A method and system for secure control of internet of things devices

Abstract

This invention belongs to the field of IoT device control technology and discloses a method and system for secure control of IoT devices. The method includes: authenticating the identities of the initiator and the confirmer based on a dual-person collaborative authentication and QR code face-to-face confirmation mechanism; generating a device start command via a server; starting the device operation according to the start command; and using a two-way mutual exclusion locking mechanism to lock the identities of the initiator and the confirmer, while recording the identity information of both parties to determine the current device shutdown permission; based on a Bluetooth heartbeat detection mechanism and combined with preset violation judgment rules, detecting operator violations in real time during device operation and generating corresponding graded warning signals and penalty mechanisms. This invention achieves secure control of IoT devices through an initiator-confirmer dual-person authentication mechanism, a two-way mutual exclusion locking mechanism, and a shutdown permission allocation mechanism.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) device control technology, and in particular to a method and system for the security control of IoT devices. Background Technology

[0002] With the rapid development of IoT technology, IoT switching devices have been widely used in industrial control, building construction, smart homes, smart parks, and other scenarios. Existing IoT switch control technologies mainly adopt the following methods: 1) Single-user authorization control, which uses account passwords or tokens for authentication, allowing a single user to complete the device's on / off operation; 2) Simple access control, which is role-based access management, allowing administrators to configure which users have permission to control specific devices; 3) Log recording, where the system records operation logs, noting the operator's identity and the operation time.

[0003] Although existing technologies can achieve basic equipment control functions, they have the following significant shortcomings in terms of safety and accountability: 1) Lack of identity verification, i.e., single-person operation cannot confirm whether the operator is actually present, which may lead to proxy operation or misoperation; 2) Difficulty in accountability, i.e., only the operator is recorded, but the true intention of the operation cannot be determined, resulting in unclear responsibility when an accident occurs; 3) Lack of concurrent control, i.e., multiple devices can be turned on at the same time, making it impossible to control the risk exposure surface, making the impact of safety accidents uncontrollable; 4) Uncontrolled shutdown permissions, i.e., anyone with equipment operation permissions can shut down the operating equipment at any time, which may cause serious personal safety accidents if the operator is working on the equipment and someone else remotely shuts it down; 5) Lack of linkage mechanism, i.e., each device is controlled independently without linkage constraints, thus failing to achieve the safety standard of "shutting down the previous device before turning on the next device".

[0004] Especially in the construction industry, suspended scaffolding is an essential piece of equipment for workers operating at heights of tens or even hundreds of meters. The lifting and lowering control of the scaffolding is directly related to the safety of the workers. Current control technologies suffer from the following serious drawbacks: 1) Remote Operation Risk: Operators may remotely activate the suspended platform via the network without verifying the presence of personnel on-site. If someone on the ground accidentally activates the platform while it is under maintenance, it could result in injury to those on board. 2) Malicious Shutdown Risk (Fatal): Workers Zhang San and Li Si are working on the suspended platform tens of meters in the air. If worker Wang Wu on the ground has control of the platform, he might accidentally or maliciously shut off the power, causing the platform to suspend in mid-air and trapping the workers. This is an extremely dangerous safety hazard. 3) Chaotic Multiple-Operation: The same suspended platform may be operated simultaneously by multiple people vying for control, making it impossible to determine responsibility. 4) Equipment Abuse Risk: Operators may simultaneously activate multiple suspended platforms, increasing safety risks. 5) Difficulty in Post-Incident Investigation: After an accident, it is difficult to determine who operated the platform and why.

[0005] To address the aforementioned security management challenges, existing technologies have also explored relevant optimizations. Among the existing technologies, patent publication number CN107950003A discloses a dual-user authentication method, which completes dual-person authentication by distributing keys and encrypted data items to two devices respectively. However, this method does not provide any constraint mechanism for concurrent operations during device operation after authentication is completed.

[0006] For example, patent CN119169724A discloses a dual-person authentication method for a Bluetooth mobile phone lock control system. However, its authentication process does not involve the management and control of device shutdown permissions, and cannot prevent third parties from shutting down the device during operation. Therefore, the existing technology fails to solve the technical problems of "how to effectively constrain the concurrent device control behavior of operators based on dual-person authentication" and "how to ensure that device shutdown permissions belong only to the personnel actually involved in the operation," and also does not provide automated security monitoring and violation management methods after personnel leave the device.

[0007] Therefore, how to provide a security control method and system for IoT devices is an urgent problem to be solved. This invention addresses the shortcomings of the existing technology by proposing a security control method and system for IoT devices that integrates dual-person collaborative authentication, bidirectional mutual exclusion locking, disabling access control, Bluetooth heartbeat personnel detection, and hierarchical management of violations. Summary of the Invention

[0008] This invention provides a method and system for security control of Internet of Things (IoT) devices to address the problems mentioned above in the prior art.

[0009] According to a first aspect of the present invention, a security control method for Internet of Things (IoT) devices is provided.

[0010] In one embodiment, the IoT device security control method includes: Based on the dual-person collaborative authentication and QR code face-to-face confirmation mechanism, the identity authentication of the initiator and the confirmer is realized, and the device opening command is generated through the server; The device is started according to the device start command, and the identity of the initiator and the confirmer is locked using a two-way mutual exclusion locking mechanism. At the same time, the identity information of the initiator and the confirmer is recorded to determine the ownership of the shutdown permission of the currently running device, so as to complete the security control of the Internet of Things device. Based on a Bluetooth heartbeat detection mechanism and pre-defined violation judgment rules, the system detects operator violations in real time during device operation and generates corresponding tiered warning signals and penalty mechanisms to achieve security control of IoT devices; specifically including: After the device is successfully turned on, it uses the built-in Bluetooth module to establish a Bluetooth connection with the mobile terminals of the initiator and the confirmer. During operation, the device sends heartbeat request signals to the mobile terminals of the initiator and the confirmer at preset time intervals; When the device receives a heartbeat response from at least one mobile terminal within a preset time interval, it determines that the user is in a normal position. If the device does not receive a heartbeat response from any mobile terminal within the preset warning period, it determines that the user is in a warning state and sends a reminder notification to the mobile terminal. If the device does not receive a heartbeat response from any mobile terminal within the preset confirmation period, it determines that the user has left the device, records the violation of the initiator and confirmer, sends a violation alarm notification, and issues a forced shutdown command to the device.

[0011] According to a second aspect of the present invention, a security control system for Internet of Things (IoT) devices is provided.

