A security internet of things data security hierarchical protection method

Abstract

The present application relates to a kind of security internet of things data security hierarchical protection method, belong to security internet of things data security protection technical field, comprising: receiving security internet of things data, write in data source, collection time, the identification of belonging area and trigger state, the data of unalarmed, unpass, unlinked and unmanual disposal are marked as security mute data;According to area identification and collection time, extract the continuous security mute data in preset collection period, read the alarm data, pass data and patrol data in the same area and adjacent area, when meeting preset correlation condition and corresponding patrol interval, equipment offline period or area unattended state, it is adjusted to blank protection level;According to blank protection level, execute query number limit, time precision truncation, area identification replacement and access audit, make the return result hide original time boundary and original area identification, to reduce reverse inference and leak risk.

Description

Technical Field

[0001] This invention relates to the field of data security protection technology for Internet of Things (IoT) security, specifically a hierarchical protection method for data security in the Internet of Things (IoT) security sector. Background Technology

[0002] In existing technologies for data security processing in security IoT platforms, access control records, patrol records, alarm records, linkage records, and manual handling records are typically stored as independent business data, with access permissions set based on the identity of the accessing entity, job authority, or the sensitivity of the data fields. Chinese patent publication CN113987581A discloses a method for data security protection and viewing / tracing of a smart security community platform. This method encrypts platform data and sets access permissions, and uses digital watermarking to associate access personnel information with the accessed data, enabling path tracing in case of data leakage or attack. While this approach improves access control and leakage tracing capabilities during data viewing on security platforms, its focus is primarily on personnel association, path recording, and leakage tracing after data has been accessed. It fails to further analyze the security gaps reflected in seemingly insensitive data such as data without alarms, access, linkage, or manual handling, under conditions of continuous time, regional topology, and missing security events.

[0003] Existing technologies also include schemes that bind data security levels to data attributes, identity authentication, or authorization permissions. Chinese patent publication CN117407849A discloses an industrial data security protection method and system based on industrial internet technology. This method classifies industrial data into multiple levels and labels them with attribute tags, then performs encryption, permission verification, and authorization matching according to the data level. This reduces the processing burden caused by using the same encryption method for different levels of data and improves the security of terminal access. This type of scheme emphasizes the correspondence between the data's own privacy level, authorization permissions, and encryption strategies, and is suitable for industrial data classification and grading scenarios. However, security IoT data has obvious temporal continuity, spatial adjacency, and event-based evidence characteristics. The absence of alarms, passage, or patrol feedback within a certain period may indirectly expose patrol intervals, equipment offline periods, or unattended areas. Grading based solely on the data fields themselves makes it difficult to identify such security risks formed by combinations of silent states.

[0004] Therefore, in security IoT scenarios, if data is still processed using fixed field hierarchies, static permission allocation, or post-access tracing methods, the accessing entity can continuously request adjacent time periods, adjacent areas, or area identifiers of different granularities to piece together the patrol sequence relationship between key areas and ordinary areas, device offline boundaries, or unattended windows. Although the above information is not alarm data or sensitive identity data in the traditional sense, it can characterize the distribution of security forces and weak protection areas, posing a risk of reverse inference and combined exploitation. Therefore, a technical solution is needed that can correlate silent security data with alarm data, access data, and patrol data in the same or adjacent areas, and adjust the protection level when preset correlation conditions are met, so that silent data does not directly expose security gaps due to its apparent low sensitivity. Summary of the Invention

[0005] The purpose of this invention is to provide a method for graded protection of data security in the Internet of Things (IoT) for security purposes, thereby addressing some of the shortcomings and deficiencies pointed out in the background art.

[0006] The present invention adopts the following technical solution to solve the above-mentioned technical problems: Receive security IoT data, write data source, collection time, area identifier and trigger status into the security IoT data, and mark the data corresponding to the trigger status as security silent data that is not alarmed, not passed, not linked and not manually handled. Extract the continuous security silent data within the preset collection period according to the area identifier and collection time. Read the alarm data, access data and patrol data of the same area and adjacent areas determined according to the preset area topology relationship. When the security silent data and the alarm data, access data and patrol data meet the preset association conditions, and the corresponding patrol interval, equipment offline time period or area unattended state, adjust the security silent data from the pre-configured data security level to the blank protection level. According to the blank protection level, the security silent data is subjected to query count limit, time precision truncation, area identifier replacement and access audit, and the returned results are made to hide the original time boundary and original area identifier that can characterize the patrol interval, equipment offline period or unattended status of the area.

[0007] Furthermore, when extracting continuous security silence data, the data interval between adjacent patrol data that is continuously without alarm and without passage is compared with the alarm data, passage data or patrol data existing in the adjacent area at the same time to form a silence counter-evidence interval, and the blank protection level is triggered by the silence counter-evidence interval.

