WO2021035587A1 - Method and apparatus for configuring client, and terminal device - Google Patents

Abstract

Embodiments of the present application provide a method and apparatus for configuring a client, and a terminal device. The method comprises: a client sends to a first configuration device a target attribute of a target resource of the client, the target attribute being used for representing a device role of the client, and the client having at least one first secure resource; in the case that the device role of the client is a mobile device, the client receives first creation signaling sent by the first configuration device, and creates a second secure resource on the client on the basis of the first creation signaling, the second secure resource and the at least one first secure resource belonging to a same resource type; and the client receives first configuration signaling sent by the first configuration device, and configures the second secure resource on the basis of the first configuration signaling.

Description

Method and device for configuring client terminal and terminal equipment Technical field

The embodiments of the present application relate to the technical field of the Internet of Things, and specifically relate to a method and device for configuring a client, and terminal equipment.

Background technique

The activation tool (Onboarding Tool, OBT) is used to configure the client of the device (hereinafter referred to as the client), so as to realize the management and control of the device and the interconnection and intercommunication between the device and other devices. At present, the client can only be configured by one OBT. When the client is in network 1, the OBT in network 1 configures the client. When the client moves from network 1 to network 2, at this time due to the network The OBT in 1 has already configured the client, so the OBT in network 2 cannot configure the client. One way is to reset the client so that the OBT in network 2 can configure the client However, when the client moves to network 1 again, the same problem will occur, resulting in the need to reconfigure the client every time the network is switched, and the user experience is poor.

Summary of the invention

The embodiments of the present application provide a method and device for configuring a client, and terminal equipment.

The method for configuring the client provided by the embodiment of the present application includes:

The client sends the target attribute of the target resource of the client to the first configuration device, where the target attribute is used to indicate the device role of the client; wherein the client has at least one first security resource;

When the device role of the client is a mobile device, the client receives the first creation signaling sent by the first configuration device, and creates a second security on the client based on the first creation signaling. Resource, the second security resource and the at least one first security resource belong to the same resource type;

The client receives the first configuration signaling sent by the first configuration device, and configures the second security resource based on the first configuration signaling.

The method for configuring the client provided by the embodiment of the present application includes:

The client sends the target attribute of the target resource of the client to the first configuration device, where the target attribute is used to indicate the device role of the client; wherein the client has at least one first security resource;

When the device role of the client is a mobile device, the client receives trigger signaling sent by the first configuration device, and the trigger signaling is used to trigger the client to initiate device-led configuration;

Creating a second secure resource on the client by the client, where the second secure resource and the at least one first secure resource belong to the same resource type;

The client obtains configuration parameters from the first configuration device, and configures the second security resource based on the configuration parameters.

The method for configuring the client provided by the embodiment of the present application includes:

The first configuration device receives the target attribute of the target resource sent by the client, where the target attribute is used to indicate the device role of the client; wherein the client has at least one first secure resource;

When the device role of the client is a mobile device, the first configuration device sends a first creation signaling to the client, and the first creation signaling is used to instruct to create a second creation on the client. A security resource, where the second security resource and the at least one first security resource belong to the same resource type;

The first configuration device sends a first configuration signaling to the client, where the first configuration signaling is used to configure the second security resource.

The method for configuring the client provided by the embodiment of the present application includes:

The first configuration device receives the target attribute of the target resource of the client sent by the client, where the target attribute is used to indicate the device role of the client; wherein the client has at least one first security resource;

When the device role of the client is a mobile device, the first configuration device sends trigger signaling to the client, and the trigger signaling is used to trigger the client to create a second configuration on the client. A security resource, where the second security resource and the at least one first security resource belong to the same resource type;

The first configuration device sends configuration parameters to the client, where the configuration parameters are used by the client to configure the second security resource.

The device for configuring the client provided by the embodiment of the present application includes:

A sending unit, configured to send a target attribute of a target resource of the client to the first configuration device, where the target attribute is used to indicate a device role of the client; wherein the client has at least one first security resource;

The receiving unit is configured to receive the first creation signaling sent by the first configuration device when the device role of the client is a mobile device, and create a first creation signaling on the client based on the first creation signaling. Two security resources, the second security resource and the at least one first security resource belong to the same resource type; receiving the first configuration signaling sent by the first configuration device, and configuring the first configuration signaling based on the first configuration signaling The second security resource.

The device for configuring the client provided by the embodiment of the present application includes:

A sending unit, configured to send a target attribute of a target resource of the client to the first configuration device, where the target attribute is used to indicate a device role of the client; wherein the client has at least one first security resource;

A receiving unit, configured to receive trigger signaling sent by the first configuration device when the device role of the client is a mobile device, where the trigger signaling is used to trigger the client to initiate device-led configuration;

A creating unit, configured to create a second secure resource on the client, where the second secure resource and the at least one first secure resource belong to the same resource type;

The obtaining unit is configured to obtain configuration parameters from the first configuration device, and configure the second security resource based on the configuration parameters.

The device for configuring the client provided by the embodiment of the present application includes:

A receiving unit, configured to receive a target attribute of a target resource sent by a client, where the target attribute is used to indicate a device role of the client; wherein the client has at least one first secure resource;

The sending unit is configured to send a first creation signaling to the client when the device role of the client is a mobile device, where the first creation signaling is used to instruct to create a second creation on the client A security resource, the second security resource and the at least one first security resource belong to the same resource type; sending a first configuration signaling to the client, where the first configuration signaling is used to configure the second security Resources.

The device for configuring the client provided by the embodiment of the present application includes:

The receiving unit is configured to receive the target attribute of the target resource of the client sent by the client, the target attribute is used to indicate the device role of the client; wherein the client has at least one first security resource;

The sending unit is configured to send trigger signaling to the client when the device role of the client is a mobile device, where the trigger signaling is used to trigger the client to create a second on the client A secure resource, where the second secure resource and the at least one first secure resource belong to the same resource type; sending configuration parameters to the client, where the configuration parameters are used by the client to configure the second secure resource.

The terminal device provided in the embodiment of the present application includes a processor and a memory. The memory is used to store a computer program, and the processor is used to call and run the computer program stored in the memory to execute the above-mentioned method for configuring a client.

The chip provided in the embodiment of the present application is used to implement the above-mentioned method for configuring the client.

Specifically, the chip includes: a processor, configured to call and run a computer program from the memory, so that the device installed with the chip executes the above-mentioned method for configuring the client.

The computer-readable storage medium provided by the embodiment of the present application is used to store a computer program, and the computer program causes a computer to execute the above-mentioned method for configuring a client.

The computer program product provided by the embodiment of the present application includes computer program instructions, and the computer program instructions cause a computer to execute the above-mentioned method for configuring a client.

The computer program provided by the embodiment of the present application, when it runs on a computer, causes the computer to execute the above-mentioned method for configuring the client.

Through the above technical solution, by adding the target attribute of the client to indicate the role of the device, the client and the OBT (that is, the first configuration device) can distinguish whether the client is a mobile device or a fixed device, thereby selecting different configuration strategies. For clients belonging to mobile devices, OBT can create new security resources and write configuration information into the newly created security resources. In this way, when the client roams in a network with different owners, it can be controlled by the current network. OBT configures it. Especially when the client frequently travels to and from two or more networks, since the OBT of these networks has been supported as the master, there is no need to repeat the OTM operation every time it is configured, avoiding too much tedious configuration process.

Description of the drawings

The drawings described here are used to provide a further understanding of the application and constitute a part of the application. The exemplary embodiments and descriptions of the application are used to explain the application, and do not constitute an improper limitation of the application. In the attached picture:

FIG. 1 is a schematic diagram of a communication system architecture provided by an embodiment of the present application;

FIG. 2 is a schematic flowchart of an OBT configuration device provided by an embodiment of the present application;

Figure 3 is a schematic diagram of a home application scenario provided by an embodiment of the present application;

FIG. 4 is a first schematic flowchart of a method for configuring a client provided by an embodiment of the present application;

FIG. 5 is a flowchart of example one provided by an embodiment of the present application;

FIG. 6 is a flowchart of Example 2 provided by an embodiment of the present application;

FIG. 7 is a second schematic flowchart of a method for configuring a client provided by an embodiment of the present application;

FIG. 8 is a flowchart of Example 3 provided by an embodiment of the present application;

FIG. 9 is a schematic diagram 1 of the structural composition of an apparatus for configuring a client provided by an embodiment of the present application;

FIG. 10 is a second schematic diagram of the structural composition of an apparatus for configuring a client provided by an embodiment of the present application;

FIG. 11 is a schematic diagram 3 of the structural composition of the apparatus for configuring a client provided by an embodiment of the present application; FIG.

FIG. 12 is a fourth schematic diagram of the structural composition of an apparatus for configuring a client provided by an embodiment of the present application; FIG.

FIG. 13 is a schematic structural diagram of a communication device provided by an embodiment of the present application;

FIG. 14 is a schematic structural diagram of a chip of an embodiment of the present application;

FIG. 15 is a schematic block diagram of a communication system provided by an embodiment of the present application.

detailed description

The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are a part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of this application.

通信架构

Communication architecture

The Open Connectivity Foundation (OCF) defines the client and server. The server refers to the device that provides resources, and the client refers to the device that accesses resources.

OCF adopts the Representational State Transfer (RESTful) architecture, which uses resources to represent the physical devices of the Internet of Things, as well as the functional services provided by the device and the status of the device. The device that provides the resource is the server, and the device that accesses the resource is the client. end. The client and server defined in OCF are logical functional entities. A device can be a client, a server, or both a client and a server.

The business interaction between the client and the server is realized by performing RESTful operations on resources. RESTful operations can be Create-Retrieve-Update-Delete-Notify (CRUDN) operations. Obviously, CRUDN The operation can be any one or more of the following operations: create (Create), read (Retrieve), update (Update), delete (Delete), and notify (Notify). The client is the initiator of the RESTful operation, and the server is the responder of the RESTful operation. The client sends a resource operation request to the server, requesting to operate the resource on the server, the server performs the resource operation, and returns a response to the client , The content and description information of the resource are carried in the response.

Figure 1 is an optional communication architecture diagram provided by an embodiment of this application. The description of resources is the resource model layer. Each resource corresponds to a specific Uniform Resource Identifier (URI), which can be accessed by To access this resource, each resource has a corresponding interface that supports Restful operations. It is the transmission protocol layer that transmits resource content and description information. By mapping resource operations to specific transmission protocols, the Restful operation of each resource is transformed into an entity message to be transmitted between devices, providing a means for interconnection and intercommunication between devices.

The OCF transmission protocol adopts the Constrained Application Protocol (CoAP) to carry resource operations. Each CRUDN operation is mapped to a CoAP request message or response message. The client can use CoAP's GET, POST, PUT, DELETE, etc. Four methods operate on the resources of the server, so as to realize the transformation of the resource state.

资源

Resources

◆Uniform Resource Identifier (URI) of the resource

Resources are identified and addressed by URI. The URI of the resource specified by OCF has the following form: ocf://<deviceID>/<path>? <query>, where the meaning of each part of the URI is as follows:

ocf: The organization (schema) of the resource URI is "ocf". If a URI omits the part before the double slash "//", the default schema is "ocf".

deviceID: The device identification (ID) of the server. The device ID is the globally unique identification of the device.

path: The path string for accessing a resource. Path is globally unique within the scope of the server to which the resource belongs, and can uniquely correspond to a resource on the server.

query: query string, the query string contains the "<name>=<value>" segment, which is a list of "name-value pairs", each "name-value pair" is separated by an "&". In OCF, the query string will be mapped to CoAP, using the syntax description corresponding to CoAP.

