CN118740420A - A security protection system and method for an Internet of Things server - Google Patents

Abstract

The invention discloses a safety protection system and method of an Internet of things server, and relates to the technical field of server information safety. The system comprises a data server, a cloud server, a unified password platform, an Internet platform and at least one terminal; the data server is connected with the Internet platform through VPN and interacts with the encrypted data/encrypted service; the data server is respectively connected with the cloud server and the terminal through a system intranet, and performs interaction of encrypted data/encrypted service with the terminal, and uploads the encrypted data to the cloud server for storage; the data server is connected with the unified password platform and sends an encryption request/verification request to the unified password platform; the unified password platform processes the encryption request/verification request and returns a decryption result/verification result to the data server for storage. The invention realizes the external interconnection and the data interaction in the pair of the system and ensures the safety and stability and the data integrity in the data interaction process.

Description

A security protection system and method for an Internet of Things server

Technical Field

The present invention relates to the technical field of server information security, and in particular to a security protection system and method for an Internet of Things server.

Background Art

With the advent of the information age, the Internet of Things has continued to develop rapidly and be widely used. As the Internet of Things technology becomes increasingly mature, many computers and other office terminals in enterprises or units are connected to the Internet, forming a huge Internet of Things network. However, this also provides attackers with more entry points and attack opportunities.

Many enterprises or organizations usually lack adequate security protection measures for IoT devices, which leads to various security threats to IoT systems, such as device hijacking, data leakage, identity forgery, etc. These threats are likely to damage the economic interests of enterprises or organizations. Therefore, security protection for IoT servers has become extremely important.

Summary of the invention

In view of the problem that many enterprises or units in the prior art usually lack sufficient security protection measures in IoT devices, resulting in economic loss of enterprises or units, the present invention provides a security protection system and method for IoT servers, which can ensure the security, stability and data integrity of IoT data servers by cooperating with a unified password platform to perform encryption and verification and other security measures when IoT data servers perform data interaction/business interaction. The specific technical solution is as follows:

A security protection system for an Internet of Things server comprises a data server, a cloud server, a unified cryptographic platform, an Internet platform and at least one terminal; the data server is connected to the Internet platform via a VPN and interacts with the Internet platform for encrypted data/encrypted services; the data server is respectively connected to the cloud server and the terminal via a system intranet, interacts with the terminal for encrypted data/encrypted services, and uploads encrypted data to the cloud server for storage; the data server is connected to the unified cryptographic platform and sends an encryption request/verification request to the unified cryptographic platform; the Internet platform is connected to the unified cryptographic platform via a VPN; the unified cryptographic platform processes the encryption request/verification request and returns a decryption result/verification result to the data server for storage, or returns a decryption result/verification result to the Internet platform.

Preferably, the interaction of encrypted data/encrypted services between the data server and the Internet platform through the VPN includes an encryption and decryption scenario of the data transmission process between the data server and the Internet platform through the VPN;

The encryption and decryption scenarios of the data server performing data transmission with the Internet platform through VPN specifically include:

The data server makes a key encryption request to the unified cryptographic platform, and the unified cryptographic platform encrypts the key and feeds it back to the data server;

The data server sends the encrypted key to the Internet platform for decryption, and the Internet platform sends the encrypted key to the unified cryptographic platform for decryption;

The unified cryptographic platform returns the decrypted key to the Internet platform, and the Internet platform verifies the key and feeds it back to the data server.

Preferably, the interaction of encrypted data/encrypted services between the data server and the Internet platform via VPN includes a protection scenario in which the data server transmits data with the Internet platform via VPN;

The protection scenarios for data transmission between the data server and the Internet platform through VPN specifically include:

The Internet platform sends an account synchronization request to the data server, and the data server transmits the account information to the unified password platform;

The unified cryptographic platform calculates the MAC code and returns the calculated MAC value to the data server;

The data server sends the account information and the MAC value to the Sohu Internet platform, and the Internet platform sends the account information and the MAC value to the unified password platform for verification, and returns the verification result to the Internet platform.

Preferably, the data server interacts with the terminal through the system intranet to perform encrypted data/encrypted services, including a scenario in which the terminal user's login account and password are verified;

The scenarios of the terminal user login account and password verification request specifically include:

When a user logs in to the terminal, he applies for a public key from the unified password service platform through the data server;

After the unified cryptographic service platform generates the key pair, it returns the public key to the data server for storage, and the data server returns the public key to the terminal;

The terminal encrypts the username and password using the public key, and obtains the decrypted password plaintext from the unified password service through the data server;

After decryption, the unified password platform returns the plain text of the password to the data server for verification, and the data server returns the login result to the terminal.