[0008] Furthermore, when performing the time precision truncation, multiple collection time ranges continuously requested by the same access subject within a preset access time window are read. If each collection time range forms a continuous time range that can cover patrol intervals, equipment offline periods, or unattended area boundaries based on the overlapping, adjacency, or overlapping relationship of time endpoints, the returned result is changed to a cross-time period summary result, and the boundary is hidden.

[0009] Furthermore, when performing the area identifier replacement, if there is a passage order or patrol order between the area corresponding to the area identifier and the preset key protection area, the area identifier is replaced with the superior area identifier that contains both in the preset area hierarchy, and the original area identifiers of adjacent areas are restricted from being returned in the same access result.

[0010] Furthermore, when reading the multiple acquisition time ranges, acquisition time ranges with overlapping, adjacent, or partially overlapping endpoints are grouped into time splicing request groups, and hidden processing intervals are formed with the start and end points corresponding to the time splicing request groups.

[0011] Furthermore, when performing the time precision truncation, for multiple collection time ranges formed by continuously changing the query start and end times of the same access subject, the same truncation granularity is used to generate cross-time period summary results, so that the boundary does not become visible as the query start and end times change.

[0012] Furthermore, when generating the cross-time period summary result, the start and end times that can represent the patrol interval, equipment offline time period, or unattended area are replaced with the corresponding statistical time period, and the number of consecutive requests of the access subject is written into the access audit.

[0013] Furthermore, when determining the passage order or patrol sequence, the access control record and patrol record corresponding to the same access result are read, and the data segments that pass through the area to which they belong and the preset key protection area are set as sequentially associated segments. When the sequentially associated segments are requested continuously within the preset access time window, the area identifier is replaced.

[0014] Furthermore, when the original region identifiers of adjacent regions are returned in the same access result, the original region identifiers of the adjacent regions corresponding to the parent region identifier are written into the blocking list. When subsequent access requests hit the blocking list, the parent region identifier and the summary result are returned, but the original region identifiers of the adjacent regions are not returned.

[0015] Furthermore, if a subsequent access request hits the block list, and the same access subject continues to request the original region identifier of the adjacent region within the preset access time window, or switches the query region level between the parent region identifier and the original region identifier of the adjacent region, then the return method of the parent region identifier and the summary result will be maintained, and the switching request will be written into the access audit.

[0016] This invention, upon receiving security IoT data, writes the data source, collection time, area identifier, and trigger status into the data. Data corresponding to trigger statuses that are not alarmed, not passed through, not linked, and not manually handled are marked as security silent data. This incorporates silent data, which would otherwise be difficult to prioritize for protection, into an identifiable and adjustable data security processing chain. By extracting continuous security silent data within a preset collection period according to the area identifier and collection time, and combining this data with alarm data, passage data, and patrol data from the same and adjacent areas for correlation processing, it can identify silent data corresponding to patrol intervals, device offline periods, or unattended areas, thereby preventing low-trigger-state data from being incorrectly maintained at the ordinary protection level.

[0017] This invention, after meeting preset association conditions, adjusts the security silent data from a pre-configured data security level to a blank protection level. It then performs query limit reduction, time precision truncation, area identifier replacement, and access auditing according to the blank protection level. This results in the returned results concealing the original time boundaries and original area identifiers that characterize patrol intervals, device offline periods, or unattended areas. This processing method prevents access subjects from deriving security blanks through continuous queries, time concatenation, or area comparison, thereby improving the hierarchical protection strength of security IoT data during sharing, querying, and auditing. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating the hierarchical protection process for data security in the Internet of Things (IoT) of this invention.

[0019] Figure 2 This is a comparison chart of the security silence data and the security activities in adjacent areas in Embodiment 1 of the present invention.

[0020] Figure 3 This is a diagram showing the calculation of the coverage ratio of the silent counter-evidence interval in Embodiment 1 of the present invention.

[0021] Figure 4 This is a diagram illustrating the time splicing request group and cross-time period summary processing in Embodiment 1 of the present invention.

[0022] Figure 5 This is a diagram showing the formation of sequentially associated segments in Embodiment 2 of the present invention.

[0023] Figure 6This is a graph showing the calculation of sequentially associated fragment request strength in Embodiment 2 of the present invention.

