WO2021035740A1

WO2021035740A1 - Access control method, server, access device and storage medium

Info

Publication number: WO2021035740A1
Application number: PCT/CN2019/103862
Authority: WO
Inventors: 吕小强
Original assignee: Oppo广东移动通信有限公司
Priority date: 2019-08-30
Filing date: 2019-08-30
Publication date: 2021-03-04
Also published as: CN113678127B; CN113678127A

Abstract

An access control method, comprising: a server (304) establishing a sharing record among a first device identifier of a first access device (301), a second device identifier of a second access device (302) and a target device identifier of a target device (303) associated with the second access device (302), the sharing record being used for sharing the access right to the target device (303) to the first access device (301) (S401); and the server (304) transmitting a local sharing credential between the first access device (301) and the second access device (302), the local sharing credential being used for the first access device (301) to establish a local connection with the target device (303) (S402).

Description

Access control method, server, access equipment and storage medium

Technical field

The present invention relates to the Internet of Things (IoT) technology, and in particular to an access control method, server, access device and storage medium.

Background technique

In the Internet of Things, devices that are not in the same local network can communicate with each other through the cloud, and the cloud groups the devices belonging to the same user under the same user ID created in the cloud. All devices registered to the cloud and belonging to the same user ID can communicate according to the device authorization cloud permission policy (for example: ACE2 policy). In the Internet of Things, devices in the same local network can communicate with each other through the local network. Therefore, cloud communication and local network communication are isolated from each other, and the device can only be accessed by one user, which cannot meet the application scenario of multiple users.

Summary of the invention

The embodiments of the present invention provide an access control method, a server, an access device, and a storage medium, which can share the access authority of the device with other users, and realize multi-user access.

The technical solution of the embodiment of the present invention is realized as follows:

In the first aspect, an embodiment of the present invention provides an access control method, including:

The server establishes a sharing record between the first device identification of the first access device, the second device identification of the second access device, and the target device identification of the target device associated with the second access device, and the sharing record is used to share Sharing the access permission of the target device to the first access device;

The server transmits a local shared credential between the first access device and the second access device, and the local shared credential is used for establishing a local connection between the first access device and the target device.

In the second aspect, an embodiment of the present invention provides an access control method, including:

The first access device acquires the second device identifier of the second access device;

The first access device sends the first device ID and the second device ID of the first access device to the server, and the first device ID and the second device ID are used by the server in the server. A sharing record is established between the first device identifier, the second device identifier, and the target device identifier of the target device associated with the second access device, and the sharing record is used to share the access permission of the target device to The first access device;

The first access device and the server transmit a local shared credential, and the local shared credential is used for the first access device to establish a local connection with the target device.

In a third aspect, an embodiment of the present invention provides an access control method, including:

The second access device acquires the first device identifier of the first access device;

The second access device sends the first device identification and the second device identification of the second access device to the server, and the first device identification and the second device identification are used by the server in the A sharing record is established between the first device identifier, the second device identifier, and the target device identifier of the target device associated with the second access device, and the sharing record is used to share the access permission of the target device to The first access device;

The second access device transmits a local shared credential with the server, and the local shared credential is used for the first access device to establish a local connection with the target device.

In a fourth aspect, an embodiment of the present invention provides a server, including:

The establishment unit is configured to establish a sharing record among the first device identification of the first access device, the second device identification of the second access device, and the target device identification of the target device associated with the second access device, the sharing The record is used to share the access permission of the target device to the first access device;

The transmission unit is configured to transmit a local shared credential between the first access device and the second access device, and the local shared credential is used for the first access device to establish a local connection with the target device.

In a fifth aspect, an embodiment of the present invention provides an access device, including:

The first obtaining unit is configured to obtain the second device identifier of the second access device;

The first sending unit is configured to send the first device identifier and the second device identifier of the first access device to the server, where the first device identifier and the second device identifier are used when the server is located at the server. A sharing record is established between the first device identifier, the second device identifier, and the target device identifier of the target device associated with the second access device, and the sharing record is used to share the access authority of the target device To the first access device;

The first transmission unit is configured to transmit a local shared credential with the server, and the local shared credential is used for the first access device to establish a local connection with the target device.

In a sixth aspect, an embodiment of the present invention provides an access device, including:

The second acquiring unit is configured to acquire the first device identifier of the first access device;

The second sending unit is configured to send the first device ID and the second device ID of the second access device to the server, where the first device ID and the second device ID are used when the server is A sharing record is established between the first device identifier, the second device identifier, and the target device identifier of the target device associated with the second access device, and the sharing record is used to share the access authority of the target device To the first access device;

The second transmission unit is configured to transmit a local shared credential with the server, and the local shared credential is used for the first access device to establish a local connection with the target device.

In a seventh aspect, an embodiment of the present invention provides a server, including: a processor and a memory for storing a computer program that can run on the processor, wherein the processor is configured to execute the server when the computer program is running. The steps of the access control method performed.

In an eighth aspect, an embodiment of the present invention provides an access device, including: a processor and a memory configured to store a computer program that can run on the processor, wherein the processor is configured to execute the above-mentioned computer program when the computer program is running. Steps of the access control method executed by the first access device.

In a ninth aspect, an embodiment of the present invention provides an access device, including: a processor and a memory configured to store a computer program that can run on the processor, wherein the processor is configured to execute the above-mentioned computer program when the computer program is running. Steps of the access control method executed by the second access device.

In a tenth aspect, an embodiment of the present invention provides a storage medium storing an executable program, and when the executable program is executed by a processor, the access control method executed by the server is implemented.

In an eleventh aspect, an embodiment of the present invention provides a storage medium that stores an executable program, and when the executable program is executed by a processor, it implements the access control method executed by the first access device.

In a twelfth aspect, an embodiment of the present invention provides a storage medium storing an executable program, and when the executable program is executed by a processor, the above-mentioned access control method executed by the second access device is implemented.

The access control method provided by the embodiment of the present invention includes: the server is configured to select the first device identifier of the first access device, the second device identifier of the second access device, and the target device identifier of the target device associated with the second access device. A sharing record is established between the target device, and the sharing record is used to share the access permission of the target device to the first access device; the server performs local operations between the first access device and the second access device. Transmission of shared credentials, where the local shared credentials are used for the first access device to establish a local connection with the target device; thereby achieving access to the target access device by the first access device that is not associated with the target device based on the shared record, and Performing a local sharing credential that enables the first access device to perform local access to the target device between the first access device and the second access device corresponding to the shared record can prevent the target device from being accessed by a user ID that only has a binding relationship To achieve multi-user access, and the first access device's access to the target device is not restricted by the network.

Description of the drawings

FIG. 1 is an optional structural diagram of an Internet of Things system provided by an embodiment of the present invention;

FIG. 2 is an optional flowchart of an access control method provided by an embodiment of the present invention;

FIG. 3 is an optional structural diagram of the Internet of Things system provided by an embodiment of the present invention;

4A is an optional flowchart of an access control method provided by an embodiment of the present invention;

4B is an optional flowchart of an access control method provided by an embodiment of the present invention;

4C is an optional flowchart of an access control method provided by an embodiment of the present invention;

FIG. 5 is an optional flowchart of an access control method provided by an embodiment of the present invention;

FIG. 6 is an optional flowchart of an access control method provided by an embodiment of the present invention;

FIG. 7 is an optional flowchart of an access control method provided by an embodiment of the present invention;

FIG. 8 is a schematic diagram of an optional structure of a server provided by an embodiment of the present invention;

FIG. 9 is a schematic diagram of an optional structure of an access device provided by an embodiment of the present invention;

FIG. 10 is a schematic diagram of an optional structure of an access device provided by an embodiment of the present invention;

FIG. 11 is a schematic diagram of an optional structure of an electronic device provided by an embodiment of the present invention.

detailed description

In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present invention. Those of ordinary skill in the art have not made All other embodiments obtained under the premise of creative work belong to the protection scope of the present invention.

Before describing in detail the access control method provided by the embodiment of the present invention, a brief description of the access control of the Internet of Things system will be given first.

The access control of the Internet of Things system includes local access based on the home network and remote access based on the cloud.

The IoT device needs to be registered in the cloud after entering the Internet of Things. The IoT device will get a corresponding user ID (UserID) during registration, and the IoT device will be in a remotely operable state after being registered in the cloud. If the IoT device is not registered in the cloud, remote operations cannot be performed, but operations can be performed locally. The reason for this result is that UserID is the user ID of the IoT device in the cloud, not the device ID (device ID). The local operation of the IoT device is related to the access policy of the IoT device, but not the UserID.

In the following, local access and remote access are explained separately.

Local access

After the IoT device is connected to the home network, it will be directly configured. The configuration work is done by OBT. During the configuration process, you need to set the Owner ID of the IoT device to the Device ID of the OBT device. In addition, you need to configure the access credential of the IoT device. The access credential is used for the two devices. Two-way authentication is performed when the connection is established. The access credential can be a symmetric key, asymmetric key, certificate, etc.

