CN115622723A - Device access control method and device, electronic device and storage medium - Google Patents

Abstract

The embodiment of the application discloses a device access control method and device, an electronic device and a storage medium, wherein the device access control method comprises the following steps: receiving an access request, wherein the access request comprises: first user attribute information of a requesting party; inquiring a block chain storing an access control strategy of the controlled equipment according to the access request; determining whether the requesting party is an authorized access user or not according to the first user attribute information and the queried access control strategy; when the requesting party is an authorized access user, allocating the use permission of the virtual capacity for the requesting party from a virtual capacity resource pool established based on the capacity of the controlled equipment; and sending a control instruction to the controlled device according to the authority range information of the use authority, wherein the control instruction is used for controlling the controlled device to accept the access of the requester in the use authority. Therefore, the storage security is improved based on the block chain storage access control strategy, and the security of the device capacity sharing based on the virtual capacity resource pool is improved.

Description

Device access control method and device, electronic device and storage medium

technical field

The present invention relates to the technical field of the Internet of Things, in particular to a device access control method and device, electronic equipment and a storage medium.

Background technique

In the prior art, access control methods for smart devices mostly use a centralized authorization decision-making entity to make access control decisions, that is, use a central trusted entity to grant access control permissions. At present, when many smart devices are in use, they do not perform two-way identity authentication or use strong passwords to protect data security. For example, in the daily use of smart home devices, a simple four-digit PIN code or two-dimensional Code scanning is used to verify the user of the device, and then realize the network access authorization of smart home devices. In addition, each smart home device often works independently, and cannot reasonably share the resources and capabilities of each smart home device. This access control method makes it easier for third parties to crack, and the software application program of the control device has a relatively low security factor, the cost of adding malicious third-party devices is small, and there are great hidden dangers in the data security of smart devices. Therefore, under the existing technology, it is impossible to ensure the security of intelligent devices while realizing the integrated and collaborative work among them.

Contents of the invention

In view of this, an embodiment of the present invention provides a device access control method and device, an electronic device, and a storage medium.

Technical scheme of the present invention is realized like this:

In a first aspect, an embodiment of the present invention provides a device access control method, including:

receiving an access request, wherein the access request includes: first user attribute information of the requesting party;

Querying the block chain storing the access control policy of the controlled device according to the access request;

Determine whether the requesting party is an authorized access user according to the first user attribute information and the queried access control policy;

When the requesting party is an authorized access user, assigning the requesting party the right to use the virtual capability from the virtual capability resource pool established based on the capabilities of the controlled device;

Sending a control instruction to the controlled device according to the permission range information of the usage permission, where the control instruction is used to control the controlled device to accept the requester's access within the usage permission.

Further, the determining whether the requester is an authorized access user according to the first user attribute information and the queried access control policy includes:

determining second user attribute information of authorized access users of the controlled device according to the queried access control policy;

Comparing the first user attribute information with the second user attribute information to determine whether the requester is an authorized access user.

Further, the allocating the use right of the virtual capability to the requester from the virtual capability resource pool established based on the capability of the controlled device includes:

Determining required target capabilities based on the access request;

determining a target device capable of providing the target capability recorded in the virtual capability resource pool established based on the capability of the controlled device;

Allocating the use rights of the target device to the requesting party.

Further, the sending a control instruction to the controlled device according to the authority range information of the use authority includes:

Obtain an authorized device list corresponding to the requesting party;

If the target device exists in the authorized device list, a control instruction is sent to the target device according to the authority range information of the usage authority.

Further, the method also includes:

querying the device public key of the controlled device in the block chain;

The sending a control command to the controlled device according to the authority range information of the use authority includes:

performing identity verification on the controlled device based on the device public key;

If the verification is successful, a control instruction is sent to the controlled device according to the authority range information of the use authority.

Further, the method also includes:

Establishing a virtual capability resource pool based on the capability of at least one controlled device;

Based on the second user attribute information of the authorized access user of the controlled device and the device attribute information of the controlled device, determine the access control policy of the controlled device recorded in the virtual capability resource pool;

The access control policy is stored in at least one block of the block chain.

Further, the method also includes:

After the storage is completed, based on the access control policy stored in each of the blocks, a hash operation is performed on the blocks to obtain an updated hash value of the blocks; wherein, the block's The hash value is stored in the next block in the blockchain;

Based on the updated hash value of the block, the hash value stored in the next block in the blockchain is updated.