Preferably, the interaction of the encrypted data/encrypted service between the data server and the terminal through the system intranet includes a scenario in which the terminal uploads an unencrypted password to the data server through the system intranet for storage;

The scenario in which the terminal uploads the unencrypted password to the data server for storage via the system intranet specifically includes:

The terminal transmits the unencrypted password to the data server, and the data server calls an API to encrypt the password on the unified password platform; the unified password platform returns the encrypted password to the data server for storage.

Preferably, the data server interacts with the terminal through the system intranet to perform encrypted data/encrypted services, including a data transmission encryption scenario in which the terminal collects user information to the data server;

The data transmission encryption scenario of the terminal collecting user information to the data server specifically includes:

After receiving the sensitive information from the terminal user, the data server encrypts the information using the public key applied for from the unified cryptographic platform;

The data server transmits the encrypted sensitive information of the user, and transmits the encrypted sensitive information of the user to the data server after decrypting the sensitive information through the unified password platform;

The data server sends the user's sensitive information to the cloud server.

Preferably, the interaction of encrypted data/encrypted services between the data server and the terminal through the system intranet includes a complete protection scenario in which the terminal application accesses the data server;

The complete protection scenario of the terminal application accessing the data server specifically includes:

The terminal makes a request to the data server to obtain permission information/change permission information;

After receiving the request information from the terminal, the data server obtains the stored MAC verification code and keycode, constructs an information summary, and sends a verification request to the unified password platform;

The unified password platform verifies the MAC code and returns a verification result table to the data server;

The data server returns the acquired authority information/modified authority information to the terminal.

Preferably, the data server interacts with the terminal through the system intranet to perform encrypted data/encrypted services, including a complete protection scenario in which the terminal stores key data/calls key data to the data server;

The complete protection scenario in which the terminal stores key data/calls key data to the data server specifically includes:

The terminal makes a request to the data server to change key data/call key information;

After receiving the request information from the terminal, the data server obtains the stored MAC verification code and keycode, constructs an information summary, and sends a verification request to the unified password platform;

The unified password platform verifies the MAC code and returns a verification result table to the data server;

The data server returns the called key data/modified key data to the terminal.

Preferably, the data server interacts with the terminal through the system intranet to perform encrypted data/encrypted services, including a complete protection scenario in which the terminal obtains log information from the data server;

The complete protection scenario in which the terminal obtains log information from the data server specifically includes:

The terminal makes a request to the data server to obtain log information;

After receiving the request information from the terminal, the data server obtains the stored MAC verification code and keycode, constructs an information summary, and sends a verification request to the unified password platform;

The unified password platform verifies the MAC code and returns a verification result table to the data server;

The data server returns log information to the terminal.

A security protection method for an Internet of Things server is applied to the security protection system of the Internet of Things server, and the method comprises:

The data server is connected to the Internet platform via VPN and interacts with the Internet platform for encrypted data/encrypted services; the data server is connected to the cloud server and the terminal respectively through the system intranet, interacts with the terminal for encrypted data/encrypted services, and uploads encrypted data to the cloud server for storage; the data server is connected to the unified cryptographic platform and sends an encryption request/verification request to the unified cryptographic platform; the unified cryptographic platform processes the encryption request/verification request and returns the decryption result/verification result to the data server for storage, and returns the decryption result/verification result to the Internet platform.

Compared with the prior art, the present invention has the following beneficial effects:

A security protection system for an Internet of Things server of the present invention utilizes a data server to connect to an Internet platform through a VPN, and interacts with the Internet platform to encrypt data/encrypted services, thereby realizing a system external interaction window and ensuring data security within the system; utilizes a data server to connect to the cloud server and the terminal respectively through a system intranet, and interacts with the terminal to encrypt data/encrypted services, thereby realizing data security within the system, preventing data leakage, and uploading encrypted data to the cloud server for storage, thereby further ensuring data integrity; utilizes a data server to connect to the unified password platform, and sends an encryption request/verification request to the unified password platform; the unified password platform processes the encryption request/verification request, and returns a decryption result/verification result to the data server for storage. The security protection system for an Internet of Things server of the present invention realizes data interaction that establishes mutual trust and matching between the system and the outside world by cooperating with the security measures of encryption and verification processes executed by the unified password platform when the data server performs data interaction/service interaction in the Internet of Things, thereby ensuring the security, stability and data integrity of the Internet of Things server during data interaction.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for the specific embodiments or the description of the prior art. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn according to the actual scale.

