WO2018233044A1 - 一种基于过滤网关的物联网数据过滤方法及系统 - Google Patents

一种基于过滤网关的物联网数据过滤方法及系统 Download PDF

Info

Publication number
WO2018233044A1
WO2018233044A1 PCT/CN2017/100007 CN2017100007W WO2018233044A1 WO 2018233044 A1 WO2018233044 A1 WO 2018233044A1 CN 2017100007 W CN2017100007 W CN 2017100007W WO 2018233044 A1 WO2018233044 A1 WO 2018233044A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal device
access node
data packet
response message
signature
Prior art date
Application number
PCT/CN2017/100007
Other languages
English (en)
French (fr)
Inventor
杜光东
Original Assignee
深圳市盛路物联通讯技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市盛路物联通讯技术有限公司 filed Critical 深圳市盛路物联通讯技术有限公司
Publication of WO2018233044A1 publication Critical patent/WO2018233044A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/66—Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information

Definitions

  • the present invention relates to the field of Internet of Things technologies, and in particular, to a method and system for filtering Internet of Things data based on a filtering gateway.
  • the device of each node in the IoT environment is classified into a terminal device, an access node, and a convergence unit, and in some application environments, a filtering gateway is further included, and the terminal device may be a humidity sensor, a lighting, and a status monitor. , oven, etc.
  • the data collected by the terminal device is sent to the access node through the wireless network, and the access node sends the data to the aggregation unit through the Internet, and the aggregation unit completes data analysis and terminal device monitoring. Since data is transmitted in multiple links, data leakage is easy to occur, and an attacker can easily disguise authorized terminal devices for data transmission, resulting in a security risk of IoT data transmission.
  • the embodiment of the invention discloses an Internet of Things data filtering method and system based on a filtering gateway, which is used for solving the security risks of the existing Internet of Things data transmission, so as to improve the security of data transmission.
  • the first aspect of the present invention discloses a method for filtering an Internet of Things data based on a filtering gateway, which may include:
  • the terminal device sends an authorization request to the filtering gateway by using the access node, where the authorization request carries the device identity (ID) number, device type, and Internet Protocol (IP) of the terminal device;
  • ID device identity
  • IP Internet Protocol
  • the filtering gateway sends the authorization request to the aggregation unit, and receives a response message returned by the aggregation unit for authorizing the terminal device, and sends the response message to the access node, where the response message includes the Signature generation algorithm and acquisition time point;
  • the terminal device collects data when the collection time point arrives, acquires a device ID number of the terminal device, and generates a signature encryption based on the signature generation algorithm based on the device ID number.
  • the information, and the collected data is signed according to the signature encryption information, to obtain a data packet, and the data packet is sent to the access node, where the data packet carries the device ID number;
  • the filtering gateway obtains the device ID number from the data packet, and generates signature verification information based on the built-in signature generation algorithm based on the device ID number;
  • the filtering gateway verifies whether the signature of the data packet is correct according to the signature verification information
  • the filtering gateway verifies that the signature of the data packet is correct, the filtering gateway forwards the data packet to the aggregation unit.
  • the filtering gateway sends the authorization request to the aggregation unit, and receives a response returned by the aggregation unit for authorizing the terminal device
  • the message is sent to the access node, including:
  • the sending, by the access node, the response message to the terminal device includes:
  • the access node writes the signature generation algorithm of the response message and the collection time point to the terminal device.
  • the that the access node forwards the data packet to the filtering gateway includes:
  • the access node determines, by using a frequency hopping manner, a frequency domain location of a physical resource block used to send the data packet from a target transmission frequency band;
  • the access node sends the data packet to the filtering gateway on the time-frequency resource corresponding to the frequency domain location of the determined physical resource block.
  • the response message further includes an operation status corresponding to the collection time point, and the terminal device collects data when the collection time point arrives, including:
  • the terminal device monitors the system time of the terminal device in real time, and when the system time reaches the collection time point, the working state of the terminal device is switched to the working state corresponding to the collection time point, and Data collection.
  • the second aspect of the present invention discloses an Internet of Things data filtering system based on a filtering gateway, which may include:
  • the terminal device is configured to send an authorization request to the filtering gateway by using the access node, where the authorization request carries the device identity ID number, the device type, and the Internet Protocol address IP of the terminal device;
  • the filtering gateway is configured to send the authorization request to the aggregation unit, and receive a response message returned by the aggregation unit for authorizing the terminal device, and send the response message to the access node, where the response message is sent.
  • the signature generation algorithm and the acquisition time point are included;
  • the access node is configured to send the response message to the terminal device
  • the terminal device is further configured to collect data when the collection time point arrives, obtain a device ID number of the terminal device, and generate signature encryption information based on the signature generation algorithm according to the device ID number, and according to the The signature encryption information is used to sign the collected data to obtain a data packet, and the data packet is sent to the access node, where the data packet carries the device ID number;
  • the access node is further configured to forward the data packet to the filtering gateway;
  • the filtering gateway is further configured to obtain the device ID number from the data packet, and generate signature verification information based on the built-in signature generation algorithm based on the device ID number;
  • the filtering gateway is further configured to verify, according to the signature verification information, whether the signature of the data packet is correct;
  • the filtering gateway is further configured to forward the data packet to the aggregation unit when verifying that the signature of the data packet is correct.
  • the filtering gateway is configured to send the authorization request to the aggregation unit, and receive the returned by the aggregation unit to authorize the terminal device.
  • the response message is sent to the access node in a specific manner as follows:
  • the filtering gateway is configured to send the authorization request to the aggregation unit, and receive, when the aggregation unit determines that the device type carried by the authorization request belongs to a device type of interest, and returns the used to authorize the a response message of the terminal device, and sending the response message to the connection Into the node.
  • the manner in which the access node sends the response message to the terminal device is specifically:
  • the access node is configured to write the signature generation algorithm of the response message and the collection time point to the terminal device.
  • the manner in which the access node is further used to forward the data packet to the filtering gateway is specifically:
  • the access node is further configured to determine, by using a frequency hopping manner, a frequency domain location of a physical resource block used to send the data packet from a target transmission frequency band, and a time frequency corresponding to a frequency domain location of the determined physical resource block.
  • the resource sends the data packet to the filtering gateway.
  • the response message further includes an operation state corresponding to the collection time point
  • the terminal device is further configured to collect data when the collection time point arrives.
  • the terminal device is further configured to monitor the system time of the terminal device in real time, and when the system time is reached to the collection time point, the working state of the terminal device is switched to the work corresponding to the collection time point. Status and collect data.
  • the embodiment of the invention has the following beneficial effects:
  • the terminal device sends an authorization request to the aggregation unit via the access node and the filtering gateway, where the authorization request carries the device ID number, the device type, and the IP address; when the aggregation unit authorizes the terminal device, the response message is returned.
  • the response message includes a signature generation algorithm and an acquisition time point.
  • the terminal device collects data when the collection time point arrives, obtains the device ID number, generates signature encryption information based on the signature generation algorithm based on the device ID number, and then signs the collected data to obtain a data message, and The data packet is sent to the access node.
  • the access node After receiving the data packet, the access node forwards the data packet to the filtering gateway, and the filtering gateway obtains the device ID number from the data packet, based on the device ID number, and generates the signature based on the built-in filtering gateway.
  • the algorithm generates signature verification information, and verifies whether the signature in the data packet is correct according to the signature verification information. If yes, the data packet is sent to the aggregation unit.
  • the filtering gateway can perform signature verification on the data packet sent by the terminal device in one step to filter the data packet sent by the unauthorized terminal device to improve the security of the data transmission; further, Can also reduce the aggregation order The processing burden of the yuan.
  • FIG. 1 is a schematic diagram of an Internet of Things architecture disclosed by some embodiments of the present invention.
  • FIG. 2 is a schematic flowchart of a method for filtering an Internet of Things data based on a filtering gateway according to an embodiment of the present invention
  • FIG. 3 is another schematic flowchart of a method for filtering an Internet of Things data based on a filtering gateway according to an embodiment of the present invention
  • FIG. 4 is a schematic structural diagram of an Internet of Things data filtering system based on a filtering gateway according to an embodiment of the present invention.
  • the embodiment of the invention discloses a method for filtering an Internet of Things data based on a filtering gateway, which is used for filtering data packets sent by an unauthorized terminal device to improve the security of data transmission. Further, the processing load of the aggregation unit can be reduced. .
  • the embodiment of the invention also correspondingly discloses an Internet of Things data filtering system based on a filtering gateway.
  • FIG. 1 is a schematic diagram of an Internet of Things architecture disclosed in some embodiments of the present invention. It should be noted that FIG. 1 is only some implementations of the present invention.
  • the schematic diagram of the disclosed Internet of Things architecture, and other schematic diagrams obtained by optimizing or deforming on the basis of FIG. 1 are all within the scope of protection of the present invention, and are not exemplified herein.
  • the IoT architecture shown in FIG. 1 may include three layers of a terminal device layer, an access node layer, and an aggregation layer according to functions.
  • the terminal device layer may include a mass-scale terminal device, such as a hygrometer, a smoke sensor, a ventilation device, a rain sensor, an irrigation valve, etc.;
  • the access node layer may include a large number of access nodes connected by the network, and the access node