Further, the method also includes:

Based on the interplanetary file system IPFS, the operation data generated during the access control process of the controlled device is stored.

In a second aspect, an embodiment of the present invention provides a device access control device, including:

A receiving unit, configured to receive an access request, wherein the access request includes: first user attribute information of the requesting party;

a query unit, configured to query a block chain storing the access control policy of the controlled device according to the access request;

A determining unit, configured to determine whether the requester is an authorized access user according to the first user attribute information and the queried access control policy;

An allocating unit, configured to allocate the requester the right to use the virtual capability from the virtual capability resource pool established based on the capability of the controlled device when the requester is an authorized access user;

A sending unit, configured to send a control instruction to the controlled device according to the authorization range information of the usage authorization, wherein the control instruction is used to control the controlled device to accept the request within the usage authorization party visits.

In a third aspect, an embodiment of the present invention provides an electronic device, where the electronic device includes: a processor and a memory for storing a computer program that can run on the processor;

When the processor runs the computer program, it executes the steps of the methods described in one or more of the foregoing technical solutions.

In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, the computer-readable storage medium stores computer-executable instructions; after the computer-executable instructions are executed by a processor, one or more of the aforementioned technical solutions can be realized the method.

The device access control method provided by the embodiment of the present invention includes: receiving an access request, wherein the access request includes: the first user attribute information of the requesting party; querying the access control policy of the controlled device according to the access request Block chain; according to the first user attribute information and the access control policy of the query, determine whether the requester is an authorized access user; when the requester is an authorized access user, from the controlled device Allocating the use authority of the virtual capability to the requester in the virtual capability resource pool established by the capability; and sending a control instruction to the controlled device according to the authority range information of the use authority. In this way, based on the virtual capability resource pool, the open sharing and unified allocation of multiple controlled device capabilities can be realized, and the utilization rate of device capability resources can be improved. On this basis, the access control policy of the controlled device is stored in the blockchain, and based on the decentralized storage characteristics of the blockchain, it can effectively suppress the dependence of the controlled device on the centralized single authorization decision-making entity, and greatly improve the reliability of the device. Security of data storage and resource sharing of multi-device capabilities.

Description of drawings

FIG. 1 is a schematic flowchart of a device access control method provided by an embodiment of the present invention;

FIG. 2 is a schematic flowchart of a device access control method provided by an embodiment of the present invention;

FIG. 3 is a schematic flowchart of a device access control method provided by an embodiment of the present invention;

FIG. 4 is a schematic flowchart of a device access control method provided by an embodiment of the present invention;

FIG. 5 is a schematic flowchart of a device access control method provided by an embodiment of the present invention;

FIG. 6 is a schematic flowchart of a device access control method provided by an embodiment of the present invention;

FIG. 7 is a schematic flowchart of a device access control method provided by an embodiment of the present invention;

FIG. 8 is a schematic structural diagram of a device access control device provided by an embodiment of the present invention;

FIG. 9 is a schematic flow diagram of smart home management and control in a resident scenario provided by an embodiment of the present invention;

FIG. 10 is a schematic flow diagram of smart home management and control under the visitor scenario provided by the embodiment of the present invention;

FIG. 11 is a schematic flowchart of a method for controlling access to smart home devices provided by an embodiment of the present invention;

FIG. 12 is a schematic flow diagram of blockchain storage provided by an embodiment of the present invention;

FIG. 13 is a schematic diagram of code implementation for storing operation data provided by an embodiment of the present invention;

FIG. 14 is a schematic diagram of code implementation for obtaining operation data provided by an embodiment of the present invention;

FIG. 15 is a schematic diagram of UPnP device attributes provided by an embodiment of the present invention;

FIG. 16 is a schematic flowchart of obtaining virtual capability resources according to an embodiment of the present invention.

detailed description

In order to make the purpose, technical solution and advantages of the present invention clearer, the present invention will be described in further detail below in conjunction with the accompanying drawings, and the described embodiments should not be considered as limiting the present invention, and those of ordinary skill in the art do not make any All other embodiments obtained under the premise of creative labor belong to the protection scope of the present invention.

In the following description, references to "some embodiments" describe a subset of all possible embodiments, but it is understood that "some embodiments" may be the same subset or a different subset of all possible embodiments, and Can be combined with each other without conflict.