FIG1 is a schematic diagram of a security protection system of an Internet of Things server of the present invention.

FIG. 2 is a schematic diagram of a second embodiment of a security protection system for an Internet of Things server of the present invention.

FIG. 3 is a schematic diagram of a third embodiment of a security protection system for an Internet of Things server of the present invention.

FIG. 4 is a schematic diagram of a fourth embodiment of a security protection system for an Internet of Things server of the present invention.

FIG. 5 is a schematic diagram of a fifth embodiment of a security protection system for an Internet of Things server of the present invention.

FIG. 6 is a schematic diagram of a sixth embodiment of a security protection system for an Internet of Things server according to the present invention.

FIG. 7 is a schematic diagram of a seventh embodiment of a security protection system for an Internet of Things server of the present invention.

FIG. 8 is a schematic diagram of an eighth embodiment of a security protection system for an Internet of Things server of the present invention.

FIG. 9 is a schematic diagram of a ninth embodiment of a security protection system for an Internet of Things server according to the present invention.

DETAILED DESCRIPTION

The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and/or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and/or combinations thereof.

It should also be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, the singular forms "a", "an" and "the" are intended to include plural forms unless the context clearly indicates otherwise.

It should be further understood that the term "and/or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

Embodiment 1

Please refer to Figure 1. This embodiment provides a security protection system for an Internet of Things server, including a data server, a cloud server, a unified cryptographic platform, an Internet platform and at least one terminal; the data server is connected to the Internet platform via a VPN, and interacts with the Internet platform for encrypted data/encrypted services; the data server is connected to the cloud server and the terminal respectively through the system intranet, and interacts with the terminal for encrypted data/encrypted services, and uploads encrypted data to the cloud server for storage; the data server is connected to the unified cryptographic platform, and sends an encryption request/verification request to the unified cryptographic platform; the Internet platform is connected to the unified cryptographic platform via a VPN; the unified cryptographic platform processes the encryption request/verification request, and returns the decryption result/verification result to the data server for storage, or returns the decryption result/verification result to the Internet platform.

In this embodiment, the terminal can be regarded as a kind of intelligent office equipment, such as a desktop computer and a platform computer, etc.; of course, it can also be some other intelligent devices that can realize data interaction.

In this embodiment, the cloud server is a simple, efficient, safe, reliable, and scalable computing service. The cloud server can flexibly expand or reduce resources at any time according to application requirements, effectively avoiding the problem of resource waste or shortage; the cloud server has the bandwidth advantage of multi-line interconnection, can intelligently detect and automatically select the best network path, and achieve efficient and fast data transmission; the cloud server supports convenient data backup functions, even in the event of hardware failure, the data is still safe, and can protect the integrity and continuous protection of the data. At the same time, the cloud server can virtualize multiple independent server parts, has excellent security and stability, and is more difficult to be attacked by hackers, further ensuring the data security of the Internet of Things server.

In this embodiment, the unified cryptographic platform is a security management platform based on cryptographic operations, supported by cryptographic devices, based on cryptographic services, and using centralized resource management methods. The main goal of the platform is to simplify the complexity of calling and managing cryptographic devices by application business systems, and to achieve resource scheduling of cryptographic devices through a unified engine interface and scheduling strategy to meet the diverse cryptographic needs of the Internet of Things and mobile terminals. The cryptographic services provided by the unified cryptographic platform mainly include key management services, cryptographic operation services, etc., and provide a unified calling interface for various application systems that have used cryptographic technology. The platform can also provide cryptographic services such as identity authentication, communication encryption, data encryption, and file encryption.

In this embodiment, the data server refers to a server device specifically used for storing, managing and processing data, providing efficient data storage and access capabilities, and meeting the needs of large-scale data processing and analysis. The data server has a strong storage capacity, can store a large amount of data, and provides efficient data access capabilities. The data server can encrypt and securely control the stored data to ensure the security and confidentiality of the data.

In addition, in this embodiment, the data server can also be used as a database server to provide data storage and access services for various applications. At the same time, the data server also provides data storage and processing capabilities for the cloud server.

In a security protection system for an Internet of Things server of the present invention, a data server can be distributed according to a spatial area, and divided into a general data server, and the general data server includes a plurality of secondary data servers, each of which is deployed in a different spatial area, and each secondary data server is connected to a cloud server. The general data server and the secondary data server are directly connected through the system intranet, and the general data server is connected to a group of terminals through the same local area network of the system intranet; the secondary data server is connected to a group of terminals through the same local area network of the system intranet or another local area network of the system intranet, which can realize the spatial difference distribution management within the system.

