2025年第8期总第752期
Niuh Haohao Zhang Yitong
Miao Jianchen Yao Jun Lei Chi
Xi’an Aviation Computing Technology Research Institute, China Aviation Industry Corporation
Abstract:/ABSTRACT
The Internet of Things (IoT) technology, as one of the core supporting technologies for the digital transformation of enterprises, plays a crucial role in the transformation of quality inspection processes for avionics products. Compared to traditional IT information systems, IoT software systems involve a more complex array of connected devices, a broader scope of information exchange, and higher requirements for real-time data processing and reliable data storage. Consequently, this brings new changes and challenges in system security protection. In this context, this paper explores the security challenges faced by IoT software systems, including device vulnerabilities, communication security, and data privacy, and proposes corresponding methods for constructing and implementing security strategies. By employing technologies such as encryption, access control, and secure update mechanisms, a highly reliable, highly available, and highly trustworthy intelligent quality inspection IoT software system has been established, providing a solid guarantee for quality control of avionics products.
Keywords:/KEY WORDS
IoT systems; intelligent quality inspection; security strategies; application security; data security
Classification Number:TP393.0
0 Introduction
The Internet of Things (IoT), as an important component of the new generation of information technology, has become a crucial supporting technology for the digital transformation of enterprises due to its powerful data collection, processing, and analysis capabilities[1]. However, with the rapid increase in the number of IoT-connected devices and the continuous expansion of application scenarios, the security issues of IoT software systems have become increasingly severe. Security vulnerabilities in IoT software systems can lead to serious consequences such as unauthorized control of devices, leakage of user data, and interruption of critical business operations, resulting in significant economic losses for enterprises. Therefore, constructing and implementing effective security strategies for IoT software systems has become an important task facing the development of IoT today[2-3]. This paper analyzes the characteristics of intelligent quality inspection IoT systems and their requirements for high reliability, high availability, and high trustworthiness against the backdrop of the digital transformation of quality inspection processes for avionics products. It identifies key issues such as terminal device security, application security, and data security faced during system construction, and elaborates on the methods and implementation steps for constructing security strategies for IoT systems, aiming to provide references for similar system constructions.
1 Architecture of Intelligent Quality Inspection IoT System
1.1
System Business Architecture
The intelligent quality inspection IoT system primarily supports the digital transformation needs of quality inspection processes. The system is logically divided into three levels: detection device layer, intelligent algorithm layer, and business and data platform layer. The detection device layer supports on-demand access to terminal inspection devices; the intelligent algorithm layer supports the basic capabilities of an open intelligent platform to complete inspection tasks; the business and data platform layer supports long-term storage and overall management of inspection data and provides open interfaces for information exchange. The system business architecture is shown in Figure 1.
1.2
System Technical Architecture
From a technical perspective, the overall application architecture of the intelligent quality inspection IoT system is divided into a basic layer, data layer, support layer, application layer, and presentation layer, as shown in Figure 2.
Among them, the basic layer provides access services for inspection devices, network devices, storage devices, and other hardware, ensuring a secure and reliable hardware environment for the entire system operation; the data layer provides functions such as data access, data storage, data analysis, data integration, security auditing, and management services; the support layer integrates common components or public services to provide unified application support services for all upper-level business application subsystems, reducing the coupling between systems and facilitating system expansion and deployment, mainly including file services, asynchronous messaging, full-text search, data caching, and service registration; the application layer serves as a bridge for data exchange and centralized processing of business, focusing on the formulation of business rules, implementation of business processes, and support for system functions; the presentation layer provides services for business processing interface interaction, interface management, and visual analysis display, supporting personalized content display and operations based on user permissions.
1.3
System Data Architecture
The data layer stores all quality inspection business data, using a thematic and business-oriented data organization method to integrate all data for centralized storage and unified management. The data mainly includes device data, inspection data, process data, supporting data, and documentation data. The data layer meets the business requirements for data storage and management, completing data transformation, normalization, and access through business logic processing.