In the following description, the term "first\second\third" is only used to distinguish similar objects, and does not represent a specific ordering of objects. Understandably, "first\second\third" Where permitted, the specific order or sequence may be interchanged such that the embodiments of the invention described herein can be practiced in sequences other than those illustrated or described herein.

Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the technical field of the invention. The terms used herein are only for the purpose of describing the embodiments of the present invention, and are not intended to limit the present invention.

As shown in Figure 1, an embodiment of the present invention provides a device access control method, including:

S110: Receive an access request, where the access request includes: first user attribute information of the requesting party;

S120: Query the block chain storing the access control policy of the controlled device according to the access request;

S130: Determine whether the requester is an authorized access user according to the first user attribute information and the queried access control policy;

S140: When the requesting party is an authorized access user, assign the requesting party the right to use the virtual capability from the virtual capability resource pool established based on the capabilities of the controlled device;

S150: Send a control instruction to the controlled device according to the authority range information of the use authority, where the control instruction is used to control the controlled device to accept the requester's access within the use authority .

Here, the controlled device may be various smart devices, such as Internet of Things devices such as Universal Plug and Play (Universal Plug and Play, UPnP) devices. The requesting party may be a user requesting to access and/or use the controlled device, and the first user attribute information is attribute information characterizing the identity of the user, for example, may include user identity information (IdentityDocument, ID) and the like.

In the embodiment of the present invention, the access request includes the first user attribute information of the requesting party, and may also carry information such as device information requested to be accessed or capability resources requested to be obtained. The access control policy of the controlled device may be information set based on the user attribute information of the authorized access user of the controlled device, the device attribute information of the controlled device, etc., and used to manage the requester's access to the controlled device.

In one embodiment, the block chain is used to store the access control policy of the controlled device, and the response to the access request and the device access control method are implemented in the block chain, so that an automated policy control process can be realized. Processing through the smart contract in the blockchain does not require any human participation, and only needs to meet the requirements recorded in the smart contract, which can greatly save time, reduce costs, and cannot be changed, effectively ensuring the overall process and user privacy information security

In another embodiment, the controlled device is a smart home device that supports the UPnP protocol, such as a TV, a projector, etc., and a plurality of smart home devices form a smart home system based on the UPnP protocol, and in the smart home system based on each smart home The capability resources of the devices form a virtual capability resource pool to realize the sharing and centralized deployment of capability resources among multiple devices.

Exemplarily, according to the requested device information carried in the access request, the stored access control policy of the corresponding controlled device can be queried in the blockchain; or, according to the virtual capability requested in the access request, Query the access control policy of each controlled device from the blockchain.

In an embodiment, according to the first user attribute information, search or match may be performed in the queried access control policy to determine whether the first user attribute information belongs to the authorized access user information recorded in the access control policy. If the first user attribute information belongs to the authorized access user information recorded in the access control policy, the requester corresponding to the first user attribute information is the authorized access user of the controlled device.

If it is determined that the requesting party is an authorized access user, the requesting party can be assigned the right to use the virtual capacity required by the requesting party in the virtual capacity resource pool formed based on the UPnP protocol, for example, according to the request carried in the access request. For virtual capabilities, a matching query is performed in the virtual capability resource pool, and access rights, use rights, etc. corresponding to the virtual capabilities are obtained and sent to the requesting party.

In another embodiment, when it is determined that the requesting party is an authorized access user, the virtual capability access right recorded in the access control policy is obtained first, and the access right is sent to the requesting party. Based on the access rights, the requester can know or browse related controlled devices with the virtual capability, so that he can request to access one or more of the controlled devices again. Based on this, the right to use the virtual capability may be returned to the requesting party after another request is received.

In an embodiment, the use right has authority range information, for example, the authority range information may record that when the requester has the use right to the controlled device and sends an instruction to the controlled device, the controlled device is allowed to respond to the instruction. Exemplarily, the controlled device is a TV, and the corresponding permission range information may include allowing the requester to perform control operations such as screen projection and volume adjustment on the controlled device, but not allowing the requester to perform operations such as restoring factory settings on the controlled device .