  • the device may include a router, a repeater, an access point, and the like, which are not limited by the embodiment of the present invention;
  • the access node may use any standard networking protocol, and the access node may implement data parsing between different network standards;
  • the layer may include a filtering gateway and a convergence unit, wherein the filtering gateway may directly or indirectly communicate with each forwarding node of the forwarding node layer through the Internet (not shown in the figure); the aggregation unit may filter the gateway to the forwarding node layer
  • Each forwarding node performs high-level management to control data transmission frequency, network topology, and other networking functions.
  • the aggregation unit can not only analyze and make decisions about the Internet of Things data generated by massive terminal devices, but also obtain information by issuing commands or Configure terminal device parameters (at this time, the data transmission direction Client device); aggregation unit may also be incorporated various services, data from a large to a social network, social networking tools and even from the "point like" sharing the weather.
  • each forwarding node can provide IoT data receiving and receiving services for a large number of terminal devices within its own wireless network coverage, wherein each forwarding node has its own wireless network coverage.
  • the terminal device can have a built-in wireless communication module, which enables each forwarding node to wirelessly communicate with each terminal device within its own wireless network coverage by wireless network communication.
  • the wireless communication module built into the terminal device can input the upper frequency point 470MHz and the lower frequency point 510MHz during production, so that the wireless communication module can automatically define the communication frequency band as 470MHz ⁇ 510MHz, It complies with the provisions of China's SRRC standard; alternatively, it can input the upper frequency point of 868MHz and the lower frequency point of 908MHz, so that the wireless communication module can automatically define the communication frequency band as 868MHz to 908MHz to comply with the European ETSI standard; or, you can enter The frequency is 918MHz and the lower frequency is 928MHz, so the wireless communication module can automatically define the communication frequency band as 918MHz ⁇ 928MHz to meet the requirements of the US FCC standard.
  • the communication frequency band of the wireless communication module can also be defined as conforming to the Japanese ARIB standard or Canada.
  • the provisions of the IC standard, the implementation of the present invention The example is not limited.
  • the terminal device can use Frequency Division Multiple Access (FDMA), Frequency-Hopping Spread Spectrum (FHSS), and Dynamic Time Division Multiple Access (Dynamic Time Division Multiple Access). , DTDMA), and backtracking multiplexing (CSMA) are combined to solve the interference problem.
  • FDMA Frequency Division Multiple Access
  • FHSS Frequency-Hopping Spread Spectrum
  • CSMA Dynamic Time Division Multiple Access
  • FIG. 2 is a schematic flowchart of a method for filtering an Internet of Things data based on a filtering gateway according to an embodiment of the present invention
  • a method for filtering an Internet of Things data based on a filtering gateway may include:
  • the terminal device sends an authorization request to the filtering gateway by using the access node, where the authorization request carries the device ID number, device type, and IP address of the terminal device.
  • the terminal device may send an authorization request to the aggregation unit to obtain an authorization when the terminal device is first turned on and accesses the wireless network or after restarting or after the authorized content (including the following signature generation algorithm validity period arrives).
  • the access node listens in real time within the coverage of the wireless network, and triggers the terminal device to send an authorization request when detecting the access of the new terminal device.
  • the access node broadcasts the interception message in real time within the coverage of the wireless network, and the terminal device in the coverage of the wireless network responds to the interception message to send a response message when receiving the interception message.
  • the response message carries the device type, the device ID number, and the IP address.
  • the access node determines that a new terminal device is accessed according to the device ID number or the IP address. With this embodiment, it is possible to implement that the terminal device sends an authorization request when accessing the network.
  • the filtering gateway sends the authorization request to the aggregation unit, and receives a response message returned by the aggregation unit for authorizing the terminal device, and sends the response message to the access node, where the response message includes a signature generation algorithm and an acquisition time point.
  • the filtering gateway sends an authorization request to the aggregation unit, and receives a response message returned by the aggregation unit for authorizing the terminal device and sends the response message to the access node, including:
  • the filtering gateway sends the authorization request to the aggregation unit, and the receiving aggregation unit returns the authorized terminal device when determining that the device type carried by the authorization request belongs to the device type of interest. Response message and send the response message to the access node.
  • the aggregation unit when receiving the authorization request, extracts the device type of the terminal device from the authorization request, determines whether the device type is the device type that is of interest to the device, and if it is the device type of interest, further The device ID number and ID address are confirmed, and after the confirmation is successful, a response message is returned.
  • the aggregation unit may be configured for the terminal device that is of interest to provide a signature generation algorithm when the devices are used to transmit data, thereby improving the security of data transmission.
  • the access node sends a response message to the terminal device.
  • the access node monitors the validity period of the signature generation algorithm in the response message in real time, and when the validity period of the signature generation algorithm arrives, the terminal device is notified to trigger The terminal device sends an authorization request to the aggregation unit again to obtain the reauthorization.
  • the terminal device is triggered to obtain the authorization again.
  • the sending, by the access node, the response message to the terminal device specifically: the access node acquires the target transmission frequency band, and then determines the time-frequency resource corresponding to the target transmission frequency band, and sends the time-frequency resource to the terminal device on the time-frequency resource.
  • Send the response message the response message is sent to the terminal device in a time division manner, which can reduce interference and improve transmission efficiency.
  • the terminal device collects data when the acquisition time point arrives, obtains the device ID number of the terminal device, generates signature encryption information based on the signature generation algorithm, and signs the collected data according to the signature encryption information.
  • the data packet is obtained, and the data packet is sent to the access node, where the data packet carries the device ID number.
  • the access node forwards the data packet to the filtering gateway.
  • the access node forwarding the data packet to the filtering gateway includes: determining, by the frequency hopping manner, the frequency domain location of the physical resource block used for sending the data packet by using the frequency hopping manner The access node sends a data packet to the filtering gateway on the time-frequency resource corresponding to the determined frequency domain location of the physical resource block.
  • the frequency division method is adopted, which can reduce interference and improve transmission efficiency.
  • the filtering gateway obtains the device ID number from the data packet, and generates signature verification information based on the built-in signature generation algorithm based on the device ID number.
  • the aggregation unit before performing step 201 of the present invention, sends a signature generation algorithm to the filtering gateway, and the filtering gateway receives the signature generation algorithm and saves.
  • the filtering gateway verifies that the signature of the data packet is correct according to the signature verification information. If the verification is correct, the process proceeds to step 208; when the verification fails, the data message is discarded, and the process ends.
  • signature verification information matches the signature encryption information used for data packet signature, the verification is correct. If it does not match, the verification fails.
  • the filtering gateway forwards the data packet to the aggregation unit.
  • the terminal device sends an authorization request to the aggregation unit via the access node and the filtering gateway, where the authorization request carries the device ID number, the device type, and the IP address; when the aggregation unit authorizes the terminal device, the response message is returned.
  • the response message includes a signature generation algorithm and an acquisition time point.
  • the terminal device collects data when the collection time point arrives, obtains the device ID number, generates signature encryption information based on the signature generation algorithm based on the device ID number, and then signs the collected data to obtain a data message, and The data packet is sent to the access node.
  • the access node After receiving the data packet, the access node forwards the data packet to the filtering gateway, and the filtering gateway obtains the device ID number from the data packet, based on the device ID number, and generates the signature based on the built-in filtering gateway.
  • the algorithm generates signature verification information, and verifies whether the signature in the data packet is correct according to the signature verification information. If yes, the data packet is sent to the aggregation unit.
  • the filtering gateway can perform signature verification on the data packet sent by the terminal device in one step to filter the data packet sent by the unauthorized terminal device to improve the security of the data transmission; further, It also reduces the processing load on the aggregation unit.
  • FIG. 3 is another schematic flowchart of a method for filtering an Internet of Things data based on a filtering gateway according to an embodiment of the present invention.
  • a method for filtering an Internet of Things data based on a filtering gateway may include:
  • the terminal device sends an authorization request to the filtering gateway by using the access node, where the authorization request carries the device ID number, device type, and IP address of the terminal device.
  • the aggregation unit needs to strengthen the security of the data sent by the terminal device for the type of device that it is interested in (the device type of the terminal device for collecting important data can be set). Further, in the embodiment of the present invention, the aggregation unit may set a corresponding signature for the terminal devices. An algorithm is generated, which generates a signature encryption information by using a device type as a factor.
  • the authorization request may also carry location information
  • the convergence unit may be configured with location information (the location information of the terminal device for collecting important data may be set).
  • the aggregation unit may set a corresponding signature generation algorithm for the terminal devices, and the signature generation algorithm generates the signature encryption information by using the device type as a factor.
  • the filtering gateway sends the authorization request to the aggregation unit, and receives a response message for the authorized terminal device returned by the aggregation unit, and sends the response message to the access node, where the response message includes a signature generation algorithm, an acquisition time point, and the corresponding time point of the collection.
  • the aggregation unit may specify the collection time point of the collected data to the terminal device, and send the collection time point to the terminal device together in the response message, so that the terminal device can set the collection time point.
