Internal private network security access method, device and equipment of internet of things device and medium

Abstract

The application discloses an internal private network security access method and device of Internet of Things equipment, equipment and medium, relates to the Internet of Things security access technical field, and the application cross-encrypts the data group according to the space-time topology fingerprint, equipment identification, random number and space-time membership degree of the divided data group of the Internet of Things equipment of the application, and the cross-encrypted basis key is derived; the chain encryption key is derived from the ciphertext hash value, the space-time topology hash value and the preset initial encryption key, and the check voucher is generated by secondary encryption; the space-time topology fingerprint is reversely reconstructed after internal private network decryption, and when the deviation of the space-time topology fingerprint is not greater than a threshold value and the check voucher passes, the equipment is allowed to access.The application binds the encryption strength, the key generation and the space-time motion state of the equipment, and improves the security of the heterogeneous Internet of Things equipment accessing the internal private network.

Description

Technical Field

[0001] This invention relates to the field of secure access technology for the Internet of Things (IoT), and more particularly to secure access methods, devices, equipment, and media for internal private networks of IoT devices. Background Technology

[0002] With the rapid development of IoT technology, intelligent devices such as drones, quadruped robots, smart glasses, and wearable cameras have been widely used in security patrols, emergency rescue, industrial monitoring, and military reconnaissance. These devices typically require access to an internal private network via a wireless network for data transmission and remote control. Current methods for IoT devices to access internal private networks involve the device initiating an access request via a wireless network. The internal private network then authenticates the device using a pre-configured password. After successful authentication, the device encrypts the collected data using a statically configured communication key and uploads it. The internal private network then groups and stores the received data according to preset fixed time and space thresholds. The drawback of this existing technology is the low security of IoT devices accessing internal private networks. The main reasons for this include:

[0003] First, the authentication method is singular, relying solely on password authentication, making it vulnerable to brute-force attacks and identity forgery attacks;

[0004] Secondly, communication keys are mostly statically configured, and a batch of data is encrypted with a single key. Once the key is leaked, the entire batch of data will be leaked, creating a long-term security risk.

[0005] Third, the access protocols of heterogeneous devices such as drones, quadruped robots, smart glasses and wearable cameras are not uniform, and there are differences in hardware crystal oscillators, network transmission latency, and inherent asynchronous deviations in the local clocks of the devices. The movement speeds vary greatly. When grouping according to fixed time thresholds and fixed space thresholds, legitimate collaborative data will be mistakenly removed, and data from neighboring devices with no business relationship will be mistakenly aggregated, leading to the failure of subsequent encryption and auditing. Summary of the Invention

[0006] This invention provides a method, apparatus, device, and medium for secure access to an internal private network for IoT devices, in order to solve the problem of low security for IoT devices accessing internal private networks in the prior art.

[0007] In a first aspect, the present invention provides a method for secure access to an internal private network for an Internet of Things (IoT) device, the method comprising:

[0008] Step 100: Obtain the motion direction coherence coefficient between any two IoT devices among the n IoT devices, m data groups of the n IoT devices, and the identifier, data acquisition timestamp, three-dimensional spatial position coordinates, instantaneous velocity and instantaneous acceleration of the n IoT devices, where n and m are both positive integers greater than 1;

[0009] Step 200: Based on the three-dimensional spatial coordinates of the r IoT devices corresponding to the k-th data group, the motion direction coherence coefficient between the r IoT devices, and the data acquisition timestamps of the r IoT devices, determine the spatiotemporal topological fingerprint corresponding to the k-th data group; based on the identifiers of the r IoT devices, random numbers, the spatiotemporal topological fingerprint corresponding to the k-th data group, and the spatiotemporal membership degree of the r IoT devices to the k-th data group, determine the cross-encryption base key for the r IoT devices corresponding to the k-th data group; based on the cross-encryption base key and the motion direction coherence coefficient between the r IoT devices, perform fragmented cross-encryption on the k-th data group to obtain the concatenated intra-group cross-encrypted ciphertext of the r IoT devices corresponding to the k-th data group, where k=1,2,...,m, and r is a positive integer greater than 1 and r<n;

[0010] Step 300: Perform hash operations on the concatenated intra-group cross-encrypted ciphertext and the spatiotemporal topological fingerprint respectively to obtain the ciphertext hash value and spatiotemporal topological hash value corresponding to the k-th data group; determine the chain encryption key corresponding to the k-th data group based on the ciphertext hash value, the spatiotemporal topological hash value, and the preset initial encryption key; use the chain encryption key to perform secondary encryption on the concatenated intra-group cross-encrypted ciphertext to obtain the concatenated inter-group cross-encrypted ciphertext corresponding to the k-th data group; obtain the verification credential based on the chain encryption key and the spatiotemporal topological fingerprint;

[0011] Step 400: The inter-group cross-encrypted ciphertexts corresponding to m data groups and the verification credentials corresponding to m data groups are sent to the internal private network. The internal private network uses the chain encryption key to decrypt the inter-group cross-encrypted ciphertexts to obtain decrypted data. Based on the decrypted data, the spatiotemporal topology fingerprint is reverse-reconstructed to obtain the reconstructed spatiotemporal topology fingerprint. When the deviation between the reconstructed spatiotemporal topology fingerprint and the original spatiotemporal topology fingerprint is not greater than a preset deviation threshold, and the chain encryption key passes the verification of the verification credentials, n IoT devices are allowed to access the internal private network.

[0012] Secondly, the present invention provides an internal private network security access device for IoT devices, the internal private network security access device for IoT devices comprising:

[0013] The parameter acquisition module is used to acquire the motion direction coherence coefficient between any two IoT devices among n IoT devices, m data groups of the n IoT devices, and the identifier, data acquisition timestamp, three-dimensional spatial position coordinates, instantaneous velocity and instantaneous acceleration of the n IoT devices, where n and m are both positive integers greater than 1;

[0014] The intra-group cross-encryption ciphertext acquisition module is used to determine the spatiotemporal topological fingerprint corresponding to the k-th data group based on the three-dimensional spatial coordinates of the r IoT devices corresponding to the k-th data group, the motion direction coherence coefficient between the r IoT devices, and the data acquisition timestamps of the r IoT devices; determine the cross-encryption base key for the r IoT devices corresponding to the k-th data group based on the identifiers of the r IoT devices, random numbers, the spatiotemporal topological fingerprint corresponding to the k-th data group, and the spatiotemporal membership degree of the r IoT devices to the k-th data group; and perform fragmented cross-encryption on the k-th data group based on the cross-encryption base key and the motion direction coherence coefficient between the r IoT devices to obtain the concatenated intra-group cross-encryption ciphertext of the r IoT devices corresponding to the k-th data group, where k=1,2,...,m, and r is a positive integer greater than 1 and r<n;

[0015] The inter-group cross-encryption ciphertext acquisition module is used to perform hash operations on the concatenated intra-group cross-encryption ciphertext and the spatiotemporal topological fingerprint respectively to obtain the ciphertext hash value and spatiotemporal topological hash value corresponding to the k-th data group; determine the chain encryption key corresponding to the k-th data group based on the ciphertext hash value, the spatiotemporal topological hash value and the preset initial encryption key; use the chain encryption key to perform secondary encryption on the concatenated intra-group cross-encryption ciphertext to obtain the concatenated inter-group cross-encryption ciphertext corresponding to the k-th data group; and obtain the verification credential based on the chain encryption key and the spatiotemporal topological fingerprint.

[0016] The data decryption and device access judgment module is used to send the inter-group cross-encrypted ciphertexts corresponding to m data groups and the verification credentials corresponding to m data groups to the internal private network. The internal private network uses the chained encryption key to decrypt the inter-group cross-encrypted ciphertexts to obtain decrypted data. Based on the decrypted data, the spatiotemporal topology fingerprint is reverse-reconstructed to obtain the reconstructed spatiotemporal topology fingerprint. When the deviation between the reconstructed spatiotemporal topology fingerprint and the original spatiotemporal topology fingerprint is not greater than a preset deviation threshold, and the chained encryption key passes the verification of the verification credentials, n IoT devices are allowed to access the internal private network.

[0017] Thirdly, the present invention provides a computer device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the secure access method for an internal private network of an Internet of Things device as described in the first aspect.

[0018] Fourthly, the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the secure access method for an internal private network of an Internet of Things device as described in the first aspect.