In another embodiment, the authority range information of the use authority can also be set according to the access control policy. For example, the access control policy records the callable capability resources of the controlled device in different time periods, so the use authority can be set accordingly Different permission scope information allows the requester to perform different operations in different time periods. Or, the access control policy records the authorized access users of different levels of controlled equipment. For example, among family members, adults are the first level, minors are the second level, and visitor members are the third level. , the usage rights can correspond to different rights range information, and after determining the authorized access user level based on the first user attribute information of the requesting party, the corresponding rights range information is determined according to the level, so as to provide different usage rights in a targeted manner.

It can be understood that the control instruction sent to the controlled device is used to instruct the controlled device to respond to the requester's instruction, and may include an access instruction, a control instruction, and the like.

In this way, a virtual capability resource pool is established based on the capability resources of the controlled equipment, which realizes the systematization of the controlled equipment, and the unified allocation and sharing of virtual capability resources among multiple devices, improving the utilization rate of capability resources and the response to capability resource requirements Spend. On this basis, the access control strategy based on blockchain storage used as the basis for access decision-making of controlled devices, based on the distributed storage characteristics of blockchain, greatly reduces the dependence on centralized authorization decision-making entities, and improves the security of information storage. Security and tamper resistance. Furthermore, based on the information stored in the blockchain to verify the identity information of the requesting party, on the basis of optimizing the use of device resources, the privacy protection of the relevant information of the controlled device and the security of device access are improved, and the integration of devices is realized. While optimizing the collaborative work, improve the overall security performance.

In some embodiments, as shown in FIG. 2, the S130 includes:

S131: Determine second user attribute information of authorized access users of the controlled device according to the queried access control policy;

S132: Compare the first user attribute information with the second user attribute information, and determine whether the requester is an authorized access user.

In the embodiment of the present invention, the second user attribute information of the authorized access user who is allowed to access the controlled device may be recorded in the access control policy, where the second user attribute information may be information in the same format as the first user attribute information, for example User ID information, etc.

In an embodiment, the access control policy may respectively record at least one second user attribute information of authorized access users, and then compare the first user attribute information with the at least one second user attribute information respectively. If they do not match, the requester is not an authorized access user; if the matching with a second user attribute information is successful during the comparison process, then the requester is an authorized access user.

In another embodiment, the access control policy may also record at least one second user attribute information in the form of a table, and then perform an existence query on the first user attribute information and the table. If the first user attribute information exists in the table, the requester is an authorized access user.

In this way, based on the access control policy stored in the blockchain, the identity of the requesting party can be verified, which can not only ensure the security of the controlled device to receive access, but also improve the privacy of authorized access to the storage of user identity information based on the blockchain .

In some embodiments, as shown in FIG. 3, the S140 includes:

S141: When the requesting party is an authorized access user, determine the required target capability according to the access request;

S142: Determine a target device capable of providing the target capability recorded in the virtual capability resource pool established based on the capability of the controlled device;

S143: Allocate the use right of the target device to the requester.

In the embodiment of the present invention, the requested target capability carried in the access request can be determined, and then according to the target capability, a match or search is performed in the virtual capability resource pool formed based on the UPnP protocol and the capabilities of multiple controlled devices to determine Whether the target capability exists in the virtual capability resource pool, and determine the controlled device that can provide the target capability as the target device. Here, the virtual capability resource pool may include a correspondence between the controlled device and the capabilities it possesses.

In one embodiment, the controlled device is a smart home device with UPnP protocol. Based on the access request, it is determined that the target capability required by the requester is the ability to perform screen projection within a certain size range, definition range, and other parameters. The virtual capability resource pool is searched according to the target capability, and it is determined that the television set can provide the target capability, and then the television set is determined as the target device.

In another embodiment, since the device with the target capability may not be able to provide the target capability at the current moment, after determining the controlled device with the target capability, based on the workload of the controlled device, resource occupation, and Parameters such as the distance from the location where the requester sends the access request are used to determine the target device that can provide the target capability. For example, when a user conducts a video conference on a mobile phone and needs to cast the screen on a larger screen, the TV set closest to the location of the current user's mobile phone can be selected as the target device.

Exemplarily, determining the target device recorded in the virtual capability resource pool that can provide the target capability may include: determining the controlled device recorded in the virtual capability resource pool that has the target capability; if the target device that has the target capability If there is only one controlled device, it is determined that the controlled device is the target device; if there are multiple controlled devices having the target capability, it is determined that the controlled device with the lowest current resource occupancy rate is the target device.