  • the aggregation unit further specifies the working state when the terminal device collects data at the time of collection.
  • the working state provided by the embodiment of the present invention may include that the working state of the terminal device may include a dormant state (the terminal device is not activated, and the wireless network Also in the off state), active state and turn off the wireless network, activate the state and turn on the wireless network.
  • the terminal device is in a dormant state, can release wireless network resources, and can also allow the terminal device to be retired and improve its service life.
  • the terminal device consumes less battery energy, thereby improving the battery. Endurance.
  • the “activated state and the closed wireless network” of the terminal device may be set as the working state when the data is collected.
  • the filtering gateway monitors the validity period of the signature generation algorithm of the response message in real time, and sends the validity period of the signature generation algorithm to the aggregation unit when the validity period of the signature generation algorithm arrives.
  • the request message requests a valid signature generation algorithm and sends the requested valid signature generation algorithm to the access node.
  • the access node sends a response message to the terminal device.
  • the access node writes a signature generation algorithm to the terminal device after receiving the signature generation algorithm sent by the aggregation unit and the acquisition time point.
  • the access node also broadcasts a listening message within its wireless network coverage to listen to the terminal device that is not online for a long time to update the routing table in real time.
  • the terminal device monitors the system time of the terminal device in real time, and when the system time reaches the collection time point, the working state of the terminal device is switched to the working state corresponding to the collection time point, and data is collected.
  • the terminal device when the system time reaches the collection time point, switches the working state to the working state corresponding to the collection time point, and starts collecting data until the data is collected. After collecting the data, the terminal device switches the working state from the working state corresponding to the collecting time point to the sleeping state, so as to enter the rest and release the wireless network resources again.
  • the terminal device acquires a device ID number of the terminal device, generates a signature encryption information based on the signature generation algorithm, and signs the collected data according to the signature encryption information to obtain a data packet, and obtains the datagram.
  • the file is sent to the access node, and the data packet carries the device ID number.
  • the access node forwards the data packet to the filtering gateway.
  • the filtering gateway obtains the device ID number from the data packet, and generates signature verification information based on the built-in signature generation algorithm based on the device ID number.
  • the data packet further carries the device type or the location information
  • the filtering gateway extracts the device type or the location information from the data packet, and determines that the device type or the location information matches the interested information of the convergence unit.
  • the device ID number is further obtained, and the signature verification information is generated based on the built-in signature generation algorithm to verify the signature.
  • the filtering gateway verifies that the signature of the data packet is correct according to the signature verification information. If the verification is correct, the process proceeds to step 308. When the verification fails, the data message is discarded, and the process ends.
  • the filtering gateway forwards the data packet to the aggregation unit.
  • the aggregation unit specifies a signature generation algorithm used by the terminal device to generate signature encryption information, a collection time point of the collected data, and an operation status corresponding to the collection time point, and the terminal device switches to the time when the acquisition time point arrives. Specify the working status to work, and then generate the signature encryption information based on the signature generation algorithm based on the device ID number, sign the collected data, obtain the data packet, and report it to the filtering gateway.
  • the filtering gateway uses the device ID number as According to the signature generation algorithm built in the filtering gateway, the signature verification information is generated, and the signature in the data packet is verified according to the signature verification information. If the signature is correct, the data packet is sent to the aggregation unit.
  • the filtering gateway can perform signature verification on the data packet sent by the terminal device in one step to filter the data packet sent by the unauthorized terminal device to improve the security of the data transmission; further, It also reduces the processing load on the aggregation unit.
  • FIG. 4 is a schematic structural diagram of an Internet of Things data filtering system based on a filtering gateway according to an embodiment of the present invention
  • an IoT data filtering system based on a filtering gateway may include:
  • the terminal device 410 is configured to send, by using the access node 420, an authorization request to the filtering gateway 430, and the authorization request carries the device identity ID number, the device type, and the Internet Protocol address IP of the terminal device 410;
  • the filtering gateway 430 is configured to send an authorization request to the aggregation unit 440, and receive a response message returned by the aggregation unit 440 for authorizing the terminal device 410, and send the response message to the access node 420, where the response message includes a signature generation algorithm and an acquisition time point;
  • the access node 420 is configured to send a response message to the terminal device 410.
  • the terminal device 410 is further configured to collect data when the acquisition time point arrives, obtain the device ID number of the terminal device 410, generate signature encryption information based on the signature generation algorithm, and perform the collected data according to the signature encryption information. Signing to obtain a data packet, and sending the data packet to the access node 420, the data packet carrying the device ID number;
  • the access node 420 is further configured to forward the data packet to the filtering gateway 430.
  • the filtering gateway 430 is further configured to obtain a device ID number from the data packet, and generate signature verification information based on the built-in signature generation algorithm based on the device ID number;
  • the filtering gateway 430 is further configured to verify, according to the signature verification information, whether the signature of the data packet is correct;
  • the filtering gateway 430 is further configured to forward the data packet to the aggregation unit 440 when the signature of the data packet is verified to be correct.
  • the terminal device 410 may send the convergence unit 440. Send an authorization request to get an authorization.
  • the access node 420 listens in real time within the coverage of the wireless network.
  • the terminal device 410 is triggered to send an authorization. begging.
  • the access node 420 broadcasts a listening message in real time within its wireless network coverage, and the terminal device 410 in the wireless network coverage responds to the interception message to receive the response message when receiving the interception message.
  • the response message carries the device type, the device ID number, the IP address, and the like.
  • the access node 420 determines that a new terminal device is accessed according to the device ID number or the IP address. With this embodiment, it is possible to implement that the terminal device 410 transmits an authorization request when accessing the network.
  • the filtering gateway 430 is configured to send the authorization request to the aggregation unit 440, and receive the response message returned by the aggregation unit 440 for authorizing the terminal device 410 and send the response message to the access node 420.
  • the filtering gateway 430 is configured to send an authorization request to the aggregation unit 440, and receive a response message returned by the aggregation unit 440 for authorizing the terminal device 410 when determining that the device type carried by the authorization request belongs to the device type of interest, and The response message is sent to the access node 420.
  • the aggregation unit 440 When receiving the authorization request, the aggregation unit 440 extracts the device type of the terminal device 410 from the authorization request, determines whether the device type is the device type of interest, and if it is the device type of interest, further the device The ID number and the ID address are confirmed, and after the confirmation is successful, a response message is returned.
  • the aggregation unit 440 can be configured for the terminal device 410 that is of interest to provide a signature generation algorithm when the devices use to transmit data, thereby improving the security of data transmission.
  • the manner in which the access node 420 sends the response message to the terminal device 410 is specifically:
  • the access node 420 is configured to write the signature generation algorithm and the acquisition time point of the response message to the terminal device 410.
  • the access node 420 monitors the validity period of the signature generation algorithm in the response message in real time, and when the validity period of the signature generation algorithm arrives, the terminal device 410 is notified. To trigger the terminal device 410 to send an authorization request to the aggregation unit 440 again to obtain re-authorization. With this implementation, after the validity period of the signature generation algorithm arrives, the terminal device 410 is triggered again to obtain the authorization.
  • the access node 420 is further configured to forward data packets to the filtering.
  • the manner of the gateway 430 is specifically as follows:
  • the access node 420 is further configured to determine, by using a frequency hopping manner, a frequency domain location of the physical resource block used for sending the data packet from the target transmission frequency band, where the frequency domain location corresponding to the frequency domain location of the determined physical resource block is A data message is sent to the filtering gateway 430.
  • the foregoing response message further includes an operation state corresponding to the collection time point, and the manner in which the terminal device 410 is further configured to collect data when the acquisition time point arrives is specifically:
  • the terminal device 410 is further configured to monitor the system time of the terminal device 410 in real time. When the system time reaches the collection time point, the working state of the terminal device 410 is switched to the working state corresponding to the collection time point, and data is collected.
  • the filtering gateway 430 monitors the validity period of the signature generation algorithm of the response message in real time, when the validity period of the signature generation algorithm arrives,
  • the aggregation unit 440 sends a request message to request a valid signature generation algorithm, and sends the requested valid signature generation algorithm to the access node 420.
  • the filtering gateway 430 can perform signature verification on the data packet sent by the terminal device 410 in one step to filter the data packet sent by the unauthorized terminal device, so as to improve the security of the data transmission; further, the data transmission can be mitigated.
  • the processing burden of the aggregation unit 440 can perform signature verification on the data packet sent by the terminal device 410 in one step to filter the data packet sent by the unauthorized terminal device, so as to improve the security of the data transmission; further, the data transmission can be mitigated.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • PROM Programmable Read-Only Memory
  • EPROM Erasable Programmable Read Only Memory
  • OTPROM One-Time Programmable Read-Only Memory
  • EEPROM Electronically-Erasable Programmable Read-Only Memory
  • CD-ROM Compact Disc Read-Only Memory