[0024] Figure 7 This is a diagram illustrating the area identifier replacement and masking list hit processing in Embodiment 2 of the present invention. Detailed Implementation

[0025] As attached Figure 1 As shown, in specific implementation, data generated by the security IoT is first uniformly received. This security IoT data can originate from access control, alarms, patrol records, linkage control, and manual handling records. After receipt, each security IoT data entry is written with its data source, collection time, area identifier, and trigger status, enabling data from different sources to be uniformly associated according to area and time. The data source, collection time, area identifier, and trigger status are written as unified receiving fields into the same data record. If any field is missing, the original record of the corresponding data source is first retrieved to complete it. If the missing field cannot be completed, the data record is marked as pending verification data and will not participate in the blank protection level triggering. The trigger status reflects whether the corresponding data has triggered an alarm, access control, linkage control, or manual handling. When the trigger status corresponds to no alarm, no access control, no linkage control, and no manual handling, it indicates that the data itself has not formed an explicit security event, but its continued occurrence may reflect implicit security conditions such as unattended operation, equipment offline, or patrol gaps within the area. Therefore, it is marked as silent security data.

[0026] After security silence data is generated, it is sorted according to its area identifier and collection time, and continuous security silence data is extracted based on a preset collection cycle. The preset collection cycle is pre-configured according to the normal reporting interval of the corresponding data source in the security IoT, and is used to distinguish between single, occasional silences and continuous silences. For the extracted continuous security silence data, alarm data, access data, and patrol data in the same area are further read, and alarm data, access data, and patrol data in adjacent areas are read according to the preset area topology relationship. The preset area topology relationship is used to record the adjacency, connectivity, and access relationships between areas, enabling the system to determine the data comparison range between the same area and adjacent areas. By comparing the data between the same area and adjacent areas, it is possible to identify whether the security silence data is related to patrol intervals, equipment offline periods, or unattended status of the area. For example, if a certain area continuously generates data showing no alarms, no passage, no linkage, and no manual intervention, while adjacent areas have patrol or passage records during the same period, it indicates that the area's silent state is not ordinary low-risk data, but may expose patrol paths, security gaps, or equipment monitoring deficiencies. Preset correlation conditions can be formed by the continuous silent state of the same area, concurrent security activity records of adjacent areas, equipment online status records, and area duty status records. If the security silent data meets the preset correlation conditions with alarm data, passage data, and patrol data, and corresponds to patrol intervals, equipment offline periods, or unattended areas, then the security silent data will be adjusted from the pre-configured data security level to the blank protection level.

[0027] After adjusting to the blank protection level, security silent data undergoes tiered protection processing. The blank protection level indicates that although the security silent data has not resulted in any explicit security events, its returned results may reveal patrol intervals, equipment offline periods, or unattended areas. Therefore, restrictions need to be placed on the number of queries, time precision, area identifiers, and access procedures. Security silent data that does not trigger the blank protection level is treated as ordinary silent data. Query limit is used to restrict the same access subject from making multiple exploratory accesses to the same type of silent data, preventing the reconstruction of patrol patterns or unattended periods through repeated queries. Time precision truncation converts the original collection time into a statistical period or a generalized time range, preventing the returned results from directly revealing patrol intervals, equipment offline start and end points, or unattended boundaries. Area identifier replacement converts the original area identifier into a higher-level area identifier or a summarized area identifier. The summarized area identifier is generated from a higher-level area identifier that can cover multiple original areas, preventing access subjects from deducing the location of key protection areas through area names, area numbers, or adjacent area relationships. Access auditing records the access subject, access time, query conditions, return method, and protection processing results, providing a basis for subsequent identification of abnormal access behavior. Through the above processing, the returned results no longer directly present the original time boundaries and original area identifiers that can characterize patrol intervals, device offline periods, or unattended status of areas. This reduces the risk of security IoT data being reverse-analyzed and sensitive statuses being inferred without completely eliminating the usability of security silent data.

[0028] In practice, after extracting continuous security silence data, the system uses the time range between two adjacent patrol data points as the basic verification range, reading the data intervals within this time range that are continuously in a state of no alarm and no passage. Two adjacent patrol data points are determined by two patrol records arranged consecutively in the same area or patrol route. If no alarm triggering, access control, linkage control, or manual handling records are generated within this data interval, it indicates that the area has formed a continuous silence state between adjacent patrols. In this case, the system does not directly treat this continuous silence state as low-risk data, but further reads the alarm data, passage data, or patrol data generated in adjacent areas during the same period, and compares the two according to the collection time, area identifier, and event type.

[0029] During the comparison process, if the target area remains continuously without alarms and passage between adjacent patrol data, while adjacent areas simultaneously show alarm triggers, personnel passage, or patrol records, it indicates a reverse discrepancy between the target area's silent state and surrounding security activities. This reverse discrepancy reflects that the target area may be in a patrol interval, monitoring gap, passage gap, or unattended state. The system identifies this continuously non-alarm and non-passage data interval as the silent verification interval and uses it as the basis for triggering the blank protection level. This ensures that the security silent data within this interval is not returned as ordinary silent data, but rather processed according to the blank protection level. The start and end points of the silent verification interval are determined by the continuously non-alarm and non-passage data interval of the target area. If this interval partially overlaps with the basic verification range between adjacent patrol data, the overlapping portion reflecting the continuous silent state is used as the silent verification interval. This method prevents access subjects from using the difference between continuous silent data and surrounding security activity data to reconstruct patrol routes, security gaps, or area duty status.

