TWI846184B - System and method for generating an authorization list - Google Patents

Abstract

Disclosed is a system for generating an authorization list. The system is connected to a plurality of wide area networks and includes an access token generating module. The module is configured to identify one or more public IP addresses, provided by one or more internet service providers to a user device (DUT), and generates an identification result according to a default MAC address of the DUT. The module further generates an access token based on the identification result of the one or more public IP addresses, and then sends the access token to the DUT so that the DUT accesses one or more local area networks through the one or more public IP addresses. The one or more local area networks are in a firewall enabled state, and only subnet access is allowed. Additionally, the disclosure provides an execution method of the foregoing system for generating the authorization list.

Description

System and method for generating authorization list

The present invention relates to a system and method for generating an authorization list, and more particularly to a system and method for generating an authorization list suitable for connecting to a plurality of wide area networks (WANs).

A Network Attached Storage (NAS) device is a file-level computer data storage server that is connected to a computer network and provides data access to heterogeneous network users. A NAS device is a network device that contains one or more storage drives that are usually arranged as logical memory, redundant memory, or fault-tolerant disk arrays (RAID). For example, it is a smart storage device that can centrally store data such as photos, videos, music, and documents. In daily life, by connecting a NAS device to the network at home or in the office, you can create a safe and easy-to-manage shared space to centrally manage, share, and synchronize data on multiple devices. You can also access data on the NAS device remotely at any time through mobile apps on your computer or phone. Not inferior to public cloud services, NAS devices provide many convenient and interesting applications.

However, there are some problems with the existing NAS devices. Please refer to FIG. 1, which is a schematic diagram of a system for generating an authorization list in the prior art. As shown in FIG. 1, in the prior art, the system 100 for generating an authorization list is mainly composed of one or more NAS devices 120, 130, wherein the number of NAS devices located on the Internet 140 can be adjusted according to actual needs. In addition, the system 100 for generating an authorization list also includes an authentication and authorization server 150, a user device (DUT) 112, a personal or corporate network 110, a data association table 122, and a data association table 152. The data association table 122 usually includes data such as user ID, device ID, IP address, etc., and the data association table 152 is, for example, a device access permission form. The user device (DUT) 112 is configured in a personal or corporate network 110 and can establish a network connection.

Generally speaking, the system 100 for generating the authorization list is in a security environment to effectively protect devices exposed to the external network environment. When a user wants to access a device in the external network environment (e.g., NAS device 120 or NAS device 130) through a user device (DUT) 112, the NAS device 120 or NAS device 130, etc., only needs to set the allowed IP in the firewall setting of the device to be accessed. However, usually the Internet Service Provider (ISP) behind the personal or corporate network 110 may provide more than one set of public IP addresses; as shown in FIG. 1 , if the source end (i.e., the user device (DUT) 112) has two public IP addresses, when using existing information security technology, after the public IP 1 is authenticated and authorized by the authentication and authorization server 150, it is not only logged in the data association table 152 of the authentication and authorization server 150, but also added to the white list of the data association table 122 of the NAS device 120. However, in actual situations, the user device (DUT) 112 may use the public IP 2 to access the NAS device 120. At this time, the user device (DUT) 112 cannot successfully access the NAS device 120 because the public IP 2 is not in the white list of the NAS device 120.

In summary, how to provide a system and method for generating an authorization list that can solve the above problems is a problem that the industry needs to solve.

In view of the above content, one aspect of the present disclosure is to provide a system for generating an authorization list, which can be connected to a plurality of wide area networks (WANs), and the system includes: an access token generation module, configured to identify one or more public IP addresses provided to the user device (DUT) by one or more Internet service providers (ISPs) according to a default gateway media access control (MAC) address of a user device (DUT) and generate an identification result, and generate an access token according to the identification result of the one or more public IP addresses, and then transmit the access token to the user device (DUT), so that the user device (DUT) can access the one or more public IP addresses through the one or more public IP addresses. The invention relates to a method for accessing one or more local area networks through a unique IP address, wherein the one or more local area networks are in a firewall-open state and only subnet access is allowed.