[0012] In one embodiment, the IoT device security control system includes: The device activation command generation module is used to authenticate the identities of the initiator and the confirmer based on a two-person collaborative authentication and QR code face-to-face confirmation mechanism, and generate a device activation command through the server. The identity locking and permission determination module is used to start the device operation according to the device start command, and use a two-way mutual exclusion locking mechanism to complete the identity locking between the initiator and the confirmer. At the same time, it records the identity information of the initiator and the confirmer, and determines the ownership of the shutdown permission of the currently running device, so as to complete the security control of the IoT device. The Bluetooth heartbeat violation detection module is used to detect operator violations in real time during device operation based on the Bluetooth heartbeat detection mechanism and preset violation judgment rules, and generate corresponding graded warning signals and penalty mechanisms to complete the security control of IoT devices. The Bluetooth heartbeat violation detection module, based on the Bluetooth heartbeat detection mechanism and pre-defined violation judgment rules, detects operator violations in real time during device operation and generates corresponding graded warning signals and penalty mechanisms to achieve security control of IoT devices. After successful device startup, it establishes a Bluetooth connection with the mobile terminals of the initiator and confirmer using its built-in Bluetooth module. During operation, the device sends heartbeat request signals to the mobile terminals of the initiator and confirmer at preset time intervals. When the device receives a heartbeat response from at least one mobile terminal within the preset time interval, it determines that the user is present. When the device does not receive a heartbeat response from any mobile terminal within the preset warning duration, it determines that the user is in a warning state and sends a reminder notification to the mobile terminal. When the device still does not receive a heartbeat response from any mobile terminal within the preset confirmation departure duration, it determines that the user has left the device, records the violations of the initiator and confirmer, sends a violation alarm notification, and simultaneously issues a forced shutdown command to the device.

[0013] According to a third aspect of the present invention, a computer device is provided.

[0014] In some embodiments, the computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of the method described above.

[0015] According to a fourth aspect of the present invention, a computer-readable storage medium is provided.

[0016] In one embodiment, a computer program is stored on the computer-readable storage medium, which, when executed by a processor, implements the steps of the above method.

[0017] The technical solutions provided by the embodiments of the present invention may include the following beneficial effects: 1) Enhance security: Mutual exclusion locking prevents multiple devices from being turned on simultaneously, reducing risk exposure; face-to-face QR code confirmation ensures both parties must be present at the same time, eliminating remote operation; the permission attribution mechanism ensures only on-duty personnel can turn off the device, preventing malicious shutdown by third parties; in scenarios such as suspended platforms, it prevents ground personnel from accidentally turning off the device, causing interruptions to workers' suspended operations, protecting personal safety; and by recording the initiator and confirmer during each operation, a community of responsibility is formed, enabling traceability of responsibility to individuals.

[0018] 2) Enhanced traceability: By recording the five-tuple of initiator, confirmer, equipment, instruction and time, construction operation data can be recorded completely; by using the session state machine to record the complete life cycle, the status can be checked; by recording abnormal data such as permission denial, equipment offline, timeout, etc., abnormal data can be tracked.

[0019] 3) Improve management efficiency: Automatic unlocking by turning off the device can achieve automatic control without manual intervention, and residual sessions can be automatically cleaned up after the session is closed, realizing a self-cleaning mechanism; support for single / dual mode switching allows the device to be flexibly configured according to needs.

[0020] 4) Enhance construction safety: Bluetooth heartbeat ensures that only personnel near the suspended platform can maintain equipment operation, enabling real-time monitoring of personnel presence; the equipment automatically shuts down when personnel leave, eliminating safety hazards caused by unattended operation and enabling proactive safety intervention; every instance of leaving the equipment unattended is clearly recorded and accumulated, making violations quantifiable; when the number of violations reaches a threshold, access is automatically suspended / terminated without manual intervention, achieving automated tiered punishment; at the same time, automatic shutdown ensures that the equipment cannot be used by unauthorized personnel in an unattended state, preventing unauthorized use; from Bluetooth pairing, heartbeat detection, departure judgment, violation recording, automatic shutdown, and access control, a complete safety management closed loop is formed. Attached Figure Description

[0021] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0022] Figure 1 This is a flowchart illustrating a security control method for an Internet of Things (IoT) device according to an exemplary embodiment; Figure 2 This is a structural block diagram illustrating the security control of an Internet of Things (IoT) device according to an exemplary embodiment; Figure 3 This is one of the schematic diagrams illustrating the principle of a security control method for Internet of Things (IoT) devices according to an exemplary embodiment; Figure 4 This is a second schematic diagram illustrating the principle of a security control method for Internet of Things (IoT) devices according to an exemplary embodiment. Figure 5 This is one of the schematic diagrams illustrating the principle of the Bluetooth heartbeat detection mechanism in an IoT device security control method according to an exemplary embodiment; Figure 6 This is a second schematic diagram illustrating the principle of the Bluetooth heartbeat detection mechanism in an IoT device security control method according to an exemplary embodiment; Figure 7 This is a schematic diagram of the structure of a computer device according to an exemplary embodiment. Detailed Implementation

[0023] The following description and accompanying drawings fully illustrate specific embodiments described herein to enable those skilled in the art to practice them. Some portions and features of certain embodiments may be included in or replace portions and features of other embodiments. The scope of the embodiments herein includes the entire scope of the claims, as well as all available equivalents of the claims.

[0024] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0025] Figure 1 An embodiment of a security control method for Internet of Things (IoT) devices according to the present invention is shown.

[0026] In this optional embodiment, the IoT device security control method includes: Step S101: Based on the dual-person collaborative authentication and QR code face-to-face confirmation mechanism, the identity authentication of the initiator and the confirmer is realized, and the device opening command is generated through the server; Step S102: Start the device operation according to the device start command, and use the two-way mutual exclusion locking mechanism to complete the identity lock between the initiator and the confirmer. At the same time, record the identity information of the initiator and the confirmer, and determine the ownership of the shutdown permission of the currently running device, so as to complete the security control of the Internet of Things device. Step S103: Based on the Bluetooth heartbeat detection mechanism and combined with the preset violation judgment rules, the violation of the operator is detected in real time during the operation of the device, and corresponding graded warning signals and punishment mechanisms are generated to complete the security control of the Internet of Things device.