[0019] The aforementioned secure access method, device, equipment, and medium for the internal private network of IoT devices obtains the motion direction coherence coefficient between any two IoT devices based on the instantaneous speed of n IoT devices. It incorporates the static spatiotemporal position and dynamic motion state of heterogeneous devices into the data group division criteria, compensating for clock asynchrony deviations between multiple devices and distinguishing devices that are geographically close but have opposite motion trends and no business association. It constructs a spatiotemporal topological fingerprint for the data group, integrates device identifiers, random numbers, and spatiotemporal membership to generate a cross-encryption base key, and adjusts the cross-encryption strength of the segmented cross-encryption according to the motion direction coherence coefficient, realizing a dynamic key mechanism of one group at a time, one key per group, and one key per device. This ensures that the leakage of the key of any single device within the group cannot restore the complete data group. A chain encryption key is determined by the ciphertext hash value, the spatiotemporal topological hash value, and the preset initial encryption key, and secondary encryption is performed, making the encryption chain subject to the dual constraints of cryptographic hash and physical spatiotemporal characteristics. During decryption, the internal private network reconstructs the spatiotemporal topological fingerprint in reverse and performs dual verification in conjunction with the verification credential, using the verification result as the determination condition for device access. Compared to existing technologies, this invention deeply binds encryption strength, key generation, and the physical and spatiotemporal motion state of the device, and uses physical and spatiotemporal characteristics as an additional authentication factor in addition to cryptographic authentication. This not only avoids the overall data leakage caused by the leakage of a static single key, but also identifies data tampering, imperceptible replay, and fake data injection behaviors. It forms an effective security audit isolation between the Internet and the internal private network, and improves the security of heterogeneous IoT devices accessing the internal private network. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a schematic diagram of an application environment for the secure access method of the internal private network for IoT devices in Embodiment 1 of the present invention;

[0022] Figure 2 This is a flowchart of a secure access method for an internal private network of an Internet of Things (IoT) device according to Embodiment 1 of the present invention;

[0023] Figure 3 This is a diagram of an apparatus for a secure access method for an internal private network of an Internet of Things (IoT) device according to Embodiment 8 of the present invention;

[0024] Figure 4 This is a schematic diagram of the structure of a computer device provided in Embodiment 9 of this application. Detailed Implementation

[0025] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] The present invention provides a method for secure access to an internal private network for IoT devices, which can be applied to applications such as... Figure 1 The application environment is shown. Specifically, the internal private network secure access method for this IoT device is applied in the internal private network secure access system of the IoT device, which includes, as shown in the example... Figure 1 The diagram illustrates n IoT devices, an internal private network, and a server. The n IoT devices communicate with the server via a network, the internal private network communicates with the server via a network, and the n IoT devices communicate with the internal private network via a network, enabling secure access to the internal private network for real-time updates of the IoT devices. IoT devices refer to intelligent terminals equipped with data acquisition units, wireless communication units, and inertial measurement units, including but not limited to drones, quadruped robots, smart glasses, wearable cameras, smartwatches, and mobile terminals. The internal private network is a dedicated internal network physically or logically isolated from the internet, carrying business data and remote control commands. It contains a security audit server for decryption and access determination. The server can be a standalone server or a server cluster.

[0027] In Example 1, as Figure 2 As shown, this embodiment provides a method for secure access to an internal private network for IoT devices, which is applied to... Figure 1 Taking the server in the example, the secure access method for the internal private network of the IoT device includes:

[0028] Step 100: Obtain the motion direction coherence coefficient between any two IoT devices among the n IoT devices, m data groups of the n IoT devices, and the identifier, data acquisition timestamp, three-dimensional spatial position coordinates, instantaneous velocity and instantaneous acceleration of the n IoT devices, where n and m are both positive integers greater than 1;

[0029] In this context, a data group refers to a collection of data obtained by aggregating preprocessed data from n IoT devices based on spatiotemporal correlations. Data within the same data group originates from multiple IoT devices working collaboratively in similar times and spaces. The IoT device identifier (DeviceID) is a physical identifier uniquely representing the IoT device, such as a device serial number or a unique chip identification code. The data acquisition timestamp is the moment the IoT device collects data, synchronously recorded by its local clock. The three-dimensional spatial coordinates are the spatial location parameters of the IoT device when collecting data, composed of longitude, latitude, and elevation, used to accurately locate the physical position of the data acquisition point. Instantaneous velocity is the velocity vector of the IoT device at the moment of data acquisition, composed of three-axis instantaneous velocity components. Instantaneous acceleration is the acceleration scalar of the IoT device at the moment of data acquisition, used to characterize the drastic change in the device's motion state. The motion direction coherence coefficient is a quantitative indicator used to characterize the degree of motion coordination between any two IoT devices.

[0030] In this embodiment, the data types collected by the n IoT devices include video stream data, sensor readings (such as temperature, humidity, air pressure, acceleration, and angular velocity), device text log data, and spatial positioning data. While collecting data, the n IoT devices also obtain their own three-dimensional spatial coordinates, instantaneous velocity, instantaneous acceleration, and data acquisition timestamps in real time through their built-in inertial measurement units (IMUs) and continuous positioning differential algorithms.

[0031] In this embodiment, the motion direction coherence coefficient is pre-calculated globally for any two IoT devices out of all n IoT devices, and is used as the input parameter for calculating the spatiotemporal correlation distance and performing fuzzy clustering to divide the data into m data groups. After the data group division is completed, the motion direction coherence coefficient between each IoT device pair that has been calculated is reused in the process of constructing the spatiotemporal topological fingerprint, and there is no need to calculate it again.

[0032] Step 200: Based on the three-dimensional spatial coordinates of the r IoT devices corresponding to the k-th data group, the motion direction coherence coefficient between the r IoT devices, and the data acquisition timestamps of the r IoT devices, determine the spatiotemporal topological fingerprint corresponding to the k-th data group; based on the identifiers of the r IoT devices, random numbers, the spatiotemporal topological fingerprint corresponding to the k-th data group, and the spatiotemporal membership degree of the r IoT devices to the k-th data group, determine the cross-encryption base key for the r IoT devices corresponding to the k-th data group; based on the cross-encryption base key and the motion direction coherence coefficient between the r IoT devices, perform fragmented cross-encryption on the k-th data group to obtain the concatenated intra-group cross-encrypted ciphertext of the r IoT devices corresponding to the k-th data group, where k=1,2,...,m, and r is a positive integer greater than 1 and r<n;

[0033] Among them, the spatiotemporal topological fingerprint refers to the set of features that uniquely characterizes the attributes of each data group, which is obtained by aggregating the spatial distribution characteristics, motion coordination characteristics, and temporal interval characteristics of each IoT device corresponding to each data group. The nonce is a one-time random value generated in real time to ensure the uniqueness of each batch of keys. Spatiotemporal membership is a quantitative indicator that characterizes the degree to which the preprocessed data of each IoT device belongs to a certain data group. The cross-encryption base key is a dedicated base key derived separately for each IoT device corresponding to each data group, used for participating in intra-group fragment cross-encryption. Fragment cross-encryption refers to the process of equally dividing the data of any IoT device corresponding to each data group into multiple data fragments, and then encrypting each data fragment using the key of the IoT device with the corresponding sequence number within the group. The concatenated intra-group cross-encryption ciphertext refers to the complete ciphertext obtained by sequentially concatenating all the encrypted data fragments of the same IoT device.

[0034] In this embodiment, the expression for the cross-encryption base key is:

[0035] Key k,i,base =KDF(ID i ‖Nonce‖Φ k ||u ki )

[0036] Among them, Key k,i,base The KDF is the cross-encryption base key for the i-th IoT device corresponding to the k-th data group, where KDF is a preset key derivation function, and ID is the base key. i Let Φ be the identifier of the i-th IoT device, and Nonce be a random number. k u is the standard spatiotemporal topological fingerprint stored during encryption corresponding to the k-th data group. ki Let represent the spatiotemporal membership degree of the i-th IoT device to the k-th data group.

[0037] Step 300: Perform hash operations on the concatenated intra-group cross-encrypted ciphertext and the spatiotemporal topological fingerprint respectively to obtain the ciphertext hash value and spatiotemporal topological hash value corresponding to the k-th data group; determine the chain encryption key corresponding to the k-th data group based on the ciphertext hash value, the spatiotemporal topological hash value, and the preset initial encryption key; use the chain encryption key to perform secondary encryption on the concatenated intra-group cross-encrypted ciphertext to obtain the concatenated inter-group cross-encrypted ciphertext corresponding to the k-th data group; obtain the verification credential based on the chain encryption key and the spatiotemporal topological fingerprint;

[0038] Here, hashing refers to the process of calculating a unique digest value for data using a cryptographic hash function. The ciphertext hash value is the unique hash value (unique fingerprint) obtained by hashing the concatenated inter-group cross-encrypted ciphertext of each data group. The spatiotemporal topology hash value is the unique hash value (unique fingerprint) obtained by hashing the spatiotemporal topology fingerprint of each data group. The preset initial encryption key is a pre-defined initial vector used to derive the chain encryption key for the first data group. The chain encryption key is a key generated using a hierarchical derivation mechanism, where the key of each subsequent data group depends on the key of the previous data group and the first and last keys associated with the hash value of the current data group. The concatenated inter-group cross-encrypted ciphertext is the final output ciphertext obtained by encrypting the inter-group cross-encrypted ciphertext twice using the chain encryption key. The verification credential is the hash digest used to verify data integrity and spatiotemporal authenticity during the decryption phase.

[0039] In this embodiment, the formula for calculating the inter-group cross-encrypted ciphertext corresponding to the kth data group is:

[0040] ,

[0041] in, Let E be the inter-group cross-encrypted ciphertext corresponding to the k-th data group, and let E be a symmetric encryption algorithm such as AES-256. C is the chain encryption key corresponding to the k-th data group. k,cross This is the inter-group cross-encrypted ciphertext of r IoT devices corresponding to the k-th data group.

[0042] The formula for calculating the verification certificate corresponding to the kth data group is:

[0043] ,

[0044] Among them, V k This is the verification credential corresponding to the k-th data group; Hash() is the cryptographic hash function. Γ is the chain encryption key corresponding to the k-th data group. kLet the spatial centroid be the spatiotemporal topological fingerprint corresponding to the k-th data group. The average motion coherence in the spatiotemporal topological fingerprint corresponding to the k-th data group.

[0045] As another implementation method, the formula for calculating the verification credential corresponding to the kth data group can also be:

[0046] .

[0047] The expression for verifying the voucher is:

[0048] V = {V1, V2, ..., V} m},

[0049] Where V is the verification credential, V m This is the verification credential corresponding to the m-th data group.