A security protection system for an Internet of Things server of the present invention utilizes a data server to connect to an Internet platform through a VPN, and interacts with the Internet platform to encrypt data/encrypt services, so that the data server Internet of Things realizes a window for external encrypted interaction of the Internet of Things data server, and also ensures the data security within the system; utilizes a data server to connect to the cloud server and the terminal respectively through the system intranet, and interacts with the terminal to encrypt data/encrypt services, realizes encrypted data interaction within the system, prevents data leakage, and uploads encrypted data to the cloud server for storage, further ensuring the integrity of the data; utilizes a data server to connect to the unified password platform, and sends an encryption request/verification request to the unified password platform; the unified password platform processes the encryption request/verification request, and returns the decryption result/verification result to the data server for storage. The security protection system for the Internet of Things server of the present invention realizes data interaction that establishes mutual trust and matching between the system and the outside and the inside by cooperating with the security measures of encryption and verification processes executed by the unified password platform when the data server performs data interaction/service interaction in the Internet of Things, and ensures the security, stability and data integrity of the Internet of Things server during the data interaction process.

Embodiment 2

Please refer to FIG. 2 , in a preferred embodiment of the application, the interaction of the encrypted data/encrypted service between the data server and the Internet platform via VPN includes an encryption and decryption scenario of the data transmission process between the data server and the Internet platform via VPN;

The encryption and decryption scenarios of the data server performing data transmission with the Internet platform through VPN specifically include:

The data server makes a key encryption request to the unified cryptographic platform, and the unified cryptographic platform encrypts the key and feeds it back to the data server;

The data server sends the encrypted key to the Internet platform for decryption, and the Internet platform sends the encrypted key to the unified cryptographic platform for decryption;

The unified cryptographic platform returns the decrypted key to the Internet platform, and the Internet platform verifies the key and feeds it back to the data server.

When data is transmitted between data servers and Internet platforms in the Internet of Things, it is necessary to encrypt the data to prevent information leakage from being captured. The data sender can use the unified password platform to encrypt the data, and the data receiver can use the unified password platform to decrypt the data. In this way, data integrity verification can be achieved. The MAC code is a unique identifier of the data, which is generated based on the content of the data and a specific key. If the data is tampered with during transmission, the recalculated MAC code will not match the MAC code provided by the sender. This allows the receiver to quickly identify whether the data has been modified, thereby ensuring the integrity of the data; it can also achieve data source verification. The MAC code depends not only on the content of the data, but also on the key used when generating the MAC. Therefore, only entities holding the correct key can generate a valid MAC code to ensure that the data comes from a trusted sender; it can also prevent replay attacks. The MAC code is usually used with some kind of timestamp or random number to ensure that each data message is unique; it can also enhance security. By using a strong encryption algorithm and a key management scheme, the unified password platform can ensure the security of the MAC code. This means that even if an attacker intercepts the data and the MAC code, they cannot forge a valid MAC code or decrypt the original data, thereby improving the security of data transmission.

Embodiment 3

Please refer to FIG. 3 , in a preferred embodiment of the application, the interaction of the data server with the Internet platform through VPN for encrypted data/encrypted services includes a protection scenario in which the data server transmits data with the Internet platform through VPN;

The protection scenarios for data transmission between the data server and the Internet platform through VPN specifically include:

The Internet platform sends an account synchronization request to the data server, and the data server transmits the account information to the unified password platform;

The unified cryptographic platform calculates the MAC code and returns the calculated MAC value to the data server;

The data server sends the account information and the MAC value to the Sohu Internet platform, and the Internet platform sends the account information and the MAC value to the unified password platform for verification, and returns the verification result to the Internet platform.

After the system's data server and Internet platform are interconnected, account synchronization is required. When the account starts to establish a connection, key verification of the data server and the Internet platform is required. During the Internet transmission, the sender can call the unified password platform to encrypt the key before transmitting it. After the receiver obtains the encrypted key, it can call the unified password platform to decrypt it. After the business verification key transmission is encrypted and decrypted, if the verification is successful, the account synchronization will continue, otherwise the operation will be stopped.