The URI of a resource can be an absolute URI or a relative URI. The absolute URI is the above-mentioned complete URI form. The relative URI does not include the schema and deviceID part. The relative URI is relative to the device to which it belongs, and uniquely identifies the resource within the scope of the device. Combine deviceID to form absolute URI.

◆Resource Model

The resource model is the core to realize the interconnection and intercommunication between devices. The transmission layer provides the interconnection and interoperability of the transmission protocol. The resource model is independent of the transmission protocol. By mapping the resource model to the transmission protocol, it provides technical support for the complete interconnection and intercommunication between devices. .

The characteristics of resources mainly include URI, attributes, resource references and interfaces, which are described separately as follows:

-URI: Each resource is identified and addressed by URI.

-Property: Each resource contains attributes, which are used to describe the status information of the resource, and the attributes appear in the form of "<key>=<value>" key-value pairs. The resource representation is a snapshot of the attribute. The interaction with resources is realized by exchanging requests and responses that contain resource expressions. For example, a read request is made to a resource, the expression of the resource can be obtained by responding, and an update request is made to the resource to update the expression of the resource.

-Resource reference (link): The resource instance comes from the resource type, and the link is used to establish the reference relationship between different resource instances.

-Interface: An interface is a mechanism for the expression and acquisition of resources. Different interfaces correspond to different expressions of resources and corresponding operating mechanisms.

The resource resides in the device. A resource must have a URI. The URI can be specified by the resource creator when creating the resource. In addition, the resource must have one or more resource types, and the resource type corresponding to the resource must be specified in the resource creation request.

In order to facilitate the understanding of the technical solutions of the embodiments of the present application, the related technologies involved in the embodiments of the present application will be described below.

The device needs to be activated before it can operate on the network or interact with other devices. The first step in activating the device is to configure the ownership of the device. The legal user uses OBT to establish the ownership of the device using the Owner Transfer Method (OTM). After the ownership is established, the legal user uses OBT to configure the device and finally enables the device to operate normally. And interact with other devices. Figure 2 shows a schematic diagram of the OBT configuration device process. Among them, CMS in Figure 2 stands for Certificate Management Service. CMS is usually part of OBT. Considering scalability and modular design, CMS can also be used as a separate service. deploy. As shown in Figure 2, the process of OBT configuration equipment includes the following steps:

201: OBT found no master device.

Specifically, OBT discovers unowned devices (that is, new devices) that need to be configured in the network.

202: The device returns the owner transfer method it supports to OBT.

Specifically, the device to be configured returns its supported owner transfer method to OBT.

203: The business transfer handshake process is executed between the OBT and the device.

Specifically, the OBT establishes a secure connection with the device to be configured through the service transfer handshake process according to the selected master transfer method.

204: OBT pre-read device identification and configuration master identity.

Specifically, OBT configures its own device identifier to the /doxm.deviceowneruuid attribute of the device, thereby establishing the owner identity of the device.

205: OBT requests the credential type supported by the device.

Specifically, OBT looks at the types of security credentials supported by the device to be configured, such as symmetric keys, asymmetric keys, certificates, and so on.

206: OBT decides which voucher to use.

Specifically, OBT selects an appropriate symmetric security credential based on the credential type supported by the device.

207: OBT configures a symmetric master credential for the device.

Specifically, OBT configures the selected symmetric security credential to the /cred resource of the device.

208: OBT allocates equipment to CMS.

Specifically, OBT assigns the device to be configured to the CMS.

209: OBT sets the resource owner for the /doxm resource of the device.

Specifically, OBT configures its own device identifier to the /doxm.rowneruuid attribute of the device to set the resource owner of the /doxm resource.

210: OBT sets the resource owner for the /cred resource of the device.

Specifically, OBT configures its own device identification (identification of CMS) to the /cred.rowneruuid attribute of the device to set the resource owner of the /cred resource.

211: OBT configures CMS credentials.

Specifically, the OBT configures the credential used to establish a secure connection with the CMS to the /cred.creds property of the device to set the CMS credential.

212: The CMS changes the device state to the service configuration state.

If CMS is used as part of OBT, it can be expressed as OBT changes the device state to the service configuration state.

213: CMS configures credentials for devices and peer devices.

Specifically, the CMS configures the credential used to establish a secure LAN connection with other devices to the /cred.creds property of the device.

If CMS is used as part of OBT, it can be expressed as OBT to configure credentials for devices and peer devices.

214: CMS changes the device status to normal working status.

If CMS is used as part of OBT, it can be expressed as OBT to change the device state to normal working state.

Among them, the structure of /doxm resource is:

OBT is the owner of the network and can configure the devices in the network. After the device is configured by OBT, the OBT is the owner of the configured device. For example, Figure 3 is an application scenario in a home. As shown in Figure 3, mobile phone 1 (for example, the mobile phone used by user 1) is used as OBT, and mobile phone 2 (for example, the mobile phone used by user 2) is used as the device to be configured, and smart home appliance 1 And the smart appliance 2 can be located in two different rooms. In this scenario, there can be the following configuration process:

1) Mobile phone 1 installs OBT.

2) The mobile phone 1 creates a family and various user roles such as admin, family, and guest.

3) The mobile phone 1 discovers and configures the smart home appliance 1, so that the mobile phone 1 can control the smart home appliance 1.

4) Mobile phone 2 installs the client.

5) The OBT of mobile phone 1 finds the client of mobile phone 2, configures the client of mobile phone 2, and grants it family permission, then mobile phone 2 can also control smart home appliance 1.

6) Mobile phone 1 can also give mobile phone 2 admin rights, and mobile phone 2 can also configure and manage smart home appliances 1.

Further, for a new smart home appliance, such as smart home appliance 2, it is configured in the same way as smart home appliance 1. For a new client, configure its roles and permissions in the same way as the client of mobile phone 2.

A client can only be configured by one OBT, that is, a client can only have one device owner, and the client's security resources such as /doxm resources and /cred resources can only have one resource owner. Since only the owner has the authority to configure the corresponding resources, after the client of mobile phone 2 is configured by user 1’s OBT, when mobile phone 2 moves to the office, since the owner of the office network is user 3, user 3’s OBT cannot Configure the client of mobile phone 2 to communicate with other devices in the office network.

Even if the client terminal of the mobile phone 2 is reset so that the OBT of the user 3 can configure the client terminal of the mobile phone 2, when the mobile phone 2 moves home again, it cannot control the household appliances at home again, and needs to be reconfigured by the OBT of the user 1. In this way, mobile phone 2 needs to be reconfigured every time when it moves in a different security domain network, and the user experience is not good. To this end, the following technical solutions of the embodiments of the present application are proposed.

Fig. 4 is a first schematic flowchart of a method for configuring a client provided by an embodiment of the present application. As shown in Fig. 4, the method for configuring a client includes the following steps:

Step 401: The client sends the target attribute of the target resource of the client to the first configuration device, and the first configuration device receives the target attribute of the target resource sent by the client, where the target attribute is used to indicate the device role of the client; Wherein, the client has at least one first secure resource.

In the embodiment of the present application, the client refers to a client in the device to be configured. Among them, the device to be configured is, for example, a terminal of any form such as a mobile phone, a tablet computer, a notebook, a wearable device, and the like.

In the embodiment of this application, the first OBT is installed on the first configuration device. Unless otherwise specified, the first configuration device in the implementation of this application can be replaced with the first OBT.

In the embodiment of the present application, the client has at least one first secure resource, and the first secure resource includes at least one of the following: /doxm resource, /cred resource. For example, the client has /doxm resources and /doxm1 resources. For another example, the client has a /cred resource and a /cred1 resource. For another example, the client has {/doxm resource, /cred resource}, {/doxm1 resource, /cred1 resource}. It should be noted that the client has two resources as an example for description, and it is not limited to this. The number of secure resources originally possessed by the client can be 1, or 3, or 4, or 5. And so on.

In the embodiment of the present application, the target resource of the client has a target attribute. Optionally, the target resource may be a /pstat resource, or other resources such as a /doxm resource, or a newly created resource. Further, optionally, the target attribute may be a provisionas attribute, which is used to indicate the device role of the client.

In specific implementation, the first configuration device sends a first request message to the client, and the client receives a first request message sent by the first configuration device, and the first request message is used to request the The target attribute of the target resource of the client; the client sends a first response message to the first configuration device, the first configuration device receives a first response message sent by the client, and the first response message is used Informing the first configuration device of the target attribute of the target resource of the client.

In the embodiment of the present application, the value of the target attribute of the target resource supports a first value, and the first value is used to indicate that the device role is a mobile device; or, the value of the target attribute of the target resource supports A second value, where the second value is used to indicate that the device role is a fixed device.

For example: the first value is "mobile", which means that the device role is a mobile device. The second value is "stationary", which means that the device role is a stationary device.

In an optional implementation manner, the client checks the target attribute of the target resource of the client; if the value of the target attribute is the first value, after the client enters the configuration mode , To retain the existing resource configuration; or, in the case where the value of the target attribute is the second value, after the client enters the configuration mode, the existing resource configuration is deleted.

Step 402: When the device role of the client is a mobile device, the first configuration device sends a first creation signaling to the client, and the client receives the first creation sent by the first configuration device. Signaling, creating a second security resource on the client based on the first creation signaling, where the second security resource and the at least one first security resource belong to the same resource type.

In specific implementation, when the device role of the client is a mobile device, the first configuration device sends a second request message to the client, and the client receives the second request sent by the first configuration device Message, the second request message is used to request resource content of the client; the client sends the resource content of the client to the first configuration device, and the first configuration device receives the resource content sent by the client The resource content of the client, the resource content includes the identification and resource type of the at least one first secure resource; the first configuration device sends the first creation signaling to the client, and the client receives the The first creation signaling sent by the first configuration device, where the first creation signaling is used to create the second security resource.

Here, the client informs the first configuration device of the identification and resource type of the at least one first security resource that already exists, and the first configuration device knows that the client has at least one first security resource, so that the newly created first security resource can be avoided. The second security resource has the same name as at least one existing first security resource.

Step 403: The first configuration device sends first configuration signaling to the client, and the client receives the first configuration signaling sent by the first configuration device, and configures the station based on the first configuration signaling. The second security resource.

Here, the first configuration signaling is used to configure the second security resource.

In the embodiment of the present application, the first partial attribute of the second secure resource is determined based on one of the first secure resources in the at least one first secure resource; the second partial attribute of the second secure resource is determined based on the first secure resource A configuration signaling is determined.

In an optional embodiment, the first part of attributes includes at least one of the following: oxms attribute, oxmsel attribute, sct attribute, owned attribute, and deviceuuid attribute.

In an optional implementation, the second part of the attributes includes at least one of the following: /doxm/deviceowneruuid attribute (ie the first attribute), /doxm/rowneruuid attribute (ie the second attribute), /cred/rowneruuid attribute ( Namely the fourth attribute), /cred/creds attribute (that is, the fifth attribute). Among them, the /doxm/deviceowneruuid attribute and the /doxm/rowneruuid attribute belong to the attribute of the /doxm resource type, and the /cred/rowneruuid attribute and the /cred/creds attribute belong to the attribute of the /cred resource type.

In the embodiment of the present application, the at least one first security resource and the second security resource belong to the same resource type, which is described below in combination with two resource types.

所述至少一个第一安全资源和所述第二安全资源均属于第一资源类型，所述第一资源类型为与主人相关的资源。

The at least one first security resource and the second security resource both belong to a first resource type, and the first resource type is a resource related to the owner.

Here, the first resource type is the /doxm resource type. For example: the client originally had /doxm resources and /doxm2 resources, and the newly created security resource was /doxm3 resources. For example, the client originally had /doxm resources, /doxm2 resources, and /doxm3 resources, and the newly created security resource was /doxm4 resource. It should be noted that the embodiment of the present application does not limit the number of first security resources originally possessed by the client.