[0050] In this embodiment, cryptographic hash functions such as SHA-256 are used to perform hash operations on the concatenated intra-group cross-encrypted ciphertext and spatiotemporal topological fingerprint corresponding to the k-th data group, respectively, to obtain the ciphertext hash value and spatiotemporal topological hash value corresponding to the k-th data group. The specific calculation formula is as follows:

[0051] H k =Hash(C k,cross ),

[0052] ,

[0053] Among them, H k Let Hash() be the ciphertext hash value corresponding to the k-th data group, where Hash() is the cryptographic hash function, and C is the hash value. k,cross This is the concatenated, cross-encrypted ciphertext corresponding to the kth data group; Φ is the spatiotemporal topological hash value corresponding to the kth data group. k The standard spatiotemporal topological fingerprint is stored during encryption for the k-th data group.

[0054] Step 400: The inter-group cross-encrypted ciphertexts corresponding to m data groups and the verification credentials corresponding to m data groups are sent to the internal private network. The internal private network uses the chain encryption key to decrypt the inter-group cross-encrypted ciphertexts to obtain decrypted data. Based on the decrypted data, the spatiotemporal topology fingerprint is reverse-reconstructed to obtain the reconstructed spatiotemporal topology fingerprint. When the deviation between the reconstructed spatiotemporal topology fingerprint and the original spatiotemporal topology fingerprint is not greater than a preset deviation threshold, and the chain encryption key passes the verification of the verification credentials, n IoT devices are allowed to access the internal private network.

[0055] Reverse reconstruction refers to the process by which the internal private network reconstructs the original spatiotemporal topological fingerprint based on the data acquisition timestamp, three-dimensional spatial coordinates, and instantaneous velocity from the decrypted original data. The preset deviation threshold is a pre-set error threshold used to determine whether the reconstructed spatiotemporal topological fingerprint is consistent with the spatiotemporal topological fingerprint stored during encryption.

[0056] In this embodiment, the internal private network strictly follows the chain-like reverse decryption rule: starting from the first data group, the corresponding chain-like encryption key is used to decrypt and obtain the cross-encrypted ciphertext within the data group. After verifying that the ciphertext hash value is correct, subsequent data groups are derived and decrypted level by level. When decrypting the kth data group, based on the original data obtained from decryption, the reconstructed spatiotemporal topological fingerprint is obtained in reverse and compared with the standard spatiotemporal topological fingerprint stored during encryption for error verification. When the sum of the spatial centroid deviation and the motion coherence deviation exceeds the preset deviation threshold, it is determined that the original data obtained from decryption has been tampered with, replayed, or illegally injected, and the decryption process is directly terminated, and the original data obtained from decryption is determined to be invalid.

[0057] The specific error verification formula is as follows:

[0058] ,

[0059] in, The deviation value between the reconstructed spatiotemporal topological fingerprint and the original spatiotemporal topological fingerprint, where k is the sequence number of the data set. For the reconstructed spatiotemporal topological fingerprint corresponding to the k-th data group, Φ k The standard spatiotemporal topological fingerprint stored during encryption for the k-th data group. Γ is the spatial centroid of the reconstructed spatiotemporal topological fingerprint corresponding to the k-th data group (the arithmetic mean of the three-dimensional spatial coordinates of the r IoT devices corresponding to the k-th data group obtained from decryption). k The spatial centroid of the spatiotemporal topological fingerprint corresponding to the kth data group is the arithmetic mean of the three-dimensional spatial position coordinates of the r IoT devices corresponding to the kth data group. Let R be the Euclidean distance between the spatial centroid of the reconstructed spatiotemporal topological fingerprint corresponding to the k-th data group and the spatial centroid of the spatiotemporal topological fingerprint corresponding to the k-th data group. base The preset base radius, The average motion coherence in the reconstructed spatiotemporal topological fingerprint corresponding to the kth data group is calculated from the motion direction coherence coefficient between any two IoT devices among the r IoT devices corresponding to the kth data group obtained by decryption. The average motion coherence in the spatiotemporal topological fingerprint corresponding to the kth data group is calculated from the motion direction coherence coefficient between any two IoT devices among the r IoT devices corresponding to the kth data group. ξ is the absolute difference between the average motion coherence in the reconstructed spatiotemporal topological fingerprint corresponding to the kth data group and the average motion coherence in the spatiotemporal topological fingerprint corresponding to the kth data group, and ξ is a preset deviation threshold.

[0060] In this embodiment, the expression for the inter-group cross-encryption ciphertext corresponding to m data groups is:

[0061] C final ={C 1,final C 2,final ,...,C m,final},

[0062] Among them, C final C is the inter-group cross-encrypted ciphertext corresponding to m data groups. m,final This is the inter-group cross-encryption ciphertext corresponding to the m-th data group.

[0063] The internal private network secure access method for IoT devices in this embodiment obtains the motion direction coherence coefficient between any two IoT devices based on the instantaneous speed of n IoT devices. It incorporates the static spatiotemporal position and dynamic motion state of heterogeneous devices into the data group division criteria, compensating for clock asynchrony deviations between multiple devices and distinguishing devices that are geographically close but have opposite motion trends and no business association. A spatiotemporal topological fingerprint of the data group is constructed, and a cross-encryption base key is generated by fusing device identifiers, random numbers, and spatiotemporal membership. The cross-encryption strength of the segmented cross-encryption is adjusted according to the motion direction coherence coefficient, realizing a dynamic key mechanism of one group at a time, one key per group, and one key per device. This ensures that the complete data group cannot be recovered if the key of any single device within the group is leaked. A chain encryption key is determined by the ciphertext hash value, the spatiotemporal topological hash value, and the preset initial encryption key, and secondary encryption is performed, so that the encryption chain is simultaneously constrained by both cryptographic hash and physical spatiotemporal characteristics. During decryption, the internal private network reconstructs the spatiotemporal topological fingerprint in reverse and performs double verification in conjunction with the verification credential, using the verification result as the determination condition for device access. By deeply binding encryption strength, key generation, and the physical and spatiotemporal motion state of the device, and using physical and spatiotemporal characteristics as an additional authentication factor in addition to cryptographic authentication, this approach not only avoids the overall data leakage caused by the leakage of a static single key, but also identifies data tampering, undetectable replay, and fake data injection behaviors. It forms an effective security audit isolation between the Internet and the internal private network, improving the security of heterogeneous IoT devices accessing the internal private network.

[0064] In Embodiment 2, step 100, the step of acquiring the m data groups, includes:

[0065] Step 111: Determine the spatiotemporal correlation distance between any two IoT devices among the n IoT devices based on the data acquisition timestamps, instantaneous velocity, and instantaneous acceleration of the n IoT devices.

[0066] Spatiotemporal correlation distance is a quantitative indicator used to characterize the degree of temporal and spatial correlation between any two IoT devices.

[0067] Step 112: Obtain preprocessed data from n IoT devices; perform fuzzy clustering on the preprocessed data based on the spatiotemporal correlation distance to obtain the spatiotemporal membership of n IoT devices to m data groups;

[0068] In this context, preprocessed data refers to standardized data obtained by sequentially performing format standardization, data cleaning, and data labeling on heterogeneous raw data uploaded by n IoT devices. Fuzzy clustering refers to the process of associating the preprocessed data from the n IoT devices with each data group based on spatiotemporal correlation distance by iteratively solving for cluster centers and spatiotemporal membership degrees. Spatiotemporal membership degree is a quantitative indicator used to characterize the degree to which the preprocessed data from the n IoT devices belongs to a certain data group.

[0069] In this embodiment, unlike traditional probabilistic measures, spatiotemporal membership does not require the sum of the membership degrees of each group to be 1, nor does it possess probabilistic additivity. Spatiotemporal membership is a degree of membership in the sense of a fuzzy set, reflecting the relative distance between data points and cluster centers in the spatiotemporal feature space: the greater the spatiotemporal membership of an IoT device to a data group, the higher the degree of synergy between the IoT device's data and the core device corresponding to that data group in both time and space dimensions; otherwise, the lower the correlation between the IoT device's data and that data group.

[0070] In this embodiment, format standardization refers to performing a unified format conversion on heterogeneous data uploaded from different IoT devices to eliminate data format inconsistencies caused by device differences. The specific conversion formula is as follows:

[0071] Distd i =F format (Draw i Type i ),

[0072] Where i is the serial number of the IoT device, Distd i For the unified standard format data of the i-th IoT device, F format () represents a preset universal format conversion function, Draw iFor the raw data of the i-th IoT device, Type i This is the device type identifier for the i-th IoT device.

[0073] Data cleaning refers to the process of removing duplicate data, outliers, and environmental noise from a dataset in batches, while also performing differentiated optimizations for different data types: sensor time-series data is smoothed and denoised using a sliding window filtering algorithm to improve data accuracy; video stream data is filtered to remove redundant frames by extracting keyframes to reduce data volume and improve the efficiency of subsequent encryption operations.

[0074] Data tagging refers to binding a unique metadata tag to each piece of standard format data to achieve full data traceability management. The specific metadata structure is as follows:

[0075] Meta i ={ID i ,T i ,P i Type i Len i},

[0076] Where i is the serial number of the IoT device, Meta i The metadata tag corresponding to the data of the i-th IoT device, ID i T is the identifier of the i-th IoT device. i Let P be the data collection timestamp of the i-th IoT device. i Let Type be the three-dimensional spatial coordinates of the i-th IoT device. i Len is the device type identifier for the i-th IoT device. i Let be the length of the current data uploaded by the i-th IoT device.