[0027] In this optional embodiment, the mechanism based on dual-person collaborative authentication and QR code face-to-face confirmation, which realizes the identity authentication of the initiator and the confirmer, and generates a device activation command through the server, includes: the initiator sending a device activation request to the server, wherein the device activation request includes the device serial number, operation instructions, initiator identity and authorization credentials; the server receiving the activation request and verifying the initiator's authorization and device control mode, and upon successful verification, creating a session in a pending confirmation state under dual-person control mode, generating a unique session code and validity period; the server returning the session code and validity period to the initiator, the initiator receiving the returned data and displaying a QR code containing the session code through their own client; the confirmer scanning the QR code displayed by the initiator through their own client and sending a confirmation request to the server, wherein the confirmation request includes the session code, device identifier, operation instructions, confirmer identity and authorization credentials; the server receiving the confirmation request and verifying it, and upon successful verification, the server generating a device activation command.

[0028] In this optional embodiment, the validity period of the session code is configured by the security administrator, and the session code automatically expires after a preset time. During the process of the confirmer scanning the QR code displayed by the initiator using their own client, the confirmer and the initiator must be different users. The server receives the confirmation request and performs verification, including: verifying the session code validity, device compatibility, instruction consistency, confirmer identity uniqueness, and confirmer's device uniqueness. Verification is considered successful only if all verifications pass.

[0029] In this optional embodiment, the step of using a bidirectional mutual exclusion locking mechanism to lock the identities of the initiator and the confirmer includes: recording the initiator and the confirmer of opening the device and marking them as locked; in the locked identity state, when the initiator or the confirmer initiates a new device opening request, the server checks whether the initiator or the confirmer already has a device in operation. If so, the new opening request is rejected; otherwise, a new device opening instruction is generated; in the locked identity state, when the initiator or the confirmer requests to close the device they participated in opening, the server receives the closure request and allows the closure operation to be performed. After the device is closed, the locked identity state of the initiator and the confirmer is released, and the session records are automatically cleared.

[0030] In this optional embodiment, recording the identity information of the initiator and confirmer to determine the ownership of the shutdown permission of the currently running device includes: after the device is successfully turned on, binding the identity information of the initiator and confirmer in the session record, and limiting the shutdown permission to only the bound initiator and confirmer; while the device is in the on state, when a shutdown request is received from any user, the server verifies whether the identity of the requesting user is the bound initiator or confirmer; if so, the server accepts the shutdown request and sends a shutdown command to the device; if not, the server rejects the shutdown request and the device remains in the on state.

[0031] In this optional embodiment, the Bluetooth heartbeat detection mechanism, combined with preset violation judgment rules, detects operator violations in real time during device operation and generates corresponding graded warning signals and penalty mechanisms. This includes: after successful device startup, establishing a Bluetooth connection with the initiator's and confirmer's mobile terminals using the device's built-in Bluetooth module; during operation, sending heartbeat request signals to the initiator's and confirmer's mobile terminals at preset time intervals; when the device receives a heartbeat response from at least one mobile terminal within the preset time interval, it determines that the user is present; when the device does not receive a heartbeat response from any mobile terminal within the preset warning duration, it determines that the user is in a warning state and sends a reminder notification to the mobile terminal; when the device still does not receive a heartbeat response from any mobile terminal within the preset confirmation departure duration, it determines that the user has left the device, records the initiator's and confirmer's violations, sends a violation alarm notification, and simultaneously issues a forced shutdown command to the device.

[0032] In this optional embodiment, after recording the violations of the initiator and confirmer and sending violation alarm notifications, the method further includes: counting the number of violations by the user; when the number of violations reaches a first preset threshold, automatically suspending the user's device operation permissions and triggering a relearning process; and when the number of violations reaches a second preset threshold, automatically deregistering the user's device operation permissions.

[0033] Figure 2 An embodiment of a security control system for Internet of Things (IoT) devices according to the present invention is shown.

[0034] In this optional embodiment, the IoT device security control system includes: The device activation command generation module 201 is used to realize the identity authentication of the initiator and the confirmer based on the dual-person collaborative authentication and QR code face-to-face confirmation mechanism, and generate the device activation command through the server. The identity locking and permission determination module 202 is used to start the device operation according to the device start command, and use a two-way mutual exclusion locking mechanism to complete the identity locking between the initiator and the confirmer. At the same time, it records the identity information of the initiator and the confirmer, and determines the ownership of the current running device's shutdown permission, so as to complete the security control of the Internet of Things device. The Bluetooth heartbeat violation detection module 203 is used to detect operator violations in real time during device operation based on the Bluetooth heartbeat detection mechanism and in combination with preset violation judgment rules, and generate corresponding graded early warning signals and penalty mechanisms to complete the security control of IoT devices.

[0035] To facilitate understanding of the above technical solutions of the present invention, the following further explains the above technical solutions of the present invention from the perspective of architecture and principle, as follows: Key terms are shown in Table 1 below: Table 1 Definitions of Key Terms ; This invention proposes an IoT device control method based on dual-person collaborative authentication and mutual exclusion locking. Through a dual-person authentication mechanism of initiator and confirmer, a two-way mutual exclusion locking mechanism, and a mechanism for disabling permission attribution, the secure control of IoT devices is achieved.

[0036] The core idea of ​​this method is: 1) The device startup operation must be completed by two people to form a community of responsibility; 2) Face-to-face confirmation via QR code ensures that both parties must be present at the same time; 3) Through a mutual exclusion locking mechanism, it is mandatory to close the previous device before the next one can be started; 4) Through a shutdown permission ownership mechanism, only the two people who participated in the startup operation have the right to shut down the device, completely eliminating the possibility of malicious shutdown by third parties.

[0037] 1) Two-person collaborative authentication mechanism Technical Features: The device activation process consists of two steps: an initiation phase and a confirmation phase. The initiator sends a device activation request and generates a unique session code; the confirmer scans the session code to confirm the activation. The confirmer and initiator must be different users to prevent self-confirmation. Technical Effect: This ensures that at least two people are present when the device is activated, forming a shared responsibility. Neither party can complete the operation alone. The session code binding ensures that both parties must communicate face-to-face.

[0038] 2) QR code face-to-face confirmation mechanism Technical Features: After the initiator initiates an operation, the system generates a 16-digit random session code and displays a QR code. The session code has a time limit (default 5 minutes) and automatically expires after the timeout. The confirmer must scan the QR code and correctly fill in the session code, device serial number, and operation command to confirm. The server verifies the session status, device compatibility, and consistency of the operation command. Technical Benefits: Eliminates remote operation, ensuring face-to-face communication between both parties; the session code is for one-time use, preventing replay attacks; the timeout mechanism prevents the session code from being intercepted and used for an extended period.