[0030] In practical implementation, before truncation of time precision, the system first establishes access request records on a per-access-subject basis. Access subjects can be user accounts, terminal identifiers, API call identities, or other identity information that can distinguish the access source. Within a preset access time window, the system reads multiple consecutive query requests initiated by the same access subject and extracts the corresponding collection time range from each query request. The preset access time window is the time range used to statistically analyze consecutive query behaviors of the same access subject and can be pre-configured according to the access interface type, data security level, and audit strategy. If multiple collection time ranges have overlapping, adjacent, or partially overlapping time endpoints, it indicates that the access subject may be probing the original time boundaries of the security silent data by repeatedly changing the query start and end times. The system merges these collection time ranges into time splicing request groups, and uses the start and end points covered by the time splicing request groups to form a hidden processing interval.

[0031] After forming a hidden processing interval, the system compares this interval with patrol records, device online status records, and area duty status records. Device online status records reflect whether the corresponding security IoT devices reported data normally within the collection time range, while area duty status records reflect whether there are duty personnel, patrol personnel, or personnel handling situations in the corresponding area within the collection time range. If a continuous time range formed after merging multiple collection time ranges covers the start and end boundaries of patrol intervals, device offline periods, or unattended areas, detailed results will no longer be returned according to the original collection time. Instead, the returned results will be changed to cross-time period summary results. Cross-time period summary results display the data quantity, data type, statistical period, and summary status within the hidden processing interval. They do not display the specific start and end times of patrol intervals, device offline periods, or unattended areas, thus preventing users from inferring the original time boundaries through differences in adjacent query results.

[0032] When performing time precision truncation, the system also ensures consistency for the behavior of the same access subject continuously changing the query start and end times. Even if the access subject adjusts the query start or end point multiple times, the system uses the same truncation granularity to generate cross-time period summary results. This truncation granularity can be determined according to a preset statistical period, ensuring that similar query requests are returned to the same statistical period, avoiding the boundary positions from being displayed in the returned results due to different query start and end times. The preset statistical period is used to determine the time range of the cross-time period summary results and maintains consistency within the same hidden processing interval. When generating cross-time period summary results, the system replaces the start and end times that can represent patrol intervals, equipment offline periods, or unattended status of areas with the corresponding statistical period, and writes the number of consecutive requests from the access subject, the time splicing request group, the hidden processing interval, and the truncation granularity into the access audit. Through this processing, while retaining the statistical value of security IoT data, it can prevent access subjects from using continuous queries to reverse-engineer patrol gaps, equipment offline boundaries, or unattended time ranges.

[0033] In practical implementation, before replacing the area identifier, the system first reads the area identifier carried in the security IoT data and determines the area, adjacent areas, and superior area identifier corresponding to the area identifier based on the preset area hierarchy. The preset area hierarchy can be formed according to parks, buildings, floors, passages, rooms, or protection units, enabling the system to determine the inclusion and adjacency relationships between multiple areas. The preset area hierarchy is used to determine the hierarchical inclusion range between areas, which is different from the preset area topology relationship used to determine area connectivity and adjacency. If there is a personnel passage sequence or patrol sequence between the area and the preset key protection area, it indicates that the access subject may infer the location, passage path, or patrol route of the key protection area by continuously obtaining the original area identifiers of the two areas. Therefore, the system replaces the area identifier with the superior area identifier that simultaneously includes the area and the preset key protection area in the preset area hierarchy, and restricts the return of the original area identifiers of adjacent areas in the same access result.

[0034] When determining the access sequence or patrol order, the system reads the access control record and patrol record corresponding to the same access result. The access control record reflects the time sequence of personnel or credentials passing through different areas, while the patrol record reflects the order in which patrol personnel pass through different patrol points. The system sorts the access control record and patrol record according to the collection time. If a data segment shows that a person, credential, or patrol object has passed through both their own area and a preset key protection area in sequence, then that data segment is set as a sequentially associated segment. A sequentially associated segment must at least include the area identifiers passed through in sequence, the corresponding collection time, and the event type, enabling the system to identify the path association between the own area and the preset key protection area. If the same access subject continuously requests sequentially associated segments within the preset access time window, it indicates that they may have reconstructed the access path or patrol path between areas through multiple accesses. Based on this, the system triggers area identifier replacement so that the returned result no longer directly exposes the original area relationship between the own area and the preset key protection area.