[0077] After completing all the above preprocessing operations, we obtain standardized preprocessed multi-source data. Based on thresholds in both time and space dimensions, the preprocessed multi-source data is intelligently grouped, and all preprocessed multi-source data that meet the spatiotemporal correlation constraints are divided into the same dataset. The specific spatiotemporal correlation constraints are as follows:

[0078] |T i -T j |≤ΔT and‖P i -P j ||2≤ΔR,

[0079] Where i and j are the serial numbers of the IoT devices, T i and T j These are the data collection timestamps for the i-th and j-th IoT devices, respectively, where ΔT is a preset time threshold, and P... iand P j Let P be the three-dimensional spatial coordinates of the i-th IoT device and the j-th IoT device, respectively. i -P j ‖2 represents the Euclidean distance between the i-th and j-th IoT devices, and ΔR is a preset spatial threshold. Taking a security patrol scenario as an example, the preset time threshold can be set to 1 to 5 seconds, and the preset spatial threshold can be set to 10 to 50 meters to adapt to the aggregation requirements of device data collected in close proximity and short time.

[0080] In this embodiment, the fuzzy C-means clustering algorithm is used to perform fuzzy clustering on the preprocessed data in each dataset.

[0081] The formula for calculating spatiotemporal membership is:

[0082] ,

[0083] Where i is the serial number of the IoT device, u ki Let be the spatiotemporal membership degree of the i-th IoT device to the k-th data set, l be the sequence number of the cluster obtained after fuzzy clustering of the preprocessed data in each dataset, and m be the total number of clusters obtained after fuzzy clustering of the preprocessed data in each dataset. Let be the spatiotemporal correlation distance from the i-th IoT device to the cluster center of the k-th data group. Let q be the spatiotemporal correlation distance from the i-th IoT device to the cluster center of the l-th cluster group, and q be a preset fuzzy weighted index (preferably, q=2).

[0084] In this embodiment, the optimal cluster centers and spatiotemporal membership degrees are obtained by iteratively minimizing the objective function. The formula for calculating the objective function is as follows:

[0085] ,

[0086] Where J is the objective function value of fuzzy clustering, k is the sequence number of the data group, m is the total number of data groups, i is the sequence number of the IoT device, and n is the total number of IoT devices. Let be the fuzzy weighted spatiotemporal membership degree of the i-th IoT device to the k-th data group. Let be the spatiotemporal correlation distance from the i-th IoT device to the cluster center of the k-th data group.

[0087] Step 113: Based on the spatiotemporal membership degree and the preset membership degree threshold, divide the preprocessed data into m data groups.

[0088] Among them, the preset membership threshold refers to the pre-set critical value used to determine whether the pre-processed data of IoT devices should be classified into a certain data group.

[0089] This embodiment of the secure access method for internal private networks of IoT devices determines the spatiotemporal correlation distance between any two IoT devices based on data acquisition timestamps, instantaneous velocity, and instantaneous acceleration. Then, it performs spatiotemporal correlation and fuzzy clustering on the standardized data obtained after format standardization, data cleaning, and data labeling, quantifying the correlation between the data of each IoT device and each data group in the form of spatiotemporal membership. Data grouping is completed based on the spatiotemporal membership degree and a preset membership threshold. Replacing static spatiotemporal parameters with membership degree for fixed dual-threshold binary judgment improves the robustness and refinement of grouping, is compatible with scenarios involving a mixture of high-speed, low-speed, and static heterogeneous devices, and solves the problems of inconsistent access protocols and missing traceability information for heterogeneous devices through unified format standardization and metadata labeling. This provides a clean and standardized data foundation for subsequent dynamic key derivation and adaptive cross-encryption.

[0090] In Embodiment 3, step 111 includes:

[0091] Step 1111: Determine the time drift compensation factor between any two IoT devices among the n IoT devices based on the absolute difference of the data acquisition timestamps between any two IoT devices, the difference of the magnitude of the instantaneous velocity, and the maximum value of the instantaneous acceleration.

[0092] Among them, the time drift compensation factor refers to the dynamic compensation parameter used to correct the asynchronous deviation of the local clock of the device.

[0093] In this embodiment, the formula for calculating the time drift compensation factor is:

[0094] ,

[0095] Where, τ ij Let ΔT be the time drift compensation factor between the i-th IoT device and the j-th IoT device. ij Let be the absolute difference between the data collection timestamps of the i-th IoT device and the j-th IoT device. Let be the instantaneous speed of the i-th IoT device. Let be the modulus of the instantaneous velocity of the i-th IoT device. Let j be the instantaneous speed of the j-th IoT device. Let a be the magnitude of the instantaneous velocity of the j-th IoT device. i Let a be the instantaneous acceleration of the i-th IoT device. jLet ε be the instantaneous acceleration of the j-th IoT device, and ε1 be a preset, minimal constant used to prevent the denominator from being zero.

[0096] Step 1112: Determine the spatial neighborhood radius between any two IoT devices among the n IoT devices based on the preset base radius, the preset speed attenuation coefficient, the magnitude of the difference between the instantaneous speeds between any two IoT devices, and the sum of the magnitudes of the instantaneous speeds between any two IoT devices.

[0097] Among them, the spatial neighborhood radius refers to the spatial association determination radius that dynamically scales with the relative motion state of IoT devices.

[0098] In this embodiment, the formula for calculating the spatial neighborhood radius is:

[0099] ,

[0100] in, Let R be the spatial neighborhood radius between the i-th IoT device and the j-th IoT device. base The preset base radius is 50 meters (preferably for security scenarios), exp() is the exponential operation, and λ is the preset velocity decay coefficient (preferably, the value of λ ranges from 0.5 to 1.5). Let be the instantaneous speed of the i-th IoT device. Let be the modulus of the instantaneous velocity of the i-th IoT device. Let j be the instantaneous speed of the j-th IoT device. Let the instantaneous velocity of the j-th IoT device be the modulus. Let εi be the magnitude of the difference in instantaneous speed between the i-th IoT device and the j-th IoT device, and let ε2 be a preset, minimal constant used to prevent the denominator from being zero.

[0101] Step 1113: Determine the motion direction coherence coefficient between any two IoT devices among the n IoT devices based on the product of the inner product of the instantaneous velocities between any two IoT devices and the modulus of the instantaneous velocities between any two IoT devices.

[0102] In this embodiment, the formula for calculating the coherence coefficient in the motion direction is:

[0103] ,

[0104] Where, η ij Let be the motion direction coherence coefficient between the i-th IoT device and the j-th IoT device. Let be the instantaneous speed of the i-th IoT device. Let be the modulus of the instantaneous velocity of the i-th IoT device. Let j be the instantaneous speed of the j-th IoT device. Let the instantaneous velocity of the j-th IoT device be the modulus. Let be the inner product of the instantaneous velocities between the i-th IoT device and the j-th IoT device. ε3 is the product of the magnitudes of the instantaneous speeds between the i-th and j-th IoT devices, and ε3 is a preset, minimal constant used to prevent the denominator from being zero.

[0105] The motion direction coherence coefficient ranges from 0 to 1. When two IoT devices move in the same direction in coordination, the motion direction coherence coefficient approaches 1. When two IoT devices move in opposite directions or away from each other, the motion direction coherence coefficient approaches 0. This allows for the accurate distinction between effectively cooperating devices and neighboring devices that are geographically close but have no business relationship.

[0106] Step 1114: Based on the three-dimensional spatial coordinates of any two IoT devices, obtain the Euclidean distance between any two IoT devices;

[0107] Euclidean distance refers to the straight-line distance between the three-dimensional spatial coordinates of any two Internet of Things (IoT) devices.

[0108] In this embodiment, the formula for calculating the Euclidean distance is:

[0109] ,

[0110] Where, ||P i -P j ||2 represents the Euclidean distance between the i-th and j-th IoT devices, and P is the distance between them. i and P j Let x and x represent the three-dimensional spatial coordinates of the i-th and j-th IoT devices, respectively. i y i and z i Let x represent the position components of the i-th IoT device in the X, Y, and Z dimensions of the three-dimensional spatial coordinates. j y j and z j These are the position components of the j-th IoT device's three-dimensional spatial coordinates in the X, Y, and Z dimensions of the three-dimensional space.

[0111] Step 1115: Determine the spatiotemporal correlation distance between any two IoT devices among the n IoT devices based on the preset maximum allowable time window length, the time drift compensation factor, the Euclidean distance, the spatial neighborhood radius, and the motion direction coherence coefficient.

[0112] In this embodiment, the formula for calculating the spatiotemporal correlation distance is:

[0113] ,

[0114] in, τ represents the spatiotemporal distance between the i-th IoT device and the j-th IoT device; ij ΔT is the time drift compensation factor between the i-th IoT device and the j-th IoT device. max The maximum allowed time window length is preset; ||P i -P j ||2 represents the Euclidean distance between the i-th IoT device and the j-th IoT device; η is the spatial neighborhood radius between the i-th IoT device and the j-th IoT device; ij ω is the motion direction coherence coefficient between the i-th IoT device and the j-th IoT device; T and ω R These are the adaptive weighting factors corresponding to the time dimension and the adaptive weighting factors corresponding to the spatial dimension, ω, respectively. T +ω R =1, and ω T and ω R It can be dynamically adjusted according to the application scenario: in high-speed reconnaissance scenarios, the weight factor corresponding to the time dimension is increased to prioritize time synchronization; in static monitoring scenarios, the weight factor corresponding to the spatial dimension is increased to prioritize spatial aggregation.

[0115] The internal private network secure access method for IoT devices in this embodiment determines the time drift compensation factor based on the absolute difference of data acquisition timestamps, the difference of instantaneous velocity modulus, and the maximum value of instantaneous acceleration. This fundamentally solves the clock asynchrony problem caused by differences in hardware crystal oscillators and network transmission latency among heterogeneous devices. A dynamically expandable spatial neighborhood radius is determined by a preset base radius, a preset velocity attenuation coefficient, and relative velocity, enabling spatial association determination to adaptively adapt to the motion differences of high-speed, low-speed, and static devices. A motion direction coherence coefficient is introduced to endow spatiotemporal association determination with motion-coordinated business semantics, preventing the mis-aggregation of data from devices that are geographically close but have opposite motion trends and no business association. The time compensation error, dynamic spatial neighborhood radius, and motion coherence are weighted and coupled into a spatiotemporal association distance, realizing multi-dimensional association determination of spatiotemporal location, motion state, and cooperative semantics. This provides a precise and dynamically adaptable measurement basis for subsequent fuzzy clustering and grouping.