Abstract

本发明公开一种基于过滤网关的物联网数据过滤方法及系统，该方法包括：终端设备通过接入节点向过滤网关发送授权请求；过滤网关将授权请求发送给汇聚单元，并将汇聚单元返回的响应消息发送给接入节点；接入节点将响应消息发送给终端设备；终端设备在采集时间点到达时采集数据，并以设备ID号为依据，基于签名生成算法生成签名加密信息以对采集的数据进行签名，以获得数据报文并发送给接入节点；接入节点将数据报文转发给过滤网关；过滤网关以设备ID号为依据，基于内置的签名生成算法生成签名验证信息，以验证数据报文的签名是否正确，如果正确，将数据报文转发给汇聚单元；用于过滤非授权终端设备发送的数据报文，提高数据传输的安全性。

Description

一种基于过滤网关的物联网数据过滤方法及系统 技术领域
本发明涉及物联网技术领域，具体涉及一种基于过滤网关的物联网数据过滤方法及系统。
背景技术
将物联网环境下各个节点的设备分类，分别包括：终端设备、接入节点和汇聚单元，其中，在一些应用环境下还包括过滤网关，终端设备可以是湿敏元件、照明灯、状态监控器、烤箱等等。终端设备采集的数据通过无线网络发送给接入节点，接入节点通过互联网发送给汇聚单元，汇聚单元完成数据分析、终端设备监控等。由于数据在多个环节中传输，容易造成数据泄漏，攻击者也可以轻易伪装授权终端设备进行数据传输，造成物联网数据传输的安全隐患。
发明内容
本发明实施例公开了一种基于过滤网关的物联网数据过滤方法及系统，用于解决现有物联网数据传输的安全隐患，以提高数据传输的安全性。
本发明第一方面公开了一种基于过滤网关的物联网数据过滤方法，可包括：
终端设备通过接入节点向过滤网关发送授权请求，所述授权请求携带所述终端设备的设备身份标识(Identity，简称ID)号、设备类型和互联网协议地址(Internet Protocol，简称IP)；
所述过滤网关将所述授权请求发送给所述汇聚单元，以及接收所述汇聚单元返回的用于授权所述终端设备的响应消息并发送给所述接入节点，所述响应消息包括所述签名生成算法和采集时间点；
所述接入节点将所述响应消息发送给所述终端设备；
所述终端设备在所述采集时间点到达时采集数据，获取所述终端设备的设备ID号，以所述设备ID号为依据，基于所述签名生成算法生成签名加密 信息，并根据所述签名加密信息对采集的数据进行签名，以获得数据报文，并将所述数据报文发送给接入节点，所述数据报文携带所述设备ID号；
所述接入节点将所述数据报文转发给所述过滤网关；
所述过滤网关从所述数据报文中获取所述设备ID号，以所述设备ID号为依据，基于内置的所述签名生成算法生成签名验证信息；
所述过滤网关根据所述签名验证信息验证所述数据报文的签名是否正确；
所述过滤网关在验证所述数据报文的签名正确时，将所述数据报文转发给所述汇聚单元。
作为一种可选的实施方式，在本发明第一方面中，所述过滤网关将所述授权请求发送给所述汇聚单元，以及接收所述汇聚单元返回的用于授权所述终端设备的响应消息并发送给所述接入节点，包括：
所述过滤网关将所述授权请求发送给所述汇聚单元，以及接收所述汇聚单元在确定所述授权请求携带的设备类型属于其感兴趣的设备类型时、返回的用于授权所述终端设备的响应消息，并将所述响应消息发送给所述接入节点。
作为一种可选的实施方式，在本发明第一方面中，所述接入节点将所述响应消息发送给所述终端设备包括：
所述接入节点将所述响应消息的所述签名生成算法和所述采集时间点，写入所述终端设备。
作为一种可选的实施方式，在本发明第一方面中，其特征在于，所述接入节点将所述数据报文转发给所述过滤网关包括：
所述接入节点通过跳频方式从目标传输频段中确定用于发送所述数据报文的物理资源块的频域位置；
所述接入节点在确定的物理资源块的频域位置所对应的时频资源上，向所述过滤网关发送所述数据报文。
作为一种可选的实施方式，在本发明第一方面中，所述响应消息还包括所述采集时间点对应的工作状态，所述终端设备在所述采集时间点到达时采集数据，包括：
所述终端设备实时监控所述终端设备的系统时间，在监控到所述系统时间到达所述采集时间点时，将所述终端设备的工作状态切换至所述采集时间点对应的工作状态，并采集数据。
本发明第二方面公开了一种基于过滤网关的物联网数据过滤系统，可包括：
终端设备，用于通过接入节点向过滤网关发送授权请求，所述授权请求携带所述终端设备的设备身份标识ID号、设备类型和互联网协议地址IP；
所述过滤网关，用于将所述授权请求发送给所述汇聚单元，以及接收所述汇聚单元返回的用于授权所述终端设备的响应消息并发送给所述接入节点，所述响应消息包括所述签名生成算法和采集时间点；
所述接入节点，用于将所述响应消息发送给所述终端设备；
所述终端设备还用于在所述采集时间点到达时采集数据，获取所述终端设备的设备ID号，以所述设备ID号为依据，基于所述签名生成算法生成签名加密信息，并根据所述签名加密信息对采集的数据进行签名，以获得数据报文，并将所述数据报文发送给接入节点，所述数据报文携带所述设备ID号；
所述接入节点还用于将所述数据报文转发给所述过滤网关；
所述过滤网关还用于从所述数据报文中获取所述设备ID号，以所述设备ID号为依据，基于内置的所述签名生成算法生成签名验证信息；
所述过滤网关还用于根据所述签名验证信息验证所述数据报文的签名是否正确；
所述过滤网关还用于在验证所述数据报文的签名正确时，将所述数据报文转发给所述汇聚单元。
作为一种可选的实施方式，在本发明第二方面中，所述过滤网关用于将所述授权请求发送给所述汇聚单元，以及接收所述汇聚单元返回的用于授权所述终端设备的响应消息并发送给所述接入节点的方式具体为：
所述过滤网关用于将所述授权请求发送给所述汇聚单元，以及接收所述汇聚单元在确定所述授权请求携带的设备类型属于其感兴趣的设备类型时、返回的用于授权所述终端设备的响应消息，并将所述响应消息发送给所述接 入节点。
作为一种可选的实施方式，在本发明第二方面中，所述接入节点用于将所述响应消息发送给所述终端设备的方式具体为：
所述接入节点用于将所述响应消息的所述签名生成算法和所述采集时间点，写入所述终端设备。
作为一种可选的实施方式，在本发明第二方面中，所述接入节点还用于将所述数据报文转发给所述过滤网关的方式具体为：
所述接入节点还用于通过跳频方式从目标传输频段中确定用于发送所述数据报文的物理资源块的频域位置，在确定的物理资源块的频域位置所对应的时频资源上，向所述过滤网关发送所述数据报文。
作为一种可选的实施方式，在本发明第二方面中，所述响应消息还包括所述采集时间点对应的工作状态，所述终端设备还用于在所述采集时间点到达时采集数据的方式具体为：
所述终端设备还用于实时监控所述终端设备的系统时间，在监控到所述系统时间到达所述采集时间点时，将所述终端设备的工作状态切换至所述采集时间点对应的工作状态，并采集数据。
与现有技术相比，本发明实施例具有以下有益效果：
在本发明实施例中，终端设备经过接入节点、过滤网关向汇聚单元发送授权请求，该授权请求携带设备ID号、设备类型和IP地址；在汇聚单元授权该终端设备时，将返回响应消息，该响应消息包括签名生成算法和采集时间点。终端设备在该采集时间点到达时采集数据，获取设备ID号，以该设备ID号为依据，基于签名生成算法生成签名加密信息，然后对采集的数据进行签名，获得数据报文，并将该数据报文发送给接入节点。接入节点在接收到数据报文后，将数据报文转发给过滤网关，过滤网关从数据报文中获取设备ID号，以该设备ID号为依据，基于内置在过滤网关中的该签名生成算法生成签名验证信息，根据该签名验证信息验证数据报文中的签名是否正确，如果正确，将数据报文发送给汇聚单元。可以看出，实施本发明实施例，过滤网关能够先一步对终端设备发送的数据报文进行签名验证，以过滤非授权终端设备发送的数据报文，以提高数据传输的安全性；进一步地，也能减轻汇聚单 元的处理负担。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本发明一些实施例公开的物联网架构示意图；
图2为本发明实施例公开的基于过滤网关的物联网数据过滤方法的流程示意图；
图3为本发明实施例公开的基于过滤网关的物联网数据过滤方法的另一流程示意图；
图4为本发明实施例公开的基于过滤网关的物联网数据过滤系统的结构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
需要说明的是，本发明实施例的术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
本发明实施例公开了一种基于过滤网关的物联网数据过滤方法，用于过滤非授权终端设备发送的数据报文，以提高数据传输的安全性；进一步地，也能减轻汇聚单元的处理负担。本发明实施例还相应地公开了一种基于过滤网关的物联网数据过滤系统。