After the two devices pass the authentication, the two parties can establish a secure communication connection, that is, they can interconnect and interoperate.

remote access

The structure of the cloud-based Internet of Things system is shown in Fig. 1, and includes: a client 101, a server 102, and a cloud 103. The client 101 accesses resources of the server 102, and the server 102 provides the resources accessed by the client 101. And the client 101 and the server 102 communicate with each other through the cloud 103.

When the client 101 requests a CRUDN operation to the resource referenced by the resource Links carried by the cloud 103, the client 101 sends a CRUDN request to the cloud 103, and the cloud 103 forwards the CRUDN request of the client 101 to the server 102 that actually carries the resource. The client 102 responds to the CRUDN request of the cloud 103, and the cloud 103 forwards the response of the server 102 to the client 101, that is, the communication path is client 101->cloud 103->server 102->cloud 103->client 101.

Exemplarily, the cloud 103 may include three functional entities:

Cloud interface 1031: Anchor on the cloud, responsible for server access management, and message routing for remote communication between the client and server. The cloud interface provides a unified address and port number, such as coaps+tcp://example.com: 443.

Authorization server 1032: Responsible for server registration and authentication of the client and server.

Resource catalog 1033: the index of the server resources, the client can obtain the resources of the target device by retrieving the resource catalog.

Wherein, the authorization server 1032 and the cloud may be the same physical entity, or may be different physical entities.

Among them, each device can be a client, a server, or both a client and a server.

The registration process of the device in the cloud is shown in Figure 2, including:

Step S201: The configurator obtains the user's access token (Access Token) from the authorization server.

The mediator function is provided in the user APP to configure the device to connect to the cloud. The configurator is configured with a uniform resource locator (URL) for cloud access, and the user has registered a user name and password, so that the authorization server can authorize the user and return an access token to the configurator. Among them, the user APP can be located on the device as the client.

Step S202: The configurator is registered in the cloud.

The configurator provides an access token to the cloud for configurator registration, and the cloud verifies the Access Token provided by the configurator and assigns a user ID. The same user uses different configurators, the authorization server will provide different Access Tokens, but any configurator used by the same user is associated with the same User ID.

Step S203: The configurator is connected to the device, and the device is configured.

The configurator connects to the device through the normal device discovery process, and then requests an Access Token from the cloud for the configured device. The configurator uses the Access Token authorized from the cloud, the Uniform Resource Identifier (URI) and the Universal Unique Identifier (UUID) of the cloud to update the cloud configuration resources on the device for cloud information configuration, such as: "Oic.r.coapcloudconf" resource. The Access Token provided by the cloud is used when the device performs initial registration with the cloud.

Step S204: The device establishes a Transport Layer Security (TLS) connection with the cloud.

After the configurator configures the configuration resources of the device, the device uses a preset digital certificate to establish a TLS connection with the cloud. The preset digital certificates include: the manufacturer's certificate of the device and the trust anchor certificate.

Step S205, the device is registered in the cloud.

To register in the cloud, the device needs to send an update (UPDATE) operation request to the account resource on the cloud. The resource update request includes the Access Token and User ID configured in the cloud configuration resource. The cloud maintains a unique instance of account resources for each device. Among them, the account resource can be the "/oic/sec/account" resource.

Step S206 to step S207, the cloud verifies the Access Token provided by the device.

The cloud sends the User ID and Access Token provided by the device to the authorization server. After the authorization server successfully verifies the update operation request, the cloud responds to the update operation. The response will provide the device with an updated Access Token and the validity period of the Access Token. In addition, the cloud also records the User ID that is associated with this device, that is, has a binding relationship.

It should be noted that when the cloud is integrated with the authorization server, step S201 is completed between the cloud and the configurator, and step S207 is not required.

The device needs to log in to the cloud to transfer data between the device and the cloud, and the device sends an update (UPDATE) operation request to the cloud session resource. After the cloud successfully verifies the update operation request, the device and the cloud establish a TLS connection, and data can be exchanged. Among them, the session resource can be a "/oic/sec/session" resource.

The device in Figure 2 can be a client or a server. If the device is used as a server, after the device establishes a TLS connection with the cloud, the device will disclose the resources it carries in the resource directory of the cloud to facilitate remote access to these resources of the client.

Devices that are not in the same local network can communicate with each other through the cloud using the Limited Application (CoAP over TCP) protocol based on the Transmission Control Protocol (Transmission Control Protocol, TCP). The cloud groups devices belonging to the same User ID under the same User ID. All devices registered to the cloud and belonging to the same User ID can communicate according to the ACE2 policy of the device authorization cloud. In the embodiment of the present invention, a device under a User ID is referred to as a device that has a binding relationship with the User ID.

However, in remote access, only devices associated with the same User ID can access each other, and the devices can only be remotely accessed by one User ID through the cloud. In a multi-member family, this solution restricts only one User ID to control the devices in the family, and other family members can only log in with the same User ID. If multiple family members have registered User IDs in the cloud, they can only control the devices managed by their User IDs, and cannot control the devices associated with other User IDs in the family through the cloud, which cannot meet the multi-user application scenarios, and Under the condition that the local communication and remote communication architecture are separated, it is impossible to complete the remote sharing and local sharing of the equipment.

Based on the above problems, the present invention provides an access control method. The access control entry method of the embodiment of the present invention can be applied to the Internet of Things system 300 shown in FIG. 3, including: a first access device 301, a second access device 302, and a target Device 303 and server 304; among them, the first access device 301 and the second access device are clients, the target device is the server, and the server 304 is the cloud. The client accesses the resources of the server based on the cloud.

The first access device 301 logs in to the server 304 with the first user ID, and the second access device 302 logs in to the server 304 with the second user ID. The first user ID is not associated with the target device, and the second user ID is associated with the target device, that is, the first access device and the target device are not devices under the same user ID, and the second access device and the target device are under the same user ID device of.

The client, server, and cloud in the Internet of Things system 300 can communicate based on various communication systems, such as: Global System of Mobile Communication (GSM) system, Code Division Multiple Access (CDMA) System, Wideband Code Division Multiple Access (WCDMA) system, General Packet Radio Service (GPRS), Long Term Evolution (LTE) system, LTE Frequency Division Duplex (Frequency Division) Duplex (FDD) system, LTE Time Division Duplex (TDD), Universal Mobile Telecommunication System (UMTS), Worldwide Interoperability for Microwave Access (WiMAX) communication system or 5G system Wait.

The first access device 301 and the second access device 302 may be terminal devices, which may refer to access terminals, user equipment (UE), user units, user stations, mobile stations, mobile stations, remote stations, and remote terminals , Mobile equipment, user terminal, terminal, wireless communication device, user agent or user device. The access terminal can be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a wireless local loop (Wireless Local Loop, WLL) station, a personal digital processing (Personal Digital Assistant, PDA), with wireless communication Functional handheld devices, computing devices or other processing devices connected to wireless modems, in-vehicle devices, wearable devices, terminal devices in 5G networks, or terminal devices in the future evolution of PLMN, etc.

The target device 303 may be IoT devices such as sensors, laser scanning systems, and smart home appliances.

Figure 3 exemplarily shows one server and two clients. Optionally, the IoT system 300 may include multiple servers and clients that have a binding relationship with the server or do not have a binding relationship with the server. Clients that define a relationship are not limited in this embodiment of the present invention.

An optional processing flow of the access control method provided by the embodiment of the present invention, as shown in FIG. 4A, includes the following steps:

Step S401: The server establishes a sharing record between the first device identification of the first access device, the second device identification of the second access device, and the target device identification of the target device associated with the second access device.

The server may receive the first device identification and the second device identification sent by the first access device or the second access device, and based on the acquired first device identification and second device identification The second access device is associated with the target device of the same user ID to establish a correspondence between the target device identifiers, and the established correspondence is called a sharing record, and the sharing record is used to share the access permission of the target device to all the target devices. The first access device is used to determine to share the access permission of at least one target device associated with the second access device to the first access device that is not associated with the target device.

Here, the first access device and the target device are not associated with the same user identity, that is, the first access device is not associated with the target device, and the second access device and the target device are associated with the same user identity, that is, the second access device is associated with the target device.

In the case where the server receives the first device identification and the second device identification sent by the first access device, the first access device initiates the registration of device sharing to the server.

In the case where the server receives the first device identification and the second device identification sent by the second access device, the second access device initiates the registration of device sharing to the server.

In the embodiment of the present invention, the server receives a registration request sent by the first access device or the second access device; the registration request carries the first device identifier and the second device identifier.

Optionally, the registration request does not carry the target device identifier of the target device. At this time, the server searches for all target devices associated with the second access device according to the second device identifier and/or the second user identifier corresponding to the second device identifier. A sharing record is established between the target device identifiers of all target devices, the first device identifier, and the second device identifier. Among them, one sharing record can be established corresponding to all target device identifiers, or corresponding sharing records can be established respectively based on different target device identifiers.