[0039] 3) Two-way mutual exclusion locking mechanism Technical Features: After successful device startup, both the initiator and the confirmer are simultaneously locked; locked users cannot start any other devices until the current device is shut down; during the lockout period, the current device can be shut down; the lockout is automatically released after the device is shut down, allowing both parties to freely operate other devices. Technical Effects: Prevents operators from simultaneously starting multiple devices, thus increasing security risks; mandates that operators must be present to shut down the device before leaving, forming a closed-loop control system of "start-lock-shutdown-unlock".

[0040] 4) Disable permission attribution mechanism (important security innovation) Technical Features: After the device is powered on, the system binds the identities of the initiator and the confirmer in the session log. When someone requests to shut down the device, the system verifies whether the requester is one of the two people who participated in the initial startup. If the requester is neither the initiator nor the confirmer, the system rejects the shutdown command. Only those who participated in the startup operation are qualified to shut down the device. Technical Effects: Completely eliminates malicious shutdown by third parties, protecting personnel working on the equipment. In scenarios such as suspended platforms, it ensures that only the workers on the platform can shut down the equipment themselves; ground personnel cannot remotely shut it down. Closed-Loop Responsibility: Start-up and shutdown are completed by the same group of people, ensuring safety responsibility throughout the process.

[0041] 5) Complete accountability system Technical Features: Each operation is recorded with a complete five-tuple: initiator, confirmer, device, operation command, and operation time; the session state machine records the complete lifecycle: PENDING, CONFIRMED, CLOSED, and abnormal situations (authorization denied, device offline, timeout, etc.) are also recorded. Technical Benefits: Any operation can be traced back to two specific personnel; the complete operation chain facilitates post-event analysis and responsibility determination; and session state recording facilitates audit tracing.

[0042] The comparison with existing technologies is shown in Table 2 below: Table 2 Characteristics of Traditional IoT Switches and This Invention ; The following uses the example of high-altitude suspended platform operation on the exterior wall of a construction site to specifically illustrate the technical solution of this invention (e.g., Figures 3-4 As shown, and Figure 3 The numbers I, II, III, IV, and V in the text are respectively related to... Figure 4 (Connecting phases I, II, III, IV, and V in the diagram). 1. Case scenario setting (characters and equipment) Scenario Description: Exterior wall decoration work is underway at a construction site. The site is equipped with IoT-controlled suspended platform equipment. To ensure worker safety, the project manager requires all suspended platforms to operate in two-person mode. The relationships between the personnel are shown in Table 3 below: Table 3 Relationships ; Character Relationship Explanation: Da Liu and Xiao Wang are the partners for today's exterior wall suspended platform operation; they will work together on the platform. Lao Chen will assist from the ground. According to safety regulations, only the person working on the platform can control its switches.

[0043] The equipment information is shown in Table 4 below: Table 4 Equipment Information ; Initial state (before the case begins): 1) Safety administrator Lao Zhao has set the control mode of both hoisting baskets No. 1 and No. 2 to dual-person mode through the backend management system; 2) Lao Zhao has set the session timeout to 5 minutes; 3) Both hoisting baskets are currently in the off state (stopped on the ground, power off); 4) Da Liu, Xiao Wang, and Lao Chen have all logged into the device control APP on their mobile phones; 5) None of the three are "locked" (none of them are involved in any hoisting baskets that are not turned off).

[0044] 2. The initiator sends a device activation request to the server. Scenario: Da Liu and Xiao Wang arrive at suspended platform number 1. Following safety procedures, they need to work together on the platform. Da Liu takes out his phone, opens the equipment control app, finds "Exterior Wall High-Altitude Suspended Platform No. 1" in the equipment list, and clicks the "Start" button. Data sent by the mobile app to the backend server: After Da Liu clicks "Start," the mobile app automatically sends a network request to the server, containing the information shown in Table 5.

[0045] Table 5 Network Request Information ; 3. The server verifies the initiator's permissions and device control mode. The first step is to check if Da Liu has permission to operate this suspended platform: the server checks the "Device Assignment Table" (a list of who has the right to operate which devices). Administrator Lao Zhao has already added Da Liu, Xiao Wang, and Lao Chen to the list of those authorized to operate suspended platform number 1; after the check is passed, Da Liu has the right to operate suspended platform number 1. The second step is to check whether this suspended platform is using single-person or dual-person mode: the server finds that the control_mode of suspended platform number 1 is "dual_strict" (dual-person strict mode), indicating that this suspended platform must follow the dual-person process. The specific rules for "dual-person mode" in this invention are shown in Table 6 below.

[0046] Table 6 Specific Rules ; 4. Create a session in the pending confirmation state and generate a unique session code. 1) Generate a 16-digit random session code: The server randomly generates a 16-digit string consisting of uppercase letters and numbers—for example, B7K2X9M4P8R1A5FQ. It then checks the "session table" for duplicates to ensure it doesn't overlap with historical records. This is like issuing a "queue number" for this operation. The reason for using random codes: If the codes are sequentially 0001, 0002, anyone can guess the next code, potentially allowing someone to impersonate the user without face-to-face scanning. Random codes eliminate this possibility. 2) Calculate the expiration time: The server's current time is 08:30:00. Adding the 5 minutes configured by the administrator, the expiration time is 08:35:00. 3) Insert a new record into the session table (as shown in Table 7 below).

[0047] Table 7 New Record Information ; 5. The server returns a session code and expiration date to the initiator. The server returned the information shown in Table 8 to Da Liu's mobile app.

[0048] Table 8 Server Return Information ; 6. The initiator displays a QR code containing the session code through the client. QR code generation: First, the text is packaged. The app packages the information into "swctrl: / / confirm?code=B7K2X9M4P8R1A5FQ&dev=DEV-BASKET-001&act=1", which contains all the information including the session code, device number, and operation instructions. Second, a QR code is generated. The app uses the phone's built-in QR code generation function to encode the text into a black and white square pattern. This process is completed entirely on the user's phone without requiring an internet connection. Since generating a QR code on the phone takes only milliseconds and does not require transmitting image data, it is faster than generating and distributing it from a server. Therefore, this invention chooses to generate the QR code on the phone.

[0049] 7. The person making the confirmation scans the QR code and sends a confirmation request to the server. Xiao Wang took out his phone, opened the app, clicked "Scan to Confirm," and pointed the camera at the QR code on Da Liu's screen. The app automatically parsed the session code B7K2X9M4P8R1A5FQ, the device DEV-BASKET-001 (No. 1 suspended platform), and the operation 1 (Start). The app displayed the confirmation page "No. 1 external wall high-altitude suspended platform - Start operation - Confirm?". After Xiao Wang saw it clearly, he clicked "Confirm." The app sent a confirmation request to the server (the confirmation request is shown in Table 9).