According to one or more embodiments of the present disclosure, the access token generation module includes: a zero-trust server, configured to identify the one or more public IP addresses provided to the user device (DUT) by the one or more Internet service providers (ISPs) according to the preset gateway media access control (MAC) address of the user device (DUT) and generate the identification result; and an authentication and authorization server, configured to generate the access token according to the identification result of the one or more public IP addresses, and transmit the access token to the user device (DUT), so that the user device (DUT) can access the network through the one or more public IP addresses. The invention relates to a method for accessing one or more local area networks through a unique IP address, wherein the one or more local area networks are in a firewall-open state and only subnet access is allowed.

According to one or more embodiments of the present disclosure, the user device (DUT) that obtains the access certificate can also access one or more network based IP cameras through the one or more public IP addresses, and the one or more network based IP cameras are in a firewall-open state and only subnet access is allowed.

According to one or more embodiments of the present disclosure, the user device (DUT) includes an identity verification unit, which is used to log in to the access token generation module and obtain the access token through the preset gateway media access control (MAC) address, so that the user device (DUT) can access the one or more local area networks or one or more network based IP cameras through the one or more public IP addresses.

According to one or more embodiments of the present disclosure, a plurality of other user devices (DUTs) are further included, and the other user devices (DUTs) all have a preset gateway media access control (MAC) address.

According to one or more implementations of the present disclosure, each of the user devices (DUT) has a device ID, and each of the device IDs is a Universally Unique Identifier (UUID).

Another aspect of the present disclosure is to provide a method for generating an authorization list, which is applicable to an authorization list generating system connected to a plurality of wide area networks (WANs), and one or more network based IP cameras or one or more local area networks in the authorization list generating system are in a firewall-open state and only allow subnet access, wherein the method for generating an authorization list includes the following steps: according to a preset gateway media access control (MAC) address of one or more user devices (DUTs), one or more public IP addresses provided by one or more Internet service providers (ISPs) to each user device (DUT) are identified and an identification result is generated; and according to the one or more public IP addresses, one or more public IP addresses are identified. The identification result of the one or more public IP addresses generates an access token, and then transmits the access token to each user device (DUT), so that each user device (DUT) can access the one or more network based IP cameras or the one or more local area networks through the one or more public IP addresses, wherein the one or more network based IP cameras or the one or more local area networks are in a firewall-open state and only subnet access is allowed.

According to one or more embodiments of the present disclosure, before each user device (DUT) obtains the access certificate, the one or more network based IP cameras or the one or more local area networks will first obtain the access certificate and establish a first data association table and a second data association table; the first data association table is used to represent a mapping relationship in which a user authorizes other users to access each user device (DUT) bound to his or her own account with other accounts; the second data association table is used to represent a mapping relationship in which the user accesses the one or more network based IP cameras or the one or more local area networks from each user device (DUT).

According to one or more embodiments of the present disclosure, the data in the first data association table includes one or more user IDs and one or more device names, and at least the one or more user IDs and the one or more device names have a mapping relationship to determine the transmission object of the data; in addition, the data in the second data association table includes the one or more user IDs, the one or more device IDs, the default gateway media access control (MAC) address, and the one or more public IP addresses, wherein the access certificate is linked to the one or more user IDs.

According to one or more embodiments of the present disclosure, before each user device (DUT) obtains the access credential, the one or more network based IP cameras or the one or more local area networks send a login and binding device request to an authentication and authorization server. When the authentication and authorization server responds with a request success message, a first data association table is established, and the one or more network based IP cameras or the one or more local area networks obtain the access credential. Then, the one or more network based IP cameras camera) or the one or more local area networks sends a subscription request to a zero-trust server, and at this time the authentication and authorization server provides the data to the zero-trust server according to the first data association table, so that the zero-trust server determines the transmission object of the data and replies with a message of successful request, and the one or more network based IP cameras or the one or more local area networks establish the second data association table according to the data, wherein the content of the subscription request includes the access certificate and the one or more device names.

According to one or more embodiments of the present disclosure, after the first data association table and the second data association table are established, the user sends a request including the one or more user IDs and the one or more passwords to the authentication and authorization server through each user device (DUT); if the authentication is successful, the authentication and authorization server will respond and issue the access token to each user device (DUT), wherein the access token corresponds to the one or more user IDs.