Optionally, the registration request also carries: the target device identifier. At this time, the server establishes a sharing record among the first device identification, the second device identification, and the target device identification carried in the registration request. The registration request may carry at least one target device identifier, and the server may establish a sharing record corresponding to all target device identifiers carried in the registration request, or may establish corresponding sharing records based on different target device identifiers.

In the embodiment of the present invention, the server stores the sharing record through an independent resource. Optionally, the resource storing the sharing record is referred to as a device share resource.

After the server establishes a new sharing record, it adds the established sharing record to the device's shared resources.

In the embodiment of the present invention, the registration request also carries one of the following information:

The first user identification of the first access device, the second user identification of the second access device, and sharing restriction conditions; correspondingly, the sharing record further includes one of the following information: the first access device The first user identification of the second access device, the second user identification of the second access device, and the sharing restriction conditions.

Sharing restriction conditions are used to restrict the access rights of the first access device to the target device. Sharing restriction conditions can include: Only one time (Only One Time), which signifies permanent access, and Always, which signifies permission Sharing time period or other conditional content for a period of access. Here, different sharing restriction conditions can be represented by different sharing identifiers.

Step S402: The server transmits the local shared credential between the first access device and the second access device.

The local shared credential is used for the first access device to establish a local connection with the target device, so that the first shared credential and the target device can establish a local connection based on the local network after accessing the local network, and the first access device is based on The established local connection accesses the target device.

In the process of performing step S402, the transmission of the local shared credential is performed between the first access device, the second access device and the server. Optionally, the server sends the local sharing credentials to the first access device and the second access device respectively. Optionally. The server receives the local sharing credential sent by the first access device, and sends the received local sharing credential to the second access device. Optionally, the server receives the local sharing credential sent by the second access device, and sends the received local sharing credential to the first access device.

The local sharing credential can be generated by the server, the first access device, or the second access device.

Optionally, in the case where the local sharing credential is generated by the server, the server sends the generated local sharing credential to the first access device and the second access device respectively, so that the second access device configures the local sharing credential to the target device. In this way, the first access device and the target device have the same local shared credential, and local access is realized.

Optionally, in a case where the local sharing credential is generated by the first access device, the first access device sends the generated local sharing credential to the server, and the server sends the received local sharing credential to the second access device, so that the second access device The access device configures the local shared credential to the target device. In this way, the first access device and the target device have the same local shared credential, and local access is realized.

Optionally, in the case where the local sharing credential is generated by the second access device, the second access device sends the generated local sharing credential to the server, and the server sends the received local sharing credential to the first access device, and the second access device The access device configures the generated local shared credential to the target device. In this way, the first access device and the target device have the same local shared credential, and local access is realized.

Optionally, in the case that the local sharing credential is generated by the second access device, the second access device configures the generated local sharing credential to the target device, the target device sends the generated local sharing credential to the server, and the server will receive the The local sharing certificate is sent to the first access device. In this way, the first access device and the target device have the same local shared credential, and local access is realized.

In the embodiment of the present invention, the transmission of the local sharing credential and the creation of the sharing record can be performed interactively, or the creation of the sharing record can be performed first and then the transmission of the local sharing credential can be performed.

Taking the first access device to initiate the registration of device sharing with the server, that is, the server receives the first device identification and the second device identification sent by the first access device as an example, the process of the server establishing a sharing record may be as shown in FIG. 4B, including:

Step S4011a, the first access device obtains the second device identifier of the second access device.

The first access device may obtain the second device identification of the second access device through out-of-band methods such as device discovery and identification scanning. Optionally, the scanned identification includes a two-dimensional code. The embodiment of the present invention does not impose any limitation on the manner and way for the first access device to obtain the identification of the second device.

Step S4012a, the first access device sends the first device identification of the first access device and the second device identification to the server.

The first device identifier and the second device identifier are used by the server to determine between the first device identifier, the second device identifier, and the target device identifier of the target device associated with the second access device A sharing record is established, and the sharing record is used to share the access permission of the target device to the first access device.

Optionally, the first access device generates a registration request according to the first device identification and the second device identification; correspondingly, step S4012a includes: the first access device sends the registration request to the server.

Here, the first access device sends the first device identification and the second device identification to the server by sending a registration request to the server. Optionally, the target device identifier is not carried in the registration request. Optionally, the target device identifier is carried in the registration request.

When the target device identification is carried in the registration request, the first access device may obtain the target device identification of the target device based on out-of-band methods such as device discovery and identification scanning. Optionally, the scanned identification includes a two-dimensional code.

The first user identification of the first access device, the second user identification of the second access device, and sharing restriction conditions; correspondingly, the sharing record further includes one of the following information: The first user identification, the second user identification of the second access device, and the sharing restriction condition.

Optionally, after receiving the registration request sent by the first access device, the server creates a sharing record according to the information carried in the registration request, as shown in FIG. 4B, and executes step S4013a and step S4014a:

Step S4013a: The server sends a first confirmation request to the second access device.

Step S4014a, the server receives the first response of the second access device in response to the first confirmation request, and sets the sharing record to an active state.

Before step S4013a is executed, the sharing record established by the server is in an unavailable and inactive state. When the server receives the first response from the second access device, it sets the established sharing record to an available active state. At this time, the sharing record can be used to control the access of the first access device to the target device.

In the embodiment of the present invention, after receiving the first confirmation request sent by the server, the second access device confirms whether to approve sharing the access rights of the target device with the first access device, and when approved, returns the first response to the server . Optionally, the first confirmation request may carry the first device identification and the target device identification, and after receiving the first device identification and the target device identification carried in the first confirmation request, the second access device sets the same in the second access device When the second access device establishes the same sharing record, it means that the second access device approves sharing the access rights of the target device to the first access device, and responds to the server with the first response.

In the embodiment of the present invention, after the server determines to obtain the approval of the second access device based on step S4014a, as shown in FIG. 4B, step S4015a-1 may be executed:

Step S4015a-1, the server sends a first sharing completion notification to the first access device.

The first sharing completion notification is used to instruct the first access device to locally set the sharing record on the first access device.

At this time, the first access device performs step S4015a-1 and step S4015a-2:

Step S4015a-1, the first access device receives the first sharing completion notification sent by the server.

In step S4015a-2, the first access is triggered based on the first sharing completion notification, and the sharing record is set.

Here, the first sharing completion notification is used to notify the first access device that the server has shared the access permission of the target device to the first access device. The first access device can synchronize the server to establish a sharing record locally.

Optionally, the first sharing completion notification carries the sharing record. Optionally, the first sharing completion notification does not carry the sharing record.

In the embodiment of the present invention, after the server determines that the second access device is approved based on step S4014a, as shown in FIG. 4B, step S4016a may be performed: the server sends a second sharing completion notification to the target device. The second sharing completion notification is used to instruct the target device to set the sharing record locally on the target device.

At this time, the target device receives the second sharing completion notification sent by the server, and sets the sharing record based on the trigger of the second sharing completion notification.

Here, the second sharing completion notification is used to notify the target device server that the access permission of the target device has been shared to the first access device. The target device can synchronize the server to establish a sharing record locally.

Optionally, the second sharing completion notification carries the sharing record. Optionally, the second sharing completion notification does not carry the sharing record.

Taking the second access device to initiate the registration of device sharing to the server, that is, the server receives the first device identification and the second device identification sent by the second access device as an example, the process for the server to establish a sharing record may be as shown in FIG. 4C, including:

Step S4011b, the second access device obtains the first device identifier of the first access device.

The second access device may obtain the first device identification of the first access device through out-of-band methods such as device discovery and identification scanning. Optionally, the scanned identification includes a two-dimensional code. The embodiment of the present invention does not impose any limitation on the manner and way for the second access device to obtain the identification of the first device.

Step S4012b, the second access device sends the first device identifier and the second device identifier of the second access device to the server.

Optionally, the second access device generates a registration request according to the first device identifier and the second device identifier; correspondingly, step S4012b includes: the second access device sends the registration request to the server.

Here, the second access device sends the first device identification and the second device identification to the server by sending a registration request to the server. Optionally, the target device identifier is not carried in the registration request. Optionally, the target device identifier is carried in the registration request.

Optionally, after receiving the registration request sent by the second access device, the server creates a sharing record according to the information carried in the registration request, as shown in FIG. 4C, and executes step S4013b and step S4014b:

Step S4013b, the server sends a second confirmation request and a third confirmation request to the first access device and the target device respectively.

Wherein, step S4013b includes:

Step S4013b-1, the server sends a second confirmation request to the first access device.

Step S4013b-2, the server sends a third confirmation request to the target device.

Step S4014b, the server receives the second response of the first access device in response to the second confirmation request, and receives the third response of the target device in response to the third confirmation request, and records the sharing Set to active state.