[0035] When restricting the return of original area identifiers of adjacent areas, the system writes the original area identifiers of adjacent areas corresponding to the superior area identifier into a blocklist. The blocklist is used to record area identifiers that have been identified to have path inference risk, patrol sequence inference risk or key area positioning risk. When a subsequent access request hits the blocklist, the system returns the superior area identifier and the aggregated result, and does not return the original area identifiers of the adjacent areas. The aggregated result is used to return the data volume, data type and affiliated superior area corresponding to the adjacent areas, and does not return the area name, area number or point identifier that can independently locate the adjacent area. If the same access subject continues to request the original area identifiers of adjacent areas within a preset access time window, or the query area level switches between the superior area identifier and the original area identifiers of adjacent areas, the system maintains the return mode of the superior area identifier and the aggregated result, does not restore the original area identifiers as the requested level changes, and writes the switching request, the time of hitting the blocklist, the access subject and the return mode into the access audit. Through this processing, the risk that the access subject reversely restores the location of key protection areas and security routes by using area identifiers, passage sequences and patrol sequences can be reduced. Example

[0036] In this example, the security Internet of Things system of a certain unit receives access control data, alarm data, patrol data, linkage control data and manual disposal records, and writes the data source, collection time, affiliated area identifier and trigger status for each piece of security Internet of Things data. The affiliated area identifier is expressed in the form of a certain area A, a certain area B, etc., and the access subject is expressed as a certain person A, a certain terminal A or a certain interface A. After receiving the data, the system first aggregates the data according to the affiliated area identifier, and then sorts the data according to the collection time, so that data of different sources in the same area can be compared under the same time reference.

[0037] Within a certain collection period, the access control equipment, alarm equipment and linkage control equipment in a certain area A report data according to a preset collection cycle of 5 minutes. The system reads the data records formed in 6 consecutive collection cycles of the certain area A, all of which show no alarm, no passage, no linkage and no manual disposal, thereby marking the data in the 6 collection cycles as security silent data. The security silent data is not directly returned as low-risk data, but is further associated with patrol data, adjacent area data and device online status records for processing.

[0038] The system reads two adjacent pieces of patrol data of the certain area A, the first patrol data corresponds to the 0th minute, and the second patrol data corresponds to the 30th minute, so a 30-minute basic verification range is formed between the adjacent patrol data. Within this basic verification range, the certain area A has continuously no alarm and no passage from the 0th minute to the 30th minute, and at the same time, no linkage control record and manual disposal record are generated. Cooperate Figure 2It can be seen that the silent interval of a certain area A completely coincides with the adjacent patrol interval on the time axis, while the adjacent areas have passage, patrol and review activities at the 8th minute, 16th minute and 24th minute respectively. This parallel display in time is used to illustrate that the silent state of a certain area A is not an isolated low activity state, but rather forms a contrasting difference with the surrounding security activities.

[0039] The system further reads data from adjacent areas determined by the preset regional topology. Area B has an access control record at the 8th minute, area C has a patrol record at the 16th minute, and area D has an alarm verification record at the 24th minute. Figure 2 Security activities in adjacent areas are arranged in the form of short-term events below the silent interval. This is used to reflect that the surrounding areas have actual security activities within the same basic verification range, so that the state of a certain area A that has not been alarmed and has not been passed can be identified as a data interval that may expose patrol intervals, passage gaps or unattended status of the area.

[0040] To clarify the formation process of the silent counter-evidence interval, the system uses the basic verification range between adjacent patrol data as the total duration, and the data interval in which a certain area A has not alarmed and has not been traversed, and which forms a comparison with the security activities in adjacent areas, as the silent counter-evidence interval. Figure 3 Furthermore, the silent counter-evidence interval and the adjacent patrol interval are each represented by a 30-minute bar chart, so that the consistency of their durations can be intuitively correlated with the coverage ratio calculation process. The coverage ratio of the silent counter-evidence interval is calculated according to the following formula:

[0041] in, This represents the coverage ratio of the silent counter-evidence interval, used to indicate the degree to which the silent counter-evidence interval covers adjacent patrol intervals. The duration of the silent counter-evidence interval is derived from the length of time that a certain area A remains without alarms and without passage, and forms an inverse difference from the security activities of adjacent areas during the same period. The total duration of adjacent patrol intervals is derived from the time interval between two consecutive patrols in the same area. This formula is derived from the relationship between the duration of the silent counter-evidence interval and the total duration of adjacent patrol intervals, and is used to confirm whether the silent state covers the main time range in the patrol interval.

[0042] In the data of this embodiment, For 30 minutes, Substituting 30 minutes into the above formula, we get:

[0043] Therefore, it can be seen that the silent counter-evidence interval of a certain region A covers the complete basic verification range between two adjacent patrols. Figure 3 Both sets of bars reached the 30-minute baseline, and the markings indicating that the coverage ratio reached 100% and the blank protection level was triggered demonstrate that the system does not adjust the protection level simply because there is no alarm in a certain area. Instead, under the common conditions that the silent interval covers the patrol interval and there are concurrent security activities in adjacent areas, the system adjusts the security silent data in the silent interval from the pre-configured data security level to the blank protection level.