[0116] In Embodiment 4, step 113 includes:

[0117] When the spatiotemporal membership degree of any IoT device among the n IoT devices to the kth data group is not less than the preset membership degree threshold, the preprocessed data of any IoT device is assigned to the kth data group; when the spatiotemporal membership degree of any IoT device to all m data groups is less than the preset membership degree threshold, the preprocessed data of any IoT device is determined to be isolated noise data, and the isolated noise data is removed.

[0118] Isolated noise data refers to data that has no effective spatiotemporal correlation with any data set, and usually originates from sporadic interference signals or false signals maliciously forged by attackers.

[0119] In this embodiment, the preset membership threshold is preferably in the range of 0.6 to 0.8. When the spatiotemporal membership degree of an IoT device to the k-th data group is not less than the membership threshold, it is determined that the IoT device and other IoT devices corresponding to the k-th data group are in a state of simultaneous, same-domain, and collaborative operation, and its preprocessed data is assigned to the k-th data group; when the spatiotemporal membership degree of an IoT device to all m data groups is less than the membership threshold, it is determined that the preprocessed data of the IoT device is isolated noise data or false interference data, and it is directly removed to filter malicious forged signals from the source.

[0120] The secure access method for internal private networks of IoT devices in this embodiment completes the division and elimination of data by comparing the spatiotemporal membership degree with the preset membership degree threshold. On the one hand, it accurately aggregates the data of collaborative IoT devices into the same data group in the form of membership degree, avoiding the accidental elimination of legitimate collaborative data. On the other hand, it filters isolated noise data and fake signals before the encryption process, avoiding noise data and interference data from mixing into the effective ciphertext system and causing batch decryption failure, thereby improving the purity and grouping accuracy of the underlying data. At the same time, it enables the internal private network to perceive the abnormal operating status of the device in real time based on the spatiotemporal membership status of the data.

[0121] In Embodiment 5, step 200, the step of determining the spatiotemporal topological fingerprint, includes:

[0122] Step 211: Obtain the spatial centroid corresponding to the kth data group based on the arithmetic mean of the three-dimensional spatial position coordinates of the r IoT devices corresponding to the kth data group.

[0123] Among them, the spatial centroid is a quantitative indicator used to characterize the core spatial location of each data set.

[0124] In this embodiment, the formula for calculating the spatial centroid is:

[0125] ,

[0126] Where k is the sequence number of the data group, Γ k Let r be the spatial centroid in the spatiotemporal topological fingerprint corresponding to the k-th data group, r be the serial number of the IoT device corresponding to the k-th data group, i be the serial number of the IoT device, and P be the spatial centroid in the spatiotemporal topological fingerprint corresponding to the k-th data group. i Let be the three-dimensional spatial coordinates of the i-th IoT device.

[0127] Step 212: Based on the motion direction coherence coefficient between any two IoT devices among the r IoT devices corresponding to the kth data group, obtain the average motion coherence corresponding to the kth data group.

[0128] Among them, average motion coherence is a quantitative indicator used to characterize the overall motion coordination of IoT devices corresponding to each data set.

[0129] In this embodiment, the formula for calculating the average motion coherence is:

[0130]

[0131] in, η represents the average motion coherence in the spatiotemporal topological fingerprint corresponding to the k-th data group; r is the serial number of the IoT device corresponding to the k-th data group; i and j are both serial numbers of the IoT device, and i ≠ j; η ij Let be the motion direction coherence coefficient between the i-th IoT device and the j-th IoT device.

[0132] Step 213: Obtain the spatial dispersion of the kth data group based on the arithmetic mean of the squared Euclidean distances between the three-dimensional spatial coordinates of the r IoT devices corresponding to the kth data group and the spatial centroid.

[0133] Spatial dispersion is a quantitative indicator used to characterize the spatial clustering density of IoT devices corresponding to each data set.

[0134] In this embodiment, the formula for calculating spatial dispersion is:

[0135] ,

[0136] Where, σ k Let r be the spatial dispersion of the k-th data set, r be the serial number of the IoT device corresponding to the k-th data set, i be the serial number of the IoT device, and P be the spatial dispersion of the k-th data set. i Let Γ be the three-dimensional spatial coordinates of the i-th IoT device. k Let the spatial centroid be the spatiotemporal topological fingerprint corresponding to the k-th data group. Let be the Euclidean distance between the three-dimensional spatial coordinates of the i-th IoT device and the spatial centroid in the spatiotemporal topological fingerprint corresponding to the k-th data set.

[0137] Step 214: Based on the data acquisition timestamps of the r IoT devices corresponding to the kth data group, determine the data acquisition start time and data acquisition end time corresponding to the kth data group; and integrate the spatial centroid, the average motion coherence, the spatial dispersion, the data acquisition start time and the data acquisition end time to obtain the spatiotemporal topological fingerprint corresponding to the kth data group.

[0138] The data collection start time refers to the minimum data collection timestamp among all IoT devices corresponding to each data group. The data collection end time refers to the maximum data collection timestamp among all IoT devices corresponding to each data group.

[0139] In this embodiment, the expression for the spatiotemporal topological fingerprint is:

[0140] ,

[0141] Where, Φ k Γ is the standard spatiotemporal topological fingerprint stored during encryption corresponding to the k-th data group. k Let the spatial centroid be the spatiotemporal topological fingerprint corresponding to the k-th data group. σ represents the average motion coherence in the spatiotemporal topological fingerprint corresponding to the k-th data set. k T represents the spatial dispersion of the k-th data set. start T represents the start time of data collection. end This is the end time of data collection.

[0142] The internal private network security access method for IoT devices in this embodiment aggregates the spatial distribution, motion coordination, and time interval characteristics of each IoT device corresponding to each data group into a unique spatiotemporal topology fingerprint, so that each data group has a unique, dynamically variable feature identifier that is strongly bound to the physical scene. This spatiotemporal topology fingerprint serves as the core foundation for subsequent dynamic key derivation, strongly binding the key to the physical location and motion state of the device, and also serves as the benchmark for spatiotemporal consistency reverse verification during the decryption stage, providing an unforgeable basis for identifying data tampering, imperceptible replay, and fake data injection.

[0143] In Example 6, step 200, the step of obtaining the intra-group cross-encrypted ciphertext after splicing the r IoT devices corresponding to the k-th data group, includes:

[0144] Step 221: Based on the comparison results of the motion direction coherence coefficients between r IoT devices and the preset coherence threshold, and the comparison results of the spatial dispersion and the preset dispersion threshold, determine the cross factor corresponding to the kth data group.

[0145] Here, the cross-factor refers to a dynamic adjustment parameter used to adaptively control the encryption cross-strength within a data group. The dynamic cross-factor matrix formed by this parameter can match the corresponding encryption level based on the motion coordination and spatial dispersion of the IoT devices corresponding to the data group. The preset coherence threshold is a pre-set critical value used to determine whether two IoT devices are in a state of high coherence cooperative motion. The preset dispersion threshold is a pre-set critical value for the spatial dispersion of the data group.

[0146] In this embodiment, the formula for calculating the crossover factor is:

[0147] ,

[0148] Where, m ij η is the cross factor between the i-th IoT device and the j-th IoT device corresponding to the k-th data group. ij Let θ be the motion direction coherence coefficient between the i-th IoT device and the j-th IoT device. η The preset coherence threshold (preferably, θ) η =0.7), α is the preset intensity scaling factor (ranging from 0.5 to 1.0), σ k γ represents the spatial dispersion of the k-th data set. max This is the preset dispersion threshold.

[0149] In this embodiment, when the motion direction coherence coefficient between two IoT devices is not less than a preset coherence threshold, they are determined to be highly coherent, the cross factor is set to 1, and full mesh cross encryption is enabled to ensure the security of highly collaborative business scenarios. When the motion direction coherence coefficient is less than the preset coherence threshold, they are determined to be low coherent, and the cross factor is the product of the intensity scaling factor and the motion direction coherence coefficient, and partial weighted cross encryption is performed to reduce the computational load of low-computing-power wearable devices and edge terminals, and to achieve a dynamic balance between security and computing power. When the spatial dispersion of the data group is greater than the preset dispersion threshold, the cross factor is set to 0, and cross encryption is prohibited to prevent noisy data and interference data from being mixed into the effective ciphertext system and causing batch decryption failure.

[0150] Step 222: Obtain the weighted hybrid key based on the cross-encryption base key of any two IoT devices among the r IoT devices and the cross factor;

[0151] The weighted hybrid key refers to the key used to actually perform fragmented encryption, which is derived from the cross-encryption base key of any two IoT devices and the cross factor between them.

[0152] In this embodiment, the formula for calculating the weighted mixing key is:

[0153] ,

[0154] in, The key is the weighted mixing key between the i-th IoT device and the j-th IoT device corresponding to the k-th data group. KDF is a preset key derivation function. k,j,base and Key k,i,base These are the cross-encryption base keys for the j-th IoT device and the i-th IoT device, respectively, and m ij It represents the cross-factor between the i-th IoT device and the j-th IoT device corresponding to the k-th data group.

[0155] Step 223: Divide the preprocessed data of any one of the r IoT devices corresponding to the k-th data group into equal parts to obtain each data fragment of any IoT device; use the weighted mixing key to encrypt each data fragment to obtain the concatenated intra-group cross-encrypted ciphertext of any one of the r IoT devices corresponding to the k-th data group.