在介绍本发明技术方案之前，先简单介绍本发明一些实施例公开的物联网架构，图1为本发明一些实施例公开的物联网架构示意图，需要说明的是，图1仅为本发明一些实施例公开的物联网架构示意图，其它在图1基础上进行优化或者变形得到的示意图均属于本发明的保护范围，在此不再一一举例。图1所示的物联网架构按照功能划分可以包括终端设备层、接入节点层以及汇聚层三个层。其中，终端设备层可以包括海量规模的终端设备，例如湿度计、烟感器、通风设备、雨量传感器、灌溉阀等等；接入节点层可以包括网络连接的大量的接入节点，接入节点可以包括路由器、中继器、接入点等设备，本发明实施例不作限定；接入节点可以使用任何标准的组网协议，而且接入节点可以在不同的网络制式之间实现数据解析；汇聚层可以包括过滤网关和汇聚单元，其中，过滤网关可以通过互联网与转发节点层的各个转发节点直接或间接通讯连接(在图中未全部示出)；汇聚单元可以通过过滤网关对转发节点层的各个转发节点进行高层管理，从而实现数据传输频率、网络拓扑以及其他组网功能的控制；汇聚单元不仅可以对海量终端设备产生的物联网数据进行分析和决策，还可以通过发指令去获取信息或者配置终端设备参数(此时数据的传输指向终端设备)；汇聚单元还可以引入各种业务，从大数据到社交网络、甚至从社交工具“点赞”到天气分享等。在图1所示的物联网架构中，每一个转发节点可以为其自身无线网络覆盖范围内的海量终端设备提供物联网数据收发服务，其中，每一个转发节点自身无线网络覆盖范围内的每一个终端设备可以内置有无线通讯模块，这使得每一转发节点可以通过无线网络通讯方式与自身无线网络覆盖范围内的每一个终端设备进行无线通讯。在图1所示的物联网架构中，终端设备内置的无线通讯模块在生产时，可以输入上频点470MHz，下频点510MHz，这样无线通讯模块可以自动将通讯频段定义为470MHz～510MHz，以符合中国SRRC标准的规定；或者，也可以输入上频点868MHz，下频点908MHz，这样无线通讯模块可以自动将通讯频段定义为868MHz～908MHz，以符合欧洲ETSI标准的规定；或者，可以输入上频点918MHz，下频点928MHz，这样无线通讯模块可以自动将通讯频段定义为918MHz～928MHz，以符合美国FCC标准的规定；或者，无线通讯模块的通讯频段也可以定义为符合日本ARIB标准或加拿大IC标准的规定，本发明实施 例不作限定。在图1所示的物联网架构中，终端设备可以采用频分复用(Frequency Division Multiple Access，FDMA)、跳频(Frequency-Hopping Spread Spectrum，FHSS)、动态时分复用(Dynamic Time Division Multiple Access，DTDMA)、退避复用(CSMA)相结合的方法来解决干扰问题。
基于图1所示的物联网架构，下面将结合具体实施例，对本发明技术方案进行详细说明。
请参阅图2，图2为本发明实施例公开的基于过滤网关的物联网数据过滤方法的流程示意图；如图2所示，一种基于过滤网关的物联网数据过滤方法可包括：
201、终端设备通过接入节点向过滤网关发送授权请求，该授权请求携带终端设备的设备ID号、设备类型和IP地址。
其中，终端设备在首次开启并接入无线网络时或者在重新启动后或者在授权内容(包括下面的签名生成算法有效期到达后)，终端设备可以向汇聚单元发送授权请求，以获得授权。
作为一种可选的实施方式，接入节点在其无线网络覆盖范围内实时侦听，在侦听到新的终端设备接入时，触发该终端设备发送授权请求。
进一步地，接入节点在其无线网络覆盖范围内实时广播侦听消息，其无线网络覆盖范围内的终端设备在接收到侦听消息时，对该侦听消息进行响应，以发送响应消息，该响应消息携带设备类型、设备ID号和IP地址等，接入节点在接收到响应消息后，根据设备ID号或者IP地址等确定有新的终端设备接入。通过该实施方式，能够实现终端设备在接入网络时发送授权请求。
202、过滤网关将授权请求发送给汇聚单元，以及接收该汇聚单元返回的用于授权终端设备的响应消息并发送给接入节点，响应消息包括签名生成算法和采集时间点。
作为一种可选的实施方式，该过滤网关将授权请求发送给汇聚单元，以及接收该汇聚单元返回的用于授权终端设备的响应消息并发送给接入节点，包括：
该过滤网关将授权请求发送给汇聚单元，以及接收汇聚单元在确定授权请求携带的设备类型属于其感兴趣的设备类型时、返回的用于授权终端设备 的响应消息，并将响应消息发送给接入节点。
具体地，汇聚单元在接收到授权请求时，从授权请求中提取该终端设备的设备类型，判断该设备类型是否为自己感兴趣的设备类型，如果是自己感兴趣的设备类型时，进一步对其设备ID号和ID地址进行确认，在确认成功后，返回响应消息。在该实施方式中，汇聚单元可以针对其感兴趣的终端设备进行设置，以提供这些设备用于传输数据时的签名生成算法，提高数据传输的安全性。
203、接入节点将响应消息发送给终端设备。
作为一种可选的实施方式，接入节点在将响应消息发送给终端设备后，实时监控响应消息中的签名生成算法的有效期，在签名生成算法的有效期到达时，将通知终端设备，以触发终端设备再次向汇聚单元发送授权请求，以获得再次授权。通过该实施方式，实现在签名生成算法有效期到达后，再次触发终端设备去获取授权。
作为一种可选的实施方式，接入节点将响应消息发送给终端设备具体包括：接入节点获取目标传输频段，然后确定目标传输频段所对应的时频资源，在时频资源上向终端设备发送该响应消息。在该实施方式中，采用时分方式向终端设备发送响应消息，能够减少干扰，提高传输效率。
204、终端设备在采集时间点到达时采集数据，获取终端设备的设备ID号，以设备ID号为依据，基于签名生成算法生成签名加密信息，并根据签名加密信息对采集的数据进行签名，以获得数据报文，并将数据报文发送给接入节点，数据报文携带设备ID号。
205、接入节点将数据报文转发给过滤网关。
作为一种可选的实施方式，接入节点将数据报文转发给过滤网关具体包括：接入节点通过跳频方式从目标传输频段中确定用于发送数据报文的物理资源块的频域位置；该接入节点在确定的物理资源块的频域位置所对应的时频资源上，向过滤网关发送数据报文。在该实施方式中，接入节点和过滤网关通信时，采用频分方式，能够减少干扰，提高传输效率。
206、过滤网关从数据报文中获取设备ID号，以设备ID号为依据，基于内置的签名生成算法生成签名验证信息。
作为一种可选的实施方式，在执行本发明步骤201之前，汇聚单元下发签名生成算法给过滤网关，过滤网关接收签名生成算法并保存。
207、过滤网关根据签名验证信息验证数据报文的签名是否正确。其中，在验证正确时，转向步骤208；在验证失败时，则丢弃该数据报文，结束流程。
其中，签名验证信息与用于数据报文签名的签名加密信息若匹配，则验证正确，若不匹配，则验证失败。
208、过滤网关将数据报文转发给汇聚单元。
在本发明实施例中，终端设备经过接入节点、过滤网关向汇聚单元发送授权请求，该授权请求携带设备ID号、设备类型和IP地址；在汇聚单元授权该终端设备时，将返回响应消息，该响应消息包括签名生成算法和采集时间点。终端设备在该采集时间点到达时采集数据，获取设备ID号，以该设备ID号为依据，基于签名生成算法生成签名加密信息，然后对采集的数据进行签名，获得数据报文，并将该数据报文发送给接入节点。接入节点在接收到数据报文后，将数据报文转发给过滤网关，过滤网关从数据报文中获取设备ID号，以该设备ID号为依据，基于内置在过滤网关中的该签名生成算法生成签名验证信息，根据该签名验证信息验证数据报文中的签名是否正确，如果正确，将数据报文发送给汇聚单元。可以看出，实施本发明实施例，过滤网关能够先一步对终端设备发送的数据报文进行签名验证，以过滤非授权终端设备发送的数据报文，以提高数据传输的安全性；进一步地，也能减轻汇聚单元的处理负担。
实施例二
请参阅图3，图3为本发明实施例公开的基于过滤网关的物联网数据过滤方法的另一流程示意图；如图3所示，一种基于过滤网关的物联网数据过滤方法可包括：
301、终端设备通过接入节点向过滤网关发送授权请求，该授权请求携带终端设备的设备ID号、设备类型和IP地址。
其中，汇聚单元针对其感兴趣的设备类型(可以设置了用于采集重要数据的终端设备的设备类型)，需要加强这类终端设备发出的数据的安全。进而，在本发明实施例中，汇聚单元可以针对这些终端设备，设置相应的签名 生成算法，该签名生成算法采用设备类型作为因子，生成签名加密信息。
作为另一种可选的实施方式，授权请求还可以携带有位置信息，汇聚单元针对其感兴趣的位置信息(可以设置了用于采集重要数据的终端设备的位置信息)，需要加强这类终端设备发出的数据的安全。进而，在本发明实施例中，汇聚单元可以针对这些终端设备，设置相应的签名生成算法，该签名生成算法采用设备类型作为因子，生成签名加密信息。
302、过滤网关将授权请求发送给汇聚单元，以及接收汇聚单元返回的用于授权终端设备的响应消息并发送给接入节点，该响应消息包括签名生成算法、采集时间点和该采集时间点对应的工作状态。
作为一种可选的实施方式，汇聚单元可以对终端设备指定采集数据的采集时间点，并在响应消息中将采集时间点一起发送给终端设备，以便终端设备能够设置其采集时间点。
进一步地，汇聚单元还将指定终端设备在采集时间点采集数据时的工作状态，本发明实施例提供的工作状态可以包括终端设备的工作状态可以包括休眠状态(终端设备未被激活，且无线网络也处于关闭状态)、激活状态且关闭无线网络、激活状态且开启无线网络。通常情况下，终端设备处于休眠状态，能够释放无线网络资源，也能够让终端设备得到休整，提高其使用寿命，而且在休眠状态下，终端设备对电池能量的消耗也比较小，从而能够提高电池的续航能力。在本发明实施例中，可以将终端设备的“激活状态且关闭无线网络”设置为采集数据时的工作状态。