In the scenario where multi-platform servers are interconnected and account synchronization is achieved, key verification is to ensure communication security and data integrity. When the account starts to establish a connection, using the key for verification can not only confirm the identity of the two communicating parties, but also prevent the intervention of malicious third parties. In the process of interconnected transmission of keys, calling the unified password platform for encryption can achieve data confidentiality protection. Encryption can ensure that the key will not be stolen or intercepted by unauthorized third parties during transmission. Even if the key is intercepted, since it has been encrypted, without the correct key or decryption method, the interceptor cannot obtain the original content of the key; it can also prevent data tampering. The encrypted key has a digital signature or other integrity verification mechanism during transmission, which can ensure that the key has not been tampered with during transmission; authentication and identity verification are achieved, and the key itself is also used in the authentication and identity verification process. By encrypting the transmission of keys, it can be ensured that only servers with the correct key can communicate with each other, thereby preventing unauthorized servers from accessing the network. Therefore, in the scenario where multi-platform servers are interconnected and account synchronization is achieved, using keys for verification and encrypted transmission through the unified password platform can ensure the security of communication and the integrity of data, reduce security risks and improve the reliability of the system.

Embodiment 4

Please refer to FIG. 4 , in a preferred embodiment of the application, the data server interacts with the terminal through the system intranet to perform encrypted data/encrypted services including a scenario in which the terminal user's login account and password are verified;

The scenarios of the terminal user login account and password verification request specifically include:

When the user logs in to the terminal, he applies to the unified password service platform through the data server to obtain the SM2 public key;

After the unified cryptographic service platform generates the SM2 key pair, it returns the SM2 public key to the data server for storage, and the data server returns the SM2 public key to the terminal;

The terminal encrypts the username and password using the SM2 public key, and obtains the decrypted password plaintext from the unified password service through the data server;

After decryption, the unified password platform returns the plain text of the password to the data server for verification, and the data server returns the login result to the terminal.

When users log in to the system using their account and password, they need to perform encryption and decryption through the unified password service platform, which can ensure the security of user account and password information, prevent information leakage and theft, and protect the normal operation of the system and the legitimate rights and interests of users.

Embodiment 5

Please refer to FIG. 5 , in a preferred embodiment of the application, the interaction of the encrypted data/encrypted service between the data server and the terminal through the system intranet includes a scenario in which the terminal uploads an unencrypted password to the data server for storage through the system intranet;

The scenario in which the terminal uploads the unencrypted password to the data server for storage via the system intranet specifically includes:

The terminal transmits the unencrypted password to the data server, and the data server calls an API to encrypt the password on the unified password platform; the unified password platform returns the encrypted password to the data server for storage.

In addition, when the user changes the password, the password is transmitted to the data server. The data server calls the unified password platform API to encrypt it using the key applied in advance. The data server stores the encrypted password and uploads it to the cloud server for storage. All subsequent passwords must be decrypted and compared to complete the password change.

When storing user passwords, they are encrypted through the unified password platform and then stored in the server.

The encrypted password is protected during storage and transmission. Even if the database is accessed without authorization, the attacker cannot directly read the plain text password, which greatly improves the security of the data. Encryption technology can effectively prevent the password from being leaked. Even if the attacker obtains the data in the database, the original password cannot be easily restored by decryption. The unified password platform usually provides password policy management, password auditing and reporting functions, which helps enterprises better manage and control the generation, storage and use of passwords. Password encryption and storage through the unified password platform can improve data security, prevent password leakage, simplify password management, etc., ensuring the security and availability of enterprise user passwords.

Embodiment 6

Please refer to FIG. 6 , in a preferred embodiment of the application, the data server interacts with the terminal through the system intranet to perform encrypted data/encrypted services, including a data transmission encryption scenario in which the terminal collects user information to the data server;

The data transmission encryption scenario of the terminal collecting user information to the data server specifically includes:

After receiving the sensitive information from the terminal user, the data server encrypts the information using the public key applied for from the unified cryptographic platform;

The data server transmits the encrypted sensitive information of the user, and transmits the encrypted sensitive information of the user to the data server after decrypting it through the unified password platform;

The data server sends the user's sensitive information to the cloud server.

When the system collects sensitive information of users, such as ID number, it is encrypted by the public key applied for on the unified password platform before transmission. After that, it is decrypted on the data server through the unified password platform and then stored in the data server and cloud server. The security of the transmission process is guaranteed. Sensitive data stored on the data server is encrypted and protected to prevent the data from being stolen or tampered with during transmission or storage.