According to one or more embodiments of the present disclosure, after the authentication and authorization server responds and issues the access certificate to each of the user devices (DUT), the user sends a request including the access certificate, the one or more device IDs, and the default gateway media access control (MAC) address to the zero-trust server through each of the user devices (DUT). Then, when the zero-trust server successfully obtains the first data association table from the authentication and authorization server, the zero-trust server maps the specific user ID, the one or more device IDs, the default gateway media access control (MAC) address, and the one or more public IPs (public IP addresses) to the first data association table. When the specific user ID, the one or more device IDs, and the default gateway media access control (MAC) address are the same, but the one or more public IP addresses are different, all the different one or more public IP addresses are stored in the second data association table of the one or more network based IP cameras or the one or more local area networks, thereby extending the access list in the second data association table instead of replacing the one or more public IP addresses previously stored.

According to one or more embodiments of the present disclosure, when each user device (DUT) establishes a network connection with the one or more network based IP cameras or the one or more local area networks, the one or more network based IP cameras or the one or more local area networks can be accessed through the one or more public IP addresses on the extended access list in the second data association table.

In order to help the review committee members to have a deeper understanding of the purpose, shape, structural features and effects of the present invention, the following embodiments are provided with accompanying drawings for detailed description.

The following disclosure provides different embodiments or examples to implement different features of the subject matter provided. The specific examples of components and arrangements described below are for the purpose of simplifying the present disclosure and are not intended to be limiting; the size and shape of the components are not limited by the disclosed range or values, but may depend on the process conditions or required characteristics of the components. For example, cross-sectional views are used to describe the technical features of the present invention, and these cross-sectional views are idealized schematic views of embodiments. Therefore, it is foreseeable that the shapes of the diagrams will be different due to manufacturing processes and/or tolerances, and should not be limited thereto.

Furthermore, spatially relative terms, such as “below,” “under,” “lower than,” “above,” and “higher than,” are intended to easily describe the relationship between elements or features depicted in the diagrams; in addition, spatially relative terms include different directions of the components when in use or operation in addition to the directions depicted in the diagrams.

First, the main terms used in the description of this case are explained as follows.

"Wide-Area Network (WAN)" refers to a remote network that connects local area networks or metropolitan network computers in different regions. Generally speaking, it can be regarded as a backbone that connects local area networks and other various communication equipment. Wide area networks (WAN) usually cover a large geographical range, ranging from tens of kilometers to thousands of kilometers. It can connect multiple regions, cities and countries, or span across several continents and provide long-distance communications to form an international remote network. In practice, it can usually be divided into public networks and private networks.

"MAC address (Media Access Control address, MAC address) refers to the media access control address, also known as the local area network address (LAN address), Ethernet address (ethernet address) or physical address (physical address). It is an address used to identify the location of a network device.

The default gateway is a device called a router that a TCP/IP computer uses to communicate with a host on another network. In other words, the default gateway is a router specified on the host that connects the host's subnet to other networks.

Next, it is explained that an embodiment of the present invention provides a system for generating an authorization list, which can be connected to a plurality of wide area networks (WANs). The system includes an access token generation module. The access token generation module can identify one or more public IP addresses provided to a user device (DUT) by one or more Internet service providers (ISPs) according to a preset gateway media access control (MAC) address of a user device (DUT) and generate an identification result, and generate an access token according to the identification result of the one or more public IP addresses, and then transmit the access token to the user device (DUT), so that the user device (DUT) can access one or more NAS devices through the one or more public IP addresses, wherein the one or more NAS devices are in a firewall-open state and only subnet access is allowed. It should be particularly noted that in the embodiment of the present invention, the one or more NAS devices are, for example, one or more local area networks or one or more network based IP cameras.