作为一种可选的实施方式，过滤网关在将响应消息发送给接入节点之后，过滤网关实时监测该响应消息的签名生成算法的有效期，在该签名生成算法的有效期到达时，向汇聚单元发送请求消息，以请求有效的签名生成算法，并将请求到的有效的签名生成算法发送给接入节点。
303、接入节点将响应消息发送给终端设备。
其中，接入节点在接收汇聚单元下发的签名生成算法和采集时间点之后，将签名生成算法写入该终端设备。
作为一种可选的实施方式，接入节点还将在其无线网络覆盖范围内广播侦听消息，以实时侦听长时间不在线的终端设备，以实时更新路由表。
304、终端设备实时监控终端设备的系统时间，在监控到系统时间到达采集时间点时，将终端设备的工作状态切换至采集时间点对应的工作状态，并采集数据。
在本发明实施例中，终端设备在系统时间到达采集时间点时，将工作状态切换至采集时间点对应的工作状态，开始采集数据，直至采集完数据。终端设备在采集完数据后，将工作状态从采集时间点对应的工作状态切换至休眠状态，以再次进入休整、释放无线网络资源。
305、终端设备获取终端设备的设备ID号，以设备ID号为依据，基于签名生成算法生成签名加密信息，并根据签名加密信息对采集的数据进行签名，以获得数据报文，并将数据报文发送给接入节点，数据报文携带设备ID号。
306、接入节点将数据报文转发给过滤网关。
307、过滤网关从数据报文中获取设备ID号，以设备ID号为依据，基于内置的签名生成算法生成签名验证信息。
作为一种可选的实施方式，数据报文还携带有设备类型或者位置信息，过滤网关从数据报文中提取该设备类型或者位置信息，在确定出设备类型或者位置信息匹配汇聚单元感兴趣的设备类型或者位置信息时，进一步获取设备ID号，以设备ID号为依据，基于内置的签名生成算法生成签名验证信息，对签名进行验证。
308、过滤网关根据签名验证信息验证数据报文的签名是否正确。其中，在验证正确时，转向步骤308；在验证失败时，则丢弃该数据报文，结束流程。
309、过滤网关将数据报文转发给汇聚单元。
在本发明实施例中，汇聚单元指定终端设备用于生成签名加密信息的签名生成算法、采集数据的采集时间点、以及采集时间点对应的工作状态，终端设备在采集时间点到达时，切换到指定工作状态进行工作，然后以设备ID号为依据，基于签名生成算法生成签名加密信息，对采集到的数据进行签名，获得数据报文，然后上报到过滤网关，过滤网关以该设备ID号为依据，基于内置在过滤网关中的该签名生成算法生成签名验证信息，根据该签名验证信息验证数据报文中的签名是否正确，如果正确，将数据报文发送给汇聚单元。 可以看出，实施本发明实施例，过滤网关能够先一步对终端设备发送的数据报文进行签名验证，以过滤非授权终端设备发送的数据报文，以提高数据传输的安全性；进一步地，也能减轻汇聚单元的处理负担。
实施例三
请参阅图4，图4为本发明实施例公开的基于过滤网关的物联网数据过滤系统的结构示意图；如图4所示，一种基于过滤网关的物联网数据过滤系统可包括：
终端设备410，用于通过接入节点420向过滤网关430发送授权请求，授权请求携带终端设备410的设备身份标识ID号、设备类型和互联网协议地址IP；
过滤网关430，用于将授权请求发送给汇聚单元440，以及接收汇聚单元440返回的用于授权终端设备410的响应消息并发送给接入节点420，响应消息包括签名生成算法和采集时间点；
接入节点420，用于将响应消息发送给终端设备410；
终端设备410还用于在采集时间点到达时采集数据，获取终端设备410的设备ID号，以设备ID号为依据，基于签名生成算法生成签名加密信息，并根据签名加密信息对采集的数据进行签名，以获得数据报文，并将数据报文发送给接入节点420，数据报文携带设备ID号；
接入节点420还用于将数据报文转发给过滤网关430；
过滤网关430还用于从数据报文中获取设备ID号，以设备ID号为依据，基于内置的签名生成算法生成签名验证信息；
过滤网关430还用于根据签名验证信息验证数据报文的签名是否正确；
过滤网关430还用于在验证数据报文的签名正确时，将数据报文转发给汇聚单元440。
作为一种可选的实施方式，终端设备410在首次开启并接入无线网络时或者在重新启动后或者在授权内容(包括下面的签名生成算法有效期到达后)，终端设备410可以向汇聚单元440发送授权请求，以获得授权。
作为一种可选的实施方式，接入节点420在其无线网络覆盖范围内实时侦听，在侦听到新的终端设备410接入时，触发该终端设备410发送授权请 求。
进一步地，接入节点420在其无线网络覆盖范围内实时广播侦听消息，其无线网络覆盖范围内的终端设备410在接收到侦听消息时，对该侦听消息进行响应，以发送响应消息，该响应消息携带设备类型、设备ID号和IP地址等，接入节点420在接收到响应消息后，根据设备ID号或者IP地址等确定有新的终端设备接入。通过该实施方式，能够实现终端设备410在接入网络时发送授权请求。
作为一种可选的实施方式，过滤网关430用于将授权请求发送给汇聚单元440，以及接收汇聚单元440返回的用于授权终端设备410的响应消息并发送给接入节点420的方式具体为：
过滤网关430用于将授权请求发送给汇聚单元440，以及接收汇聚单元440在确定授权请求携带的设备类型属于其感兴趣的设备类型时、返回的用于授权终端设备410的响应消息，并将响应消息发送给接入节点420。
汇聚单元440在接收到授权请求时，从授权请求中提取该终端设备410的设备类型，判断该设备类型是否为自己感兴趣的设备类型，如果是自己感兴趣的设备类型时，进一步对其设备ID号和ID地址进行确认，在确认成功后，返回响应消息。在该实施方式中，汇聚单元440可以针对其感兴趣的终端设备410进行设置，以提供这些设备用于传输数据时的签名生成算法，提高数据传输的安全性。
作为一种可选的实施方式，接入节点420用于将响应消息发送给终端设备410的方式具体为：
接入节点420用于将响应消息的签名生成算法和采集时间点，写入终端设备410。
作为一种可选的实施方式，接入节点420在将响应消息发送给终端设备410后，实时监控响应消息中的签名生成算法的有效期，在签名生成算法的有效期到达时，将通知终端设备410，以触发终端设备410再次向汇聚单元440发送授权请求，以获得再次授权。通过该实施方式，实现在签名生成算法有效期到达后，再次触发终端设备410去获取授权。
作为一种可选的实施方式，接入节点420还用于将数据报文转发给过滤 网关430的方式具体为：
接入节点420还用于通过跳频方式从目标传输频段中确定用于发送数据报文的物理资源块的频域位置，在确定的物理资源块的频域位置所对应的时频资源上，向过滤网关430发送数据报文。
作为一种可选的实施方式，上述响应消息还包括采集时间点对应的工作状态，终端设备410还用于在采集时间点到达时采集数据的方式具体为：
终端设备410还用于实时监控终端设备410的系统时间，在监控到系统时间到达采集时间点时，将终端设备410的工作状态切换至采集时间点对应的工作状态，并采集数据。
作为一种可选的实施方式，过滤网关430在将响应消息发送给接入节点420之后，过滤网关430实时监测该响应消息的签名生成算法的有效期，在该签名生成算法的有效期到达时，向汇聚单元440发送请求消息，以请求有效的签名生成算法，并将请求到的有效的签名生成算法发送给接入节点420。
实施上述实施方式，过滤网关430能够先一步对终端设备410发送的数据报文进行签名验证，以过滤非授权终端设备发送的数据报文，以提高数据传输的安全性；进一步地，也能减轻汇聚单元440的处理负担。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序可以存储于一计算机可读存储介质中，存储介质包括只读存储器(Read-Only Memory，ROM)、随机存储器(Random Access Memory，RAM)、可编程只读存储器(Programmable Read-only Memory，PROM)、可擦除可编程只读存储器(Erasable Programmable Read Only Memory，EPROM)、一次可编程只读存储器(One-time Programmable Read-Only Memory，OTPROM)、电子抹除式可复写只读存储器(Electrically-Erasable Programmable Read-Only Memory，EEPROM)、只读光盘(Compact Disc Read-Only Memory，CD-ROM)或其他光盘存储器、磁盘存储器、磁带存储器、或者能够用于携带或存储数据的计算机可读的任何其他介质。
以上对本发明实施例公开的一种基于过滤网关的物联网数据过滤方法及系统进行了详细介绍，本文中应用了具体个例对本发明的原理及实施方式进 行了阐述，以上实施例的说明只是用于帮助理解本发明的方法及其核心思想；同时，对于本领域的一般技术人员，依据本发明的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本发明的限制。