In this way, the virtual capability resource pool established based on the capability of the controlled device can effectively establish a mapping relationship between the controlled device and the virtual capability resource, and realize more detailed and clear access control to the device. On this basis, the virtual capabilities that the requester needs to obtain can be specified, so that an accurate search can be performed in the virtual capability resource pool, and the requester can be provided with the most suitable equipment to meet its current virtual capability needs.

In some embodiments, as shown in FIG. 4, the S150 includes:

S151: Obtain an authorized device list corresponding to the requesting party;

S152: If the target device exists in the authorized device list, send a control instruction to the target device according to the authority range information of the usage authority.

In the embodiment of the present invention, the second user attribute information of the authorized access user corresponds to an authorized device list. Optionally, different authorized access users correspond to different authorized device lists, so as to provide different accessible devices for different users. For example, for a child, for security reasons, if the child is not expected to access or control the smart cooking device, the smart cooking device may not be included in the list of authorized devices corresponding to the child.

In one embodiment, after the target device capable of providing the target capability is determined, based on the authorized device list corresponding to the requester, it is verified whether the target device is within the access scope of the requester. Here, the authorized device list may record device attribute information and the like of devices accessible to the authorized access user. If it is determined that the target device exists in the authorized device list, it is determined that the target device can be accessed by the requester.

In this way, after the authorized access user of the controlled device verifies the identity and authority of the requester, the availability of the target device is verified based on the authorized device of the requester, thereby realizing two-way authentication between the requester and the device, further optimizing the Control of device access.

In some embodiments, as shown in Figure 5, the method also includes:

S160: Query the device public key of the controlled device in the block chain;

The S150, including:

S153: Perform identity verification on the controlled device based on the device public key;

S154: If the verification is successful, send a control instruction to the controlled device according to the authority range information of the use authority.

In the embodiment of the present invention, the public key of the device can be stored in the blockchain together with the access control policy of the controlled device, and is used to verify the validity of the identity of the controlled device to be provided with virtual capability resources.

In one embodiment, after the required target capability is determined based on the access request and the target device is determined based on the target capability, the corresponding device public key can be queried in the blockchain based on the device attribute information of the target device, and the public key of the device can be used to key to verify the identity of the target device. If the verification is successful, it indicates that the target device is a security device that matches the public key recorded in the blockchain, and control instructions can be sent to it.

In another embodiment, sending the control command to the controlled device may include: sending the control command to the controlled device, and monitoring the state of the controlled device, for example, receiving the generated and fed back by the controlled device according to the executed processing action. Information.

In this way, the device public key is stored based on the blockchain, and the identity of the target device is verified based on the device public key, which further improves the security of device information storage and device access control.

In some embodiments, as shown in Figure 6, the method further includes:

S101: Establish a virtual capability resource pool based on the capability of at least one controlled device;

S102: Based on the second user attribute information of the authorized access user of the controlled device and the device attribute information of the controlled device, determine the access control policy of the controlled device recorded in the virtual capability resource pool;

S103: Store the access control policy in at least one block of the blockchain.

In the embodiment of the present invention, the capability of at least one controlled device can be obtained through the device attribute information of the at least one controlled device, wherein the device attribute information can be used to record the identification information, capability information, etc. of the controlled device. For example, if the controlled device is a smart home device under the UPnP protocol, the device attribute information of the controlled device can be obtained based on the preset UPnP discovery protocol, and then the capability of the controlled device can be determined.

Here, the controlled device is a smart home device under the UPnP protocol, which may be a hardware device produced according to the UPnP standard. The device attribute information can be a device description file in Extensible Markup Language (Extensible Markup Language, XML) format, which records detailed information about the controlled device and its virtual capabilities, and can include device name, device manufacturer (Original Equipment Manufacturer, OEM) or Solution provider (Original Design Manufacturer, ODM), service information list, etc.

In an embodiment, acquiring the capability of at least one controlled device through the device attribute information of at least one controlled device may include: receiving device attribute information sent by multicast from at least one controlled device, and obtaining the capability of the controlled device based on the device attribute information. ability to control the device.

Exemplarily, the controlled device is a smart home device under the UPnP protocol, and the controlled device can send device attribute information through multicast to announce that the device is online and describe its own functions. By monitoring and recording the fixed address and port of the device attribute information sent by the controlled device, after the target capability is determined, it can be used to find the controlled device with the target capability. Through the device attribute information provided by the controlled device, the detailed information of the controlled device and its related virtual capabilities is obtained, and the information is recorded and integrated to establish a virtual capability resource pool.