In addition, an embodiment of the present invention also provides a method for generating an authorization list, which is applicable to a system for generating an authorization list connected to multiple wide area networks (WANs), and one or more network based IP cameras or one or more local area networks in the system for generating the authorization list are in a firewall-open state and only subnet access is allowed. The method for generating the authorization list includes the following steps: identifying one or more public IP addresses provided to each user device (DUT) by one or more Internet service providers (ISPs) and generating an identification result according to a preset gateway media access control (MAC) address of each of the one or more user devices (DUT); and generating an access token according to the identification result of the one or more public IP addresses, and then transmitting the access token to each user device (DUT), so that each user device (DUT) can access the one or more network based IP cameras or the one or more local area networks through the one or more public IP addresses. The one or more network based IP cameras or the one or more local area networks are in a firewall-opened state and only subnet access is allowed.

The following is a diagram illustrating a system for generating an authorization list and a method for generating an authorization list using the system in an embodiment of the present invention. Please refer to Figures 2 to 5, which are schematic diagrams of a system for generating an authorization list and a method for generating an authorization list using the system in an embodiment of the present invention.

First, as shown in FIG. 2 to FIG. 5 , the access token generation module in the authorization list generation system 200 of one embodiment of the present invention includes a zero-trust server 260 and an authentication and authorization server 250 that are independent of each other. In other embodiments of the present invention, the access token generation module may also be an integrated server that has the functions of both the zero-trust server 260 and the authentication and authorization server 250. In addition, although the authorization list generation system 200 shown in Figures 2 to 5 only uses one user device (DUT) 212 as an example, it is not intended to limit the present invention; in other embodiments of the present invention, the authorization list generation system 200 may also include multiple other user devices (DUTs), and these other user devices (DUTs) all have a preset gateway media access control (MAC) address.

Next, as shown in Figures 2 to 5, the zero-trust server 260 is used to identify one or more public IP addresses provided to the user device (DUT) 212 by one or more Internet service providers (ISPs) based on the default gateway media access control (MAC) address of the user device (DUT) 212 and generate an identification result. In addition, the authentication and authorization server 250 is used to generate an access token based on the identification results of the one or more public IP addresses obtained from the zero-trust server 260, and transmit the access token to the user device (DUT) 212, so that the user device (DUT) 212 can access one or more network based IP cameras or one or more local area networks through the one or more public IP addresses, wherein the one or more network based IP cameras or the one or more local area networks are in a firewall-open state and only subnet access is allowed. The one or more public IP addresses are, for example, public IP 1, public IP 2 or another public IP N, where N is a natural number representing the number of public IPs provided by the one or more Internet Service Providers (ISPs).

In the embodiment of the present invention, the user device (DUT) 212 is not only configured in a personal or corporate network 210 and can establish a network connection, but also has a preset gateway media access control (MAC) address and a device ID. Therefore, the user device (DUT) 212 that obtains the access certificate can access one or more network surveillance cameras (network based IP cameras) or one or more NAS devices 220, 230 such as one or more local area networks through the one or more public IP addresses, and the one or more NAS devices 220, 230 are in a firewall-open state and only subnet access is allowed. In the embodiment of the present invention, each of the device IDs is a Universally Unique Identifier (UUID).

Next, the method of generating an authorization list using the system for generating an authorization list is described diagram by diagram.

As shown in FIG. 2 , in an embodiment of the present invention, before each user device (DUT) 212 obtains the access credential, one or more NAS devices 220, 230 or other NAS devices send a login and device binding request to an authentication and authorization server 250. When the authentication and authorization server 250 responds with a request success message, a first data association table 252 is established, and the one or more NAS devices 220, 230 or other NAS devices obtain the access credential. Then, the one or more NAS devices 220, 230 or other NAS devices send a subscription request to a zero-trust server 260, and the authentication and authorization server 250 provides the data to the zero-trust server 260 according to the first data association table 252, so that the zero-trust server 260 determines the transmission object of the data and replies with a message of successful request, and the one or more NAS devices 220, 230 or other NAS devices establish a second data association table 222 based on the data, wherein the content of the subscription request includes the access certificate and one or more device names. In the embodiment of the present invention, the NAS device 220, NAS device 230 or other NAS devices refers to one or more network based IP cameras or one or more local area networks, but the present invention is not limited thereto. Of course, in other embodiments of the present invention, the NAS device 220, NAS device 230 or other NAS devices may also be any device that provides network services or other hardware devices with network connection functions, which will not be elaborated in the following.