[0050] Table 9 Confirmation Request Information ; 8. Server verification (all 8 items must pass before approval) Key rule: All eight checks below must pass simultaneously for the final "verification passed". If any one check fails, the entire confirmation request will be rejected immediately, and the gondola will not be opened.

[0051] Verification Item 1: Verify the accreditation credentials of the confirmer. The server verifies whether Xiao Wang's credentials are valid and whether he belongs to Xiao Wang. If Xiao Wang's credentials are valid, the check passes. Verification Item 2: Verify whether the accrediter has permission to operate this hoist. If the server checks the "Device Assignment Table" and confirms that Xiao Wang is also on the operation list for Hoist 1, the check passes. Verification Item 3: Verify the existence of the session code. If the server finds B7K2X9M4P8R1A5FQ in the session table, the check passes. Verification Item 4: Verify if the session is within its validity period. If the current time 08:31:00 < the expiration time 08:35:00, with 4 minutes remaining, the check passes. Verification Item 5: Verify if the session status is PENDING. If the session status is indeed PENDING and has not been used, the check passes. Verification Item 6: Verify device matching. If the device requested by Xiao Wang is DEV-BASKET-001, and the device in the session record is also DEV-BASKET-001, the check passes. Verification Item 7: Verify that the confirmer and the initiator are not the same person. If Xiao Wang's account wangli ≠ Da Liu's account liugong, they are not the same person, and the check passes. Verification Item 8: Mutual exclusion check (check if Xiao Wang has other unclosed pools), that is, does the server search the session table for a record with a status of CONFIRMED, onoff=1, and Xiao Wang being the initiator or confirmer? If the result is no, it means that Xiao Wang has no "debts", and the check passes.

[0052] 9. The session status has been updated to "Confirmed". The server updated the session record: confirmer_acid changed from NULL to "wangli" (the confirmer is Xiao Wang); status changed from "PENDING" to "CONFIRMED" (confirmed); confirmed_at was entered with the current time 08:31:15. The key information in this session record includes: session code B7K2X9M4P8R1A5FQ, device DEV-BASKET-001 (No. 1 hanging basket), initiator liugong (Da Liu), confirmer wangli (Xiao Wang), just bound, status CONFIRMED, just updated, operation started.

[0053] 10. After successful verification, the server sends an opening command to the suspended platform. The server sends a command to gondola number 1 via MQTT message: "Power on, allow lifting operation." Upon receiving the command, the gondola powers on and the control system starts. The gondola responds with "Power on successful." The server updates the session status to CLOSED (the session for this power-on operation has been completed).

[0054] 11. Record operation logs The server adds a new record to the "Control Log Table" (as shown in Table 10 below).

[0055] Table 10 Fields of the Control Log Table ; Simultaneously, notifications popped up on Da Liu and Xiao Wang's mobile apps: "The No. 1 exterior wall suspended platform has been successfully activated." The two climbed into the platform and began exterior wall work. The platform slowly rose to the 6th floor.

[0056] 12. Demonstration of the mutex locking mechanism taking effect At this time, the suspended platform had been raised to the exterior wall of the 6th floor, where Da Liu and Xiao Wang were working.

[0057] Scenario 1: Da Liu attempts to start gondola number 2: Although Da Liu is on the 6th floor, suppose he suddenly decides to click "Start gondola number 2 1" on the app; the server performs a mutual exclusion check, and in the session table, Da Liu (liugong) has participated in starting gondola number 1, and the status is CONFIRMED, onoff=1; the server rejects the request and prompts "You have currently participated in starting gondola number 1. Please close this gondola before you can start other devices."

[0058] Scenario 2: Xiao Wang attempts to open basket number 2: Similarly, Xiao Wang attempts to open basket number 2, but the result is the same – he is refused. This is because Xiao Wang is also the confirmer of basket number 1.

[0059] Scenario 3: Ground worker Lao Chen attempts to open hoist basket number 2: Lao Chen is on the ground and wants to open hoist basket number 2 himself. He clicks "Open Hoist Basket Number 2"; the server performs a mutual exclusion check. Lao Chen (chensf) has no involvement in any open hoist baskets in the session table; the mutual exclusion lock is successful, locking only Da Liu and Xiao Wang, not Lao Chen. Because this invention only locks the person participating in the operation, it does not affect others. Lao Chen can normally initiate the process of opening hoist basket number 2 (of course, he also needs someone to scan the code for confirmation).

[0060] 13. Disabling the permission attribution mechanism—the core security innovation of this invention This is the most critical security aspect of the entire invention. We will now illustrate this with a complete scenario.

[0061] 1) Scene setting: Da Liu and Xiao Wang are working on the No. 1 suspended platform, which is positioned on the exterior wall of the 6th floor. Lao Chen is on the ground.

[0062] Scenario 1: Da Liu closes the suspended platform himself (permitted). After completing the work on the 6th floor, Da Liu discussed it with Xiao Wang and selected "Suspended Platform No. 1" on the APP, then clicked "Close".

[0063] Server processing flow: First, a shutdown request is received. Da Liu's account is liugong, requesting the shutdown of DEV-BASKET-001. Next, the server checks the session table and finds the CONFIRMED record for basket number 1, with liugong (Da Liu) as the initiator and wangli (Xiao Wang) as the confirmer. Then, the shutdown permission verification is performed. The server checks whether the person requesting the shutdown (Da Liu) is the initiator or confirmer in the session record. When liugong = liugong (the initiator), the verification passes, and the server issues a shutdown command to the basket. Then, the basket is safely lowered to the ground, and the power is cut off. Finally, the server clears the session and unlocks Da Liu and Xiao Wang.

[0064] Scenario 2: Xiao Wang shuts down the gondola (permitted). If Da Liu's phone runs out of battery, Xiao Wang shuts it down instead. The operation process is exactly the same as Da Liu's. During the server check, it finds wangli=wangli (confirmer), and passes. Either the initiator or the confirmer can shut down the gondola.

[0065] Scene 3: Ground worker Lao Chen tries to close the suspended platform (refused). This is the most critical security scene.

[0066] Imagine this scenario: Da Liu and Xiao Wang are working on the 6th floor, while Lao Chen is on the ground. For some reason (perhaps by mistake or perhaps to cause trouble), Lao Chen opens his mobile app, selects "No. 1 suspended platform," and clicks "close."