Claims (10)

  1. 一种基于过滤网关的物联网数据过滤方法，其特征在于，包括：
    终端设备通过接入节点向过滤网关发送授权请求，所述授权请求携带所述终端设备的设备身份标识ID号、设备类型和互联网协议地址IP；
    所述过滤网关将所述授权请求发送给所述汇聚单元，以及接收所述汇聚单元返回的用于授权所述终端设备的响应消息并发送给所述接入节点，所述响应消息包括所述签名生成算法和采集时间点；
    所述接入节点将所述响应消息发送给所述终端设备；
    所述终端设备在所述采集时间点到达时采集数据，获取所述终端设备的设备ID号，以所述设备ID号为依据，基于所述签名生成算法生成签名加密信息，并根据所述签名加密信息对采集的数据进行签名，以获得数据报文，并将所述数据报文发送给接入节点，所述数据报文携带所述设备ID号；
    所述接入节点将所述数据报文转发给所述过滤网关；
    所述过滤网关从所述数据报文中获取所述设备ID号，以所述设备ID号为依据，基于内置的所述签名生成算法生成签名验证信息；
    所述过滤网关根据所述签名验证信息验证所述数据报文的签名是否正确；
    所述过滤网关在验证所述数据报文的签名正确时，将所述数据报文转发给所述汇聚单元。
  2. 根据权利要求1所述的方法，其特征在于，所述过滤网关将所述授权请求发送给所述汇聚单元，以及接收所述汇聚单元返回的用于授权所述终端设备的响应消息并发送给所述接入节点，包括：
    所述过滤网关将所述授权请求发送给所述汇聚单元，以及接收所述汇聚单元在确定所述授权请求携带的设备类型属于其感兴趣的设备类型时、返回的用于授权所述终端设备的响应消息，并将所述响应消息发送给所述接入节点。
  3. 根据权利要求1所述的方法，其特征在于，所述接入节点将所述响应消息发送给所述终端设备包括：
    所述接入节点将所述响应消息的所述签名生成算法和所述采集时间点，写入所述终端设备。
  4. 根据权利要求1～3任一项所述的方法，其特征在于，所述接入节点将所述数据报文转发给所述过滤网关包括：
    所述接入节点通过跳频方式从目标传输频段中确定用于发送所述数据报文的物理资源块的频域位置；
    所述接入节点在确定的物理资源块的频域位置所对应的时频资源上，向所述过滤网关发送所述数据报文。
  5. 根据权利要求1所述的方法，其特征在于，所述响应消息还包括所述采集时间点对应的工作状态，所述终端设备在所述采集时间点到达时采集数据，包括：
    所述终端设备实时监控所述终端设备的系统时间，在监控到所述系统时间到达所述采集时间点时，将所述终端设备的工作状态切换至所述采集时间点对应的工作状态，并采集数据。
  6. 一种基于过滤网关的物联网数据过滤系统，其特征在于，包括：
    终端设备，用于通过接入节点向过滤网关发送授权请求，所述授权请求携带所述终端设备的设备身份标识ID号、设备类型和互联网协议地址IP；
    所述过滤网关，用于将所述授权请求发送给所述汇聚单元，以及接收所述汇聚单元返回的用于授权所述终端设备的响应消息并发送给所述接入节点，所述响应消息包括所述签名生成算法和采集时间点；
    所述接入节点，用于将所述响应消息发送给所述终端设备；
    所述终端设备还用于在所述采集时间点到达时采集数据，获取所述终端设备的设备ID号，以所述设备ID号为依据，基于所述签名生成算法生成签名加密信息，并根据所述签名加密信息对采集的数据进行签名，以获得数据报文，并将所述数据报文发送给接入节点，所述数据报文携带所述设备ID号；
    所述接入节点还用于将所述数据报文转发给所述过滤网关；
    所述过滤网关还用于从所述数据报文中获取所述设备ID号，以所述设备ID号为依据，基于内置的所述签名生成算法生成签名验证信息；
    所述过滤网关还用于根据所述签名验证信息验证所述数据报文的签名是否正确；
    所述过滤网关还用于在验证所述数据报文的签名正确时，将所述数据报文转发给所述汇聚单元。
  7. 根据权利要求6所述的系统，其特征在于，所述过滤网关用于将所述授权请求发送给所述汇聚单元，以及接收所述汇聚单元返回的用于授权所述终端设备的响应消息并发送给所述接入节点的方式具体为：
    所述过滤网关用于将所述授权请求发送给所述汇聚单元，以及接收所述汇聚单元在确定所述授权请求携带的设备类型属于其感兴趣的设备类型时、返回的用于授权所述终端设备的响应消息，并将所述响应消息发送给所述接入节点。
  8. 根据权利要求6所述的系统，其特征在于，所述接入节点用于将所述响应消息发送给所述终端设备的方式具体为：
    所述接入节点用于将所述响应消息的所述签名生成算法和所述采集时间点，写入所述终端设备。
  9. 根据权利要求6～8任一项所述的系统，其特征在于，所述接入节点还用于将所述数据报文转发给所述过滤网关的方式具体为：
    所述接入节点还用于通过跳频方式从目标传输频段中确定用于发送所述数据报文的物理资源块的频域位置，在确定的物理资源块的频域位置所对应的时频资源上，向所述过滤网关发送所述数据报文。
  10. 根据权利要求6所述的系统，其特征在于，所述响应消息还包括所述采集时间点对应的工作状态，所述终端设备还用于在所述采集时间点到达时采集数据的方式具体为：
    所述终端设备还用于实时监控所述终端设备的系统时间，在监控到所述系统时间到达所述采集时间点时，将所述终端设备的工作状态切换至所述采集时间点对应的工作状态，并采集数据。
PCT/CN2017/100007 2017-06-21 2017-08-31 一种基于过滤网关的物联网数据过滤方法及系统 WO2018233044A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710473278.4 2017-06-21
CN201710473278.4A CN107276751A (zh) 2017-06-21 2017-06-21 一种基于过滤网关的物联网数据过滤方法及系统