During specific implementation, the client receives the first configuration signaling sent by the first configuration device, and the first configuration signaling carries the first device identifier of the first configuration device; here, the first configuration The signaling is used to configure the first attribute (such as deviceowneruuid attribute) and the second attribute (such as rowneruuid attribute) of the second security resource; the client configures the second security resource based on the first configuration signaling The first attribute and the second attribute, wherein the first attribute is used to indicate a device owner identifier, the second attribute is used to indicate a resource owner identifier, and the value of the first attribute is the first device identifier, The value of the second attribute is the first device identifier.

Further, optionally, the first configuration device sends second configuration signaling to the client, where the second configuration signaling is used to configure a third attribute (such as an owned attribute) of the second security resource; The client receives the second configuration signaling sent by the first configuration device, and configures the third attribute of the second security resource based on the second configuration signaling, where the third attribute is used to indicate whether Create a device owner, the value of the third attribute is a third value (for example, true), and the third value is used to indicate that the device owner has been created; the client terminal sets the value of the at least one first secure resource The third attribute is set to the third value (such as true).

所述至少一个第一安全资源和所述第二安全资源均属于第二资源类型，所述第二资源类型为与凭证相关的资源。

The at least one first security resource and the second security resource both belong to a second resource type, and the second resource type is a resource related to a credential.

Here, the second resource type is the /cred resource type. For example: the client originally had the /cred resource and the /cred2 resource, and the newly created security resource was the /cred3 resource. For example: the client originally had /cred resources, /cred2 resources, and /cred3 resources, and the newly created security resource was /cred4 resource. It should be noted that the embodiment of the present application does not limit the number of first security resources originally possessed by the client.

In specific implementation, the client receives the first configuration signaling sent by the first configuration device, and the first configuration signaling carries the first device identifier and the credential content of the first configuration device; the first The configuration signaling is used to configure the fourth attribute (such as rowneruuid attribute) and the fifth attribute (such as creds attribute) of the second security resource; the client configures the second security resource based on the first configuration signaling The fourth attribute and the fifth attribute of, wherein the fourth attribute is used to indicate the resource owner identification, the fifth attribute is used to indicate the content of the voucher, and the value of the fourth attribute is the first device identification.

It should be noted that the at least one first security resource and the newly created second security resource possessed by the client may both belong to the /doxm resource type, or both belong to the /cred resource type. Not limited to this, the first secure resource may include two types of resources (such as /doxm resource type, /cred resource type), and accordingly, the newly created second secure resource may also include two types of resources (such as / Doxm resource type, /cred resource type), when creating a new second security resource, you need to ensure that it is consistent with the resource type of the existing security resource.

It should be noted that, in the technical solution of the embodiment of the present application, the number of first secure resources owned by the client is mostly explained by taking two as an example, and it is not limited to this. The number of first secure resources owned by the client Other numbers are also possible.

The following uses 5 and FIG. 6 to illustrate the technology of the embodiment of the present application. It should be noted that the solution in FIG. 5 is based on the extension/doxm resource as an example, and the solution in FIG. 6 is based on the extension/doxm resource and/ Take the cred resource as an example.

Example 1:

Add a provisionas attribute to the client's /oic/sec/pstat resource (/pstat resource for short), the attribute value is an enumerated type, and the optional attribute values include "mobile" and "stationary" .

At this time, the representation of the /oic/sec/pstat resource is:

The value of the above provisionas attribute can be specified during client development. If the client does not specify the provisionas attribute value when it leaves the factory, it can be configured by OBT when the client is configured. If the provisionas attribute value is specified when the client is shipped from the factory, it can also be changed when the client is configured.

Assume that a smart watch does not specify the provisionas attribute value when it leaves the factory. When entering the first network (home 1 network), the OBT of the home 1 network configured it and set the provisionas attribute value to "mobile". After that, the watch entered the second network (home 2 network), which was configured by the OBT of the home 2 network.

At this time, the user wears the watch and enters the home 3 network. The OBT of the home 3 network configures the watch as shown in Figure 5. The client represents the watch, OBT represents the OBT of the home 3 network, and the controlled device is the home 3 Devices in the network. As shown in Figure 5, the specific process includes the following steps:

Step 501: The client enters the configuration state (master=false).

Here, "master=false" represents that the client is a client without a master configured.

Specifically, after the client enters the configuration state (ie, configuration mode), the owned attribute of the /oic/sec/doxm resource is set to false (ie, owned=false).

The client checks the provisionas attribute of its /oic/sec/pstat resource. If the value is "mobile", the previous resource configuration will be retained after entering the configuration state; if the value is "stationary", the previous resource configuration will be cleared after entering the configuration state .

Step 502: OBT performs device discovery.

Specifically, OBT sends broadcast or multicast Get/oic/sec/doxm? The owned=false message is used to discover unowned devices and find the client. The client returns /oic/sec/doxm resource content.

Step 503: The OBT checks the device role according to the target attribute of the target resource.

Here, the OBT is, for example, the /pstat resource, and the target attribute is, for example, the provisionas attribute.

Specifically, the OBT establishes a connection with the client, and sends a Get/oic/sec/pstat message to obtain the provisionas attribute of the client's /pstat resource, and view its device role.

The client returns the device role as "mobile". It should be noted that if the client returns the device role as "stationary", it will be configured according to the normal configuration process.

Step 504: OBT obtains the resource content of the client.

Specifically, OBT sends a Get/oic/res message to obtain the client's /oic/res resource content, and the representation of all resource links obtained from the client is as follows (the following example is omitted):.

Step 505: The OBT checks the doxm resource type of the client, and obtains the /doxm resource and the /doxm2 resource.

Specifically, the OBT checks the client's doxm resource type (the rt attribute includes oic.r.doxm), and finds the /oic/sec/doxm resource (abbreviated as /doxm resource) and /oic/sec/doxm2 (abbreviated as /doxm2 resource).

Step 506: OBT creates a /doxm3 resource.

Specifically, OBT sends the following message to create the /doxm3 resource:

Create a new doxm resource on the client through the above message, namely /oic/sec/doxm3 (abbreviated as /doxm3 resource). Among them, the "oxms", "oxmsel", "sct", "owned", and "deviceuuid" attribute values of the /doxm3 resource are determined according to the corresponding attribute values of the /oic/sec/doxm resource that the client has existing.

Step 507: OBT configuration/doxm3 resource.

Specifically, OBT configures the /oic/sec/doxm3 resource, and sets the deviceowneruuid and rowneruuid attributes of the /oic/sec/doxm3 resource as the device ID of the OBT.

Step 508: The OBT sets the owner attribute of the doxm3 resource to true (ie, master=true), and the client synchronizes the doxm resource and the owner attribute of the doxm2 resource to true.

Step 509: OBT configures the credential.

Specifically, the OBT configures the client's /oic/sec/cred resource and allocates pairwise security credentials to it.

Step 510: OBT configures credentials.

Specifically, OBT configures the /oic/sec/cred resource of the controlled device and assigns pairwise security credentials to it.

Step 511: The client communicates with the controlled device using the credential.

Specifically, the client establishes a connection with the controlled device through pairwise security credentials and controls the controlled device.

At this point, the watch can be connected with controlled devices in the home 3 network to realize various intelligent scene operations. When the watch re-enters the home 1 network or the home 2 network, it can still be connected with the controlled devices in the home 1 network or the home 2 network to realize various intelligent scene operations. In addition, the OBT in the home 1 network, home 2 network, or home 3 network can directly set the watch without re-starting the initial configuration process.

Example two

Add a provisionas attribute to the client's /oic/sec/pstat resource (/pstat resource for short), the attribute value is an enumerated type, and the optional attribute values include "mobile" and "stationary" .

At this time, the representation of the /oic/sec/pstat resource is:

The value of the above provisionas attribute can be specified during client development. If the client does not specify the provisionas attribute value when it leaves the factory, it can be configured by OBT when the client is configured. If the provisionas attribute value is specified when the client is shipped from the factory, it can also be changed when the client is configured.

Assume that a smart watch does not specify the provisionas attribute value when it leaves the factory. When entering the first network (home 1 network), the OBT of the home 1 network configured it and set the provisionas attribute value to "mobile". After that, the watch entered the second network (home 2 network), which was configured by the OBT of the home 2 network.

At this time, the user wears the watch and enters the home 3 network. The OBT of the home 3 network configures the watch as shown in Figure 6. The client represents the watch, OBT represents the OBT of the home 3 network, and the controlled device is the home 3 Devices in the network. As shown in Figure 6, the specific process includes the following steps:

Step 601: The client enters the configuration state (master=false).

Here, "master=false" represents that the client is a client without a master configured.

Specifically, after the client enters the configuration state (ie, configuration mode), the owned attribute of the /oic/sec/doxm resource is set to false (ie, owned=false).

The client checks the provisionas attribute of its /oic/sec/pstat resource. If the value is "mobile", the previous resource configuration will be retained after entering the configuration state; if the value is "stationary", the previous resource configuration will be cleared after entering the configuration state .

Step 602: OBT performs device discovery.

Specifically, OBT sends broadcast or multicast Get/oic/sec/doxm? The owned=false message is used to discover unowned devices and find the client. The client returns /oic/sec/doxm resource content.

Step 603: The OBT checks the device role according to the target attribute of the target resource.

Here, the OBT is, for example, the /pstat resource, and the target attribute is, for example, the provisionas attribute.

Specifically, the OBT establishes a connection with the client, and sends a Get/oic/sec/pstat message to obtain the provisionas attribute of the client's /pstat resource, and view its device role.

The client returns the device role as "mobile". It should be noted that if the client returns the device role as "stationary", it will be configured according to the normal configuration process.

Step 604: OBT obtains the resource content of the client.

Specifically, OBT sends a Get/oic/res message to obtain the client's /oic/res resource content, and the representation of all resource links obtained from the client is as follows (the following example is omitted):.

Get/oic/res

Get the client's /oic/res resource content, and get the description of all the client's resource links (the following example is omitted).

Step 605: The OBT checks the doxm resource type of the client, and obtains the /doxm resource and the /doxm2 resource.

Specifically, the OBT checks the client's doxm resource type (the rt attribute includes oic.r.doxm), and finds the /oic/sec/doxm resource (abbreviated as /doxm resource) and /oic/sec/doxm2 (abbreviated as /doxm2 resource).

Step 606: OBT creates a /doxm3 resource.

Specifically, OBT sends the following message to create the /doxm3 resource:

Create a new doxm resource on the client through the above message, namely /oic/sec/doxm3 (abbreviated as /doxm3 resource). Among them, the "oxms", "oxmsel", "sct", "owned", and "deviceuuid" attribute values of the /doxm3 resource are determined according to the corresponding attribute values of the /oic/sec/doxm resource that the client has existing.

Step 607: OBT configuration/doxm3 resource.

Specifically, OBT configures the /oic/sec/doxm3 resource, and sets the deviceowneruuid and rowneruuid attributes of the /oic/sec/doxm3 resource as the device ID of the OBT.

Step 608: OBT sets the owner attribute of the doxm3 resource to true (ie, master=true), and the client synchronizes the doxm resource and the owner attribute of the doxm2 resource to true.

Step 609: The OBT checks the cred type resource of the client, and obtains the /cred resource and the /cred2 resource.

Specifically, after OBT obtains the /oic/res resource, it judges that the client has two cred resource types (the rt attribute includes oic.r.cred), namely /oic/sec/cred resource (abbreviated as /cred resource) and /oic /sec/cred2 resource (abbreviated as /cred2 resource).