Embodiment 7

Please refer to FIG. 7 , in a preferred embodiment of the application, the data server interacts with the terminal through the system intranet to perform encrypted data/encrypted services, including a complete protection scenario in which the terminal application accesses the data server;

The complete protection scenario of the terminal application accessing the data server specifically includes:

The terminal makes a request to the data server to obtain permission information/change permission information;

After receiving the request information from the terminal, the data server obtains the stored MAC (Message Authentication Code) verification code and keycode, constructs an information digest, and sends a verification request to the unified password platform;

The unified password platform verifies the MAC code and returns a verification result table to the data server;

The data server returns the acquired authority information/modified authority information to the terminal.

The system uses the MAC check code of the unified password platform to implement the integrity protection of access rights and user rights. The MAC check code of the unified password platform can ensure data integrity. The MAC check code can ensure that the configuration file or configuration information has not been tampered with during transmission or storage. Any modification to the data will cause the recalculated MAC value to not match the original MAC value, thereby timely detecting the destruction of data integrity; it can also prevent unauthorized modifications. Since the MAC check code is generated based on the key and message content, only entities with the correct key can generate a valid MAC value. Therefore, even if an attacker gains access to the configuration file, if they do not have the correct key, they cannot modify the configuration file and generate a valid MAC value, thereby preventing unauthorized modifications; it can also simplify key management. Implementing the MAC check code function on the unified password platform can centrally manage and distribute keys. This can reduce the risk of key leakage and improve the efficiency and security of key management. At the same time, it can also ensure that all entities using the MAC check code use the same key to maintain consistency; it can also quickly detect tampering. When the configuration file or configuration information is tampered with, such tampering can be quickly detected by verifying the MAC value. This helps to promptly detect and respond to potential security threats and reduce system risks caused by configuration file tampering. Using the MAC verification code of the unified password platform to implement access rights and integrity protection of user rights can improve the security and reliability of the system, prevent abuse and tampering of rights, and ensure the normal operation of the system and the security of data.

In other embodiments, the system can control which users or devices can access the data server through identity authentication and authorization mechanisms, which can prevent unauthorized access and potential security threats.

Embodiment 8

Please refer to FIG8 , in a preferred embodiment of the application, the data server interacts with the terminal through the system intranet to encrypt data/encrypt services, including a complete protection scenario in which the terminal stores key data/calls key data to the data server;

The complete protection scenario in which the terminal stores key data/calls key data to the data server specifically includes:

The terminal makes a request to the data server to change key data/call key information;

After receiving the request information from the terminal, the data server obtains the stored MAC verification code and keycode, constructs an information summary, and sends a verification request to the unified password platform;

The unified password platform verifies the MAC code and returns a verification result table to the data server;

The data server returns the called key data/modified key data to the terminal.

In terms of the integrity protection of some key and important configuration files or configuration information in the system, the MAC check code of the unified password platform can be used to ensure data integrity. The MAC check code can ensure that the configuration file or configuration information has not been tampered with during transmission or storage. Any modification to the data will cause the recalculated MAC value to not match the original MAC value, thereby timely detecting the integrity of the data being destroyed; it can also prevent unauthorized modifications. Since the MAC check code is generated based on the key and message content, only entities with the correct key can generate a valid MAC value. Therefore, even if an attacker gains access to the configuration file, if they do not have the correct key, they cannot modify the configuration file and generate a valid MAC value, thereby preventing unauthorized modifications; it can also simplify key management. By implementing the MAC check code function on the unified password platform, keys can be centrally managed and distributed. This can reduce the risk of key leakage and improve the efficiency and security of key management. At the same time, it can also ensure that all entities using the MAC check code use the same key to maintain consistency; it can also quickly detect tampering. When the configuration file or configuration information is tampered with, such tampering can be quickly detected by verifying the MAC value. This helps to promptly discover and respond to potential security threats and reduce system risks caused by tampering of configuration files. By using the MAC check code of the unified password platform to implement integrity protection for key and important configuration files or configuration information, the security and reliability of the system can be improved and the risks caused by data tampering can be reduced.

Embodiment 9

Please refer to FIG. 9 , in a preferred embodiment of the application, the data server interacts with the terminal through the system intranet to perform encrypted data/encrypted services, including a complete protection scenario in which the terminal obtains log information from the data server;

The complete protection scenario in which the terminal obtains log information from the data server specifically includes:

The terminal makes a request to the data server to obtain log information;

After receiving the request information from the terminal, the data server obtains the stored MAC verification code and keycode, constructs an information summary, and sends a verification request to the unified password platform;

The unified password platform verifies the MAC code and returns a verification result table to the data server;

The data server returns log information to the terminal.