[0044] After the blank protection level is triggered, the system does not return detailed data for a certain area A every 5 minutes according to the original collection time, but instead enters time precision truncation processing. The system establishes access request records based on the access subject. If an access subject A initiates 3 consecutive query requests within the preset access time window, the first request corresponds to the 2nd to 12th minute, the second request corresponds to the 12th to 22nd minute, and the third request corresponds to the 20th to 30th minute. Figure 4 The three consecutive query requests mentioned above are placed within the same relative time axis. The first and second requests have overlapping endpoints, and the second and third requests have partial overlap. This is used to illustrate that the accessing entity may try to explore the original time boundary by changing the start and end times of the query.

[0045] The system groups the above-mentioned multiple collection time ranges into a time splicing request group, and forms a hidden processing interval based on the earliest start and latest end point covered by the time splicing request group. Figure 4 The hidden processing interval extends from minute 2 to minute 30 and is located below the three query requests, indicating that the merged continuous coverage area is approaching the full patrol interval. The length of the hidden processing interval is calculated using the following formula:

[0046] in, To hide the length of the processing interval, it is used to represent the continuous time range covered after the time splicing request group is merged; It is the latest endpoint among multiple collection time ranges, and its source is the end time of continuous query requests from the same access subject within the preset access time window; The earliest starting point among multiple collection time ranges is derived from the start time of consecutive query requests from the same access subject within a preset access time window. This formula is derived by subtracting the earliest starting point from the latest end point of the time splicing request group, and is used to obtain the continuous coverage area after merging.

[0047] In the data of this embodiment, the earliest start point of multiple collection time ranges is the 2nd minute, and the latest end point is the 30th minute. Substituting into the above formula, we get:

[0048] Therefore, it can be seen that the length of the hidden processing interval is 28 minutes, and this hidden processing interval continuously overlaps with the patrol interval from minute 0 to minute 30, which can cover the main time range and end boundary of the patrol interval. Figure 4 By displaying the cross-time period summary range as the complete statistical period from minute 0 to minute 30, it is further explained that the system does not change the return boundary as the request endpoint of the access subject changes, but instead merges multiple consecutive requests and returns them according to the same statistical period.

[0049] When generating cross-time period summary results, the system uses the same truncation granularity to process consecutive query requests from the same user. For example, minutes 0 to 30 are grouped into the same statistical time period, and the returned results display the quantity of security silent data, data type, summary identifier of the region, and summary status within that statistical time period. Figure 4 The mid-to-span time period summary range is located below the hidden processing interval. This indicates that the returned results are output in units of statistical time periods. The original collection time, patrol interval boundaries, unattended status boundaries, and endpoints of each query request are not directly presented in the returned results.

[0050] In access auditing, the system records the number of consecutive requests, time-stitched request groups, hidden processing intervals, truncation granularity, and return methods for a specific access subject A. The number of consecutive requests is recorded as 3; the time-stitched request groups are recorded as minutes 2 to 12, 12 to 22, and 20 to 30; the hidden processing interval is recorded as minutes 2 to 30; and the return method is recorded as a summary result across time periods. Combined with... Figures 2 to 4 The data comparison, coverage ratio calculation, and time splicing and merging process shown in the figure allows the system to retain the statistical value of security IoT data while preventing access subjects from using continuous silent data and continuous query requests to reverse-engineer patrol gaps, device offline boundaries, or unattended time ranges in areas. Example

[0051] In this embodiment, after the security silence data has triggered the blank protection level, the security IoT system of a certain unit performs a replacement process on the area identifier in the returned result. The system reads the area identifier carried in the security IoT data and determines the belonging area, the preset key protection area, and the parent area identifier corresponding to both based on the preset area hierarchy. The preset area hierarchy is used to represent the inclusion relationship between different areas, enabling the system to retain the data statistical value with a higher-level area identifier without returning the original area identifier.

[0052] In a specific processing scenario, region A is the parent region, region B is a preset key protection region, and region C is a superior region that includes both regions A and B. There is a sequential relationship between region A and region B in terms of personnel access paths and patrol routes. If the same accessing entity continuously obtains the original region identifiers and corresponding event times for both, it may be possible to reconstruct the location, access paths, or patrol routes of the key protection region. Therefore, the system does not directly return the original region identifiers of region A and region B, but instead replaces them with the identifier of the superior region of region C.