In another embodiment, the second user attribute information and device attribute information may be recorded in the access control policy. When determining the target capability according to the access request and determining the corresponding target device based on the target capability, you can query the device attribute information recorded in the access control policy, obtain the virtual capability resource information of the controlled device, and compare it with the target capability to determine A target device capable of providing targeted capabilities.

In one embodiment, the access control policy is subjected to signature encryption processing, for example, it can be encrypted by a message digest algorithm (Message-Digest Algorithm, MD5), a secure hash algorithm (Secure Hash Algorithm, SHA), etc., and the encrypted Access control policies are stored in at least one block of the blockchain.

In this way, the virtual capability resource pool established based on device capabilities can realize resource sharing and seamless connection among multiple devices, facilitate unified processing and scheduling of access requests, and simplify network implementation based on unified allocation. On this basis, the relevant information is stored in the blockchain, and the requester identity verification, device identity verification and other processing processes are performed through the blockchain, which greatly improves the security of resource sharing of controlled equipment capabilities.

In some embodiments, as shown in Figure 7, the method also includes:

S104: After the storage is completed, perform a hash operation on the block based on the access control policy stored in each block to obtain an updated hash value of the block; wherein, the block The hash of the block is stored in the next block in the blockchain;

S105: Based on the updated hash value of the block, update the hash value stored in the next block in the blockchain.

In the embodiment of the present invention, after the access control policy of the newly added controlled device is stored in the block chain, since the block storage content is updated, the block is hashed based on the block storage content The updated hash value can be obtained. In a blockchain, except for the first block, each block stores the hash value of the previous block to form a chain.

After the storage is completed, the hash operation is performed on the block, and the updated hash value obtained is stored in the next block. For example, after the access control policy of the new controlled device is stored in the block 2, a hash operation is performed on the block 2 to obtain a new hash value. Since the old hash value of block 2 is stored in block 3, the new hash value is stored in block 3 instead of the old hash value at this time, and the update of the storage content of block 3 is completed. Further, a hash operation is performed on block 3, and the new hash value of block 3 is updated to block 4, and so on.

In another embodiment, in addition to storing the hash value of the previous block, each block may also store the hash value of the current block as a basis for address traceback. Based on this, after obtaining the updated hash value of the block, the hash value stored in the block and the hash value stored in the next block need to be updated synchronously.

In this way, based on the hash value of the previous block stored in each block in the blockchain, the relevance and directivity of each block are greatly improved. Based on this, if a third-party malicious device tries to join the blockchain, it will cause a change in the storage content of the block after being stored in a block, which will cause a change in the hash value of the block, resulting in The hash value stored in the next block will also change. By analogy, the cost of third-party malicious devices entering the blockchain is greatly increased, effectively suppressing the malicious intrusion of other devices.

In some embodiments, the method also includes:

Based on the interplanetary file system IPFS, the operation data generated during the access control process of the controlled device is stored.

In the embodiment of the present invention, during the access control process of the controlled device, each processing action will generate corresponding operation data, and the amount of data is relatively large, often requiring a huge storage space. Operational data is stored based on the Inter Planetary File System (IPFS). IPFS is essentially a content-addressable, versioned, point-to-point hypermedia distributed storage and transmission protocol. A uniquely mapped hash identifier can be generated by performing a hash operation on the operation data. The operation data can be stored in the public network of IPFS, and the hash identifier of the operation data is stored in the local storage space. When the operation data needs to be called, it can be searched according to the hash identifier to obtain the corresponding operation data.

In this way, IPFS-based storage can store operational data in the entire public network. At the same time, it is no longer necessary to use multi-level directories to store operational data, but to access corresponding operational data through unique hash identifiers. It can save storage space overhead to a certain extent.

As shown in Figure 8, an embodiment of the present invention provides a device access control device, characterized in that the device includes:

The receiving unit 110 is configured to receive an access request, wherein the access request includes: first user attribute information of the requesting party;

The query unit 120 is configured to query the block chain storing the access control policy of the controlled device according to the access request;

A determining unit 130, configured to determine whether the requester is an authorized access user according to the first user attribute information and the queried access control policy;

An allocating unit 140, configured to, when the requesting party is an authorized access user, assign the requesting party the right to use the virtual capability from the virtual capability resource pool established based on the capabilities of the controlled device;

The sending unit 150 is configured to send a control instruction to the controlled device according to the authorization range information of the usage authorization, wherein the control instruction is used to control the controlled device to accept the Requester's Access.