Step 610: OBT creates a /cred3 resource.

Specifically, OBT sends the following message to create a /cred3 resource:

Further, OBT configures the /oic/sec/cred3 resource (/cred3 resource for short), and sets the rowneruuid attribute of the /oic/sec/cred3 resource to the device ID of the OBT.

Step 611: OBT configures credentials.

Specifically, OBT further configures the /oic/sec/cred3 resource, allocates pairwise security credentials to it, and writes the credentials into the creds attribute of the /oic/sec/cred3 resource.

Step 612: OBT configures credentials.

Specifically, OBT configures the /oic/sec/cred resource of the controlled device and assigns pairwise security credentials to it.

Step 613: The client communicates with the controlled device using the credential.

Specifically, the client establishes a connection with the controlled device through pairwise security credentials and controls the controlled device.

At this point, the watch can be connected with controlled devices in the home 3 network to realize various intelligent scene operations. When the watch re-enters the home 1 network or the home 2 network, it can still be connected with the controlled devices in the home 1 network or the home 2 network to realize various intelligent scene operations. In addition, the OBT in the home 1 network, home 2 network, or home 3 network can directly set the watch without re-starting the initial configuration process.

FIG. 7 is a schematic diagram of the second flow of a method for configuring a client provided by an embodiment of the application. As shown in FIG. 7, the method for configuring a client includes the following steps:

Step 701: The client sends the target attribute of the target resource of the client to the first configuration device, and the first configuration device receives the target attribute of the target resource of the client sent by the client, and the target attribute is used to indicate the client The device role of the terminal; wherein, the client has at least one first security resource.

In the embodiment of the present application, the client refers to the client in the device to be configured. Among them, the device to be configured is, for example, a terminal of any form such as a mobile phone, a tablet computer, a notebook, a wearable device, etc.

In the embodiment of this application, the first OBT is installed on the first configuration device. Unless otherwise specified, the first configuration device in the implementation of this application can be replaced with the first OBT.

In the embodiment of the present application, the client has at least one first secure resource, and the first secure resource includes at least one of the following: /doxm resource, /cred resource. For example, the client has /doxm resources and /doxm1 resources. For another example, the client has a /cred resource and a /cred1 resource. For another example, the client has {/doxm resource, /cred resource}, {/doxm1 resource, /cred1 resource}. It should be noted that the client has two resources as an example for description, and it is not limited to this. The number of secure resources originally possessed by the client can be 1, or 3, or 4, or 5. And so on.

In the embodiment of the present application, the target resource of the client has a target attribute. Optionally, the target resource may be a /pstat resource, or other resources such as a /doxm resource, or a newly created resource. Further, optionally, the target attribute may be a provisionas attribute, which is used to indicate the device role of the client.

In specific implementation, the first configuration device sends a first request message to the client, and the client receives a first request message sent by the first configuration device, and the first request message is used to request the The target attribute of the target resource of the client; the client sends a first response message to the first configuration device, the first configuration device receives a first response message sent by the client, and the first response message is used Informing the first configuration device of the target attribute of the target resource of the client.

In the embodiment of the present application, the value of the target attribute of the target resource supports a first value, and the first value is used to indicate that the device role is a mobile device; or, the value of the target attribute of the target resource supports A second value, where the second value is used to indicate that the device role is a fixed device.

For example: the first value is "mobile", which means that the device role is a mobile device. The second value is "stationary", which means that the device role is a stationary device.

In an optional implementation manner, the client checks the target attribute of the target resource of the client; if the value of the target attribute is the first value, after the client enters the configuration mode , To retain the existing resource configuration; or, in the case where the value of the target attribute is the second value, after the client enters the configuration mode, the existing resource configuration is deleted.

Step 702: When the device role of the client is a mobile device, the first configuration device sends trigger signaling to the client, and the client receives the trigger signaling sent by the first configuration device. The trigger signaling is used to trigger the client to initiate device-led configuration.

Here, that the trigger signaling is used to trigger the client to initiate device-led configuration refers to triggering the client to create a second secure resource on the client.

Step 703: The client creates a second secure resource on the client, where the second secure resource and the at least one first secure resource belong to the same resource type.

Step 704: The first configuration device sends configuration parameters to the client, the client obtains the configuration parameters from the first configuration device, and the client configures the second security resource based on the configuration parameters.

Here, the configuration parameter is used by the client to configure the second security resource.

In the embodiment of the present application, the first partial attribute of the second secure resource is determined based on one of the first secure resources in the at least one first secure resource; the second partial attribute of the second secure resource is based on the configuration The parameters are determined.

In an optional embodiment, the first part of attributes includes at least one of the following: oxms attribute, oxmsel attribute, sct attribute, owned attribute, and deviceuuid attribute.

In an optional implementation, the second part of the attributes includes at least one of the following: /doxm/deviceowneruuid attribute (ie the first attribute), /doxm/rowneruuid attribute (ie the second attribute), /cred/rowneruuid attribute ( Namely the fourth attribute), /cred/creds attribute (that is, the fifth attribute). Among them, the /doxm/deviceowneruuid attribute and the /doxm/rowneruuid attribute belong to the attribute of the /doxm resource type, and the /cred/rowneruuid attribute and the /cred/creds attribute belong to the attribute of the /cred resource type.

In the embodiment of the present application, the at least one first security resource and the second security resource belong to the same resource type, which is described below in combination with two resource types.

所述至少一个第一安全资源和所述第二安全资源均属于第一资源类型，所述第一资源类型为与主人相关的资源。

The at least one first security resource and the second security resource both belong to a first resource type, and the first resource type is a resource related to the owner.

Here, the first resource type is the /doxm resource type. For example: the client originally had /doxm resources and /doxm2 resources, and the newly created security resource was /doxm3 resources. For example: the client originally had /doxm resources, /doxm2 resources, and /doxm3 resources, and the newly created security resource was /doxm4 resource. It should be noted that the embodiment of the present application does not limit the number of first security resources originally possessed by the client.

In specific implementation, the client obtains the first device identifier of the first configuration device from the first configuration device, and the first device identifier is used to configure the first attribute of the second security resource (such as deviceowneruuid Attribute) and a second attribute (such as rowneruuid attribute), the client configures the first attribute and the second attribute of the second security resource based on the first device identifier, wherein the first attribute is used to indicate the device The owner identifier, the second attribute is used to indicate the resource owner identifier, the value of the first attribute is the first device identifier, and the value of the second attribute is the first device identifier.

Further, optionally, the client configures a third attribute (such as an owned attribute) of the second secure resource, where the third attribute is used to indicate whether to create a device owner, and the value of the third attribute Is the third value (such as the owned attribute), the third value is used to indicate that the device owner has been created; the client sets the third attribute of the at least one first secure resource to the third value (Such as the owned attribute).

所述至少一个第一安全资源和所述第二安全资源均属于第二资源类型，所述第二资源类型为与凭证相关的资源。

The at least one first security resource and the second security resource both belong to a second resource type, and the second resource type is a resource related to a credential.

Here, the second resource type is the /cred resource type. For example: the client originally had the /cred resource and the /cred2 resource, and the newly created security resource was the /cred3 resource. For example: the client originally had /cred resources, /cred2 resources, and /cred3 resources, and the newly created security resource was /cred4 resource. It should be noted that the embodiment of the present application does not limit the number of first security resources originally possessed by the client.

During specific implementation, the client obtains the first device identification and credential content of the first configuration device from the first configuration device, and the first device identification and the credential content are used to configure the second security The fourth attribute (such as rowneruuid attribute) and the fifth attribute (such as creds attribute) of the resource; the client configures the fourth and fifth attributes of the second secure resource based on the first device identifier and the content of the credential Attributes, wherein the fourth attribute is used to indicate a resource owner identifier, the fifth attribute is used to indicate voucher content, and the value of the fourth attribute is the first device identifier.

It should be noted that the at least one first security resource and the newly created second security resource possessed by the client may both belong to the /doxm resource type, or both belong to the /cred resource type. Not limited to this, the first secure resource may include two types of resources (such as /doxm resource type, /cred resource type), and accordingly, the newly created second secure resource may also include two types of resources (such as / Doxm resource type, /cred resource type), when creating a new second security resource, you need to ensure that it is consistent with the resource type of the existing security resource.

It should be noted that, in the technical solution of the embodiment of the present application, the number of first secure resources owned by the client is mostly explained by taking two as an example, and it is not limited to this. The number of first secure resources owned by the client Other numbers are also possible.

The following describes the technology of the embodiment of the present application with reference to 8. It should be noted that the solution in FIG. 8 is described by using the expansion of the /doxm resource and the /cred resource as an example.

Example three:

Add a provisionas attribute to the client's /oic/sec/pstat resource (/pstat resource for short), the attribute value is an enumeration type, and the optional attribute values include "mobile" and "stationary" .

At this time, the representation of the /oic/sec/pstat resource is:

The value of the above provisionas attribute can be specified during client development. If the client does not specify the provisionas attribute value when it leaves the factory, it can be configured by OBT when the client is configured. If the provisionas attribute value is specified when the client is shipped from the factory, it can also be changed when the client is configured.

Assume that a smart watch does not specify the provisionas attribute value when it leaves the factory. When entering the first network (home 1 network), the OBT of the home 1 network configured it and set the provisionas attribute value to "mobile". After that, the watch entered the second network (home 2 network), which was configured by the OBT of the home 2 network.

At this time, the user wears the watch and enters the home 3 network. The OBT of the home 3 network configures the watch as shown in Figure 8. The client represents the watch, OBT represents the OBT of the home 3 network, and the controlled device is the home 3 Devices in the network. As shown in Figure 8, the specific process includes the following steps:

Step 801: The client enters the configuration state (master=false).

Here, "master=false" represents that the client is a client without a master configured.

Specifically, after the client enters the configuration state (ie, configuration mode), the owned attribute of the /oic/sec/doxm resource is set to false (ie, owned=false).

The client checks the provisionas attribute of its /oic/sec/pstat resource. If the value is "mobile", the previous resource configuration will be retained after entering the configuration state; if the value is "stationary", the previous resource configuration will be cleared after entering the configuration state .

Step 802: OBT performs device discovery.

Specifically, OBT sends broadcast or multicast Get/oic/sec/doxm? The owned=false message is used to discover unowned devices and find the client. The client returns /oic/sec/doxm resource content.

Step 803: The OBT checks the device role according to the target attribute of the target resource.

Here, the OBT is, for example, the /pstat resource, and the target attribute is, for example, the provisionas attribute.

Specifically, the OBT establishes a connection with the client, and sends a Get/oic/sec/pstat message to obtain the provisionas attribute of the client's /pstat resource, and view its device role.

The client returns the device role as "mobile". It should be noted that if the client returns the device role as "stationary", it will be configured according to the normal configuration process.

Step 804: OBT starts the device-led configuration.

Specifically, OBT finds that the client supports the device-led configuration mode, and sends the following message (ie, trigger signaling, which is used to trigger the client to initiate the device-led configuration) to the client to start the device-led configuration :

Step 805: The client checks the doxm resource type, and obtains the /doxm resource and the /doxm2 resource.

Specifically, the client checks its own doxm resource type (the rt attribute includes oic.r.doxm), and finds /oic/sec/doxm resources (abbreviated as /doxm resources) and /oic/sec/doxm2 (abbreviated as /doxm2 resources).

Step 806: The client creates a /doxm3 resource.

Specifically, the client creates the following new resource /oic/sec/doxm3 resource (/doxm3 resource for short):

Among them, the "oxms", "oxmsel", "sct", "owned", and "deviceuuid" attribute values of the /doxm3 resource are determined according to the corresponding attribute values of the /oic/sec/doxm resource that the client has existing.