The system can ensure data integrity by using the MAC check code of the unified password platform to protect the integrity of operation logs and login logs. The MAC check code is a fixed-length value based on the key and message content. The generated MAC value will be the same only when the message content and key remain unchanged. Therefore, if the message is tampered with during transmission or storage, the MAC value calculated by the receiver will not match the MAC value sent by the sender, so that the integrity of the data can be detected to be destroyed; it can also provide message authentication. Since the MAC value is generated based on the key and message content, only the sender with the correct key can generate a valid MAC value. Therefore, the receiver can confirm whether the message comes from a legitimate sender by verifying the MAC value, thereby providing the function of message authentication; it can also prevent replay attacks. MAC can also combine mechanisms such as timestamps or serial numbers to prevent replay attacks. In this case, the MAC value is not only generated based on the message content and key, but also contains dynamic information such as timestamps or serial numbers. In this way, even if the attacker intercepts the previous message and tries to resend it, the receiver can recognize that it is a replayed message and refuse to process it because the timestamp or sequence number is outdated. It can also simplify key management: the MAC check code function is implemented on the unified password platform, and keys can be centrally managed and distributed. This can reduce the risk of key leakage and improve the efficiency and security of key management. It can also improve the overall security of the system. Since the MAC check code provides data integrity protection and message authentication functions, it can improve the security of the entire system. When attackers try to tamper with or forge login logs, it is difficult for them to bypass the detection mechanism of the MAC check code. Using the MAC check code of the unified password platform to implement integrity protection of login logs is a very effective method to improve the security and reliability of the system.

The embodiment of the present application also provides a security protection method for an Internet of Things server, which is applied to the security protection system of the Internet of Things server mentioned above, and the method includes:

The data server is connected to the Internet platform via VPN and interacts with the Internet platform for encrypted data/encrypted services; the data server is connected to the cloud server and the terminal respectively via the system intranet, interacts with the terminal for encrypted data/encrypted services, and uploads encrypted data to the cloud server for storage; the data server is connected to the unified cryptographic platform and sends an encryption request/verification request to the unified cryptographic platform; the unified cryptographic platform processes the encryption request/verification request and returns the decryption result/verification result to the data server for storage, and returns the decryption result/verification result to the Internet platform.

The beneficial effects of the security protection method for an Internet of Things server of this embodiment are the same as the beneficial effects of the security protection system for an Internet of Things server in Embodiment 1, and will not be repeated here.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. These modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be included in the scope of the claims and specification of the present invention.

Claims (10)