Further, as shown in FIG2 , in step S1A, the NAS device 220 (or NAS device 230 or other NAS devices, the same below) sends a login and binding device request to the authentication and authorization server 250 via the Internet 240, wherein the necessary information is the user ID, password and device name. In the embodiment of the present invention, the device name is unique.

Then, in step S1B, the authentication and authorization server 250 will respond to the login and binding device request with a success or failure message to the NAS device 220. If successful, the NAS device 220 will obtain an access token. In the embodiment of the present invention, the access token has a time limit, ranging from a few hours to a few days.

Next, in step S1C1, the NAS device 220 sends a subscription request to the zero-trust server 260, the content of the request includes the access token and the device name mentioned in step S1A. In addition, in step S1C2, the zero-trust server 260 transmits the subscription request to the authentication and authorization server 250.

Thereafter, in step S1D, the authentication and authorization server 250 creates a first data association table 252 and responds to the zero trust server 260 with the device name mapped to a specific user ID in the first data association table 252 .

After the subscription request is successful, in step S1E, the NAS device 220 (or NAS device 230 or other NAS devices) will wait to receive information from the zero-trust server 260. It should be particularly noted that in step S1D, it has been determined that the object to which the zero-trust server 260 is to send information is the NAS device 220, the NAS device 230 or other NAS devices. In this way, the NAS device 220 (or NAS device 230 or other NAS devices) will establish a second data association table 222. In the embodiment of the present invention, the first data association table 252 is used to represent the mapping relationship of a user authorizing other users to access the user devices (DUT) 212 bound to his own account with other accounts; the second data association table 222 is used to represent the mapping relationship of the user accessing the NAS device 220 (or NAS device 230 or other NAS devices) from each user device (DUT) 212. The NAS device 220 (or NAS device 230 or other NAS devices) is, for example, the one or more network based IP cameras or the one or more local area networks.

In addition, in the embodiment of the present invention, after the authentication and authorization server 250 is authenticated, the access token and the so-called refresh token can be obtained according to OAuth, which is an open standard, wherein the former has a shorter validity period and the latter has a longer validity period. If the access token expires, we can use the refresh token to call the authentication and authorization server 250 again to obtain a new access token.

In addition, in the embodiment of the present invention, the data in the first data association table 252 includes one or more user IDs and one or more device names, and at least the one or more user IDs and the one or more device names have a mapping relationship to determine the transmission object of the data. In other words, the first data association table 252 indicates which accounts are authorized to access the device bound to a certain account. For example, the NAS device 220 is bound to user A, and there is a device (unique) name of device A, then user A can share device A with user B and user C.

In addition, the data of the second data association table 222 includes the one or more user IDs, the one or more device IDs, the preset gateway media access control (MAC) address, and the one or more public IP addresses, wherein the access token is linked to the one or more user IDs. In other words, the second data association table 222 represents the mapping relationship between a certain user accessing a device to be protected from a certain user device.

That is, in the embodiment of the present invention, before each user device (DUT) 212 obtains the access certificate, the NAS device 220, NAS device 230 or other NAS devices will first obtain the access certificate and establish a first data association table 252 and a second data association table 222. The first data association table 252 is used to indicate the mapping relationship of a user authorizing other users to access the user device (DUT) 212 bound to his own account with other accounts. In addition, the second data association table 222 is used to indicate the mapping relationship of the user accessing the NAS device 220, NAS device 230 or other NAS devices from each user device (DUT) 212. Similarly, the NAS device 220, the NAS device 230 or other NAS devices refers to one or more network based IP cameras, or one or more local area networks, or any device providing network services or other hardware devices with network connection function.

In addition, it should be particularly noted that in the embodiment of the present invention, when the user device (DUT) 212 has the ability to browse the Internet, there will be a default gateway, and the default gateway will have a corresponding default gateway media access control (MAC) address. The default gateway media access control (MAC) address can be found by, for example, traceroute 8.8.8.8 to find the default gateway IP, and then use ARP to find the media access control (MAC) address corresponding to the IP.

