined based on the risk level corresponding to the security label. If the test result indicates that the security label does not exist in the target data, then it is determined that the fourth security level does not exist; The multiple risk levels are determined based on the first security level, the second security level, the third security level, and the fourth security level.

3. The method according to claim 1, characterized in that, The step of encrypting and encapsulating the target data according to the data category corresponding to the target data, the target quantum key, and the target encryption algorithm to obtain the corresponding encrypted data includes: Determine the data category; If the data category is real-time streaming data, then the target data is stream encrypted based on the target quantum key and the target encryption algorithm; If the data category is block data, then the target data is encrypted in blocks based on the target quantum key and the target encryption algorithm; The encrypted target data is encapsulated to obtain the corresponding encrypted data.

4. A method for encrypted transmission of Internet of Things (IoT) data, characterized in that, Applied to the data receiver, the method includes: Receive encrypted data sent by the data sender, and perform integrity verification on the encrypted data to obtain the target encrypted data; The header of the target encrypted data is parsed to obtain the corresponding target risk level; Based on the target risk level and the corresponding level mapping table, the corresponding target quantum key and target encryption algorithm are determined; Based on the target quantum key and the target encryption algorithm, the target encrypted data is symmetrically decrypted to obtain the corresponding target data.

5. The method according to claim 4, characterized in that, The process of performing integrity verification on the encrypted data to obtain the target encrypted data includes: Based on the encrypted data, the corresponding data length is determined, and the data length is compared with the preset verification length to obtain the corresponding verification result. If the verification result shows that the lengths are consistent, then the encrypted data is determined to be the target encrypted data; If the verification result indicates a length discrepancy, a corresponding prompt message will be output, which indicates that the current data is abnormal.

6. The method according to claim 4, characterized in that, After performing symmetric decryption on the target encrypted data based on the target quantum key and the target encryption algorithm to obtain the corresponding target data, the method further includes: Determine whether the number of times the target quantum key has been used has reached the preset number of times; If so, then destroy the target quantum key; If not, the target quantum key will not be destroyed.

7. An encrypted data transmission device for the Internet of Things, characterized in that, Applied to the data sender, the device includes: The determination module is used to determine multiple risk levels based on the device identifier, preset keywords, target model and security label corresponding to the target data, and to determine the target risk level corresponding to the target data based on the highest risk level. The query module is used to query the corresponding level mapping table based on the target risk level to obtain the target quantum key and the target encryption algorithm; An encryption module is used to encrypt and encapsulate the target data according to the data category corresponding to the target data, the target quantum key, and the target encryption algorithm to obtain the corresponding encrypted data; The sending module is used to send the encrypted data to the corresponding data receiver.

8. An encrypted data transmission device for the Internet of Things, characterized in that, The device, applied to a data receiver, includes: The verification module is used to receive encrypted data sent by the data sender and perform integrity verification on the encrypted data to obtain the target encrypted data; The parsing module is used to parse the header of the target encrypted data to obtain the corresponding target risk level; The algorithm determination module is used to determine the corresponding target quantum key and target encryption algorithm based on the target risk level and the corresponding level mapping table; The decryption module is used to perform symmetric decryption of the target encrypted data based on the target quantum key and the target encryption algorithm to obtain the corresponding target data.

9. A computer device, characterized in that, include: One or more processors; Memory; One or more programs, wherein the one or more programs are stored in memory and configured to be executed by one or more processors, the one or more programs being configured to perform the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores program code that can be called by a processor to perform the method as described in any one of claims 1 to 7.

Images