Step 807: The client obtains the device identification of the OBT.

Step 808: The client configures the /doxm3 resource.

Specifically, the client configures the obtained device identifier of the OBT to the deviceowneruuid attribute and rowneruuid attribute of the /oic/sec/doxm3 resource.

Step 809: The client sets the master attribute of the doxm3 resource to true (ie, master=true), and the client synchronizes the master attribute of the doxm resource and the doxm2 resource to true.

Step 810: The client checks the cred type resource, and obtains the /cred resource and the /cred2 resource.

Specifically, the client checks its own cred resource type (the rt attribute includes oic.r.cred), which are respectively /oic/sec/cred resource (abbreviated as /cred resource) and /oic/sec/cred2 resource (abbreviated as /cred2 resource) ).

Step 811: The client creates a /cred3 resource.

Specifically, the client creates the following new resource /oic/sec/cred3 resource (/cred3 resource for short):

Its rowneruuid attribute is set to the device identifier of OBT.

Step 812: The client configures the credential to the /cred3 resource.

Specifically, the client obtains the pairwise security credential for the P2P connection from the OBT. The client writes the pairwise security credentials into the creds attribute of the /oic/sec/cred3 resource.

Step 813: OBT configures the credential.

Specifically, OBT configures the /oic/sec/cred resource of the controlled device and assigns pairwise security credentials to it.

Step 814: The client communicates with the controlled device using the credential.

Specifically, the client establishes a connection with the controlled device through pairwise security credentials and controls the controlled device.

At this point, the watch can be connected with controlled devices in the home 3 network to realize various intelligent scene operations. When the watch re-enters the home 1 network or the home 2 network, it can still be connected with the controlled devices in the home 1 network or the home 2 network to realize various intelligent scene operations. In addition, the OBT in the home 1 network, home 2 network, or home 3 network can directly set the watch without re-starting the initial configuration process.

FIG. 9 is a schematic diagram 1 of the structural composition of an apparatus for configuring a client provided by an embodiment of the application. As shown in FIG. 9, the apparatus for configuring a client includes:

The sending unit 901 is configured to send the target attribute of the target resource of the client to the first configuration device, where the target attribute is used to indicate the device role of the client; wherein the client has at least one first security resource;

The receiving unit 902 is configured to receive the first creation signaling sent by the first configuration device when the device role of the client is a mobile device, and create on the client based on the first creation signaling A second security resource, where the second security resource and the at least one first security resource belong to the same resource type; receiving the first configuration signaling sent by the first configuration device, and configuring the device based on the first configuration signaling The second security resource.

In an optional implementation manner, the first partial attribute of the second secure resource is determined based on one of the at least one first secure resource;

The second partial attribute of the second security resource is determined based on the first configuration signaling.

In an optional implementation manner, the value of the target attribute of the target resource supports a first value, and the first value is used to indicate that the device role is a mobile device; or,

The value of the target attribute of the target resource supports a second value, and the second value is used to indicate that the device role is a fixed device.

In an optional embodiment, the device further includes:

The processing unit (not shown in the figure) is used to check the target attribute of the target resource of the client; if the value of the target attribute is the first value, after the client enters the configuration mode , To retain the existing resource configuration; or, in the case where the value of the target attribute is the second value, after the client enters the configuration mode, the existing resource configuration is deleted.

In an optional implementation manner, the receiving unit 902 is configured to receive a first request message sent by the first configuration device, where the first request message is used to request a target attribute of a target resource of the client;

The sending unit 901 is configured to send a first response message to the first configuration device, where the first response message is used to notify the first configuration device of the target attribute of the target resource of the client.

In an optional implementation manner, the receiving unit 902 is configured to receive a second request message sent by the first configuration device when the device role of the client is a mobile device, and the second request message For requesting the resource content of the client;

The sending unit 901 is configured to send resource content of the client to the first configuration device, where the resource content includes the identifier and resource type of the at least one first secure resource;

The receiving unit 902 is configured to receive first creation signaling sent by the first configuration device, where the first creation signaling is used to create the second security resource.

In an optional implementation manner, the at least one first security resource and the second security resource both belong to a first resource type, and the first resource type is a resource related to the owner.

In an optional implementation manner, the receiving unit 902 is configured to receive first configuration signaling sent by the first configuration device, where the first configuration signaling carries the first device identifier of the first configuration device ; Configure the first attribute and the second attribute of the second security resource based on the first configuration signaling, wherein the first attribute is used to indicate the device owner identification, and the second attribute is used to indicate the resource owner identification , The value of the first attribute is the first device identifier, and the value of the second attribute is the first device identifier.

In an optional implementation manner, the receiving unit 902 is configured to receive second configuration signaling sent by the first configuration device, and configure the third attribute of the second security resource based on the second configuration signaling , Wherein the third attribute is used to indicate whether to create a device owner, the value of the third attribute is a third value, and the third value is used to indicate that the device owner has been created; The third attribute of a secure resource is set to the third value.

In an optional implementation manner, the at least one first secure resource and the second secure resource both belong to a second resource type, and the second resource type is a resource related to a credential.

In an optional implementation manner, the receiving unit 902 is configured to receive first configuration signaling sent by the first configuration device, where the first configuration signaling carries the first device identifier of the first configuration device And voucher content; configure the fourth attribute and the fifth attribute of the second security resource based on the first configuration signaling, wherein the fourth attribute is used to indicate the resource owner identifier, and the fifth attribute is used to indicate Voucher content, the value of the fourth attribute is the first device identifier.

Those skilled in the art should understand that the relevant description of the foregoing apparatus for configuring the client in the embodiment of the present application can be understood with reference to the relevant description of the method for configuring the client in the embodiment of the present application.

FIG. 10 is a schematic diagram 2 of the structural composition of the apparatus for configuring a client provided by an embodiment of the application. As shown in FIG. 10, the apparatus for configuring a client includes:

The sending unit 1001 is configured to send a target attribute of a target resource of the client to a first configuration device, where the target attribute is used to indicate a device role of the client; wherein the client has at least one first security resource;

The receiving unit 1002 is configured to receive trigger signaling sent by the first configuration device when the device role of the client is a mobile device, where the trigger signaling is used to trigger the client to initiate device-led configuration;

The creating unit 1003 is configured to create a second secure resource on the client, where the second secure resource and the at least one first secure resource belong to the same resource type;

The obtaining unit 1004 is configured to obtain configuration parameters from the first configuration device, and configure the second security resource based on the configuration parameters.

In an optional implementation manner, the first partial attribute of the second secure resource is determined based on one of the at least one first secure resource;

The second partial attribute of the second security resource is determined based on the configuration parameter.

In an optional implementation manner, the value of the target attribute of the target resource supports a first value, and the first value is used to indicate that the device role is a mobile device; or,

The value of the target attribute of the target resource supports a second value, and the second value is used to indicate that the device role is a fixed device.

In an optional embodiment, the device further includes:

The processing unit (not shown in the figure) is used to check the target attribute of the target resource of the client; if the value of the target attribute is the first value, after the client enters the configuration mode , To retain the existing resource configuration; or, in the case where the value of the target attribute is the second value, after the client enters the configuration mode, the existing resource configuration is deleted.

In an optional implementation manner, the receiving unit 1002 is configured to receive a first request message sent by the first configuration device, where the first request message is used to request a target attribute of a target resource of the client;

The sending unit 1001 is configured to send a first response message to the first configuration device, where the first response message is used to notify the first configuration device of the target attribute of the target resource of the client.

In an optional implementation manner, the at least one first security resource and the second security resource both belong to a first resource type, and the first resource type is a resource related to the owner.

In an optional implementation manner, the obtaining unit 1004 is configured to obtain a first device identifier of the first configuration device from the first configuration device, and configure the second security resource based on the first device identifier The first attribute and the second attribute of, wherein the first attribute is used to represent the device owner identification, the second attribute is used to represent the resource owner identification, and the value of the first attribute is the first device identification , The value of the second attribute is the first device identifier.

In an optional embodiment, the device further includes:

The configuration unit (not shown in the figure) is used to configure the third attribute of the second security resource, where the third attribute is used to indicate whether to create a device owner, and the value of the third attribute is third The third value is used to indicate that the device owner has been created; the third attribute of the at least one first secure resource is set to the third value.

In an optional implementation manner, the at least one first secure resource and the second secure resource both belong to a second resource type, and the second resource type is a resource related to a credential.

In an optional implementation manner, the acquiring unit 1004 is configured to acquire the first device identification and credential content of the first configuration device from the first configuration device; based on the first device identification and the credential The content configures the fourth attribute and the fifth attribute of the second security resource, where the fourth attribute is used to indicate the resource owner identifier, the fifth attribute is used to indicate the content of the voucher, and the value of the fourth attribute Is the first device identifier.

Those skilled in the art should understand that the relevant description of the foregoing apparatus for configuring the client in the embodiment of the present application can be understood with reference to the relevant description of the method for configuring the client in the embodiment of the present application.

FIG. 11 is a schematic diagram 3 of the structural composition of an apparatus for configuring a client provided by an embodiment of the application. As shown in FIG. 11, the apparatus for configuring a client includes:

The receiving unit 1101 is configured to receive a target attribute of a target resource sent by a client, where the target attribute is used to indicate a device role of the client; wherein the client has at least one first secure resource;

The sending unit 1102 is configured to send a first creation signaling to the client when the device role of the client is a mobile device, where the first creation signaling is used to instruct to create a second creation on the client Two security resources, the second security resource and the at least one first security resource belong to the same resource type; sending a first configuration signaling to the client, and the first configuration signaling is used to configure the second Security resources.

In an optional implementation manner, the first partial attribute of the second secure resource is determined based on one of the at least one first secure resource;

The second partial attribute of the second security resource is determined based on the first configuration signaling.

In an optional implementation manner, the value of the target attribute of the target resource supports a first value, and the first value is used to indicate that the device role is a mobile device; or,

The value of the target attribute of the target resource supports a second value, and the second value is used to indicate that the device role is a fixed device.

In an optional implementation manner, the sending unit 1102 is configured to send a first request message to the client, where the first request message is used to request a target attribute of a target resource of the client;

The receiving unit 1101 is configured to receive a first response message sent by the client, where the first response message is used to notify the first configuration device of the target attribute of the target resource of the client.

In an optional implementation manner, the sending unit 1102 is configured to send a second request message to the client when the device role of the client is a mobile device, and the second request message is used to request The resource content of the client;

The receiving unit 1101 is configured to receive resource content of the client sent by the client, where the resource content includes the identifier and resource type of the at least one first secure resource;

The sending unit 1102 is configured to send first creation signaling to the client, where the first creation signaling is used to create the second security resource.

In an optional implementation manner, the at least one first security resource and the second security resource both belong to a first resource type, and the first resource type is a resource related to the owner.

In an optional implementation manner, the first configuration signaling carries a first device identifier of the first configuration device;

The first configuration signaling is used to configure the first attribute and the second attribute of the second security resource, where the first attribute is used to indicate the device owner identification, and the second attribute is used to indicate the resource owner identification , The value of the first attribute is the first device identifier, and the value of the second attribute is the first device identifier.

In an optional implementation manner, the sending unit 1102 is configured to send second configuration signaling to the client, and the second configuration signaling is used to configure a third attribute of the second security resource, where The third attribute is used to indicate whether to create a device owner, the value of the third attribute is a third value, and the third value is used to indicate that the device owner has been created.

In an optional implementation manner, the at least one first secure resource and the second secure resource both belong to a second resource type, and the second resource type is a resource related to a credential.