In some embodiments, the device also includes:

a query unit, configured to query the device public key of the controlled device in the block chain;

The sending unit is specifically configured to authenticate the controlled device based on the device public key;

If the verification is successful, a control instruction is sent to the controlled device according to the authority range information of the use authority.

In some embodiments, the device also includes:

An establishing unit, configured to establish a virtual capability resource pool based on the capability of at least one controlled device;

A decision-making unit, configured to determine the access control policy of the controlled device recorded in the virtual capability resource pool based on the second user attribute information of the authorized access user of the controlled device and the device attribute information of the controlled device ;

A storage unit, configured to store the access control policy in at least one block of the block chain.

In some embodiments, the device also includes:

A calculation unit, configured to perform a hash operation on the block based on the access control policy stored in each block after the storage is completed, to obtain an updated hash value of the block; wherein, The hash value of the block is stored in the next block in the blockchain;

An update unit, configured to update the hash value stored in the next block in the block chain based on the updated hash value of the block.

In some embodiments, the storage unit is also used for:

Based on the interplanetary file system IPFS, the operation data generated during the access control process of the controlled device is stored.

A specific example is provided below in combination with any of the above-mentioned embodiments:

The embodiment of the present invention provides a block chain-based smart home distributed capability sharing access control method, which combines block chain technology, UPnP protocol and access control. The system topology of the embodiment of the present invention is shown in Figures 9 and 10 , describing the control process of smart home devices in two scenarios of residents and visitors.

1. Core process: The workflow of the smart home management and control system combined with the blockchain is jointly processed by four modules: smart home resource information module, smart home resource management module, smart home resource execution module, and smart home resource decision-making module. Each module cooperates Work, process user requests through related components, as shown in Figure 11, there are nine steps:

Step 1: The smart home owner (resident) uploads the access control permission information of the smart home device through the resource information module, including user attribute information and UPnP device information, and uses the resource management module to configure the access control corresponding to the user and capability resources policy and store this information in the blockchain;

Step 2: The smart home user (resident/visitor) initiates an access request to the smart home device through the resource execution module;

Step 3: The resource decision-making module calls the resource management module to obtain the access control policy corresponding to the user and capability resource, and calls the resource information module to obtain the relevant attribute information of the smart home user;

Step 4: The resource decision-making module compares the attribute information of the smart home user with the attribute information set in the access control policy, and if the judgment result shows that the user is allowed, it will return the correct result to the resource execution module ;

Step 5: The resource execution module receives the decision result sent by the resource decision-making module, organizes and obtains the use rights of the open virtual capabilities stipulated in the access control policy, and returns these rights to the user, and the smart home user can obtain access to the open virtual capabilities. authority;

Step 6: The smart home user applies for permission to use virtual capabilities through the resource execution module;

Step 7: The resource execution module transmits the request of the user of the smart home device to the resource decision-making module;

Step 8: The resource decision-making module searches for UPnP devices with relevant virtual capabilities, compares the obtained resource list of the smart home user, determines whether it is within the permitted range and confirms, and returns the confirmation information to the resource execution module;

Step 9:

9-1. The resource execution module returns permission call response information to the smart home user, and sends a control action request to the relevant UPnP device.

9-2. After receiving the feedback, the smart home user can use the smart home device with permission, and the process ends.

2. The smart home management and control system will encrypt relevant attribute information of users and devices on the block chain. Since the hash of the previous block needs to be used when calculating the hash of this block, if a third party needs to add a malicious device to the blockchain, the cost will be very high. The blockchain adopts a block chain data structure, that is, the transaction processing that occurs within a period of time is stored in blocks, and a cryptographic algorithm is used to connect the blocks into a chain in chronological order. When saving the corresponding data on the blockchain, trusted data signature processing is required, and digital fingerprint technologies such as MD5 and SHA are used to obtain the corresponding signature value. Therefore, relevant information will be saved in each data block: previous block hash and current block hash, user access control policy, device authorization public key information, etc. In this way, the address of the previous block can be used for backtracking, so that these data can be saved in a chain, which improves the security of the data. The relevant processing of signatures in each block is shown in Figure 12, where 00006yjabc, 000007jlabc, 000008baced, and 000009yycae are hash values generated by hash operations.