Next, as shown in FIG3 , in the embodiment of the present invention, after the first data association table 252 and the second data association table 222 are established, the user sends a request including the one or more user IDs and the one or more passwords to the authentication and authorization server 250 through each user device (DUT) 212. If the authentication is successful, the authentication and authorization server 250 will respond and issue the access token to each user device (DUT) 212, wherein the access token corresponds to the one or more user IDs.

Furthermore, as shown in FIG. 3 , in step S2A, the user sends a request to the authentication and authorization server 250 via the Internet 240 on the user device (DUT) 212, and the content of the request includes a user ID and a password. In one embodiment of the present invention, the user device (DUT) 212 further includes an identity verification unit 214, and the identity verification unit 214 is used to log in to the authentication and authorization server 250, and obtain the access token through the preset gateway media access control (MAC) address, so that the user device (DUT) 212 can access the one or more NAS devices 220, 230 through the one or more public IP addresses, wherein the one or more NAS devices 220, 230 are one or more local area networks or one or more network based IP cameras. In addition, in other embodiments of the present invention, the identity verification unit 214 is used to log in to the access token generation module and obtain the access token through the preset gateway media access control (MAC) address, so that the user device (DUT) 212 can access the one or more local area networks or one or more network based IP cameras through the one or more public IP addresses.

As shown in FIG. 3 , after step S2A, if the authentication is successful, in step S2B, the authentication and authorization server 250 will return the access token to the user device (DUT) 212, wherein the access token has a corresponding user ID.

As shown in FIG. 4 , in an embodiment of the present invention, after the authentication and authorization server 250 responds and issues the access certificate to each of the user devices (DUT) 212, the user sends a request including the access certificate, the one or more device IDs, and the default gateway media access control (MAC) address to the zero trust server 260 through each of the user devices (DUT) 212. Then, when the zero-trust server 260 successfully obtains the first data association table 252 from the authentication and authorization server 250, the zero-trust server 260 will transmit the specific user ID, the one or more device IDs, the default gateway media access control (MAC) address, and the one or more public IP addresses to the specific device names based on the mapping relationship between the specific user IDs and the specific device names that can be accessed. When the specific user ID, the one or more device IDs, and the default gateway media access control (MAC) address are the same, but the one or more public IP addresses are different, all the different one or more public IP addresses are stored in the second data association table 222 of the NAS device 220, the NAS device 230 or other NAS devices, thereby extending the access list in the second data association table 222 instead of replacing the one or more public IP addresses previously stored.

Furthermore, as shown in FIG. 4 , after completing step S2B, in step S3A, the user sends a request to the zero-trust server 260 on the user device (DUT) 212, and the content of the request includes the access token, the device ID, and the default gateway media access control (MAC) address.

As shown in FIG. 4 , after receiving the request, the zero trust server 260 then transmits the request of step S3A to the authentication and authorization server 250 in step S3B and obtains the first data association table 252 , wherein the first data association table 252 contains the device names that can be accessed by the specific user ID.

As shown in FIG4 , if step S3B is successful, then in step S3C, the zero-trust server 260 sends the user ID, the device ID, the default gateway media access control (MAC) address, and the IP address to the specific device name, and these data are established as a second data association table 222 in one of the one or more NAS devices 220, 230 or other NAS devices. In the embodiment of the present invention, if sent to the NAS device 220, the IP address is the public IP address of the user device (DUT) 212. It should be particularly noted here that, through the established mapping relationship (e.g., the user ID, the device ID, the default gateway media access control (MAC) address), when the user ID, the device ID, and the default gateway media access control (MAC) address are the same but the public IP (public IP) address is different, the authorization list generation system 200 will extend the access list in the user device (DUT) 212 instead of replacing it; that is, in this case, if the user device (DUT) 212 has an array of public IP (public IP) addresses, these public IP (public IP) addresses will be added to the user device (DUT) 212 access list, i.e., the second data association table 222.