Publications (1)

Publication Number Publication Date
WO2018233044A1 true WO2018233044A1 (zh) 2018-12-27

Family

ID=60068180

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/100007 WO2018233044A1 (zh) 2017-06-21 2017-08-31 一种基于过滤网关的物联网数据过滤方法及系统

Country Status (2)

Country Link
CN (1) CN107276751A (zh)
WO (1) WO2018233044A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109067566B (zh) * 2018-07-09 2021-08-17 奇安信科技集团股份有限公司 一种在静默模式下截图的方法、终端和监管设备
CN111586125A (zh) * 2020-04-28 2020-08-25 济南浪潮高新科技投资发展有限公司 一种物联网系统
CN113286296B (zh) * 2021-05-24 2022-09-30 广东电网有限责任公司广州供电局 无线传感网络的数据处理方法、装置及计算机设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101895888A (zh) * 2010-07-30 2010-11-24 中国移动通信集团重庆有限公司 传感器鉴权的方法、装置及传感器鉴权系统
KR20130005726A (ko) * 2011-07-07 2013-01-16 전북대학교산학협력단 센서 네트워크에서 시그니처를 이용한 노드―ｉｄ 부여 방법
CN103401687A (zh) * 2013-08-01 2013-11-20 广州大学 一种实现无线传感网络节点数据认证的系统及方法
CN103945378A (zh) * 2013-01-21 2014-07-23 中兴通讯股份有限公司 一种终端协同的认证方法及设备中间件
CN106793005A (zh) * 2016-11-14 2017-05-31 深圳市唯传科技有限公司 基于LoRa的物联网设备的漫游通信方法及系统

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101969438B (zh) * 2010-10-25 2013-10-09 胡祥义 一种物联网的设备认证、数据完整和保密传输实现方法
CN104168249A (zh) * 2013-05-16 2014-11-26 中国电信股份有限公司 对数据进行签名的方法、装置和系统
US10063374B2 (en) * 2015-05-31 2018-08-28 Massachusetts Institute Of Technology System and method for continuous authentication in internet of things
CN106656999A (zh) * 2016-11-10 2017-05-10 济南浪潮高新科技投资发展有限公司 一种物联网终端设备安全传输认证方法及装置
CN106851636B (zh) * 2017-01-10 2019-11-08 南京邮电大学 一种应用于无线传感器网络的动态密钥虚假数据过滤方法
CN106686004B (zh) * 2017-02-28 2019-07-12 飞天诚信科技股份有限公司 一种登录认证方法及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101895888A (zh) * 2010-07-30 2010-11-24 中国移动通信集团重庆有限公司 传感器鉴权的方法、装置及传感器鉴权系统
KR20130005726A (ko) * 2011-07-07 2013-01-16 전북대학교산학협력단 센서 네트워크에서 시그니처를 이용한 노드―ｉｄ 부여 방법
CN103945378A (zh) * 2013-01-21 2014-07-23 中兴通讯股份有限公司 一种终端协同的认证方法及设备中间件
CN103401687A (zh) * 2013-08-01 2013-11-20 广州大学 一种实现无线传感网络节点数据认证的系统及方法
CN106793005A (zh) * 2016-11-14 2017-05-31 深圳市唯传科技有限公司 基于LoRa的物联网设备的漫游通信方法及系统

Also Published As

Publication number Publication date
CN107276751A (zh) 2017-10-20

Similar Documents

Publication Publication Date Title
CN111478902B (zh) 电力边缘网关设备及基于该设备的传感数据上链存储方法
CN109922162B (zh) 一种基于区块链的扁平化建筑设备物联网监控系统及方法
Alaba et al. Internet of Things security: A survey
TWI816761B (zh) 藍牙網狀網路及其配網鑑權方法、設備和儲存媒體
Sivanathan et al. Characterizing and classifying IoT traffic in smart cities and campuses
WO2019047631A1 (zh) 基于区块链的微基站通信管理方法、系统及设备
CN102202298B (zh) 结合网络及无线传感器网络终端加入网络的方法
CN107566314A (zh) 一种数据传输系统、方法和设备
CN107396416B (zh) 一种基于数据类型的通信控制方法及系统
CN102202302A (zh) 结合网络及无线传感器网络终端加入网络的方法
WO2017066574A1 (en) Coap enhancements to enable an autonomic control plane
WO2018233044A1 (zh) 一种基于过滤网关的物联网数据过滤方法及系统
WO2018233048A1 (zh) 一种控制物联网终端设备通信的方法及系统
CN110768842B (zh) 一种智能家居通信安全管控方法、系统和存储介质
CN103309307A (zh) 一种基于对象访问控制的智能家电控制方法
WO2018233045A1 (zh) 一种物联网通信模式的切换控制方法及系统
CN102215515B (zh) 一种数据处理方法及通信系统以及相关设备
CN107248993B (zh) 一种基于位置的物联网数据加密方法及系统
CN113596141B (zh) 设备控制权限的设置方法、装置、计算机设备和存储介质
CN112822216A (zh) 一种用于物联网子设备绑定的认证方法
CN105744524A (zh) 一种wia-pa工业无线网络中移动设备入网认证机制
WO2018233031A1 (zh) 一种基于物联网的数据传输控制方法及系统
WO2018233034A1 (zh) 一种物联网数据的传输控制方法及系统
WO2018233035A1 (zh) 一种物联网数据传输的加密方法及系统
CN106937280A (zh) 传感器节点及传感器节点接入移动通信网络的认证方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17915073

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 15/05/2020)

122 Ep: pct application non-entry in european phase

Ref document number: 17915073

Country of ref document: EP

Kind code of ref document: A1