[0053] When determining the access sequence or patrol order, the system reads the access control record and patrol record corresponding to the same access result. The access control record shows that the same pass passed through area A at the 2nd minute and through area B at the 5th minute. The patrol record shows that patrolman A passed through area A at the 10th minute and through area B at the 13th minute. Figure 5 The access control records and patrol records are presented in the same 15-minute access time window, showing the sequential relationship between them. Both the access control sequence fragment and the patrol sequence fragment are shown to be in the same direction from a certain area A to a certain area B, which is used to illustrate that the system can identify data fragments with a consistent path pointing from different data sources.

[0054] The sequential association fragment includes at least the area identifiers traversed, the collection time, the event type, and the access subject information. The access control record shows the same credential passing through area A and area B sequentially, reflecting the order of personnel passage. Similarly, the patrol record shows a patroller A passing through area A and area B sequentially, reflecting the patrol order. Figure 5 The two sequential segments are located on the access control record and the patrol record, respectively. Although they come from different sources, they both form a sequential relationship from a certain area A to a certain area B within the same access time window. Therefore, the system sets this type of data segment as a sequentially associated segment.

[0055] To ensure the triggering process for region identifier replacement is clear, the system calculates the request strength based on the number of times segments are requested sequentially within a preset access time window and the window length. The request strength is calculated using the following formula:

[0056] in, Sequential Fragment Request Intensity: This indicates the density of sequential fragment requests made by the same access subject within a unit of time. The number of times a sequentially associated fragment is requested by the same access subject, and its source is the number of data requests that hit the same passage order or patrol order in the access request record; The preset access time window length is derived from the access behavior audit time range pre-configured by the system. This formula is derived by dividing the number of requests by the access time window length and is used to reflect the concentration of continuous request behavior over time.

[0057] In the data of this embodiment, a certain access subject A requests the access records and patrol records corresponding to a certain area A and a certain area B three times consecutively within a preset access time window of 15 minutes. Substituting into the above formula, we get:

[0058] If the system's preset request intensity is 1 / 6 times per minute, then the request intensity calculated in this embodiment is 1 / 5 times per minute. Figure 6 The actual request intensity and the preset request intensity are displayed in a bar chart, with the position of 1 / 6 times per minute marked by a trigger baseline. It can be seen that the actual request intensity is higher than the trigger baseline. Based on this, the system triggers a region identifier replacement, uniformly replacing the original region identifiers of region A and region B with the parent region identifier of region C, and adjusting the returned content to a summary result within the range of region C.

[0059] When generating summary results, the system retains the data quantity, event type, and parent region identifier, but does not return the original region name, region number, or location identifier that can individually locate a specific region A or region B. For adjacent regions involved in the same access result, the system restricts the simultaneous return of their original region identifiers to prevent the access subject from reconstructing the passage path or patrol path based on the sequential relationship between adjacent region identifiers.

[0060] The system further adds the original region identifiers of adjacent regions corresponding to region C to a blocking list. This blocking list records region identifiers that have been identified as having path inference risk, patrol order inference risk, or key area location risk. When a subsequent access request hits the blocking list, the system continues to return the parent region identifier of region C and the summary result, but does not return the original region identifiers of regions A and B. Figure 7 The four processing levels—original possible return, replacement return, blocked list, and subsequent hits—are presented side by side to illustrate that once the original region identifier moves from the possible return state to the blocked list, subsequent queries will still maintain the return method of the upper-level region summary, even if the level changes.

[0061] To ensure the masking list's effect on suppressing area identifier exposure is clearly defined, the system calculates the area identifier exposure suppression quantity based on the original number of area identifiers that might have been returned and the actual number of original area identifiers returned. The area identifier exposure suppression quantity is calculated using the following formula:

[0062] in, The number of region identifiers exposed and suppressed is used to indicate the number of original region identifiers that were not returned to the accessing subject due to region identifier replacement and mask list processing; This represents the number of original region identifiers of adjacent regions that might have been returned, and its source is the original region identifiers corresponding to the region to which the access request hits and the preset key protection region. This represents the actual number of original region identifiers returned, derived from the number of original region identifiers that the system directly returns in the access results after region identifier replacement. This formula is derived by subtracting the actual number of returned identifiers from the originally possible number, and is used to indicate the degree to which the return of original region identifiers is suppressed.

[0063] In this embodiment, the data requested by a certain access subject A might originally return two original region identifiers, region A and region B. Therefore The value is 2. After the system triggers the area identifier replacement, the actual number of original area identifiers returned in the access results is 0. Substituting 0 into the above equation, we get:

[0064] Therefore, it can be seen that two original region identifiers were suppressed and returned in the results of this access. Figure 7 Regions A and B are changed from a state where they might return a value to a state where they are not directly output. The access result is changed to a summary of region C. The mask list records both regions A and B, thus preventing the accessing entity from directly obtaining the original regional relationship between region A and region B from the same access result.