1. A security protection system for an Internet of Things server, characterized in that it includes a data server, a cloud server, a unified cryptographic platform, an Internet platform and at least one terminal; the data server is connected to the Internet platform via a VPN, and interacts with the Internet platform for encrypted data/encrypted services; the data server is connected to the cloud server and the terminal respectively through a system intranet, interacts with the terminal for encrypted data/encrypted services, and uploads encrypted data to the cloud server for storage; the data server is connected to the unified cryptographic platform, and sends an encryption request/verification request to the unified cryptographic platform; the Internet platform is connected to the unified cryptographic platform via a VPN; the unified cryptographic platform processes the encryption request/verification request, and returns the decryption result/verification result to the data server for storage, or returns the decryption result/verification result to the Internet platform. 2. A security protection system for an Internet of Things server according to claim 1, characterized in that the interaction of encrypted data/encrypted services between the data server and the Internet platform through VPN includes encryption and decryption scenarios of data transmission between the data server and the Internet platform through VPN; The encryption and decryption scenarios of the data server performing data transmission with the Internet platform through VPN specifically include: The data server makes a key encryption request to the unified cryptographic platform, and the unified cryptographic platform encrypts the key and feeds it back to the data server; The data server sends the encrypted key to the Internet platform for decryption, and the Internet platform sends the encrypted key to the unified cryptographic platform for decryption; The unified cryptographic platform returns the decrypted key to the Internet platform, and the Internet platform verifies the key and feeds it back to the data server. 3. A security protection system for an Internet of Things server according to claim 1, characterized in that the interaction of encrypted data/encrypted services between the data server and the Internet platform through VPN includes a protection scenario in which the data server transmits data with the Internet platform through VPN; The protection scenarios for data transmission between the data server and the Internet platform through VPN specifically include: The Internet platform sends an account synchronization request to the data server, and the data server transmits the account information to the unified password platform; The unified cryptographic platform calculates the MAC code and returns the calculated MAC value to the data server; The data server sends the account information and the MAC value to the Sohu Internet platform, and the Internet platform sends the account information and the MAC value to the unified password platform for verification, and returns the verification result to the Internet platform. 4. A security protection system for an Internet of Things server according to claim 1, characterized in that the interaction of encrypted data/encrypted services between the data server and the terminal through the system intranet includes a scenario in which the terminal user's login account and password are verified; The scenarios of the terminal user login account and password verification request specifically include: When a user logs in to the terminal, he applies for a public key from the unified password service platform through the data server; After the unified cryptographic service platform generates the key pair, it returns the public key to the data server for storage, and the data server returns the public key to the terminal; The terminal encrypts the username and password using the public key, and obtains the decrypted password plaintext from the unified password service through the data server; After decryption, the unified password platform returns the plain text of the password to the data server for verification, and the data server returns the login result to the terminal. 5. A security protection system for an Internet of Things server according to claim 1, characterized in that the interaction of encrypted data/encrypted services between the data server and the terminal through the system intranet includes a scenario in which the terminal uploads an unencrypted password to the data server for storage through the system intranet; The scenario in which the terminal uploads the unencrypted password to the data server for storage through the system intranet specifically includes: the terminal transmits the unencrypted password to the data server, the data server calls the API of the unified password platform to encrypt the password; the unified password platform returns the encrypted password to the data server for storage. 6. A security protection system for an Internet of Things server according to claim 1, characterized in that the interaction of encrypted data/encrypted services between the data server and the terminal through the system intranet includes a data transmission encryption scenario in which the terminal collects user information to the data server; The data transmission encryption scenario of the terminal collecting user information to the data server specifically includes: After receiving the sensitive information from the terminal user, the data server encrypts the information using the public key applied for from the unified cryptographic platform; The data server transmits the encrypted sensitive information of the user, and transmits the encrypted sensitive information of the user to the data server after decrypting the sensitive information through the unified password platform; The data server sends the user's sensitive information to the cloud server. 7. A security protection system for an Internet of Things server according to claim 1, characterized in that the interaction of encrypted data/encrypted services between the data server and the terminal through the system intranet includes a complete protection scenario in which the terminal application accesses the data server; The complete protection scenario of the terminal application accessing the data server specifically includes: The terminal makes a request to the data server to obtain permission information/change permission information; After receiving the request information from the terminal, the data server obtains the stored MAC verification code and keycode, constructs an information summary, and sends a verification request to the unified password platform; The unified password platform verifies the MAC code and returns a verification result table to the data server; The data server returns the acquired authority information/modified authority information to the terminal. 8. A security protection system for an Internet of Things server according to claim 1, characterized in that the interaction of encrypted data/encrypted services between the data server and the terminal through the system intranet includes a complete protection scenario in which the terminal stores key data/calls key data to the data server; The complete protection scenario in which the terminal stores key data/calls key data to the data server specifically includes: the terminal makes a request to the data server to change key data/call key information; After receiving the request information from the terminal, the data server obtains the stored MAC verification code and keycode, constructs an information summary, and sends a verification request to the unified password platform; The unified password platform verifies the MAC code and returns a verification result table to the data server; The data server returns the called key data/modified key data to the terminal. 9. A security protection system for an Internet of Things server according to claim 1, characterized in that the interaction of encrypted data/encrypted services between the data server and the terminal through the system intranet includes a complete protection scenario in which the terminal obtains log information from the data server; The complete protection scenario in which the terminal obtains log information from the data server specifically includes: The terminal makes a request to the data server to obtain log information; After receiving the request information from the terminal, the data server obtains the stored MAC verification code and keycode, constructs an information summary, and sends a verification request to the unified password platform; The unified password platform verifies the MAC code and returns a verification result table to the data server; The data server returns log information to the terminal. 10. A security protection method for an Internet of Things server, characterized in that it is applied to the security protection system for the Internet of Things server according to any one of claims 1 to 9, and the method comprises: The data server is connected to the Internet platform via VPN and interacts with the Internet platform for encrypted data/encrypted services; The data server is connected to the cloud server and the terminal respectively through the system intranet, interacts with the terminal for encrypted data/encrypted services, and uploads encrypted data to the cloud server for storage; the data server is connected to the unified cryptographic platform, and sends an encryption request/verification request to the unified cryptographic platform; the unified cryptographic platform processes the encryption request/verification request, and returns the decryption result/verification result to the data server for storage, and returns the decryption result/verification result to the Internet platform.