Afterwards, as shown in FIG. 5 , in step S4, when the default gateway media access control (MAC) address of the user device (DUT) 212 is not changed, public IP 1 and public IP 2 are added to the access list of the NAS device 220, i.e., the second data association table 222. In this way, the user device (DUT) 212 can browse the NAS device 220 normally. Of course, similarly, in other embodiments of the present invention, such as when there are multiple user devices (DUT), through the system 200 and method for generating the authorization list of the embodiments of the present invention, any user device (DUT) with multiple public IP addresses can browse the NAS device protected in any information security environment normally.

Compared to the prior art, the system 200 and method for generating the authorization list of the embodiment of the present invention is to add a preset gateway media access control (MAC) address. As long as the gateway media access control (MAC) address does not change, for the device to be protected, the network of the user (or client) who wants to access it does not change, which means that the network environment behind the user (or client) has more than one Public IP, that is, all these public IP addresses need to be included in the list of the authorization permission list. Therefore, the embodiment of the present invention is different from the prior art in that the user (or client) can access the protected device using any public IP address, and the situation in the prior art of FIG. 1 where the protected device cannot be accessed using public IP 2 will not occur.

In summary, in the embodiment of the present invention, when each user device (DUT) 212 establishes a network connection with the NAS device 220, the NAS device 230 or other NAS devices, the NAS device 220, the NAS device 230 or other NAS devices can be accessed through the one or more public IP addresses on the extended access list in the second data association table 222.

In addition, in the embodiment of the present invention, the Internet 240 includes a public cloud, a private cloud, a social cloud, and a hybrid cloud.

The above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention is described in detail with reference to the preferred embodiments, ordinary technicians in this field should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention.

100~System for generating the authorization list; 110~Personal or corporate network; 112~User device (DUT); 120, 130~NAS device; 122~Data association table; 140~Internet; Authentication and authorization server 150; Data association table 152; Public IP 1; Public IP 2; 200~authorization list generation system; 210~personal or corporate network; 212~user device (DUT); 214~identity verification unit; 220, 230~NAS device; 222~second data association table; 240~Internet; authentication and authorization server 250; first data association table 252; S1A, S1B, S1C1, S1C2, S1D, S1E, S2A, S2B, S3A, S3B, S3C, S4~step.

In order to make the above and other purposes, features, advantages and embodiments of the present invention more clearly understandable, the attached drawings are described as follows: FIG. 1 is a schematic diagram of a system for generating an authorization list of the prior art. FIG. 2 to FIG. 5 are schematic diagrams of a system for generating an authorization list of an embodiment of the present invention and a method for generating an authorization list by the system.

According to conventional operation methods, various features and components in the figure are not drawn according to the actual scale, and the drawing method is to present the specific features and components related to the present invention in the best way. In addition, between different figures, the same or similar element symbols are used to refer to similar elements and components.

200~System for generating an authorization list; 210~Personal or corporate network; 212~User device (DUT); 214~Identity verification unit; 220, 230~NAS device; 222~Second data association table; 240~Internet; Authentication and authorization server 250; First data association table 252; S1A, S1B, S1C1, S1C2, S1D, S1E, S2A, S2B, S3A, S3B, S3C, S4~Steps.

Claims (11)