Wherein, step S4014b includes:

Step S4014b-1, the server receives a second response of the first access device in response to the second confirmation request.

Step S4014b-2, the server receives a third response of the target device in response to the third confirmation request.

In step S4014b-3, the server sets the sharing record to an active state.

Before performing step S4013b, the sharing record established by the server is in an unavailable and inactive state. After the server receives the second response from the first access device and the third response from the target device, it sets the created sharing record Active state is available. At this time, the sharing record can be used to control the access of the first access device to the target device.

In the embodiment of the present invention, after receiving the second confirmation request sent by the server, the first access device confirms whether to approve sharing the access rights of the target device with the first access device, and when approved, returns a second response to the server . Optionally, the second confirmation request may carry the second device identification and the target device identification, and after receiving the second device identification and the target device identification carried in the second confirmation request, the first access device sets the same in the first access device When the first access device establishes the same sharing record, it means that the first access device approves sharing the access rights of the target device to the first access device, and responds to the server with a second response.

In the embodiment of the present invention, after receiving the third confirmation request sent by the server, the target device confirms whether to approve sharing the access permission of the target device with the first access device, and when approved, returns a third response to the server. Optionally, the third confirmation request may carry the first device identification and the second device identification, and after receiving the first device identification and the second device identification carried in the third confirmation request, the target device sets the same share in the target device Record, when the target device establishes the same sharing record, it indicates that the target device approves sharing the access permission of the target device to the first access device, and responds to the server with a third response.

In the embodiment of the present invention, after the server determines that the first access device and the target device are approved based on step S4014b, as shown in FIG. 4C, step S4015b-1 may be executed:

In step S4015b-1, the server sends a third sharing completion notification to the second access device.

The third sharing completion notification is used to instruct the second access device to locally set the sharing record on the second access device.

At this time, the second access device performs step S4015b-1 and step S4015b-2:

Step S4015b-1, the second access device receives the third sharing completion notification sent by the server.

In step S4015b-2, the second access device sets the sharing record based on the trigger of the third sharing completion notification.

Here, the third sharing completion notification is used to notify the second access device that the server has shared the access permission of the target device to the first access device. The second access device can synchronize the server to establish a sharing record locally.

Optionally, the third sharing completion notification carries the sharing record. Optionally, the third sharing completion notification does not carry the sharing record.

In the embodiment of the present invention, in the case that the local sharing credential is generated by the server, step S402 can complete the transmission between the first access device and the second access device through the information interaction in FIG. 4B or FIG. 4C.

Taking the local sharing credential generated by the server and the registration of device sharing initiated by the first access device to the server as an example, step S402 the server performs the transmission of the local sharing credential between the first access device and the second access device includes : The server sends the local sharing credential to the second access device through the first confirmation request carrying the local sharing credential; the server sends the first sharing completion notification that carries the local sharing credential The local sharing credential is sent to the first access device.

Here, the first confirmation request in step S4013a and the first sharing completion notification in step S4015a-1 shown in FIG. 4B respectively carry the local sharing credentials sent to the second access device and the first access device.

At this time, the transmission of the local sharing credential between the first access device and the server includes: the first access device receives the local share sent by the server through the first sharing completion notification carrying the local sharing credential Sharing credentials, and the local sharing credentials are generated by the server. The second access device receives the local sharing credential sent by the server through the first confirmation request.

Taking the local sharing credential generated by the server and the registration of device sharing initiated by the second access device to the server as an example, step S402 the server performs the transmission of the local sharing credential between the first access device and the second access device includes : The server sends the local sharing credential to the first access device through a second confirmation request that carries the local sharing credential; the server sends the local sharing credential to the first access device through a third sharing completion notification that carries the local sharing credential The local sharing credential is sent to the second access device.

Here, the second confirmation request in step S4013b-1 and the third sharing completion in step S4015b-1 shown in FIG. 4C respectively carry the local sharing credentials sent to the first access device and the second access device.

At this time, the transmission of the local sharing credential between the second access device and the server includes: the second access device receives the local share sent by the server through the third sharing completion notification carrying the local sharing credential. Sharing credentials, and the local sharing credentials are generated by the server. The first access device requests to receive the local sharing credential sent by the server through the second confirmation.

Taking the local sharing credential generated by the first access device as an example, the transmission of the local sharing credential between the first access device and the server includes: the first access device generates the local sharing credential; the first access The device sends the local sharing credential to the server, so that the server sends the local sharing credential to the second access device. At this time, the server performing the transmission of the local shared credential between the first access device and the second access device includes: the server receives the local shared credential sent by the first access device; the server Sending the local sharing credential to the second access device. The transmission of the local shared credential between the second access device and the server includes: the second access device receives the local shared credential generated by the first access device and sent by the server.

Taking the local sharing credential generated by the second access device as an example, the transmission of the local sharing credential between the second access device and the server includes: the second access device generates the local sharing credential; the second access The device configures the local sharing credential to the target server, so that the server sends the local sharing credential to the first access device.

Optionally, the second access device directly sends the local sharing credential to the server. Optionally, the second access device configures the local sharing credential to the target device, and the target device sends it to the server.

In the case that the second access device configures the local shared credential to the target device and the target device sends it to the server, in the case where the server generates the local shared credential, the server is connected to the first access device and the server. The transmission of the local shared credential between the second access devices includes: the server receives the local shared credential sent by the target device; and the server sends the local shared credential to the first access device. At this time, the transmission of the local shared credential between the first access device and the server includes: the first access device receives the local shared credential generated by the second access device and sent by the server.

In the embodiment of the present invention, in the case that the local sharing credential received by the server is sent by the first access device, the local sharing credential is generated by the first access device; or on the server In a case where the received local sharing credential is sent by the target device, the local sharing credential is generated by the second access device.

In the embodiment of the present invention, the first access device configures an access policy for the first access device to access the target device according to the local shared credential. The second access device configures an access policy for the second access device to access the target device according to the local shared credential.

In the embodiment of the present invention, the first access device generates an access request based on the target device identifier, sends the access request to a server, and the server forwards the access request to For the target device, at this time, the server receives an access request sent by the first access device to access the target device; if the sharing record exists, the server forwards the access request to all The target device.

When the first access device and the target device are not in the same local network, the first access device can initiate an access request to access the target device based on the target device identifier, and send the access request to the server, and the server determines based on the shared record that the target device’s If the access permission is shared to the first access device, the access request is sent to the target device.

When the first access device and the target device are in a local network, the first access device may establish a local connection with the target device based on the local shared credential to access the target device.

Hereinafter, the present invention will be described in detail with reference to specific embodiments. Among them, the target device is Device A, OBT A is the client that has an association relationship with Device A, that is, the second access device, Device A and OBT A have the same User ID: User ID A, OBT B is a client that does not have an association relationship with Device A That is, the first access device, OBT B has User ID: User ID B.

Example one

In Example 1, OBTA is used as the initiator of device sharing registration and the generator of local sharing credentials.

Step S501: OBTA obtains the device information of OBTB.

The device information of the OBTB may include: device identification and/or user identification. Step S501 can be performed in an out-of-band manner, for example, OBTA scans the two-dimensional code generated by OBTB.

The embodiment of the present invention does not impose any limitation on the way and method for the OBTA to obtain the device information of the OBTB.

Step S502: The OBTA initiates a registration request to the cloud.

The information that OBTA sends to the cloud through the registration request includes: User ID A (optional), Device ID of OBTA, Device ID of Device A, User ID B (optional), Device ID of OBTB, etc.,

The registration request can also carry sharing restrictions: Only One Time\Always, etc. Sharing restrictions can also be time restrictions, such as from 8:00-10:00, and more complex restrictions.

The cloud platform generates a sharing record based on the information sent by the registration request. It should be noted that the sharing record is still available without being activated at this time.

In the implementation process, a device share (deviceshare) resource can be set, and the deviceshare resource can be saved in the cloud and the device side at the same time, and its purpose is to save the sharing record. However, only the associated UserID (for example: User ID A or User ID B) can be accessed for the saved records saved in the cloud.

When the cloud platform receives an access request, it will check the deviceshare resource. If the access target specified in the message is a device that has a sharing relationship based on the sharing record, the cloud platform should forward the access request.

Among them, the content of the sharing record can be as shown in Table 1.

Table 1

Step S503-Step S504, the cloud confirms the approval of Device A and OBT B.

Step S503 includes: step S503-1 and step S503-2.

In step S503-1, the cloud sends a confirmation request to Device A to confirm whether the above registration request is approved by Device A.

The way to confirm is to add the same content as step S502 to the deviceshare resource saved on Device A

Step S503-2, Device A sends a sharing confirmation to the cloud.

When Device A approves the above registration request, it sends the sharing confirmation corresponding to the confirmation request to the cloud platform, which is the third response.