The data layer must possess good characteristics such as high performance, high concurrency, high availability, and high scalability to support various upper-level applications and services such as data collection, data processing, task scheduling, data retrieval, label management, and data management. The system’s data types include structured and unstructured data, and depending on the different types of data, the data storage must support file systems, structured databases, unstructured databases, and message queues.
1.4
System Network Architecture
The system network connection is based on the industrial control network in the production environment, with all devices physically connected via Ethernet cables, without any wireless connections. The entire network is divided into four network zones: detection device zone, analysis device zone, IT device zone, and data interface zone, as shown in Figure 3. The detection device zone is primarily for connecting various detection devices, which can be directly operated and accessed by end users, with daily maintenance performed by professionals. The analysis device zone is where users conduct daily analysis and re-evaluation, consisting of client devices in the IT environment, mainly workstations or personal computers running analysis and re-evaluation software and front-end service programs for application layer software, with high frequency of use by end users. The IT device zone mainly consists of servers and storage devices supporting the operation of the intelligent quality inspection IoT system, belonging to the server side of the IT environment, running back-end service programs for application layer software, which end users generally do not directly access, managed by operations personnel. The data interface zone mainly consists of devices that interact with data from other business systems, represented by IP addresses in the intelligent quality inspection IoT system.
2 Identification of Key Points in System Security Protection
Based on the architectural characteristics of the intelligent quality inspection IoT system, detailed system security protection strategies should be formulated according to the principles of “general security routine protection” and “key risk focused protection,” while adhering to the security protection framework requirements of industrial control network systems, in light of the special requirements for high reliability, high availability, and high trustworthiness of the intelligent quality inspection IoT system. The analysis of key points in system security protection is shown in Figure 4.
The intelligent quality inspection IoT system is deployed based on the industrial control network in the production environment, and its physical security, host security, boundary security, network security, and security management all follow general security strategies. Physical and network security are ensured through enhanced security management, while firewall policies, port-level access control policies, and IP/MAC address binding are implemented to control unauthorized device and terminal access, achieving boundary isolation and security protection, thus ensuring network and host security.
Terminal security, application security, and data security are the key focus areas for the security protection of the intelligent quality inspection IoT system[5]. Terminal security includes device terminal security, office terminal security, and operation and maintenance terminal security, with detection and analysis devices being directly accessible to end users and frequently used, making them the focus of terminal security protection, necessitating the formulation of targeted protection strategies. In terms of application security, the system integrates complex business scenarios such as data management, process management, label management, and electronic document management, thus ensuring business security is paramount, along with the need for system stability design and real-time monitoring of system operation to ensure stability meets usage requirements. Data security is the top priority in the system’s security protection; only by obtaining reliable and trustworthy quality data can continuous improvement in design and manufacturing processes be guided, thus requiring the formulation of relevant data security protection strategies to prevent data loss, data corruption, data leakage, data misuse, and data tampering.
3 Construction and Implementation of System Security Strategies
3.1
Terminal Security
The system involves office terminals, operation and maintenance terminals, and device terminals in the industrial control network, where device terminal security is a distinguishing feature of IoT systems compared to traditional IT systems[6], making it the focus of terminal security protection in the intelligent quality inspection IoT system. For device terminals, information device management standards should be followed, antivirus software and firewalls installed, automatic virus scanning strategies configured, and operating system and software update strategies set. Device login should adopt digital certificate authentication, strong password policies, lockout and automatic logout strategies, and unauthorized external device connections should be strictly prohibited, with automatic alarm strategies in place. At the same time, access control, network partition isolation, and operation log recording and backup should be coordinated with the server side to ensure device terminal security and high availability.
3.2
Application Security
The focus of application security is to strengthen the security protection of server-side applications and system interfaces. On the platform server side, authentication mechanisms are employed to achieve user identity verification and authorization, with configuration management, access control, and security auditing strategies established, enhancing user role classification and permission control. Techniques such as session management, residual information protection, and security vulnerability scanning are used to ensure server-side application security. Interface security protection is achieved through interface authentication, access control, and encrypted transmission. The system security protection strategies and specific measures are shown in Table 1.