[0067] Server processing flow: First, a closure request is received. Mr. Chen's account is chensf, requesting to close DEV-BASKET-001. Next, the server checks the session table and finds the CONFIRMED record for hoisting basket No. 1, with the initiator being liugong and the confirmer being wangli. Then, the server checks if chensf is liugong (initiator) or wangli (confirmer). If neither is the case, the closure is refused, and the server returns the error "You are not the on-duty operator of this equipment and do not have the authority to close it. Please contact the current operator of the equipment, Da Liu (liugong) or Xiao Wang (wangli)." At the same time, a red notification pops up on Mr. Chen's phone: "You are not the on-duty operator of hoisting basket No. 1 and cannot close it. The current operator of the hoisting basket is Da Liu (liugong) or Xiao Wang (wangli)."

[0068] This is the core value of the power-off permission mechanism—protecting lives. Without this mechanism, anyone with equipment access could shut down a suspended platform at any time. Workers suspended dozens of meters in the air would face unimaginable consequences if the platform suddenly lost power. This invention, through the "whoever opens it, closes it" permission rule, completely eliminates the possibility of malicious or accidental shutdown by a third party.

[0069] 2) Detailed Explanation of the Lock Release Mechanism (Implicit Unlock): In this invention, the "locking" of the initiator and confirmer is not achieved through a separate "lock field" or "lock table," but is implicitly expressed through the record status in the session table. This design is very ingenious, avoiding common problems in traditional locking mechanisms such as "forgetting to unlock," "deadlock," and "inconsistent lock status."

[0070] The essence of locking: "Locking" means that when the mutual exclusion check module finds a record in the session table with status='CONFIRMED' and onoff=1 (start operation), and the initiator or confirmer in that record matches the current operator, it will reject any new start requests. In other words, "locking" is not an explicit flag, but a query result. As long as a corresponding CONFIRMED record exists in the session table, the mutual exclusion check will take effect, exhibiting the effect of "being locked".

[0071] The specific process for unlocking is as follows: When Da Liu (or Xiao Wang) clicks "Close No. 1 Hanging Basket" on the APP, the server performs the following operations: Receives the closing request (liugong requests to close DEV-BASKET-001) — Session table query (finds the record with session_code='B7K2X9M4P8R1A5FQ' and status='CONFIRMED') — Closing permission verification (verifies whether liugong is the initiator or confirmer in the record) — Issues the closing command (sends the onoff=0 command to the hanging basket via MQTT) — The hanging basket executes the closing (the hanging basket returns to the ground, cuts off the power, and replies "closing successful") — Updates the session status (updates the status of this record from 'CONFIRMED' to 'CLOSED') — Writes the closing log (adds a closing record to the operation log table).

[0072] The key to unlocking is: before execution, the record in the session table is in the state of CONFIRMED (session code B7K2X9M4P8R1A5FQ, device DEV-BASKET-001, initiator liugong, confirmer wangli, state CONFIRMED, onoff 1). After execution, the state changes to CLOSED, and the lock is released.

[0073] Changing the status to CLOSED is equivalent to "unlocking": Reviewing the mutual exclusion check's query conditions, only records with status='CONFIRMED' are checked, with the query condition status='CONFIRMED' AND onoff=1. When a record's status becomes CLOSED, this record no longer meets the mutual exclusion check's query conditions, and the mutual exclusion check module cannot find it. At this point, if Da Liu tries to start basket number 2 again, the server performs a mutual exclusion check and searches the session table for records with status='CONFIRMED' AND onoff=1 using liugong. However, no results are found (because the record for basket number 1 has already become CLOSED). Finally, the mutual exclusion check passes, and Da Liu can normally initiate the process of starting basket number 2.

[0074] The advantages of the implicit unlocking design are shown in Table 11: Table 11 Design Advantages of Implicit Unlocking ; For example, in a traditional hotel's front desk registration book, guests write "checked in" upon arrival and cross it out upon check-out. If the front desk forgets to cross it out, the system will forever display "checked in," creating "dirty data." This invention's lock-type traffic light uses a red light (CONFIRMED) to indicate no movement and a green light (CLOSED) to indicate movement. The light color is determined by the current traffic situation (session state), eliminating the problem of "forgetting to switch." The light automatically changes with road conditions, just as the lock state automatically changes with the session state.

[0075] 14. Unlock verification after closing the suspended platform After basket number 1 is closed, the locked status of Da Liu and Xiao Wang is automatically released. Verification: Da Liu tries to open basket number 2 again. This time, the mutual exclusion check passes (the previous record of basket number 1 has been cleared). Da Liu and Xiao Wang can now proceed with the normal two-person process to open basket number 2 and continue working.

[0076] 15. Bluetooth communication heartbeat detection Building upon the aforementioned dual-person collaborative authentication, mutual exclusion locking, and disabling of permission attribution, a further proposed solution for personnel presence monitoring and violation management based on Bluetooth communication heartbeat detection is presented (e.g., Figures 5-6 As shown, and Figure 5 The numbers I, II, III, and IV in the text are respectively related to... Figure 6 (Connecting I, II, III, and IV in the diagram). This scheme addresses the problems not covered by the basic scheme (as shown in Table 12 below): Table 12 Problems Solved by Derivative Solutions ; 1) Scenario Case Study (Continuing from the previous case study) Scenario Setting: Da Liu and Xiao Wang are performing exterior wall work using suspended platform No. 1. The platform has a built-in Bluetooth communication module. When Da Liu and Xiao Wang's mobile apps are activated, a communication heartbeat is established with the platform's Bluetooth module. The following three sub-scenarios demonstrate the complete working mechanism of the derived solution.

[0077] 2) Establishing Bluetooth heartbeat communication Bluetooth pairing timing: Simultaneously with Da Liu and Xiao Wang completing their dual QR code scanning confirmation and the server issuing the start command to the suspended platform, the server sends the Bluetooth identifiers (such as Bluetooth MAC addresses) of Da Liu and Xiao Wang's phones to the suspended platform's IoT switch module. The suspended platform's built-in Bluetooth module then actively searches for and connects to the Bluetooth signals of these two phones. Since Bluetooth's effective communication distance is typically around 10 meters, it perfectly matches the criterion of "persons being near the equipment." WiFi has a much wider range (tens or even hundreds of meters), and GPS accuracy is insufficient indoors / in buildings with obstructions. Bluetooth is the most suitable technology for determining "whether a person is near the equipment."

[0078] Heartbeat Mechanism: After successful pairing, the Bluetooth module of the hanging basket sends a "heartbeat request" signal to both Da Liu's and Xiao Wang's mobile phones at regular intervals (e.g., every 10 seconds). Upon receiving the signal, the mobile app automatically replies with a "heartbeat response." This back-and-forth process is called a "heartbeat communication."