In step S504-1, the cloud sends a confirmation request to OBT B to confirm whether the above registration request is approved by OBT B.

The way of confirmation is to add the same content as step S502 to the deviceshare resource saved on OBT B.

In step S504-2, OBT B sends a sharing confirmation to the cloud.

When OBT B approves the above registration request, it sends the sharing confirmation corresponding to the confirmation request to the cloud platform, which is the third response.

The way of confirmation is to add the same content as step S502 to the deviceshare resource saved on Device A.

In step S505, the cloud changes the sharing attribute of the saved sharing record to true.

After the cloud platform is approved by Device A and OBTB, it changes the shareenabled of the saved sharing record to true to activate the sharing record.

Optionally, after step S505, the cloud sends a request to Device A and OBTB to modify the share enabled of the sharing records saved on Device A and OBTB to true.

In step S506, the cloud sends a sharing completion notification to the OBTA.

After OBTA receives the above request, it can also modify the shareenabled attribute of the corresponding shared record it saves to become true. So far, OBT B and Device A have established a connection at the application layer, and OBT B can remotely access Device A.

In practical applications, after step S505, the cloud platform can update the aforementioned sharing record to the deviceshare resource stored on OBT A, that is to say, the same sharing record is stored on all the aforementioned devices.

In step S507, the OBTA generates a local sharing certificate.

After receiving the notification of completion of sharing from the cloud platform, OBTA initiates a local sharing process and generates a local sharing certificate. Two devices with locally shared credentials can be connected.

Local shared credentials may include various forms of credentials such as pin codes, shared keys, certificates, etc.

Step S508: OBT A configures Device A's access policy.

OBT A uses the local shared credential generated in step S506 to configure the access policy of Device A.

Taking the local shared credential as the shared key as an example, the shared key is saved as an access policy of Device A, and the credential is used to confirm both parties when the connection is subsequently established.

Among them, step S508 includes: step S508-1 and step S508-2.

In step S508-1, OBT A configures the generated local shared credential to Device A.

Step S508-2, Device A sends a configuration complete message to OBT A.

In step S509, OBT A shares the local sharing certificate to OBTB through the cloud.

After OBT A completes the configuration of Device A's access policy, it can share the local shared credentials to OBTB through the cloud platform.

It should be noted that only DeviceA and OBTB save the local shared credentials, so the credentials can only be used for the above two devices.

Wherein, step S509 includes: step S509-1, step S509-2, step 509-3, step S509-4, and step S509-5.

In step S509-1, Device A notifies the cloud to update Device A's local sharing certificate.

In step S509-2, the cloud notifies OBTB to update Device A's local sharing certificate.

Step S509-3, OBTB completes self-configuration according to Device A's local shared credentials.

In step S509-4, the OBTB sends a self-configuration complete message to the cloud.

Step S509-5, the cloud forwards the self-configuration complete message sent by OBTB to Device A.

At this point, both Device A and OBTB have a local shared certificate, and Device A and OBTB can establish a connection locally.

Example two

In the second example, OBT B is used as the initiator of the registration of device sharing and the generator of the local sharing credential.

Step S601: OBT B obtains device information of OBT A.

The device information of OBT A may include: device identification and/or user identification. Step S601 may be performed in an out-of-band manner, for example, OBT B scans the two-dimensional code generated by OBT A.

The embodiment of the present invention does not impose any limitation on the way and method for the OBT B to obtain the device information of the OBT A.

Step S602: OBTB initiates a registration request to the cloud.

The information that OBT B sends to the cloud platform through the registration request includes: User ID A (optional), Device ID of OBTA, Device ID of Device A, User ID B (optional), Device ID of OBTB, etc.,

The cloud platform generates a sharing record based on the information sent by the registration request, and the sharing limit in the sharing record can be modified by OBT. It should be noted that at this time, the sharing record is not available if it has not been activated.

In step S603, the cloud confirms the approval of OBT A.

Step S603 includes: step S603-1 and step S603-2.

In step S603-1, the cloud sends a confirmation request to OBT A to confirm whether the above registration request is approved by OBT A.

The way to confirm is to add the same content as step S602 to the deviceshare resource saved on OBT A

Step S603-2, OBT A sends a sharing confirmation to the cloud.

When OBT A approves the above registration request, it sends the sharing confirmation corresponding to the confirmation request to the cloud platform, which is the first response.

In step S604, the sharing attribute of the sharing record saved in the cloud is changed to true.

After the cloud platform is approved by OBT A, it changes the shareenabled of the saved sharing record to true to activate the sharing record.

Step S605: The cloud sends a sharing notification to Device A.

The cloud platform sends a sharing notification to Device A, and Device A saves the sharing record on it and changes the shareenabled attribute to true.

In step S606, the cloud sends a sharing completion notification to OBT B.

The cloud platform sends a sharing completion notification for the registration request in step S602 to the OBTB. After OBTB receives the notification of completion of sharing, it can also modify the shareenabled attribute of the corresponding shared record it saved to become true.

So far, OBT B and Device A have established a connection at the application layer, and OBT B can remotely access Device A.

In step S607, OBT B generates a local sharing certificate.

After receiving the notification of completion of sharing from the cloud platform, OBTB initiates a local sharing process and generates a local sharing certificate. Two devices with locally shared credentials can be connected.

Step S608, OBT B completes self-configuration according to Device A's local shared credential.

In step S609, OBT B notifies the cloud to update Device A's local sharing certificate.

In step S610, the cloud notifies OBT A to update Device A's local sharing certificate.

Step S611: OBT A configures Device A's access policy.

OBT A uses the local shared credential received in step S610 to configure the access policy of Device A.

Wherein, step S611 includes: step S6011-1 and step S6011-2.

In step S611-1, OBT A configures the received local shared credential to Device A.

In step S611-2, Device A sends a configuration complete message to OBT A.

Step S612, OBT A sends a self-configuration complete message to the cloud.

In step S613, the cloud forwards the self-configuration completion message sent by OBT A to OBT B.

Example three

In Example 3, the cloud is the generator of the local shared credential.

Step S701: OBTA obtains the device information of OBTB.

Step S702: OBTA initiates a registration request to the cloud.

Step S703-Step S704, the cloud confirms the approval of Device A and OBT B.

Step S703 includes: step S703-1 and step S703-2.

In step S703-1, the cloud sends a confirmation request to Device A to confirm whether the above registration request is approved by Device A.

Step S703-2, Device A sends a sharing confirmation to the cloud.

Step 704-1: The cloud sends a confirmation request to OBT B to confirm whether the above registration request is approved by OBT B.

Among them, the cloud platform may carry the local sharing certificate in the confirmation request sent to the OBTB.

In step S704-2, OBT B sends a sharing confirmation to the cloud.

In step S705, the sharing attribute of the sharing record saved in the cloud is changed to true.

In step S706, the cloud sends a sharing completion notification to the OBTA.

After OBTA receives the above request, it can also modify the shareenabled attribute of the corresponding shared record it saves to become true. At the same time, the sharing completion notification sent by the cloud platform to OBTA carries the local sharing credentials.

Step S707: OBT B completes self-configuration according to the received local sharing credential.

In step S708-1, OBT A configures the received local shared credential to Device A.

Step S708-2, Device A sends a configuration complete message to OBT A.

It should be noted that, in the embodiment of the present invention, the steps shown by the dotted lines in FIGS. 5 to 8 are optional.

In practical applications, the remote sharing and local sharing in Example 1 and Example 2 can be cross-combined. In the above example, only the OBTA identifier can be carried in the registration request, and the identifier of Device A does not need to be carried, which means that all devices associated with the OBTA can be shared with OBTB. Of course, it can also be extended to share multiple devices at once.

In order to implement the foregoing access control method, an embodiment of the present invention further provides a server 800, as the server 304 in FIG. 3, the composition structure of the server 800, as shown in FIG. 8, the server 800 includes:

The establishing unit 801 is configured to establish a sharing record between the first device identifier of the first access device, the second device identifier of the second access device, and the target device identifier of the target device associated with the second access device, the The sharing record is used to share the access permission of the target device to the first access device;

The credential transmission unit 802 is configured to transmit a local shared credential between the first access device and the second access device, and the local shared credential is used to establish a local connection between the first access device and the target device. connection.

In the embodiment of the present invention, the server 800 further includes:

The receiving unit is configured to receive a registration request sent by the first access device or the second access device; the registration request carries the first device identifier and the second device identifier.

In the embodiment of the present invention, the registration request also carries: the target device identifier.

The first user identification of the first access device, the second user identification of the second access device, and sharing restriction conditions;

Correspondingly, the sharing record also includes one of the following information: the first user identification of the first access device, the second user identification of the second access device, and sharing restriction conditions.

In the embodiment of the present invention, the server 800 further includes:

The first confirmation unit is configured as:

In the case that the registration request is sent by the first access device, sending a first confirmation request to the second access device;

The first response of the second access device in response to the first confirmation request is received, and the sharing record is set to an active state.