[0065] During subsequent access, access subject A continues to request the original region identifier of region A or region B, or switches the query region level between region C, region A, and region B. Since this request hits the block list, the system retains the parent region identifier of region C and the return method of the summary results, and does not restore the original region identifier as the query region level changes. Furthermore, the system continues to record the request, the level switching request, the time the block list is hit, the access subject, and the return method in the access audit. Figure 7 Subsequent hits at higher levels will redirect queries for region C, region A, and region B to a summary of region C, demonstrating the continued constraint of the block list on subsequent requests.

[0066] Through the above methods, the system can replace the area identifiers with access order or patrol order without deleting the statistical value of security IoT data, and restrict the return of the original area identifiers in subsequent accesses through a blocking list, thereby reducing the risk that the access subject can reverse the location of key protection areas and security routes by using area identifiers, access order and patrol order.

Claims

1. A method for graded protection of data security in the Internet of Things (IoT) for security purposes, characterized in that, Receive security IoT data, write data source, collection time, area identifier and trigger status into the security IoT data, and mark the data corresponding to the trigger status as security silent data that is not alarmed, not passed, not linked and not manually handled. Extract the continuous security silent data within the preset collection period according to the area identifier and collection time. Read the alarm data, access data and patrol data of the same area and adjacent areas determined according to the preset area topology relationship. When the security silent data and the alarm data, access data and patrol data meet the preset association conditions, and the corresponding patrol interval, equipment offline time period or area unattended state, adjust the security silent data from the pre-configured data security level to the blank protection level. According to the blank protection level, the security silent data is subjected to query count limit, time precision truncation, area identifier replacement and access audit, and the returned results are made to hide the original time boundary and original area identifier that can characterize the patrol interval, equipment offline period or unattended status of the area.

2. The security IoT data security classification protection method according to claim 1, characterized in that, When extracting continuous security silent data, the data interval between adjacent patrol data that is continuously without alarm and without passage is compared with the alarm data, passage data or patrol data existing in the adjacent area at the same time to form a silent counter-evidence interval, and the blank protection level is triggered by the silent counter-evidence interval.

3. The security IoT data security classification protection method according to claim 1, characterized in that, When performing the time precision truncation, read multiple collection time ranges continuously requested by the same access subject within the preset access time window. If each collection time range forms a continuous time range that can cover the patrol interval, equipment offline time period or unattended area boundary according to the overlapping, adjacency or overlapping relationship of the time endpoints, then change the returned result to a cross-time period summary result and hide the boundary.

4. The security IoT data security classification protection method according to claim 1, characterized in that, When performing the area identifier replacement, if there is a passage order or patrol order between the area corresponding to the area identifier and the preset key protection area, the area identifier is replaced with the superior area identifier that contains both in the preset area hierarchy, and the original area identifiers of adjacent areas are restricted from being returned in the same access result.

5. The security IoT data security classification protection method according to claim 3, characterized in that, When reading the multiple collection time ranges, collection time ranges with overlapping, adjacent, or partially overlapping endpoints are grouped into time splicing request groups, and hidden processing intervals are formed with the start and end points corresponding to the time splicing request groups.

6. The security IoT data security classification protection method according to claim 3, characterized in that, When performing the time precision truncation, for multiple collection time ranges formed by continuously changing the query start and end times of the same access subject, the same truncation granularity is used to generate cross-time period summary results, so that the boundary does not become visible as the query start and end times change.

7. The security IoT data security classification protection method according to claim 3, characterized in that, When generating the cross-time period summary results, the start and end times that can represent patrol intervals, equipment offline periods, or unattended areas are replaced with the corresponding statistical time periods, and the number of consecutive requests by the access subject is written into the access audit.

8. The security IoT data security classification protection method according to claim 4, characterized in that, When determining the passage order or patrol order, the access control record and patrol record corresponding to the same access result are read, and the data segments that pass through the area and the preset key protection area in sequence are set as sequentially associated segments. When the sequentially associated segments are continuously requested within the preset access time window, the area identifier is replaced.

9. A method for graded protection of security IoT data according to claim 4, characterized in that, When the original region identifiers of adjacent regions are returned in the same access result, the original region identifiers of the adjacent regions corresponding to the parent region identifier are written into the blocking list. When subsequent access requests hit the blocking list, the parent region identifier and the summary result are returned, but the original region identifiers of the adjacent regions are not returned.

10. A method for graded protection of security IoT data according to claim 9, characterized in that, If a subsequent access request hits the block list, and the same access subject continues to request the original region identifier of the adjacent region within the preset access time window, or queries the region level to switch between the parent region identifier and the original region identifier of the adjacent region, then the return method of the parent region identifier and the summary result will be maintained, and the switching request will be written into the access audit.

Images