[0156] Equal partitioning refers to the process of dividing the complete data block of a single IoT device corresponding to a data group into an equal number of data fragments according to the total number of IoT devices corresponding to the data group.

[0157] In this embodiment, the data fragment splicing structure is as follows:

[0158] D k,i =d k,i,1 ‖d k,i,2 ‖...‖d k,i,a

[0159] Among them, D k,i For the preprocessed complete data block of the i-th IoT device corresponding to the k-th data group, d k,i,a Let be the a-th data fragment of the i-th IoT device corresponding to the k-th data group, where a is the total number of data fragments of the i-th IoT device corresponding to the k-th data group, and ‖ is the data splicing identifier.

[0160] In this embodiment, the formula for calculating ciphertext fragmentation is:

[0161]

[0162] Among them, C k,i,a Let E be the encrypted ciphertext fragment obtained by cross-encrypting the a-th data fragment of the i-th IoT device corresponding to the k-th data group, where E is a symmetric encryption algorithm such as AES-256. d is the weighted mixing key between the i-th IoT device and the j-th IoT device corresponding to the k-th data group. k,i,a This refers to the a-th data fragment of the i-th IoT device corresponding to the k-th data group.

[0163] The ciphertext fragments of the i-th IoT device corresponding to the k-th data group are sequentially concatenated to obtain the complete single-device ciphertext, which is the concatenated intra-group cross-encryption ciphertext. The specific expression is:

[0164] C k,i =C k,i,1 ||C k,i,2 C k,i,a ,

[0165] Among them, C k,i C is the intra-group cross-encrypted ciphertext of the i-th IoT device corresponding to the k-th data group. k,i,a The encrypted ciphertext fragment is obtained by cross-encrypting the a-th data fragment of the i-th IoT device corresponding to the k-th data group, where a is the total number of data fragments of the i-th IoT device corresponding to the k-th data group, and || is the data splicing identifier.

[0166] As another implementation method, a unique encryption key is generated for each IoT device corresponding to the k-th data group, with the specific expression as follows:

[0167] Key k,i =KDF(ID i ||T k,i Nonce k,i )

[0168] Among them, Key k,i The key is the unique encryption key for the i-th IoT device corresponding to the k-th data group, KDF is the preset key derivation function, and ID is the key. i T is the identifier of the i-th IoT device. k,i Nonce is the data acquisition timestamp of the i-th IoT device corresponding to the k-th data group. k,i This is the random value for the i-th IoT device corresponding to the k-th data group.

[0169] The formula for calculating ciphertext fragmentation can also be:

[0170]

[0171] Among them, Ck,i,a The encrypted ciphertext fragment is obtained by cross-encrypting the a-th data fragment of the i-th IoT device corresponding to the k-th data group, where E is a symmetric encryption algorithm such as AES-256, and Key is the key. k,i d is the unique encryption key for the i-th IoT device corresponding to the k-th data group. k,i,a This refers to the a-th data fragment of the i-th IoT device corresponding to the k-th data group.

[0172] The ciphertext fragments of the i-th IoT device corresponding to the k-th data group are sequentially concatenated to obtain the complete single-device ciphertext, which is the concatenated intra-group cross-encrypted ciphertext of the i-th IoT device corresponding to the k-th data group. The specific expression is as follows:

[0173] C k,i =C k,i,1 ||C k,i,2 C k,i,a ,

[0174] Among them, C k,i C is the intra-group cross-encrypted ciphertext of the i-th IoT device corresponding to the k-th data group. k,i,a The encrypted ciphertext fragment is obtained by cross-encrypting the a-th data fragment of the i-th IoT device corresponding to the k-th data group, where a is the total number of data fragments of the i-th IoT device corresponding to the k-th data group, and || is the data splicing identifier.

[0175] Step 224: Based on the concatenated intra-group cross-encrypted ciphertext of all IoT devices in the r IoT devices, obtain the concatenated intra-group cross-encrypted ciphertext of the r IoT devices corresponding to the kth data group.

[0176] In this embodiment, the expression for the intra-group cross-encrypted ciphertext of the r IoT devices corresponding to the k-th data group is:

[0177] C k,cross ={C k,1 C k,2 ,...C k,r}

[0178] Among them, C k,cross C is the intra-group cross-encrypted ciphertext of the concatenated data from r IoT devices corresponding to the k-th data group. k,r This is the intra-group cross-encrypted ciphertext of the r-th IoT device corresponding to the k-th data group.

[0179] The internal private network secure access method for IoT devices in this embodiment determines the cross-factor based on motion coordination and spatial aggregation, enabling adaptive switching between three encryption strengths: full mesh cross-encryption, partial weighted cross-encryption, and cross-encryption prohibited. This ensures precise matching between encryption strength and the coordination of IoT devices, balancing encryption security with the computational efficiency requirements of heterogeneous IoT devices with uneven computing power. Segmented encryption is completed by using the cross-encryption base key of any two IoT devices and the cross-factor-derived weighted hybrid key. Finally, the ciphertext segments are sequentially concatenated to obtain the cross-encrypted ciphertext within the group. Each IoT device's ciphertext contains data segments encrypted with the keys of other IoT devices corresponding to that data group. To completely decrypt a single data group, it is necessary to obtain the keys of all IoT devices corresponding to that data group, completely avoiding the problem of overall data leakage caused by the leakage of a single key.

[0180] In Example 7, step 400, the step of determining the chain encryption key corresponding to the k-th data group, includes:

[0181] When k equals 1, the ciphertext hash value, the spatiotemporal topology hash value, the preset initial vector, and the random salt value corresponding to the first data group are concatenated to obtain the chain encryption key corresponding to the first data group. When k is greater than or equal to 2, the data acquisition time interval between the kth data group and the (k-1)th data group is determined based on the data acquisition start time and the data acquisition end time corresponding to the (k-1)th data group. The ciphertext hash value, the spatiotemporal topology hash value, the chain encryption key, the data acquisition time interval, and the random salt value corresponding to the kth data group are concatenated to obtain the chain encryption key corresponding to the kth data group.

[0182] The preset initialization vector refers to the pre-defined initial parameters used to derive the chained encryption key for the first data group. The random salt value is a randomly generated value for each data group, used to resist rainbow table attacks. The data acquisition time interval refers to the interval between the data acquisition times of two adjacent data groups, used to ensure the temporal continuity between data groups.

[0183] In this embodiment, the formula for calculating the chain encryption key corresponding to the first data group is:

[0184] ,

[0185] in, Here, is the chained encryption key corresponding to the first data block, KDF is the preset key derivation function, and H1 is the ciphertext hash value corresponding to the first data block. is the spatiotemporal topological hash value corresponding to the first data group, IV is the preset initial vector, and Salt1 is the random salt value corresponding to the first data group.

[0186] The formula for calculating the chain encryption key corresponding to the kth data group is:

[0187] ,

[0188] in, Let H be the chained encryption key corresponding to the k-th data block, and KDF be the preset key derivation function. k This is the ciphertext hash value corresponding to the k-th data group. This is the spatiotemporal topological hash value corresponding to the k-th data group. Let ΔT be the chain encryption key corresponding to the (k-1)th data group. k-1,k Salt represents the data acquisition time interval between the k-th data group and the (k-1)-th data group. k This is the random salt value corresponding to the k-th data group.

[0189] Where, ΔT k-1,k The calculation formula is:

[0190] ΔT k-1,k =|T start,k -T end,k-1 |,

[0191] Among them, T start,k T represents the start time of data collection for the k-th data group. end,k-1 This is the data collection end time corresponding to the (k-1)th data group.

[0192] As another implementation, the chained encryption key can also be derived step-by-step from the ciphertext hash value, the chained encryption key of the previous data group, and the random salt value, and only the hash digest of the chained encryption key is used as the verification credential. The specific calculation formulas are as follows:

[0193] ,

[0194] .

[0195] The internal private network security access method for IoT devices in this embodiment uses a hierarchical derivation mechanism of chained encryption keys to constrain cryptographic hashes and physical spatiotemporal characteristics onto the same encryption chain. The key of each subsequent data group depends on the key of the previous data group, the ciphertext hash value of the current data group, the spatiotemporal topology hash value, and the data acquisition time interval of adjacent data groups. This ensures that if any data group is tampered with or lost, its ciphertext hash value will be abnormal, and the chained encryption keys of all subsequent data groups will be unable to be derived normally. This accurately identifies tampering behavior and ensures the integrity of the entire batch of multi-source data. At the same time, since the chained keys also depend on the physical spatiotemporal state of the front-end devices, spatiotemporal replay attacks are avoided, and rainbow table attacks are resisted through independent random salt values ​​for each data group, achieving a dual binding of data security and physical scene security.