In the embodiment of the present invention, the server 800 further includes: a first notification unit configured to send a first sharing completion notification to the first access device, where the first sharing completion notification is used to indicate that the first access device is in the place The first access device locally sets the sharing record.

In the embodiment of the present invention, the server 800 further includes:

The second notification unit is configured to send a second sharing completion notification to the target device, where the second sharing completion notification is used to instruct the target device to locally set the sharing record on the target device.

In the embodiment of the present invention, the server 800 further includes: a second confirmation unit configured to:

In a case where the registration request is sent by the second access device, sending a second confirmation request and a third confirmation request to the first access device and the target device respectively;

The second response of the first access device in response to the second confirmation request is received, and the third response of the target device in response to the third confirmation request is received, and the sharing record is set to an active state.

In the embodiment of the present invention, the server 800 further includes:

Third notification The server sends a third sharing completion notification to the second access device, where the third sharing completion notification is used to instruct the second access device to locally set the sharing record on the second access device.

In the embodiment of the present invention, the credential transmission unit 802 is further configured to:

In the case that the server generates the local sharing credential,

Sending the local sharing credential to the second access device through a first confirmation request carrying the local sharing credential;

The local sharing credential is sent to the first access device through the first sharing completion notification carrying the local sharing credential.

In the embodiment of the present invention, the credential transmission unit 802 is further configured to: when the server generates the local shared credential,

Sending the local sharing credential to the first access device through a second confirmation request carrying the local sharing credential;

The local sharing credential is sent to the second access device through a third sharing completion notification carrying the local sharing credential.

Receiving the local sharing credential sent by the first access device or the target device;

Sending the local sharing credential to the second access device or the first access device.

In the embodiment of the present invention,

In the case that the received local sharing credential is sent by the first access device, the local sharing credential is generated by the first access device; or

In the case that the received local sharing credential is sent by the target device, the local sharing credential is generated by the second access device.

In the embodiment of the present invention, the server 800 further includes:

The first access unit is configured as:

Receiving an access request for accessing the target device sent by the first access device;

If the sharing record exists, forward the access request to the target device.

An embodiment of the present invention also provides a server, including a processor and a memory for storing a computer program that can run on the processor, wherein the processor is used to execute the access control performed by the server when the computer program is running. Method steps.

The embodiment of the present invention also provides an access device 900, as the first access device 301 in FIG. 3, a schematic diagram of the composition structure of the access device 900, as shown in FIG. 9, includes:

The first obtaining unit 901 is configured to obtain the second device identifier of the second access device;

The first sending unit 902 is configured to send the first device identifier and the second device identifier of the first access device to the server, where the first device identifier and the second device identifier are used by the server when the server is A sharing record is established between the first device identifier, the second device identifier, and the target device identifier of the target device associated with the second access device, and the sharing record is used to use the access authority of the target device Share to the first access device;

The first transmission unit 903 is configured to transmit a local shared credential with the server, and the local shared credential is used for the first access device to establish a local connection with the target device.

In the embodiment of the present invention, the access device 900 further includes:

A first generating unit, configured to generate a registration request according to the first device identifier and the second device identifier;

Correspondingly, the first sending unit is configured to send the registration request to the server.

Correspondingly, the sharing record further includes one of the following information: the first user identification of the first access device, the second user identification of the second access device, and sharing restriction conditions.

In the embodiment of the present invention, the access device 900 further includes: a first setting unit configured to:

Receiving the first sharing completion notification sent by the server;

Based on the trigger of the first sharing completion notification, the sharing record is set.

In the embodiment of the present invention, the first transmission unit 903 is further configured to receive a local sharing credential sent by the server through the first sharing completion notification carrying the local sharing credential, and the local sharing credential is the server Generated.

In the embodiment of the present invention, the first transmission unit 903 is further configured to:

Generating the local sharing certificate;

Sending the local sharing credential to the server, so that the server sends the local sharing credential to the second access device.

In the embodiment of the present invention, the first transmission unit 903 is further configured to receive the local sharing credential generated by the second access device and sent by the server.

The second access unit is configured to generate an access request based on the target device identifier, send the access request to a server, and if the sharing record exists, the server forwards the access request to the target device .

The first configuration unit is configured to configure an access policy for the access device to access the target device according to the local shared credential.

An embodiment of the present invention also provides an access device, including a processor and a memory for storing a computer program that can run on the processor. When the processor is used to run the computer program, the access device 900 executes The steps of the access control method.

The embodiment of the present invention also provides an access device 1000, as the second access device 302 in FIG. 3, a schematic diagram of the composition structure of the access device 1000, as shown in FIG. 10, includes:

The second obtaining unit 1001 is configured to obtain the first device identifier of the first access device;

The second sending unit 1002 is configured to send the first device identification and the second device identification of the second access device to a server, where the first device identification and the second device identification are used by the server to A sharing record is established between the first device identifier, the second device identifier, and the target device identifier of the target device associated with the second access device, and the sharing record is used to use the access authority of the target device Share to the first access device;

The second transmission unit 1003 is configured to transmit a local shared credential with the server, and the local shared credential is used for the first access device to establish a local connection with the target device.

In the embodiment of the present invention, the access device 1000 further includes:

A second generating unit, configured to generate a registration request according to the first device identifier and the second device identifier;

Correspondingly, the second sending unit is configured to send the registration request to the server.

In the embodiment of the present invention, the access device 1000 further includes: a second setting unit configured to:

Receiving a third sharing completion notification sent by the server;

Based on the trigger of the third sharing completion notification, the sharing record is set.

In the embodiment of the present invention, the second transmission unit 1003 is further configured to receive the local sharing credential sent by the server through the third sharing completion notification carrying the local sharing credential, and the local sharing credential is The server generated.

In the embodiment of the present invention, the second transmission unit 1003 is further configured to:

Generating the local sharing certificate;

Sending the local sharing credential to the server, so that the server sends the local sharing credential to the first access device.

In the embodiment of the present invention, the second transmission unit 1003 is further configured to receive the local sharing credential generated by the first access device and sent by the server.

The second configuration unit is configured to configure an access policy for the second access device to access the target device according to the local shared credential.

An embodiment of the present invention also provides an access device, including a processor and a memory for storing a computer program that can run on the processor, wherein, when the processor is used to run the computer program, the access device 1000 executes The steps of the access control method.

11 is a schematic diagram of the hardware composition structure of an electronic device (access device or server) according to an embodiment of the present invention. The electronic device 1100 includes: at least one processor 1101, a memory 1102, and at least one network interface 1104. The various components in the electronic device 1100 are coupled together through the bus system 1105. It can be understood that the bus system 1105 is used to implement connection and communication between these components. In addition to the data bus, the bus system 1105 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clear description, various buses are marked as the bus system 1105 in FIG. 11.

It can be understood that the memory 1102 may be a volatile memory or a non-volatile memory, and may also include both volatile and non-volatile memory. Among them, non-volatile memory can be ROM, Programmable Read-Only Memory (PROM), Erasable Programmable Read-Only Memory (EPROM), and electrically erasable Programmable read-only memory (EEPROM, Electrically Erasable Programmable Read-Only Memory), magnetic random access memory (FRAM, ferromagnetic random access memory), flash memory (Flash Memory), magnetic surface memory, optical disk, or CD-ROM -ROM, Compact Disc Read-Only Memory); Magnetic surface memory can be disk storage or tape storage. The volatile memory may be a random access memory (RAM, Random Access Memory), which is used as an external cache. By way of exemplary but not restrictive description, many forms of RAM are available, such as static random access memory (SRAM, Static Random Access Memory), synchronous static random access memory (SSRAM, Synchronous Static Random Access Memory), and dynamic random access memory. Memory (DRAM, Dynamic Random Access Memory), Synchronous Dynamic Random Access Memory (SDRAM, Synchronous Dynamic Random Access Memory), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM, Double Data Rate Synchronous Dynamic Random Access Memory), enhanced Type synchronous dynamic random access memory (ESDRAM, Enhanced Synchronous Dynamic Random Access Memory), synchronous connection dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), direct memory bus random access memory (DRRAM, Direct Rambus Random Access Memory) ). The memory 1102 described in the embodiment of the present invention is intended to include, but is not limited to, these and any other suitable types of memory.

The memory 1102 in the embodiment of the present invention is used to store various types of data to support the operation of the electronic device 1100. Examples of such data include: any computer program used to operate on the electronic device 1100, such as an application program 11021. The program for implementing the method of the embodiment of the present invention may be included in the application program 11021.