[0079] 3) Logic for determining the presence and departure of personnel Judgment rules: The IoT switch module of the suspended platform maintains a "personnel presence status". The judgment rules are divided into three levels (as shown in Table 13).

[0080] Table 13 Judgment Rules ; In actual operation, Da Liu might temporarily leave the suspended platform to retrieve materials, while Xiao Wang remains working on it. As long as at least one person is present, the equipment is not considered "unattended." Only when both individuals leave the Bluetooth range is it considered "all personnel have left." Scenario demonstration, normal on-site condition: Da Liu and Xiao Wang are working on the suspended platform. During this time, Da Liu's phone sends a normal heartbeat notification every 10 seconds, and Xiao Wang's phone also sends a normal notification. The system determines that both are in place normally, and everything is normal.

[0081] 4) Irregular detection and three-level alarm mechanism Warning: Personnel may be temporarily absent. Da Liu and Xiao Wang completed a section of exterior wall work and decided to get down from the suspended platform to get some water. They parked the platform on the 8th floor but forgot to turn off the equipment. After getting off the platform, they moved out of the Bluetooth communication range (approximately 10 meters). At the 10th second, the platform's Bluetooth sent a heartbeat request to both phones, but neither phone responded. At the 20th second, it sent another request, still without a response. At the 30th second, it sent a third request, still without a response. After three consecutive heartbeat responses (approximately 30 seconds), a warning was triggered. At this point, the platform's IoT module reported to the server, "Personnel heartbeat lost, may have left the equipment," and the server pushed a notification to Da Liu and Xiao Wang's mobile apps: "Reminder: We have detected that you have left the work area of ​​suspended platform 1. If you are not using it temporarily, please turn off the equipment immediately. The equipment will automatically turn off in 60 seconds." At the same time, the server added a warning record to the violation record table (this is only a reminder and is not recorded as a formal violation).

[0082] Confirm departure: This triggers a violation and automatic shutdown. Da Liu and Xiao Wang saw the phone notification but thought, "I'll just have a drink of water and be right back," so they ignored it. At the 40th, 50th, and 60th second, the hanging basket's Bluetooth continued to send heartbeat requests, but still received no response. After six consecutive unanswered attempts (approximately 60 seconds), a confirmation departure was triggered. At this point, the following actions were performed: Action 1 - Mark Violation: The server adds a new official violation record 9 to the violation record table (as shown in Table 14 below); Table 14 Violation Records ; Action 2—Automatic Equipment Shutdown: The server forcibly sends a shutdown command to hoist basket No. 1. Upon receiving the command, the hoist basket automatically descends to the ground and cuts off the power. With the hoist basket suspended at a height and unattended, if someone (such as an unsuspecting worker) climbs up to operate it, it could cause a serious accident. Although automatic shutdown is a form of "passive security," it can eliminate safety hazards immediately after a violation occurs.

[0083] Action 3 – Alarm Notification: The server pushes an alarm notification to Da Liu and Xiao Wang's mobile phones: "Violation Warning: You left the work area without closing the No. 1 suspended platform, which has triggered the system to automatically shut down. This is the first violation. Three violations will require you to relearn the safety regulations, and five violations will result in termination of cooperation." At the same time, the server pushes an alarm to the safety administrator Lao Zhao's backend.

[0084] 5) Accumulated violation count and tiered penalty mechanism: Violation record: The server maintains a "personal violation file" for each worker (as shown in Table 15 below), which records all of the worker's violation history.

[0085] Table 15 Individual Violation Records ; Tiered penalty mechanism: The site manager (Old Zhao) set the following penalty thresholds in the background (as shown in Table 16 below). Table 16 Penalty Thresholds ; Scenario Demonstration: Da Liu has accumulated 3 violations. Assume Da Liu already had 2 violations (one for forgetting to turn off the device, and one for allowing an unauthorized person to scan a QR code), adding this latest violation brings the total to 3. Automatic Execution: Da Liu's account status changes to SUSPENDED; Da Liu's app displays "Your device operation permission has been suspended due to 3 violations (leaving the device unattended). Please participate in the security regulations training and pass the exam to restore your permission." Da Liu can no longer initiate any requests to open the hoist, even if he finds Xiao Wang to scan the QR code for confirmation, the server will block it before the mutual exclusion check, displaying "Your account has been suspended due to violations and this operation cannot be performed." Lao Zhao's backend system shows Da Liu's status as "Pending Retraining." Xiao Wang, although only having 1 violation and not suspended, can operate normally. However, Da Liu can no longer act as Xiao Wang's "initiator" or "confirmer." Xiao Wang needs to find another worker with a normal status (such as Lao Chen) to partner with him.

[0086] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 7 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database stores static and dynamic information data. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements the steps in the above method embodiments.

[0087] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present invention and does not constitute a limitation on the computer device to which the present invention is applied. A specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0088] In addition, the present invention also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0089] In addition, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0090] This invention is not limited to the structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this invention is limited only by the appended claims.

Claims

1. A security control method for Internet of Things (IoT) devices, characterized in that, include: Based on the dual-person collaborative authentication and QR code face-to-face confirmation mechanism, the identity authentication of the initiator and the confirmer is realized, and the device opening command is generated through the server; The device is started according to the device start command, and the identity of the initiator and the confirmer is locked using a two-way mutual exclusion locking mechanism. At the same time, the identity information of the initiator and the confirmer is recorded to determine the ownership of the shutdown permission of the currently running device, so as to complete the security control of the Internet of Things device. Based on a Bluetooth heartbeat detection mechanism and pre-defined violation judgment rules, the system detects operator violations in real time during device operation and generates corresponding tiered warning signals and penalty mechanisms to achieve security control of IoT devices; specifically including: After the device is successfully turned on, it uses the built-in Bluetooth module to establish a Bluetooth connection with the mobile terminals of the initiator and the confirmer. During operation, the device sends heartbeat request signals to the mobile terminals of the initiator and the confirmer at preset time intervals; When the device receives a heartbeat response from at least one mobile terminal within a preset time interval, it determines that the user is in a normal position. If the device does not receive a heartbeat response from any mobile terminal within the preset warning period, it determines that the user is in a warning state and sends a reminder notification to the mobile terminal. If the device does not receive a heartbeat response from any mobile terminal within the preset confirmation period, it determines that the user has left the device, records the violation of the initiator and confirmer, sends a violation alarm notification, and issues a forced shutdown command to the device.