[0196] In embodiment eight, an internal private network security access device 30 for IoT devices is provided, such as... Figure 3 As shown, it includes:

[0197] The parameter acquisition module is used to acquire the motion direction coherence coefficient between any two IoT devices among n IoT devices, m data groups of the n IoT devices, and the identifier, data acquisition timestamp, three-dimensional spatial position coordinates, instantaneous velocity and instantaneous acceleration of the n IoT devices, where n and m are both positive integers greater than 1;

[0198] The intra-group cross-encryption ciphertext acquisition module is used to determine the spatiotemporal topological fingerprint corresponding to the k-th data group based on the three-dimensional spatial coordinates of the r IoT devices corresponding to the k-th data group, the motion direction coherence coefficient between the r IoT devices, and the data acquisition timestamps of the r IoT devices; determine the cross-encryption base key for the r IoT devices corresponding to the k-th data group based on the identifiers of the r IoT devices, random numbers, the spatiotemporal topological fingerprint corresponding to the k-th data group, and the spatiotemporal membership degree of the r IoT devices to the k-th data group; and perform fragmented cross-encryption on the k-th data group based on the cross-encryption base key and the motion direction coherence coefficient between the r IoT devices to obtain the concatenated intra-group cross-encryption ciphertext of the r IoT devices corresponding to the k-th data group, where k=1,2,...,m, and r is a positive integer greater than 1 and r<n;

[0199] The inter-group cross-encryption ciphertext acquisition module is used to perform hash operations on the concatenated intra-group cross-encryption ciphertext and the spatiotemporal topological fingerprint respectively to obtain the ciphertext hash value and spatiotemporal topological hash value corresponding to the k-th data group; determine the chain encryption key corresponding to the k-th data group based on the ciphertext hash value, the spatiotemporal topological hash value and the preset initial encryption key; use the chain encryption key to perform secondary encryption on the concatenated intra-group cross-encryption ciphertext to obtain the concatenated inter-group cross-encryption ciphertext corresponding to the k-th data group; and obtain the verification credential based on the chain encryption key and the spatiotemporal topological fingerprint.

[0200] The data decryption and device access judgment module is used to send the inter-group cross-encrypted ciphertexts corresponding to m data groups and the verification credentials corresponding to m data groups to the internal private network. The internal private network uses the chained encryption key to decrypt the inter-group cross-encrypted ciphertexts to obtain decrypted data. Based on the decrypted data, the spatiotemporal topology fingerprint is reverse-reconstructed to obtain the reconstructed spatiotemporal topology fingerprint. When the deviation between the reconstructed spatiotemporal topology fingerprint and the original spatiotemporal topology fingerprint is not greater than a preset deviation threshold, and the chained encryption key passes the verification of the verification credentials, n IoT devices are allowed to access the internal private network.

[0201] Optionally, the above parameter acquisition module includes:

[0202] The spatiotemporal correlation distance determination module is used to determine the spatiotemporal correlation distance between any two IoT devices among the n IoT devices based on the data acquisition timestamps, instantaneous velocities, and instantaneous accelerations of the n IoT devices.

[0203] The spatiotemporal membership acquisition module is used to acquire preprocessed data from n IoT devices; and to perform fuzzy clustering on the preprocessed data based on the spatiotemporal association distance to obtain the spatiotemporal membership of the n IoT devices to the m data groups.

[0204] The data group acquisition module is used to divide the preprocessed data into m data groups based on the spatiotemporal membership degree and a preset membership degree threshold.

[0205] Optionally, the above-mentioned spatiotemporal correlation distance determination module includes:

[0206] The time drift compensation factor determination module is used to determine the time drift compensation factor between any two IoT devices among the n IoT devices based on the difference of the data acquisition timestamps between any two IoT devices, the difference of the magnitude of the instantaneous velocity, and the maximum value of the instantaneous acceleration.

[0207] The spatial neighborhood radius determination module is used to determine the spatial neighborhood radius between any two IoT devices among n IoT devices based on a preset base radius, a preset velocity attenuation coefficient, the magnitude of the difference between the instantaneous velocities between any two IoT devices, and the sum of the magnitudes of the instantaneous velocities between any two IoT devices.

[0208] The motion direction coherence coefficient determination module is used to determine the motion direction coherence coefficient between any two IoT devices among n IoT devices based on the product of the inner product of the instantaneous velocities between any two IoT devices and the modulus of the instantaneous velocities between any two IoT devices.

[0209] The Euclidean distance acquisition module is used to obtain the Euclidean distance between any two IoT devices based on their three-dimensional spatial coordinates.

[0210] The spatiotemporal correlation distance calculation module is used to determine the spatiotemporal correlation distance between any two IoT devices among n IoT devices based on the length of the preset maximum allowable time window, the time drift compensation factor, the Euclidean distance, the spatial neighborhood radius, and the motion direction coherence coefficient.

[0211] Optionally, the above data acquisition module includes:

[0212] The data group partitioning module is used to assign the preprocessed data of any IoT device to the kth data group when the spatiotemporal membership degree of any IoT device to the kth data group is not less than the preset membership degree threshold; and to determine that the preprocessed data of any IoT device is isolated noise data and remove the isolated noise data when the spatiotemporal membership degree of any IoT device to all m data groups is less than the preset membership degree threshold.

[0213] Optionally, the above-mentioned intra-group cross-encryption ciphertext acquisition module includes:

[0214] The spatial centroid acquisition module is used to obtain the spatial centroid corresponding to the kth data group based on the arithmetic mean of the three-dimensional spatial position coordinates of the r IoT devices corresponding to the kth data group.

[0215] The average motion coherence acquisition module is used to obtain the average motion coherence corresponding to the kth data group based on the motion direction coherence coefficient between any two IoT devices among the r IoT devices corresponding to the kth data group.

[0216] The spatial dispersion acquisition module is used to obtain the spatial dispersion corresponding to the kth data group based on the arithmetic mean of the squared Euclidean distance between the three-dimensional spatial position coordinates of the r IoT devices corresponding to the kth data group and the spatial centroid.

[0217] The spatiotemporal topological fingerprint acquisition module is used to determine the data acquisition start time and data acquisition end time corresponding to the kth data group based on the data acquisition timestamps of r IoT devices corresponding to the kth data group; and to integrate the spatial centroid, the average motion coherence, the spatial dispersion, the data acquisition start time and the data acquisition end time to obtain the spatiotemporal topological fingerprint corresponding to the kth data group.

[0218] Optionally, the above-mentioned intra-group cross-encryption ciphertext acquisition module also includes:

[0219] The cross factor determination module is used to determine the cross factor corresponding to the kth data group based on the comparison results of the motion direction coherence coefficient between r IoT devices and a preset coherence threshold, and the comparison results of the spatial dispersion and a preset dispersion threshold.

[0220] The weighted hybrid key acquisition module is used to obtain a weighted hybrid key based on the cross-encryption base key of any two IoT devices among r IoT devices and the cross factor;

[0221] The intra-group cross-encryption ciphertext splicing module is used to equally divide the preprocessed data of any one of the r IoT devices corresponding to the k-th data group to obtain each data fragment of any IoT device; and to encrypt each of the data fragments using the weighted mixing key to obtain the spliced ​​intra-group cross-encryption ciphertext of any one of the r IoT devices corresponding to the k-th data group.

[0222] The intra-group cross-encryption ciphertext determination module is used to obtain the intra-group cross-encryption ciphertext of the r IoT devices corresponding to the k-th data group based on the intra-group cross-encryption ciphertext of all IoT devices in r IoT devices.

[0223] Optionally, the aforementioned inter-group cross-encryption ciphertext acquisition module includes:

[0224] The chain encryption key acquisition module is used to, when k equals 1, concatenate the ciphertext hash value corresponding to the first data group, the spatiotemporal topology hash value corresponding to the first data group, the preset initial vector, and the random salt value corresponding to the first data group to obtain the chain encryption key corresponding to the first data group; when k is greater than or equal to 2, determine the data acquisition time interval between the kth data group and the (k-1)th data group based on the data acquisition start time corresponding to the kth data group and the data acquisition end time corresponding to the (k-1)th data group; and concatenate the ciphertext hash value corresponding to the kth data group, the spatiotemporal topology hash value corresponding to the kth data group, the chain encryption key corresponding to the (k-1)th data group, the data acquisition time interval, and the random salt value corresponding to the kth data group to obtain the chain encryption key corresponding to the kth data group.

[0225] It should be noted that the information interaction and execution process between the above modules are based on the same concept as the method embodiments of the present invention. For details on their specific functions and technical effects, please refer to the method embodiments section, which will not be repeated here.

[0226] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0227] In embodiment nine, a computer device is provided, such as Figure 4 As shown, it includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the secure access method for the internal private network of the Internet of Things device described in any of the embodiments one to seven above, for example... Figure 2 Steps 100 to 400 shown are not repeated here to avoid repetition.

[0228] In Embodiment 10, a computer-readable storage medium is provided, on which a computer program is stored. When executed by a processor, the computer program implements the secure access method for an internal private network of an IoT device described in any of Embodiments 1 to 7 above, for example... Figure 2 Steps 100 to 400 shown are not repeated here to avoid repetition.

[0229] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0230] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0231] While specific embodiments of the invention have been described in detail by way of example, those skilled in the art should understand that the examples are for illustrative purposes only and not intended to limit the scope of the invention. Those skilled in the art should also understand that various modifications can be made to the embodiments without departing from the scope and spirit of the invention. The scope of this invention is defined by the appended claims.