A system for generating an authorized list, which can be connected to a plurality of wide area networks (WANs), includes: a zero-trust server, configured to receive a request from a user through each user device (DUT) to send a content including an access certificate, one or more device IDs, and a default gateway media access control (MAC) address; and an authentication and authorization server, configured to when the zero-trust server successfully obtains a first data association table from the authentication and authorization server, the zero-trust server will map the specific user IDs, the one or more device IDs, the default gateway media access control (MAC) address, and one or more public IPs (public IP addresses) to the specific device names that can be accessed by the specific user IDs. The method further comprises: transmitting a specific IP address to each specific device name, wherein when the specific user ID, the one or more device IDs, and the preset gateway media access control (MAC) address are the same, but the one or more public IP addresses are different, all the different one or more public IP addresses are stored in the second data association table of the one or more network based IP cameras or the one or more local area networks, thereby extending the access list in the second data association table instead of replacing the one or more public IP addresses previously stored, and the one or more network based IP cameras or the one or more local area networks are accessed with the firewall open. A system for generating an authorization list as described in claim 1, wherein the user device (DUT) that obtains the access certificate can also access one or more network based IP cameras through the one or more public IP addresses, and wherein the one or more network based IP cameras are in a firewall-open state and only subnet access is allowed. A system for generating an authorization list as described in claim 1, wherein the user device (DUT) includes an identity verification unit, which is used to log in to the authentication and authorization server, and obtain the access token through the preset gateway media access control (MAC) address, so that the user device (DUT) can access the one or more local area networks or the one or more network based IP cameras through the one or more public IP addresses. The system for generating the authorization list as described in claim 1 further includes: a plurality of other user devices (DUTs), and each of the other user devices (DUTs) has a default gateway media access control (MAC) address. A system for generating an authorization list as described in claim 1 or 4, wherein each user device (DUT) has a device ID, and each device ID is a universally unique identifier (UUID). A method for generating an authorization list is applicable to an authorization list generating system connected to a plurality of wide area networks (WANs), wherein one or more network based IP cameras (network based IP cameras) in the authorization list generating system are camera) or one or more local area networks are in a firewall-open state for access, wherein the method for generating the authorization list includes the following steps: a user sends a request including an access certificate, one or more device IDs and a preset gateway media access control (MAC) address to a zero-trust server through each user device (DUT); and when the zero-trust server successfully obtains a first data association table from an authentication and authorization server, the zero-trust server will map the specific user IDs, the one or more device IDs, the preset gateway media access control (MAC) address and one or more public IPs (public IP addresses) to the specific device names that can be accessed by the specific user IDs. The method further comprises: transmitting a specific IP address to each specific device name, wherein when the specific user ID, the one or more device IDs, and the default gateway media access control (MAC) address are the same, but the one or more public IP addresses are different, all the different one or more public IP addresses are stored in a second data association table of the one or more network based IP cameras or the one or more local area networks, thereby extending the access list in the second data association table instead of replacing the one or more public IP addresses previously stored. The method for generating the authorization list as described in item 6 of the patent application scope further includes: before each user device (DUT) obtains the access certificate, the one or more network based IP cameras or the one or more local area networks will first obtain the access certificate and establish the first data association table and the second data association table; the first data association table is used to indicate the mapping relationship of the user authorizing other users to access the user devices (DUT) bound to their own accounts with other accounts; the second data association table is used to indicate the mapping relationship of the user accessing the one or more network based IP cameras or the one or more local area networks from each user device (DUT). As described in item 7 of the patent application scope, the data of the first data association table includes one or more user IDs and one or more device names, and at least there is a mapping relationship between the one or more user IDs and the one or more device names to determine the transmission object of the data; and the data of the second data association table includes the one or more user IDs, one or more device IDs, the preset gateway media access control (MAC) address, and the one or more public IP addresses, wherein the access certificate is linked to the one or more user IDs. The method for generating an authorization list as described in item 8 of the patent application further includes: before each user device (DUT) obtains the access certificate, the one or more network based IP cameras or the one or more local area networks send a login and binding device request to an authentication and authorization server, and when the authentication and authorization server responds with a request success message, the first data association table is established, and the one or more network based IP cameras or the one or more local area networks obtain the access certificate; then, the one or more network based IP cameras camera) or the one or more local area networks sends a subscription request to the zero-trust server, and at this time the authentication and authorization server provides the data to the zero-trust server according to the first data association table, so that the zero-trust server determines the transmission object of the data and replies with a successful request message, and the one or more network based IP cameras or the one or more local area networks establish the second data association table according to the data, wherein the content of the subscription request includes the access certificate and the one or more device names. The method for generating an authorization list as described in item 9 of the patent application further includes: after the first data association table and the second data association table are established, the user sends a request including the one or more user IDs and the one or more passwords to the authentication and authorization server through each user device (DUT); if the authentication is successful, the authentication and authorization server will respond and issue the access certificate to each user device (DUT), wherein the access certificate corresponds to the one or more user IDs. A method for generating an authorization list as described in item 6 of the patent application, wherein when each user device (DUT) establishes a network connection with the one or more network based IP cameras or the one or more local area networks, the one or more network based IP cameras or the one or more local area networks can be accessed through the one or more public IP addresses on the extended access list in the second data association table.

Images