2. The IoT device security control method according to claim 1, characterized in that, The mechanism based on dual-person collaborative authentication and QR code face-to-face confirmation achieves identity authentication between the initiator and the confirmer, and generates a device activation command through the server, including: The initiator sends a device activation request to the server, and the device activation request includes the device serial number, operation instructions, initiator's identity and authorization credentials; The server receives the request to start and verifies the initiator's permissions and device control mode. Once the verification is successful, it creates a session in the dual-control mode pending confirmation state and generates a unique session code and validity period. The server returns a session code and validity period to the initiator, who receives the returned data and displays a QR code containing the session code through their own client. The confirmer scans the QR code displayed by the initiator using their own client and sends a confirmation request to the server. This confirmation request includes a session code, device identifier, operation instructions, and the confirmer's identity and authorization credentials. The server receives the confirmation request and performs verification. Once the verification is successful, the server generates a device startup command.

3. The IoT device security control method according to claim 2, characterized in that, The validity period of the session code is configured by the security administrator, and the session code automatically expires after a preset time.

4. The IoT device security control method according to claim 2, characterized in that, During the process of the confirmer scanning the QR code displayed by the initiator using their own client, the confirmer and the initiator must be different users.

5. The IoT device security control method according to claim 2, characterized in that, The server receives and verifies the confirmation request, including: verifying the session code validity, device matching, instruction consistency, uniqueness of the confirmer's identity, and uniqueness of the device operated by the confirmer. The verification is deemed successful only when all verifications pass.

6. The IoT device security control method according to claim 1, characterized in that, The method of using a two-way mutual exclusion locking mechanism to lock the identities between the initiator and the confirmer includes: Record the initiator and acknowledgment person who opened the device, and mark the initiator and acknowledgment person as locked; When the identity is locked, when the initiator or confirmer initiates a new device activation request, the server checks whether the initiator or confirmer already has an activated device. If so, the new activation request is rejected; otherwise, a new device activation command is generated. When the initiator or confirmer requests to close the device they participated in, the server receives the closure request and allows the closure operation to be performed. After the device is closed, the initiator and confirmer's identity lock status is released, and the session records are automatically cleared.

7. The IoT device security control method according to claim 1, characterized in that, The recording of the initiator's and confirmer's identity information, and the determination of the currently running device's shutdown permission, includes: After the device is successfully turned on, the identity information of the initiator and the confirmer is bound in the session record, and the closing permission is restricted to only the bound initiator and the confirmer; While the device is powered on, when a user requests to turn off the device, the server verifies whether the requesting user is the initiator or confirmer of the binding. If yes, the server accepts the shutdown request and sends a shutdown command to the device; otherwise, it rejects the shutdown request and the device remains on.

8. A security control system for Internet of Things (IoT) devices, characterized in that, include: The device activation command generation module is used to authenticate the identities of the initiator and the confirmer based on a two-person collaborative authentication and QR code face-to-face confirmation mechanism, and generate a device activation command through the server. The identity locking and permission determination module is used to start the device operation according to the device start command, and use a two-way mutual exclusion locking mechanism to complete the identity locking between the initiator and the confirmer. At the same time, it records the identity information of the initiator and the confirmer, and determines the ownership of the shutdown permission of the currently running device, so as to complete the security control of the IoT device. The Bluetooth heartbeat violation detection module is used to detect operator violations in real time during device operation based on the Bluetooth heartbeat detection mechanism and preset violation judgment rules, and generate corresponding graded warning signals and penalty mechanisms to complete the security control of IoT devices. The Bluetooth heartbeat violation detection module, based on the Bluetooth heartbeat detection mechanism and pre-defined violation judgment rules, detects operator violations in real time during device operation and generates corresponding graded warning signals and penalty mechanisms to achieve security control of IoT devices. After successful device startup, it establishes a Bluetooth connection with the mobile terminals of the initiator and confirmer using its built-in Bluetooth module. During operation, the device sends heartbeat request signals to the mobile terminals of the initiator and confirmer at preset time intervals. When the device receives a heartbeat response from at least one mobile terminal within the preset time interval, it determines that the user is present. When the device does not receive a heartbeat response from any mobile terminal within the preset warning duration, it determines that the user is in a warning state and sends a reminder notification to the mobile terminal. When the device still does not receive a heartbeat response from any mobile terminal within the preset confirmation departure duration, it determines that the user has left the device, records the violations of the initiator and confirmer, sends a violation alarm notification, and simultaneously issues a forced shutdown command to the device.

9. The IoT device security control system according to claim 8, characterized in that, The device activation command generation module, based on a dual-person collaborative authentication and QR code face-to-face confirmation mechanism, realizes the identity authentication of the initiator and the confirmer. When generating a device activation command through the server, the initiator sends a device activation request to the server, which includes the device serial number, operation instructions, initiator identity and authorization credentials. The server receives the activation request and verifies the initiator's authorization and device control mode. When the verification is successful, a session in the dual-person control mode pending confirmation is created, and a unique session code and validity period are generated. The server returns a session code and validity period to the initiator. The initiator receives the returned data and displays a QR code containing the session code through its own client. The confirmer scans the QR code displayed by the initiator through its own client and sends a confirmation request to the server. This confirmation request contains the session code, device identifier, operation instructions, and the confirmer's identity and authorization credentials. The server receives the confirmation request and verifies it. Once the verification is successful, the server generates a device activation command.

10. The IoT device security control system according to claim 8, characterized in that, The identity locking and permission determination module uses a two-way mutual exclusion locking mechanism to lock the identities of the initiator and the confirmer, while recording the identity information of the initiator and the confirmer, and determining the ownership of the shutdown permission of the currently running device to complete the security control of IoT devices. It records the initiator and confirmer who opened the device and marks them as locked. In the identity-locked state, when the initiator or confirmer initiates a new device opening request, the server checks whether the initiator or confirmer already has a device in operation. If so, the new opening request is rejected; otherwise, a new device opening instruction is generated. In the identity-locked state, when the initiator or confirmer requests to close a device they participated in opening, the server receives the closure request and allows the closure operation. After the device is closed, the identity-locked state of the initiator and confirmer is released, and the session record is automatically cleared. After the device is successfully opened, the identity information of the initiator and confirmer is bound to the session record, and the shutdown permission is limited to only the bound initiator and confirmer. While the device is powered on, when a shutdown request is received from any user, the server verifies whether the requesting user is the initiator or confirmer of the binding. If so, the server accepts the shutdown request and sends a shutdown command to the device. If not, the server rejects the shutdown request and the device remains powered on.

Images