In an optional implementation manner, the first configuration signaling carries the first device identifier and credential content of the first configuration device;

The first configuration signaling is used to configure the fourth attribute and the fifth attribute of the second security resource, where the fourth attribute is used to indicate the resource owner identifier, and the fifth attribute is used to indicate the content of the credential, The value of the fourth attribute is the first device identifier.

Those skilled in the art should understand that the relevant description of the foregoing apparatus for configuring the client in the embodiment of the present application can be understood with reference to the relevant description of the method for configuring the client in the embodiment of the present application.

FIG. 12 is a schematic diagram 4 of the structural composition of the apparatus for configuring a client provided by an embodiment of the application. As shown in FIG. 12, the apparatus for configuring a client includes:

The receiving unit 1201 is configured to receive the target attribute of the target resource of the client sent by the client, where the target attribute is used to indicate the device role of the client; wherein the client has at least one first secure resource;

The sending unit 1202 is configured to send trigger signaling to the client when the device role of the client is a mobile device, where the trigger signaling is used to trigger the client to create a second session on the client. Two security resources, the second security resource and the at least one first security resource belong to the same resource type; sending configuration parameters to the client, the configuration parameters being used by the client to configure the second security resource .

In an optional implementation manner, the first partial attribute of the second secure resource is determined based on one of the at least one first secure resource;

The second partial attribute of the second security resource is determined based on the configuration parameter.

In an optional implementation manner, the value of the target attribute of the target resource supports a first value, and the first value is used to indicate that the device role is a mobile device; or,

The value of the target attribute of the target resource supports a second value, and the second value is used to indicate that the device role is a fixed device.

In an optional implementation manner, the sending unit 1202 is configured to send a first request message to the client, where the first request message is used to request a target attribute of a target resource of the client;

The receiving unit 1201 is configured to receive a first response message sent by the client, where the first response message is used to notify the first configuration device of the target attribute of the target resource of the client.

In an optional implementation manner, the at least one first security resource and the second security resource both belong to a first resource type, and the first resource type is a resource related to the owner.

In an optional implementation manner, the configuration parameter includes a first device identifier of the first configuration device;

The first device identifier is used to configure the first attribute and the second attribute of the second secure resource, where the first attribute is used to indicate the device owner identifier, and the second attribute is used to indicate the resource owner identifier, The value of the first attribute is the first device identifier, and the value of the second attribute is the first device identifier.

In an optional implementation manner, the at least one first secure resource and the second secure resource both belong to a second resource type, and the second resource type is a resource related to a credential.

In an optional implementation manner, the configuration parameters include a first device identifier and credential content of the first configuration device;

The first device identifier and the credential content are used to configure the fourth attribute and the fifth attribute of the second secure resource, where the fourth attribute is used to indicate the resource owner identifier, and the fifth attribute is used to Indicates the content of the voucher, and the value of the fourth attribute is the first device identifier.

Those skilled in the art should understand that the relevant description of the foregoing apparatus for configuring the client in the embodiment of the present application can be understood with reference to the relevant description of the method for configuring the client in the embodiment of the present application.

FIG. 13 is a schematic structural diagram of a communication device 1300 according to an embodiment of the present application. The communication device may be a terminal device or a client. The communication device 1300 shown in FIG. 13 includes a processor 1310, and the processor 1310 can call and run a computer program from a memory to implement the method in the embodiment of the present application.

Optionally, as shown in FIG. 13, the communication device 1300 may further include a memory 1320. The processor 1310 may call and run a computer program from the memory 1320 to implement the method in the embodiment of the present application.

The memory 1320 may be a separate device independent of the processor 1310, or may be integrated in the processor 1310.

Optionally, as shown in FIG. 13, the communication device 1300 may further include a transceiver 1330, and the processor 1310 may control the transceiver 1330 to communicate with other devices. Specifically, it may send information or data to other devices, or receive other devices. Information or data sent by the device.

Among them, the transceiver 1330 may include a transmitter and a receiver. The transceiver 1330 may further include an antenna, and the number of antennas may be one or more.

Optionally, the communication device 1300 may specifically be a network device of an embodiment of the application, and the communication device 1300 may implement the corresponding process implemented by the network device in each method of the embodiment of the application. For brevity, details are not repeated here. .

Optionally, the communication device 1300 may specifically be a mobile terminal/terminal device of an embodiment of the present application, and the communication device 1300 may implement the corresponding process implemented by the mobile terminal/terminal device in each method of the embodiment of the present application. For the sake of brevity , I won’t repeat it here.

FIG. 14 is a schematic structural diagram of a chip of an embodiment of the present application. The chip 1400 shown in FIG. 14 includes a processor 1410, and the processor 1410 can call and run a computer program from the memory to implement the method in the embodiment of the present application.

Optionally, as shown in FIG. 14, the chip 1400 may further include a memory 1420. The processor 1410 can call and run a computer program from the memory 1420 to implement the method in the embodiment of the present application.

The memory 1420 may be a separate device independent of the processor 1410, or may be integrated in the processor 1410.

Optionally, the chip 1400 may further include an input interface 1430. The processor 1410 can control the input interface 1430 to communicate with other devices or chips, and specifically, can obtain information or data sent by other devices or chips.

Optionally, the chip 1400 may further include an output interface 1440. The processor 1410 can control the output interface 1440 to communicate with other devices or chips, and specifically, can output information or data to other devices or chips.

Optionally, the chip can be applied to the network device in the embodiment of the present application, and the chip can implement the corresponding process implemented by the network device in each method of the embodiment of the present application. For the sake of brevity, details are not described herein again.

Optionally, the chip can be applied to the mobile terminal/terminal device in the embodiment of the present application, and the chip can implement the corresponding process implemented by the mobile terminal/terminal device in each method of the embodiment of the present application. For the sake of brevity, here No longer.

It should be understood that the chip mentioned in the embodiment of the present application may also be referred to as a system-level chip, a system-on-chip, a system-on-chip, or a system-on-chip.

FIG. 15 is a schematic block diagram of a communication system 1500 according to an embodiment of the present application. As shown in FIG. 15, the communication system 1500 includes a terminal device 1510 and a network device 1520.

Wherein, the terminal device 1510 can be used to implement the corresponding function implemented by the terminal device in the above method, and the network device 1520 can be used to implement the corresponding function implemented by the network device in the above method. For brevity, it will not be repeated here. .

It should be understood that the processor of the embodiment of the present application may be an integrated circuit chip with signal processing capability. In the implementation process, the steps of the foregoing method embodiments can be completed by hardware integrated logic circuits in the processor or instructions in the form of software. The above-mentioned processor may be a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (ASIC), a ready-made programmable gate array (Field Programmable Gate Array, FPGA) or other Programming logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps, and logical block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like. The steps of the method disclosed in the embodiments of the present application can be directly embodied as being executed and completed by a hardware decoding processor, or executed and completed by a combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, or electrically erasable programmable memory, registers. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

It can be understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory. Among them, the non-volatile memory can be read-only memory (Read-Only Memory, ROM), programmable read-only memory (Programmable ROM, PROM), erasable programmable read-only memory (Erasable PROM, EPROM), and electrically available Erase programmable read-only memory (Electrically EPROM, EEPROM) or flash memory. The volatile memory may be random access memory (Random Access Memory, RAM), which is used as an external cache. By way of exemplary but not restrictive description, many forms of RAM are available, such as static random access memory (Static RAM, SRAM), dynamic random access memory (Dynamic RAM, DRAM), synchronous dynamic random access memory (Synchronous DRAM, SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (Double Data Rate SDRAM, DDR SDRAM), Enhanced Synchronous Dynamic Random Access Memory (Enhanced SDRAM, ESDRAM), Synchronous Link Dynamic Random Access Memory (Synchlink DRAM, SLDRAM) ) And Direct Rambus RAM (DR RAM). It should be noted that the memories of the systems and methods described herein are intended to include, but are not limited to, these and any other suitable types of memories.

It should be understood that the foregoing memory is exemplary but not restrictive. For example, the memory in the embodiment of the present application may also be static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), Synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection Dynamic random access memory (synch link DRAM, SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DR RAM) and so on. That is to say, the memory in the embodiments of the present application is intended to include, but is not limited to, these and any other suitable types of memory.

The embodiment of the present application also provides a computer-readable storage medium for storing computer programs.

Optionally, the computer-readable storage medium may be applied to the network device in the embodiment of the present application, and the computer program causes the computer to execute the corresponding process implemented by the network device in each method of the embodiment of the present application. For the sake of brevity, here No longer.

Optionally, the computer-readable storage medium can be applied to the mobile terminal/terminal device in the embodiment of the present application, and the computer program causes the computer to execute the corresponding process implemented by the mobile terminal/terminal device in each method of the embodiment of the present application , For the sake of brevity, I won’t repeat it here.

The embodiments of the present application also provide a computer program product, including computer program instructions.

Optionally, the computer program product can be applied to the network device in the embodiment of the present application, and the computer program instructions cause the computer to execute the corresponding process implemented by the network device in each method of the embodiment of the present application. For the sake of brevity, it is not here Go into details again.

Optionally, the computer program product can be applied to the mobile terminal/terminal device in the embodiment of the present application, and the computer program instructions cause the computer to execute the corresponding process implemented by the mobile terminal/terminal device in each method of the embodiment of the present application, For the sake of brevity, I will not repeat them here.

The embodiment of the present application also provides a computer program.

Optionally, the computer program can be applied to the network device in the embodiment of the present application. When the computer program runs on the computer, it causes the computer to execute the corresponding process implemented by the network device in each method of the embodiment of the present application. For the sake of brevity , I won’t repeat it here.

Optionally, the computer program can be applied to the mobile terminal/terminal device in the embodiment of the present application. When the computer program runs on the computer, the computer executes each method in the embodiment of the present application. For the sake of brevity, the corresponding process will not be repeated here.

A person of ordinary skill in the art may realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether these functions are performed by hardware or software depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.

Those skilled in the art can clearly understand that, for the convenience and conciseness of description, the specific working process of the system, device and unit described above can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, device, and method may be implemented in other ways. For example, the device embodiments described above are merely illustrative, for example, the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components may be combined or It can be integrated into another system, or some features can be ignored or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.

In addition, the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.

If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solution of the present application essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory,) ROM, random access memory (Random Access Memory, RAM), magnetic disks or optical disks and other media that can store program codes. .

The above are only specific implementations of this application, but the protection scope of this application is not limited to this. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed in this application. Should be covered within the scope of protection of this application. Therefore, the protection scope of this application shall be subject to the protection scope of the claims.