The method disclosed in the foregoing embodiment of the present invention may be applied to the processor 1101 or implemented by the processor 1101. The processor 1101 may be an integrated circuit chip with signal processing capabilities. In the implementation process, the steps of the foregoing method can be completed by an integrated logic circuit of hardware in the processor 1101 or instructions in the form of software. The aforementioned processor 1101 may be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, and the like. The processor 1101 may implement or execute various methods, steps, and logical block diagrams disclosed in the embodiments of the present invention. The general-purpose processor may be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiments of the present invention may be directly embodied as being executed and completed by a hardware decoding processor, or executed and completed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, and the storage medium is located in the memory 1102. The processor 1101 reads the information in the memory 1102, and completes the steps of the foregoing method in combination with its hardware.

In an exemplary embodiment, the electronic device 1100 may be used by one or more application specific integrated circuits (ASIC, Application Specific Integrated Circuit), DSP, programmable logic device (PLD, Programmable Logic Device), and complex programmable logic device (CPLD). , Complex Programmable Logic Device), FPGA, general-purpose processor, controller, MCU, MPU, or other electronic components to implement the foregoing method.

The embodiment of the present invention also provides a storage medium for storing computer programs.

Optionally, the storage medium may be applied to the server in the embodiment of the present invention, and the computer program causes the computer to execute the corresponding process in each method of the embodiment of the present invention. For brevity, details are not described herein again.

Optionally, the storage medium can be applied to the access device in the embodiment of the present invention, and the computer program causes the computer to execute the corresponding process in each method of the embodiment of the present invention. For brevity, details are not described herein again.

The present invention is described with reference to flowcharts and/or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and/or block in the flowchart and/or block diagram, and the combination of processes and/or blocks in the flowchart and/or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing equipment to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing equipment are generated It is a device that realizes the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device. The device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment. The instructions provide steps for implementing the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

The above are only the embodiments of the present invention and are not used to limit the protection scope of the present invention. Any modification, equivalent replacement and improvement made within the spirit and scope of the present invention are all included in the protection scope of the present invention.

Claims

An access control method, including:

The server establishes a sharing record between the first device identification of the first access device, the second device identification of the second access device, and the target device identification of the target device associated with the second access device, and the sharing record is used to share Sharing the access permission of the target device to the first access device;

The server transmits a local shared credential between the first access device and the second access device, and the local shared credential is used for establishing a local connection between the first access device and the target device.
The method according to claim 1, wherein the method further comprises:

The server receives a registration request sent by the first access device or the second access device; the registration request carries the first device identifier and the second device identifier.
The method according to claim 2, wherein the registration request also carries: the target device identifier.
The method according to claim 2 or 3, wherein the registration request also carries one of the following information:

The first user identification of the first access device, the second user identification of the second access device, and sharing restriction conditions;

Correspondingly, the sharing record also includes one of the following information: the first user identification of the first access device, the second user identification of the second access device, and sharing restriction conditions.
The method according to any one of claims 2 to 4, wherein, in the case that the registration request is sent by the first access device, the method further comprises:

Sending, by the server, a first confirmation request to the second access device;

The server receives the first response of the second access device in response to the first confirmation request, and sets the sharing record to an active state.
The method according to claim 5, wherein the method further comprises:

The server sends a first sharing completion notification to the first access device, where the first sharing completion notification is used to instruct the first access device to locally set the sharing record on the first access device.
The method according to claim 5, wherein the method further comprises:

The server sends a second sharing completion notification to the target device, where the second sharing completion notification is used to instruct the target device to locally set the sharing record on the target device.
The method according to any one of claims 2 to 4, wherein, in the case that the registration request is sent by the second access device, the method further comprises:

The server sends a second confirmation request and a third confirmation request to the first access device and the target device respectively;

The server receives the second response of the first access device in response to the second confirmation request, and receives the third response of the target device in response to the third confirmation request, and sets the sharing record as active status.
The method according to claim 8, wherein the method further comprises:

The server sends a third sharing completion notification to the second access device, where the third sharing completion notification is used to instruct the second access device to locally set the sharing record on the second access device.
7. The method according to claim 6, wherein, in the case that the server generates the local shared credential, the server transmits the local shared credential between the first access device and the second access device ,include:

The server sends the local sharing credential to the second access device through a first confirmation request carrying the local sharing credential;

The server sends the local sharing credential to the first access device through the first sharing completion notification carrying the local sharing credential.
9. The method according to claim 9, wherein, in the case that the server generates the local shared credential, the server transmits the local shared credential between the first access device and the second access device ,include:

Sending, by the server, the local sharing credential to the first access device through a second confirmation request carrying the local sharing credential;

The server sends the local sharing credential to the second access device through a third sharing completion notification carrying the local sharing credential.
The method according to any one of claims 1 to 9, wherein the server performing the transmission of the local shared credential between the first access device and the second access device includes:

The server receives the local sharing credential sent by the first access device or the target device;

The server sends the local sharing credential to the second access device or the first access device.
The method of claim 12, wherein:

In the case that the local sharing credential received by the server is sent by the first access device, the local sharing credential is generated by the first access device; or

In the case that the local sharing credential received by the server is sent by the target device, the local sharing credential is generated by the second access device.
The method according to any one of claims 1 to 13, wherein the method further comprises:

Receiving, by the server, an access request sent by the first access device to access the target device;

In the case where the sharing record exists, the server forwards the access request to the target device.
An access control method, including:

The first access device acquires the second device identifier of the second access device;

The first access device sends the first device ID and the second device ID of the first access device to the server, and the first device ID and the second device ID are used by the server in the server. A sharing record is established between the first device identifier, the second device identifier, and the target device identifier of the target device associated with the second access device, and the sharing record is used to share the access permission of the target device to The first access device;

The first access device and the server transmit a local shared credential, and the local shared credential is used for the first access device to establish a local connection with the target device.
The method according to claim 15, wherein the method further comprises:

Generating, by the first access device, a registration request according to the first device identifier and the second device identifier;

Correspondingly, the sending, by the first access device, the first device identifier and the second device identifier of the first access device to the server, includes:

The first access device sends the registration request to the server.
The method according to claim 16, wherein the registration request also carries: the target device identifier.
The method according to claim 16 or 17, wherein the registration request also carries one of the following information:

The first user identification of the first access device, the second user identification of the second access device, and sharing restriction conditions;

Correspondingly, the sharing record further includes one of the following information: the first user identification of the first access device, the second user identification of the second access device, and sharing restriction conditions.
The method according to any one of claims 16 to 18, wherein the method further comprises:

Receiving, by the first access device, a first sharing completion notification sent by the server;

The first access is triggered based on the first sharing completion notification, and the sharing record is set.
The method according to claim 19, wherein the transmission of the local shared credential between the first access device and the server comprises:

The first access device receives the local sharing credential sent by the server through the first sharing completion notification carrying the local sharing credential, and the local sharing credential is generated by the server.
The method according to any one of claims 15 to 19, wherein the transmission of the local shared credential between the first access device and the server comprises:

Generating the local sharing credential by the first access device;

The first access device sends the local sharing credential to the server, so that the server sends the local sharing credential to the second access device.
The method according to any one of claims 15 to 19, wherein the transmission of the local shared credential between the first access device and the server comprises:

The first access device receives the local sharing credential generated by the second access device and sent by the server.
The method according to any one of claims 15 to 22, wherein the method further comprises:

The first access device generates an access request based on the target device identifier, sends the access request to a server, and the server forwards the access request to the target device if the sharing record exists.
The method according to any one of claims 15 to 23, wherein the method further comprises:

The first access device configures an access policy for the first access device to access the target device according to the local shared credential.
An access control method, the method includes:

The second access device acquires the first device identifier of the first access device;

The second access device sends the first device identification and the second device identification of the second access device to the server, and the first device identification and the second device identification are used by the server in the A sharing record is established between the first device identifier, the second device identifier, and the target device identifier of the target device associated with the second access device, and the sharing record is used to share the access permission of the target device to The first access device;

The second access device transmits a local shared credential with the server, and the local shared credential is used for the first access device to establish a local connection with the target device.
The method of claim 25, wherein the method further comprises:

Generating, by the second access device, a registration request according to the first device identifier and the second device identifier;

Correspondingly, the sending of the first device identifier and the second device identifier of the second access device to the server by the second access device includes:

The second access device sends the registration request to the server.
The method according to claim 26, wherein the registration request further carries: the target device identifier.
The method according to claim 26 or 27, wherein the registration request also carries one of the following information:

The first user identification of the first access device, the second user identification of the second access device, and sharing restriction conditions;

Correspondingly, the sharing record further includes one of the following information: the first user identification of the first access device, the second user identification of the second access device, and sharing restriction conditions.
The method according to any one of claims 26 to 28, wherein the method further comprises:

Receiving, by the second access device, a third sharing completion notification sent by the server;

The second access device sets the sharing record based on the trigger of the third sharing completion notification.
The method according to claim 29, wherein the transmission of the local shared credential between the second access device and the server comprises:

The second access device receives the local sharing credential sent by the server through the third sharing completion notification carrying the local sharing credential, and the local sharing credential is generated by the server.
The method according to any one of claims 25 to 29, wherein the transmission of the local shared credential between the second access device and the server includes:

Generating the local sharing credential by the second access device;

The second access device configures the local sharing credential to the target server, so that the server sends the local sharing credential to the first access device.
The method according to any one of claims 25 to 29, wherein the transmission of the local shared credential between the second access device and the server includes:

The second access device receives the local sharing credential generated by the first access device and sent by the server.
The method according to any one of claims 25 to 32, wherein the method further comprises:

The second access device configures an access policy for the second access device to access the target device according to the local shared credential.
A server that includes:

The establishment unit is configured to establish a sharing record among the first device identification of the first access device, the second device identification of the second access device, and the target device identification of the target device associated with the second access device, the sharing The record is used to share the access permission of the target device to the first access device;

A credential transmission unit configured to transmit a local shared credential between the first access device and the second access device, where the local shared credential is used for establishing a local connection between the first access device and the target device .
The server according to claim 34, wherein the server further comprises:

The receiving unit is configured to receive a registration request sent by the first access device or the second access device; the registration request carries the first device identifier and the second device identifier.
The server according to claim 35, wherein the registration request further carries: the target device identifier.
The server according to claim 35 or 36, wherein the registration request also carries one of the following information:

The first user identification of the first access device, the second user identification of the second access device, and sharing restriction conditions;

Correspondingly, the sharing record also includes one of the following information: the first user identification of the first access device, the second user identification of the second access device, and sharing restriction conditions.
The server according to any one of claims 35 to 37, wherein the server further comprises:

The first confirmation unit is configured as:

In the case that the registration request is sent by the first access device, sending a first confirmation request to the second access device;

The first response of the second access device in response to the first confirmation request is received, and the sharing record is set to an active state.
The server according to claim 38, wherein the server further comprises: a first notification unit configured to send a first sharing completion notification to the first access device, the first sharing completion notification being used to instruct the The first access device locally sets the sharing record on the first access device.
The server according to claim 38, wherein the server further comprises:

The second notification unit is configured to send a second sharing completion notification to the target device, where the second sharing completion notification is used to instruct the target device to locally set the sharing record on the target device.
The server according to any one of claims 35 to 37, wherein the server further comprises: a second confirmation unit configured to:

In a case where the registration request is sent by the second access device, sending a second confirmation request and a third confirmation request to the first access device and the target device respectively;

The second response of the first access device in response to the second confirmation request is received, and the third response of the target device in response to the third confirmation request is received, and the sharing record is set to an active state.
The server according to claim 41, wherein the server further comprises:

Third notification The server sends a third sharing completion notification to the second access device, where the third sharing completion notification is used to instruct the second access device to locally set the sharing record on the second access device.
The server according to claim 39, wherein the credential transmission unit is further configured to:

In the case that the server generates the local sharing credential,

Sending the local sharing credential to the second access device through a first confirmation request carrying the local sharing credential;

The local sharing credential is sent to the first access device through the first sharing completion notification carrying the local sharing credential.
The server according to claim 42, wherein the credential transmission unit is further configured to: when the server generates the local shared credential,

Sending the local sharing credential to the first access device through a second confirmation request carrying the local sharing credential;

The local sharing credential is sent to the second access device through a third sharing completion notification carrying the local sharing credential.
The server according to any one of claims 34 to 42, wherein the credential transmission unit is further configured to:

Receiving the local sharing credential sent by the first access device or the target device;

Sending the local sharing credential to the second access device or the first access device.
The server according to claim 45, wherein:

In the case that the received local sharing credential is sent by the first access device, the local sharing credential is generated by the first access device; or

In the case that the received local sharing credential is sent by the target device, the local sharing credential is generated by the second access device.
The server according to any one of claims 34 to 46, wherein the server further comprises:

The first access unit is configured as:

Receiving an access request for accessing the target device sent by the first access device;

If the sharing record exists, forward the access request to the target device.
An access device including:

The first obtaining unit is configured to obtain the second device identifier of the second access device;

The first sending unit is configured to send the first device identifier and the second device identifier of the first access device to the server, where the first device identifier and the second device identifier are used when the server is located at the server. A sharing record is established between the first device identifier, the second device identifier, and the target device identifier of the target device associated with the second access device, and the sharing record is used to share the access authority of the target device To the first access device;

The first transmission unit is configured to transmit a local shared credential with the server, and the local shared credential is used for the first access device to establish a local connection with the target device.
The access device according to claim 48, wherein the access device further comprises:

A first generating unit, configured to generate a registration request according to the first device identifier and the second device identifier;

Correspondingly, the first sending unit is configured to send the registration request to the server.
The access device according to claim 49, wherein the registration request further carries: the target device identifier.
The access device according to claim 49 or 50, wherein the registration request also carries one of the following information:

The first user identification of the first access device, the second user identification of the second access device, and sharing restriction conditions;

Correspondingly, the sharing record further includes one of the following information: the first user identification of the first access device, the second user identification of the second access device, and sharing restriction conditions.
The access device according to any one of claims 49 to 51, wherein the access device further comprises: a first setting unit configured to:

Receiving the first sharing completion notification sent by the server;

Based on the trigger of the first sharing completion notification, the sharing record is set.
The access device according to claim 52, wherein the first transmission unit is further configured to receive the local sharing credential sent by the server through the first sharing completion notification carrying the local sharing credential, and the local The sharing credential is generated by the server.
The access device according to any one of claims 48 to 52, wherein the first transmission unit is further configured to:

Generating the local sharing certificate;

Sending the local sharing credential to the server, so that the server sends the local sharing credential to the second access device.
The access device according to any one of claims 48 to 52, wherein the first transmission unit is further configured to receive a local sharing credential generated by the second access device and sent by the server.
The access device according to any one of claims 48 to 55, wherein the access device further comprises:

The second access unit is configured to generate an access request based on the target device identifier, send the access request to a server, and if the sharing record exists, the server forwards the access request to the target device .
The access device according to any one of claims 48 to 56, wherein the access device further comprises:

The first configuration unit is configured to configure an access policy for the access device to access the target device according to the local shared credential.
An access device including:

The second acquiring unit is configured to acquire the first device identifier of the first access device;

The second sending unit is configured to send the first device ID and the second device ID of the second access device to the server, where the first device ID and the second device ID are used when the server is A sharing record is established between the first device identifier, the second device identifier, and the target device identifier of the target device associated with the second access device, and the sharing record is used to share the access authority of the target device To the first access device;

The second transmission unit is configured to transmit a local shared credential with the server, and the local shared credential is used for the first access device to establish a local connection with the target device.
The access device according to claim 58, wherein the access device further comprises:

A second generating unit, configured to generate a registration request according to the first device identifier and the second device identifier;

Correspondingly, the second sending unit is configured to send the registration request to the server.
The access device according to claim 59, wherein the registration request further carries: the target device identifier.
The access device according to claim 59 or 60, wherein the registration request also carries one of the following information:

The first user identification of the first access device, the second user identification of the second access device, and sharing restriction conditions;

Correspondingly, the sharing record further includes one of the following information: the first user identification of the first access device, the second user identification of the second access device, and sharing restriction conditions.
The access device according to any one of claims 59 to 60, wherein the access device further comprises: a second setting unit configured to:

Receiving a third sharing completion notification sent by the server;

Based on the trigger of the third sharing completion notification, the sharing record is set.
The access device according to claim 62, wherein the second transmission unit is further configured to receive the local sharing credential sent by the server through the third sharing completion notification carrying the local sharing credential, and the local The sharing credential is generated by the server.
The access device according to any one of claims 58 to 62, wherein the second transmission unit is further configured to:

Generating the local sharing certificate;

Sending the local sharing credential to the server, so that the server sends the local sharing credential to the first access device.
The access device according to any one of claims 58 to 62, wherein the second transmission unit is further configured to receive a local sharing credential generated by the first access device and sent by the server.
The access device according to any one of claims 58 to 65, wherein the access device further comprises:

The second configuration unit is configured to configure an access policy for the second access device to access the target device according to the local shared credential.
A server including a processor and a memory for storing computer programs that can run on the processor, wherein:

When the processor is used to run the computer program, it executes the steps of the access control method according to any one of claims 1 to 14.
An access device, including a processor and a memory for storing a computer program that can run on the processor, wherein:

When the processor is used to run the computer program, it executes the steps of the access control method according to any one of claims 15 to 24.
An access device, including a processor and a memory for storing a computer program that can run on the processor, wherein:

When the processor is used to run the computer program, it executes the steps of the access control method according to any one of claims 25 to 33.
A storage medium storing an executable program, and when the executable program is executed by a processor, the access control method according to any one of claims 1 to 14 is implemented.
A storage medium storing an executable program, and when the executable program is executed by a processor, the access control method according to any one of claims 15 to 24 is implemented.
A storage medium storing an executable program, and when the executable program is executed by a processor, the access control method according to any one of claims 25 to 33 is implemented.