Claims

1. A method for secure access to an internal private network for IoT devices, characterized in that, The secure access method for the internal private network of the IoT device includes: Step 100: Obtain the motion direction coherence coefficient between any two IoT devices among the n IoT devices, m data groups of the n IoT devices, and the identifier, data acquisition timestamp, three-dimensional spatial position coordinates, instantaneous velocity and instantaneous acceleration of the n IoT devices, where n and m are both positive integers greater than 1; Step 200: Based on the three-dimensional spatial coordinates of the r IoT devices corresponding to the k-th data group, the motion direction coherence coefficient between the r IoT devices, and the data acquisition timestamps of the r IoT devices, determine the spatiotemporal topological fingerprint corresponding to the k-th data group; based on the identifiers of the r IoT devices, random numbers, the spatiotemporal topological fingerprint corresponding to the k-th data group, and the spatiotemporal membership degree of the r IoT devices to the k-th data group, determine the cross-encryption base key for the r IoT devices corresponding to the k-th data group; based on the cross-encryption base key and the motion direction coherence coefficient between the r IoT devices, perform fragmented cross-encryption on the k-th data group to obtain the concatenated intra-group cross-encrypted ciphertext of the r IoT devices corresponding to the k-th data group, where k=1,2,...,m, and r is a positive integer greater than 1 and r<n; Step 300: Perform hash operations on the concatenated intra-group cross-encrypted ciphertext and the spatiotemporal topological fingerprint respectively to obtain the ciphertext hash value and spatiotemporal topological hash value corresponding to the k-th data group; determine the chain encryption key corresponding to the k-th data group based on the ciphertext hash value, the spatiotemporal topological hash value, and the preset initial encryption key; use the chain encryption key to perform secondary encryption on the concatenated intra-group cross-encrypted ciphertext to obtain the concatenated inter-group cross-encrypted ciphertext corresponding to the k-th data group; obtain the verification credential based on the chain encryption key and the spatiotemporal topological fingerprint; Step 400: The inter-group cross-encrypted ciphertexts corresponding to m data groups and the verification credentials corresponding to m data groups are sent to the internal private network. The internal private network uses the chain encryption key to decrypt the inter-group cross-encrypted ciphertexts to obtain decrypted data. Based on the decrypted data, the spatiotemporal topology fingerprint is reverse-reconstructed to obtain the reconstructed spatiotemporal topology fingerprint. When the deviation between the reconstructed spatiotemporal topology fingerprint and the original spatiotemporal topology fingerprint is not greater than a preset deviation threshold, and the chain encryption key passes the verification of the verification credentials, n IoT devices are allowed to access the internal private network.

2. The method for secure access to an internal private network for IoT devices according to claim 1, characterized in that, In step 100, the steps for obtaining the m data groups include: Step 111: Determine the spatiotemporal correlation distance between any two IoT devices among the n IoT devices based on the data acquisition timestamps, instantaneous velocity, and instantaneous acceleration of the n IoT devices. Step 112: Obtain preprocessed data from n IoT devices; perform fuzzy clustering on the preprocessed data based on the spatiotemporal correlation distance to obtain the spatiotemporal membership of n IoT devices to m data groups; Step 113: Based on the spatiotemporal membership degree and the preset membership degree threshold, divide the preprocessed data into m data groups.

3. The method for secure access to an internal private network for IoT devices according to claim 2, characterized in that, Step 111 includes: Step 1111: Determine the time drift compensation factor between any two IoT devices among the n IoT devices based on the absolute difference of the data acquisition timestamps between any two IoT devices, the difference of the magnitude of the instantaneous velocity, and the maximum value of the instantaneous acceleration. Step 1112: Determine the spatial neighborhood radius between any two IoT devices among the n IoT devices based on the preset base radius, the preset speed attenuation coefficient, the magnitude of the difference between the instantaneous speeds between any two IoT devices, and the sum of the magnitudes of the instantaneous speeds between any two IoT devices. Step 1113: Determine the motion direction coherence coefficient between any two IoT devices among the n IoT devices based on the product of the inner product of the instantaneous velocities between any two IoT devices and the modulus of the instantaneous velocities between any two IoT devices. Step 1114: Based on the three-dimensional spatial coordinates of any two IoT devices, obtain the Euclidean distance between any two IoT devices; Step 1115: Determine the spatiotemporal correlation distance between any two IoT devices among the n IoT devices based on the preset maximum allowable time window length, the time drift compensation factor, the Euclidean distance, the spatial neighborhood radius, and the motion direction coherence coefficient.

4. The method for secure access to an internal private network for IoT devices according to claim 2, characterized in that, Step 113 includes: When the spatiotemporal membership degree of any IoT device among the n IoT devices to the kth data group is not less than the preset membership degree threshold, the preprocessed data of any IoT device is assigned to the kth data group; when the spatiotemporal membership degree of any IoT device to all m data groups is less than the preset membership degree threshold, the preprocessed data of any IoT device is determined to be isolated noise data, and the isolated noise data is removed.

5. The method for secure access to an internal private network for IoT devices according to claim 1, characterized in that, In step 200, the determination step of the spatiotemporal topological fingerprint includes: Step 211: Obtain the spatial centroid corresponding to the kth data group based on the arithmetic mean of the three-dimensional spatial position coordinates of the r IoT devices corresponding to the kth data group. Step 212: Based on the motion direction coherence coefficient between any two IoT devices among the r IoT devices corresponding to the kth data group, obtain the average motion coherence corresponding to the kth data group. Step 213: Obtain the spatial dispersion of the kth data group based on the arithmetic mean of the squared Euclidean distances between the three-dimensional spatial coordinates of the r IoT devices corresponding to the kth data group and the spatial centroid. Step 214: Based on the data acquisition timestamps of the r IoT devices corresponding to the kth data group, determine the data acquisition start time and data acquisition end time corresponding to the kth data group; and integrate the spatial centroid, the average motion coherence, the spatial dispersion, the data acquisition start time and the data acquisition end time to obtain the spatiotemporal topological fingerprint corresponding to the kth data group.

6. The method for secure access to an internal private network for IoT devices according to claim 1, characterized in that, In step 200, the steps for obtaining the intra-group cross-encrypted ciphertext of the r IoT devices corresponding to the k-th data group include: Step 221: Based on the comparison results of the motion direction coherence coefficients between r IoT devices and the preset coherence threshold, and the comparison results of the spatial dispersion and the preset dispersion threshold, determine the cross factor corresponding to the kth data group. Step 222: Obtain the weighted hybrid key based on the cross-encryption base key of any two IoT devices among the r IoT devices and the cross factor; Step 223: Divide the preprocessed data of any one of the r IoT devices corresponding to the k-th data group into equal parts to obtain each data fragment of any IoT device; use the weighted mixing key to encrypt each data fragment to obtain the concatenated intra-group cross-encrypted ciphertext of any one of the r IoT devices corresponding to the k-th data group. Step 224: Based on the concatenated intra-group cross-encrypted ciphertext of all IoT devices in the r IoT devices, obtain the concatenated intra-group cross-encrypted ciphertext of the r IoT devices corresponding to the kth data group.

7. The method for secure access to an internal private network for IoT devices according to claim 1, characterized in that, In step 300, the steps for determining the chain encryption key corresponding to the k-th data group include: When k equals 1, the ciphertext hash value, the spatiotemporal topology hash value, the preset initial vector, and the random salt value corresponding to the first data group are concatenated to obtain the chain encryption key corresponding to the first data group. When k is greater than or equal to 2, the data acquisition time interval between the kth data group and the (k-1)th data group is determined based on the data acquisition start time and the data acquisition end time corresponding to the (k-1)th data group. The ciphertext hash value, the spatiotemporal topology hash value, the chain encryption key, the data acquisition time interval, and the random salt value corresponding to the kth data group are concatenated to obtain the chain encryption key corresponding to the kth data group.

8. A secure access device for an internal private network of an Internet of Things (IoT) device, characterized in that, The internal private network security access device for the IoT device includes: The parameter acquisition module is used to acquire the motion direction coherence coefficient between any two IoT devices among n IoT devices, m data groups of the n IoT devices, and the identifier, data acquisition timestamp, three-dimensional spatial position coordinates, instantaneous velocity and instantaneous acceleration of the n IoT devices, where n and m are both positive integers greater than 1; The intra-group cross-encryption ciphertext acquisition module is used to determine the spatiotemporal topological fingerprint corresponding to the k-th data group based on the three-dimensional spatial coordinates of the r IoT devices corresponding to the k-th data group, the motion direction coherence coefficient between the r IoT devices, and the data acquisition timestamps of the r IoT devices; determine the cross-encryption base key for the r IoT devices corresponding to the k-th data group based on the identifiers of the r IoT devices, random numbers, the spatiotemporal topological fingerprint corresponding to the k-th data group, and the spatiotemporal membership degree of the r IoT devices to the k-th data group; and perform fragmented cross-encryption on the k-th data group based on the cross-encryption base key and the motion direction coherence coefficient between the r IoT devices to obtain the concatenated intra-group cross-encryption ciphertext of the r IoT devices corresponding to the k-th data group, where k=1,2,...,m, and r is a positive integer greater than 1 and r<n; The inter-group cross-encryption ciphertext acquisition module is used to perform hash operations on the concatenated intra-group cross-encryption ciphertext and the spatiotemporal topological fingerprint respectively to obtain the ciphertext hash value and spatiotemporal topological hash value corresponding to the k-th data group; determine the chain encryption key corresponding to the k-th data group based on the ciphertext hash value, the spatiotemporal topological hash value and the preset initial encryption key; use the chain encryption key to perform secondary encryption on the concatenated intra-group cross-encryption ciphertext to obtain the concatenated inter-group cross-encryption ciphertext corresponding to the k-th data group; and obtain the verification credential based on the chain encryption key and the spatiotemporal topological fingerprint. The data decryption and device access judgment module is used to send the inter-group cross-encrypted ciphertexts corresponding to m data groups and the verification credentials corresponding to m data groups to the internal private network. The internal private network uses the chained encryption key to decrypt the inter-group cross-encrypted ciphertexts to obtain decrypted data. Based on the decrypted data, the spatiotemporal topology fingerprint is reverse-reconstructed to obtain the reconstructed spatiotemporal topology fingerprint. When the deviation between the reconstructed spatiotemporal topology fingerprint and the original spatiotemporal topology fingerprint is not greater than a preset deviation threshold, and the chained encryption key passes the verification of the verification credentials, n IoT devices are allowed to access the internal private network.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the secure access method for the internal private network of the Internet of Things device according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the secure access method for the internal private network of the Internet of Things device according to any one of claims 1 to 7.

Images