Claims (83)

A method for configuring a client, the method comprising: The client sends the target attribute of the target resource of the client to the first configuration device, where the target attribute is used to indicate the device role of the client; wherein the client has at least one first security resource; When the device role of the client is a mobile device, the client receives the first creation signaling sent by the first configuration device, and creates a second security on the client based on the first creation signaling. Resource, the second security resource and the at least one first security resource belong to the same resource type; The client receives the first configuration signaling sent by the first configuration device, and configures the second security resource based on the first configuration signaling. The method of claim 1, wherein: The first partial attribute of the second secure resource is determined based on one of the at least one first secure resource; The second partial attribute of the second security resource is determined based on the first configuration signaling. The method of claim 1 or 2, wherein: The value of the target attribute of the target resource supports a first value, and the first value is used to indicate that the device role is a mobile device; or, The value of the target attribute of the target resource supports a second value, and the second value is used to indicate that the device role is a fixed device. The method according to claim 3, wherein the method further comprises: The client checks the target attribute of the target resource of the client; In the case where the value of the target attribute is the first value, after the client enters the configuration mode, the existing resource configuration is retained; or, In a case where the value of the target attribute is the second value, after the client enters the configuration mode, the existing resource configuration is deleted. The method according to any one of claims 1 to 4, wherein the client sending the target attribute of the target resource of the client to the first configuration device comprises: Receiving, by the client, a first request message sent by the first configuration device, where the first request message is used to request a target attribute of a target resource of the client; The client sends a first response message to the first configuration device, where the first response message is used to notify the first configuration device of the target attribute of the target resource of the client. The method according to any one of claims 1 to 5, wherein when the device role of the client is a mobile device, the client receiving the first creation signaling sent by the first configuration device includes : When the device role of the client is a mobile device, the client receives a second request message sent by the first configuration device, and the second request message is used to request resource content of the client; Sending, by the client, the resource content of the client to the first configuration device, the resource content including the identifier and resource type of the at least one first secure resource; The client receives the first creation signaling sent by the first configuration device, where the first creation signaling is used to create the second security resource. The method according to any one of claims 1 to 6, wherein the at least one first secure resource and the second secure resource both belong to a first resource type, and the first resource type is related to the owner Resources. The method according to claim 7, wherein the client receiving the first configuration signaling sent by the first configuration device, and configuring the second security resource based on the first configuration signaling comprises: Receiving, by the client, first configuration signaling sent by the first configuration device, where the first configuration signaling carries a first device identifier of the first configuration device; The client configures the first attribute and the second attribute of the second security resource based on the first configuration signaling, where the first attribute is used to indicate the device owner identifier, and the second attribute is used to indicate The resource owner identifier, the value of the first attribute is the first device identifier, and the value of the second attribute is the first device identifier. The method according to claim 8, wherein the method further comprises: The client receives the second configuration signaling sent by the first configuration device, and configures the third attribute of the second security resource based on the second configuration signaling, where the third attribute is used to indicate whether Creating a device owner, the value of the third attribute is a third value, and the third value is used to indicate that the device owner has been created; The client sets the third attribute of the at least one first secure resource to the third value. The method according to any one of claims 1 to 6, wherein the at least one first secure resource and the second secure resource both belong to a second resource type, and the second resource type is related to a credential Resources. The method according to claim 10, wherein the client receiving the first configuration signaling sent by the first configuration device, and configuring the second security resource based on the first configuration signaling comprises: Receiving, by the client, first configuration signaling sent by the first configuration device, where the first configuration signaling carries the first device identifier and credential content of the first configuration device; The client configures the fourth attribute and the fifth attribute of the second security resource based on the first configuration signaling, where the fourth attribute is used to indicate the resource owner identifier, and the fifth attribute is used to indicate Voucher content, the value of the fourth attribute is the first device identifier. A method for configuring a client, the method comprising: The client sends the target attribute of the target resource of the client to the first configuration device, where the target attribute is used to indicate the device role of the client; wherein the client has at least one first security resource; When the device role of the client is a mobile device, the client receives trigger signaling sent by the first configuration device, and the trigger signaling is used to trigger the client to initiate device-led configuration; Creating a second secure resource on the client by the client, where the second secure resource and the at least one first secure resource belong to the same resource type; The client obtains configuration parameters from the first configuration device, and configures the second security resource based on the configuration parameters. The method of claim 12, wherein: The first partial attribute of the second secure resource is determined based on one of the at least one first secure resource; The second partial attribute of the second security resource is determined based on the configuration parameter. The method according to claim 12 or 13, wherein: The value of the target attribute of the target resource supports a first value, and the first value is used to indicate that the device role is a mobile device; or, The value of the target attribute of the target resource supports a second value, and the second value is used to indicate that the device role is a fixed device. The method according to claim 14, wherein the method further comprises: The client checks the target attribute of the target resource of the client; In the case where the value of the target attribute is the first value, after the client enters the configuration mode, the existing resource configuration is retained; or, In a case where the value of the target attribute is the second value, after the client enters the configuration mode, the existing resource configuration is deleted. The method according to any one of claims 12 to 15, wherein the client sending the target attribute of the target resource of the client to the first configuration device comprises: Receiving, by the client, a first request message sent by the first configuration device, where the first request message is used to request a target attribute of a target resource of the client; The client sends a first response message to the first configuration device, where the first response message is used to notify the first configuration device of the target attribute of the target resource of the client. The method according to any one of claims 12 to 16, wherein the at least one first secure resource and the second secure resource both belong to a first resource type, and the first resource type is related to the owner Resources. The method according to claim 17, wherein the client obtaining configuration parameters from the first configuration device, and configuring the second security resource based on the configuration parameters comprises: The client obtains the first device identifier of the first configuration device from the first configuration device, and configures the first attribute and the second attribute of the second security resource based on the first device identifier, where all The first attribute is used to indicate the device owner identification, the second attribute is used to indicate the resource owner identification, the value of the first attribute is the first device identification, and the value of the second attribute is the The first device identification. The method according to claim 18, wherein the method further comprises: The client configures a third attribute of the second secure resource, where the third attribute is used to indicate whether to create a device owner, the value of the third attribute is a third value, and the third attribute is Value is used to indicate the owner of the created device; The client sets the third attribute of the at least one first secure resource to the third value. The method according to any one of claims 12 to 16, wherein the at least one first secure resource and the second secure resource both belong to a second resource type, and the second resource type is credential-related Resources. The method according to claim 20, wherein the client obtaining configuration parameters from the first configuration device, and configuring the second security resource based on the configuration parameters comprises: Acquiring, by the client, the first device identification and credential content of the first configuration device from the first configuration device; The client configures the fourth attribute and the fifth attribute of the second secure resource based on the first device identifier and the credential content, where the fourth attribute is used to indicate the resource owner identifier, and the fifth attribute The attribute is used to indicate the content of the voucher, and the value of the fourth attribute is the first device identifier. A method for configuring a client, the method comprising: The first configuration device receives the target attribute of the target resource sent by the client, where the target attribute is used to indicate the device role of the client; wherein the client has at least one first secure resource; When the device role of the client is a mobile device, the first configuration device sends a first creation signaling to the client, and the first creation signaling is used to instruct to create a second creation on the client. A security resource, where the second security resource and the at least one first security resource belong to the same resource type; The first configuration device sends a first configuration signaling to the client, where the first configuration signaling is used to configure the second security resource. The method of claim 22, wherein: The first partial attribute of the second secure resource is determined based on one of the at least one first secure resource; The second partial attribute of the second security resource is determined based on the first configuration signaling. The method according to claim 22 or 23, wherein: The value of the target attribute of the target resource supports a first value, and the first value is used to indicate that the device role is a mobile device; or, The value of the target attribute of the target resource supports a second value, and the second value is used to indicate that the device role is a fixed device. The method according to any one of claims 22 to 24, wherein the first configuration device receiving the target attribute of the target resource sent by the client includes: Sending, by the first configuration device, a first request message to the client, where the first request message is used to request the target attribute of the target resource of the client; The first configuration device receives a first response message sent by the client, where the first response message is used to notify the first configuration device of the target attribute of the target resource of the client. The method according to any one of claims 22 to 25, wherein when the device role of the client is a mobile device, the first configuration device sending the first creation signaling to the client includes: When the device role of the client is a mobile device, the first configuration device sends a second request message to the client, and the second request message is used to request resource content of the client; Receiving, by the first configuration device, resource content of the client sent by the client, the resource content including the identifier and resource type of the at least one first secure resource; The first configuration device sends a first creation signaling to the client, where the first creation signaling is used to create the second security resource. The method according to any one of claims 22 to 26, wherein the at least one first security resource and the second security resource both belong to a first resource type, and the first resource type is related to the owner Resources. The method according to claim 27, wherein the first configuration signaling carries a first device identifier of the first configuration device; The first configuration signaling is used to configure the first attribute and the second attribute of the second security resource, where the first attribute is used to indicate the device owner identification, and the second attribute is used to indicate the resource owner identification , The value of the first attribute is the first device identifier, and the value of the second attribute is the first device identifier. The method of claim 28, wherein the method further comprises: The first configuration device sends second configuration signaling to the client, where the second configuration signaling is used to configure a third attribute of the second security resource, where the third attribute is used to indicate whether A device owner is created, the value of the third attribute is a third value, and the third value is used to indicate that the device owner has been created. The method according to any one of claims 22 to 26, wherein the at least one first secure resource and the second secure resource both belong to a second resource type, and the second resource type is credential-related Resources. The method according to claim 30, wherein the first configuration signaling carries the first device identification and credential content of the first configuration device; The first configuration signaling is used to configure the fourth attribute and the fifth attribute of the second security resource, where the fourth attribute is used to indicate the resource owner identifier, and the fifth attribute is used to indicate the content of the credential, The value of the fourth attribute is the first device identifier. A method for configuring a client, the method comprising: The first configuration device receives the target attribute of the target resource of the client sent by the client, where the target attribute is used to indicate the device role of the client; wherein the client has at least one first security resource; When the device role of the client is a mobile device, the first configuration device sends trigger signaling to the client, and the trigger signaling is used to trigger the client to create a second configuration on the client. A security resource, where the second security resource and the at least one first security resource belong to the same resource type; The first configuration device sends configuration parameters to the client, where the configuration parameters are used by the client to configure the second security resource. The method of claim 32, wherein: The first partial attribute of the second security resource is determined based on one of the at least one first security resource; The second partial attribute of the second security resource is determined based on the configuration parameter. The method according to claim 32 or 33, wherein: The value of the target attribute of the target resource supports a first value, and the first value is used to indicate that the device role is a mobile device; or, The value of the target attribute of the target resource supports a second value, and the second value is used to indicate that the device role is a fixed device. The method according to any one of claims 32 to 34, wherein the first configuration device receiving the target attribute of the target resource sent by the client includes: Sending, by the first configuration device, a first request message to the client, where the first request message is used to request the target attribute of the target resource of the client; The first configuration device receives a first response message sent by the client, where the first response message is used to notify the first configuration device of the target attribute of the target resource of the client. The method according to any one of claims 32 to 35, wherein the at least one first secure resource and the second secure resource both belong to a first resource type, and the first resource type is related to the owner Resources. The method of claim 36, wherein the configuration parameter includes a first device identifier of the first configuration device; The first device identifier is used to configure the first attribute and the second attribute of the second secure resource, where the first attribute is used to indicate the device owner identifier, and the second attribute is used to indicate the resource owner identifier, The value of the first attribute is the first device identifier, and the value of the second attribute is the first device identifier. The method according to any one of claims 32 to 35, wherein the at least one first secure resource and the second secure resource both belong to a second resource type, and the second resource type is credential-related Resources. The method according to claim 38, wherein the configuration parameters include a first device identification and credential content of the first configuration device; The first device identifier and the credential content are used to configure the fourth attribute and the fifth attribute of the second secure resource, where the fourth attribute is used to indicate the resource owner identifier, and the fifth attribute is used to Indicates the content of the voucher, and the value of the fourth attribute is the first device identifier. A device for configuring a client, the