3.3
Data Security
Data includes system data and business data, and in terms of security protection, in addition to basic requirements such as storage security and transmission security, high availability is also a key focus of data security protection. The intelligent quality inspection IoT system adopts a server-side database storage strategy, prohibiting data storage in other areas of the server and client to ensure the security of system data storage; it employs SM3 to generate digests for verification, ensuring the integrity of data transmission. Additionally, detailed data classification storage, hot and cold backup, and data recovery strategies are established to meet the high availability requirements of system data.
The overall storage and backup strategy of the system is shown in Figure 5.
A MongoDB replica set is used to achieve high availability and hot backup of detailed data, with primary and secondary nodes storing data, where the primary node receives all write operations, and the secondary node applies the primary node’s operations to its own data set, as shown in Figure 6. MySQL MHA (Master High Availability) is used to achieve hot backup of non-detailed data, adopting a one primary and two backup deployment architecture, with the MHA Manager installed on the primary node, as shown in Figure 7. Additionally, scheduled exports are used for cold backups, employing physical backup methods to copy data to NAS storage[12].
In the event of a sudden failure, the system switches from the primary server to the backup server and from the primary database to the backup database to complete recovery. Simultaneously, backup data is exported from the network storage device to the database for data recovery.
4 Conclusion
This paper focuses on the construction process of the intelligent quality inspection IoT system, analyzing the differences in security protection between this system and traditional IT information systems, identifying three key protection points: terminal security, application security, and data security. Following the security protection framework requirements of industrial control network systems, detailed system security protection strategies and implementation methods have been formulated based on the principles of “general security routine protection” and “key risk focused protection”; through systematic configuration of security protection strategies, a highly reliable, highly available, and highly trustworthy intelligent quality inspection IoT software system has been constructed.
END
Long press to identify the mini program for online reading and ordering at a better price
References
[1] Li Bohu, Chai Xudong, Liu Yang, et al. Research on the Empowerment of Intelligent Manufacturing by Information and Communication Technologies in Industrial Environments [J]. China Engineering Science, 2022, 24(2): 75-85.
[2] Shu Jun. Research Progress on IoT Security Models [J]. China New Communications, 2022, 24(17): 110-112.
[3] Zhang Shuhong. Research Based on IoT Security [J]. Shanxi Electronic Technology, 2022(4): 91-93.
[4] Li Bing, Li Lu, Zhang Rui, et al. Design of Security System for IoT Platforms [J]. Industrial Information Security, 2022(5): 17-23.
[5] Zhang Chao, A Wei, Xu Yaping, et al. Preliminary Exploration of IoT Security Technology Development and Protection Measures [J]. China Security, 2022(6): 39-42.
[6] Yang Weichao, Guo Yuanbo, Li Tao, et al. IoT Device Identification Method Based on Traffic Fingerprints and IoT Security Model [J]. Computer Science, 2020, 47(7): 299-306.
[7] Huang Ruihui, Xu Yan, Gao Ying, et al. Discussion on Key Technologies for IoT Security Certification [J]. Computer Knowledge and Technology, 2021, 17(35): 42-44.
[8] Qin Tao. Security Analysis and Application Research of Industrial Internet [J]. Confidential Science and Technology, 2022(3): 26-30.
[9] Liu Qixu, Jin Ze, Chen Canhua, et al. Overview of IoT Access Control Security [J]. Computer Research and Development, 2022, 59(10): 2190-2211.
[10] Ma Xiaohui. Discussion on the Application of Industrial Control Network Security Technology in Discrete Manufacturing Enterprises [J]. Technology and Market, 2022, 29(2): 70-72.
[11] Tang Jun, Zhao Suyun. Vulnerability Analysis and Research of Web Applications [J]. Software, 2022, 43(1): 102-104.
[12] Fu Lei, Qu Xiaofeng. Design of High Availability Data Management System Based on Heterogeneous Databases [J]. Information Technology, 2022(7): 131-135.
— Previous Recommendations —
Research on Abnormal Wear of Carbon Slippers in Nanjing Metro Airport Line Electric Multiple Units
Diagnosis and Treatment of Abnormal Leakage in Generator Hydrogen Coolers
Design and Implementation of CAN Bus Driver Based on FPGA