device comprising: A sending unit, configured to send a target attribute of a target resource of the client to the first configuration device, where the target attribute is used to indicate a device role of the client; wherein the client has at least one first security resource; The receiving unit is configured to receive the first creation signaling sent by the first configuration device when the device role of the client is a mobile device, and create a first creation signaling on the client based on the first creation signaling. Two security resources, the second security resource and the at least one first security resource belong to the same resource type; receiving the first configuration signaling sent by the first configuration device, and configuring the first configuration signaling based on the first configuration signaling The second security resource. The device of claim 40, wherein: The first partial attribute of the second security resource is determined based on one of the at least one first security resource; The second partial attribute of the second security resource is determined based on the first configuration signaling. The device according to claim 40 or 41, wherein: The value of the target attribute of the target resource supports a first value, and the first value is used to indicate that the device role is a mobile device; or, The value of the target attribute of the target resource supports a second value, and the second value is used to indicate that the device role is a fixed device. The device according to claim 42, wherein the device further comprises: The processing unit is configured to check the target attribute of the target resource of the client; if the value of the target attribute is the first value, after the client enters the configuration mode, the existing resource configuration is retained Or, in the case where the value of the target attribute is the second value, after the client enters the configuration mode, the existing resource configuration is deleted. The apparatus according to any one of claims 40 to 43, wherein the receiving unit is configured to receive a first request message sent by the first configuration device, and the first request message is used to request the client The target attribute of the target resource at the end; The sending unit is configured to send a first response message to the first configuration device, where the first response message is used to notify the first configuration device of the target attribute of the target resource of the client. The apparatus according to any one of claims 40 to 44, wherein the receiving unit is configured to receive a second request sent by the first configuration device when the device role of the client is a mobile device Message, the second request message is used to request resource content of the client; The sending unit is configured to send resource content of the client to the first configuration device, where the resource content includes the identifier and resource type of the at least one first secure resource; The receiving unit is configured to receive first creation signaling sent by the first configuration device, where the first creation signaling is used to create the second security resource. The device according to any one of claims 40 to 45, wherein the at least one first secure resource and the second secure resource both belong to a first resource type, and the first resource type is related to the owner Resources. The apparatus according to claim 46, wherein the receiving unit is configured to receive a first configuration signaling sent by the first configuration device, and the first configuration signaling carries a first configuration signal of the first configuration device. Device identification; configure the first attribute and the second attribute of the second security resource based on the first configuration signaling, wherein the first attribute is used to indicate the device owner identification, and the second attribute is used to indicate the resource The owner identifier, the value of the first attribute is the first device identifier, and the value of the second attribute is the first device identifier. The apparatus according to claim 47, wherein the receiving unit is configured to receive the second configuration signaling sent by the first configuration device, and configure the second configuration signaling of the second security resource based on the second configuration signaling. Three attributes, where the third attribute is used to indicate whether to create a device owner, the value of the third attribute is a third value, and the third value is used to indicate that the device owner has been created; The third attribute of a first security resource is set to the third value. The device according to any one of claims 40 to 45, wherein the at least one first secure resource and the second secure resource both belong to a second resource type, and the second resource type is related to a credential Resources. The apparatus according to claim 49, wherein the receiving unit is configured to receive a first configuration signaling sent by the first configuration device, and the first configuration signaling carries a first configuration signal of the first configuration device. Device identification and credential content; configure the fourth attribute and the fifth attribute of the second security resource based on the first configuration signaling, where the fourth attribute is used to indicate the resource owner identification, and the fifth attribute is used To indicate the content of the voucher, the value of the fourth attribute is the first device identifier. A device for configuring a client, the device comprising: A sending unit, configured to send a target attribute of a target resource of the client to the first configuration device, where the target attribute is used to indicate a device role of the client; wherein the client has at least one first security resource; A receiving unit, configured to receive trigger signaling sent by the first configuration device when the device role of the client is a mobile device, where the trigger signaling is used to trigger the client to initiate device-led configuration; A creating unit, configured to create a second secure resource on the client, where the second secure resource and the at least one first secure resource belong to the same resource type; The obtaining unit is configured to obtain configuration parameters from the first configuration device, and configure the second security resource based on the configuration parameters. The device of claim 51, wherein: The first partial attribute of the second security resource is determined based on one of the at least one first security resource; The second partial attribute of the second security resource is determined based on the configuration parameter. The device according to claim 51 or 52, wherein: The value of the target attribute of the target resource supports a first value, and the first value is used to indicate that the device role is a mobile device; or, The value of the target attribute of the target resource supports a second value, and the second value is used to indicate that the device role is a fixed device. The device according to claim 53, wherein the device further comprises: The processing unit is configured to check the target attribute of the target resource of the client; if the value of the target attribute is the first value, after the client enters the configuration mode, the existing resource configuration is retained Or, in the case where the value of the target attribute is the second value, after the client enters the configuration mode, the existing resource configuration is deleted. The apparatus according to any one of claims 51 to 54, wherein the receiving unit is configured to receive a first request message sent by the first configuration device, and the first request message is used to request the client The target attribute of the target resource at the end; The sending unit is configured to send a first response message to the first configuration device, where the first response message is used to notify the first configuration device of the target attribute of the target resource of the client. The device according to any one of claims 51 to 55, wherein the at least one first secure resource and the second secure resource both belong to a first resource type, and the first resource type is related to the owner Resources. The apparatus according to claim 56, wherein the acquiring unit is configured to acquire the first device identification of the first configuration device from the first configuration device, and configure the second device identification based on the first device identification. The first attribute and the second attribute of the secure resource, wherein the first attribute is used to indicate the device owner identification, the second attribute is used to indicate the resource owner identification, and the value of the first attribute is the first A device identifier, where the value of the second attribute is the first device identifier. The device of claim 57, wherein the device further comprises: The configuration unit is configured to configure a third attribute of the second security resource, where the third attribute is used to indicate whether to create a device owner, the value of the third attribute is a third value, and the third attribute is The value is used to indicate that the device owner has been created; the third attribute of the at least one first secure resource is set as the third value. The device according to any one of claims 51 to 55, wherein the at least one first secure resource and the second secure resource both belong to a second resource type, and the second resource type is related to a credential Resources. The apparatus according to claim 59, wherein the obtaining unit is configured to obtain a first device identification and credential content of the first configuration device from the first configuration device; based on the first device identification and the first configuration device; The content of the voucher configures the fourth attribute and the fifth attribute of the second security resource, wherein the fourth attribute is used to indicate the resource owner identifier, the fifth attribute is used to indicate the content of the voucher, and the value of the fourth attribute The value is the first device identifier. A device for configuring a client, the device comprising: A receiving unit, configured to receive a target attribute of a target resource sent by a client, where the target attribute is used to indicate a device role of the client; wherein the client has at least one first secure resource; The sending unit is configured to send a first creation signaling to the client when the device role of the client is a mobile device, where the first creation signaling is used to instruct to create a second creation on the client A security resource, the second security resource and the at least one first security resource belong to the same resource type; sending a first configuration signaling to the client, where the first configuration signaling is used to configure the second security Resources. The device of claim 61, wherein: The first partial attribute of the second security resource is determined based on one of the at least one first security resource; The second partial attribute of the second security resource is determined based on the first configuration signaling. The device according to claim 61 or 62, wherein: The value of the target attribute of the target resource supports a first value, and the first value is used to indicate that the device role is a mobile device; or, The value of the target attribute of the target resource supports a second value, and the second value is used to indicate that the device role is a fixed device. The apparatus according to any one of claims 61 to 63, wherein the sending unit is configured to send a first request message to the client, and the first request message is used to request a target resource of the client Target attributes; The receiving unit is configured to receive a first response message sent by the client, where the first response message is used to notify the first configuration device of the target attribute of the target resource of the client. The apparatus according to any one of claims 61 to 64, wherein the sending unit is configured to send a second request message to the client when the device role of the client is a mobile device, so The second request message is used to request resource content of the client; The receiving unit is configured to receive resource content of the client sent by the client, where the resource content includes an identifier and a resource type of the at least one first secure resource; The sending unit is configured to send first creation signaling to the client, where the first creation signaling is used to create the second security resource. The apparatus according to any one of claims 61 to 65, wherein the at least one first secure resource and the second secure resource both belong to a first resource type, and the first resource type is related to the owner Resources. The apparatus according to claim 66, wherein the first configuration signaling carries a first device identifier of the first configuration device; The first configuration signaling is used to configure the first attribute and the second attribute of the second security resource, where the first attribute is used to indicate the device owner identification, and the second attribute is used to indicate the resource owner identification , The value of the first attribute is the first device identifier, and the value of the second attribute is the first device identifier. The apparatus according to claim 67, wherein the sending unit is configured to send second configuration signaling to the client, and the second configuration signaling is configured to configure a third attribute of the second security resource , Wherein the third attribute is used to indicate whether to create a device owner, the value of the third attribute is a third value, and the third value is used to indicate that the device owner has been created. The device according to any one of claims 61 to 65, wherein the at least one first secure resource and the second secure resource both belong to a second resource type, and the second resource type is related to a credential Resources. The apparatus according to claim 69, wherein the first configuration signaling carries a first device identification and credential content of the first configuration device; The first configuration signaling is used to configure the fourth attribute and the fifth attribute of the second security resource, where the fourth attribute is used to indicate the resource owner identifier, and the fifth attribute is used to indicate the content of the credential, The value of the fourth attribute is the first device identifier. A device for configuring a client, the device comprising: The receiving unit is configured to receive the target attribute of the target resource of the client sent by the client, the target attribute is used to indicate the device role of the client; wherein the client has at least one first security resource; The sending unit is configured to send trigger signaling to the client when the device role of the client is a mobile device, where the trigger signaling is used to trigger the client to create a second on the client A secure resource, where the second secure resource and the at least one first secure resource belong to the same resource type; sending configuration parameters to the client, where the configuration parameters are used by the client to configure the second secure resource. The device of claim 71, wherein: The first partial attribute of the second security resource is determined based on one of the at least one first security resource; The second partial attribute of the second security resource is determined based on the configuration parameter. The device according to claim 71 or 72, wherein: The value of the target attribute of the target resource supports a first value, and the first value is used to indicate that the device role is a mobile device; or, The value of the target attribute of the target resource supports a second value, and the second value is used to indicate that the device role is a fixed device. The apparatus according to any one of claims 71 to 73, wherein the sending unit is configured to send a first request message to the client, and the first request message is used to request a target resource of the client Target attributes; The receiving unit is configured to receive a first response message sent by the client, where the first response message is used to notify the first configuration device of the target attribute of the target resource of the client. The device according to any one of claims 71 to 74, wherein the at least one first secure resource and the second secure resource both belong to a first resource type, and the first resource type is related to the owner Resources. The apparatus according to claim 75, wherein the configuration parameter includes a first device identifier of the first configuration device; The first device identifier is used to configure the first attribute and the second attribute of the second secure resource, where the first attribute is used to indicate the device owner identifier, and the second attribute is used to indicate the resource owner identifier, The value of the first attribute is the first device identifier, and the value of the second attribute is the first device identifier. The device according to any one of claims 71 to 74, wherein the at least one first secure resource and the second secure resource both belong to a second resource type, and the second resource type is related to a credential Resources. The apparatus according to claim 77, wherein the configuration parameters include a first device identifier and credential content of the first configuration device; The first device identifier and the credential content are used to configure the fourth attribute and the fifth attribute of the second secure resource, where the fourth attribute is used to indicate the resource owner identifier, and the fifth attribute is used to Indicates the content of the voucher, and the value of the fourth attribute is the first device identifier. A terminal device, comprising: a processor and a memory, the memory is used to store a computer program, the processor is used to call and run the computer program stored in the memory, and execute any one of claims 1-21 , Or the method of any one of claims 22 to 39. A chip comprising: a processor, configured to call and run a computer program from a memory, so that a device installed with the chip executes the method according to any one of claims 1 to 21, or claims 22 to 39 The method of any one of. A computer-readable storage medium for storing a computer program that causes a computer to execute the method according to any one of claims 1 to 21, or the method according to any one of claims 22 to 39 . A computer program product comprising computer program instructions that cause a computer to execute the method according to any one of claims 1 to 21 or the method according to any one of claims 22 to 39. A computer program that causes a computer to execute the method according to any one of claims 1 to 21 or the method according to any one of claims 22 to 39.

Images