3. The smart home management and control system will distribute and store a large amount of operational data information that may be generated during the use of the smart home through IPFS. IPFS is essentially a content-addressable, versioned, point-to-point hypermedia distributed storage and transmission protocol. It has the characteristics of content addressability. It generates a unique hash identifier through the file content, which saves space to a certain extent. The cost of overhead. IPFS performs hash operation on the operation data of the smart home, and then searches according to the hash value to obtain the corresponding storage content, and the feedback hash value and the storage content of the operation data are mapped to each other.

For example, the storage of operation data can be realized through the pseudocode shown in FIG. 13 .

The corresponding hash value above can be obtained by hashing the operation data of the smart home.

When it is necessary to obtain the uploaded smart home operation data, it can be obtained through the code shown in Figure 14.

4. The smart home management and control system uses the UPnP protocol to complete device discovery and control. As a general UPnP control point, UPnP has a standard protocol for automatic discovery and control, which can realize zero configuration for smart home devices. When a smart home device is added to the network, the UPnP discovery protocol can allow it to multicast to the smart home management and control system to announce that the device is online and describe its functions. At the same time, the smart home management and control system will monitor the fixed address and port of the device sending messages. In this way, the devices with relevant virtual capabilities required in the network can be found, and the detailed information of the devices and their related virtual capabilities can be obtained through the device description files provided by the devices, and the information can be recorded through the smart home resource information module. Afterwards, when the device user has obtained the authorization to use the smart home device through verification, the smart home management and control system uses the public key of the device on the blockchain to perform signature verification, and then selects the operation to be performed according to the description of the device and obtains the details of the device. The service provided, transmits the control behavior request to the specified smart home device, requires the device to start the service and monitor the status of the device, and take corresponding processing actions when the status changes. At the same time, the smart home device will feedback relevant information to the smart home device after executing the command. control system.

5. The smart home device is a hardware device produced according to the UPnP standard, which can be regarded as a "container" associated with services and containing conventional devices, including a series of sub-devices and various services. Usually, the detailed information of devices and virtual capabilities is recorded in XML device description files. These device description files are generally processed by manufacturers and contain some attributes related to devices, as shown in Figure 15, such as device name, device vendor (OEM ) or the solution provider (ODM), the Universal Unique Identifier (UUID) of the device, the device type or model (modeName), service list (serviceList), etc. Wherein, the service list may record the service type (serviceType), service ID (serviceId), service description Uniform Resource Locator (Service Control Protocol Document-Uniform Resource Locator, SCPDURL), service control URL (controlURL), etc.

After the smart home management and control system obtains detailed description information related to devices and services, it can call corresponding service actions to realize the control and operation of smart home devices. In this way, devices in a home or company network can be seamlessly connected, and network implementation thereof is simplified. For example, when we receive a video conference call, the smart home management and control system can help us switch the video screen of our colleagues from the small mobile phone interface to the TV screen for display, achieving a better interactive experience. The user transmits a request to obtain the corresponding virtual capability, and the process is shown in Figure 16. Wherein, the virtual capability resource pool may include capability resources such as display, network communication, microphone, speaker, central processing unit (central processing unit, CPU), and global positioning system (Global Positioning System, GPS).

6. The method of opening and sharing the capabilities of smart home devices can avoid "denial of service" attacks. This attack is announced online to the system by a third-party hacker and guides the system to request to download service content, thereby occupying a large amount of system resources and causing the entire system to The service speed of the system slows down or even stops. This method introduces blockchain and smart contract strategies in the process of automatic discovery and control of UPnP devices. At the same time, the device information will be encrypted and signed. Only after the device is verified and confirmed, can it be uploaded to the chain, which to a certain extent eliminates malicious Device intrusion. And only after the authorization is granted, the device user can operate the UPnP device, and the security and reliability of the device have been greatly improved.

An embodiment of the present invention also provides an electronic device, which includes: a processor and a memory for storing a computer program that can run on the processor. When the processor runs the computer program, it executes one or more of the aforementioned The steps of the method described in the technical solution.

An embodiment of the present invention also provides a computer-readable storage medium, the computer-readable storage medium stores computer-executable instructions, and after the computer-executable instructions are executed by a processor, the methods described in one or more of the foregoing technical solutions can be implemented .

The computer storage medium provided in this embodiment may be a non-transitory storage medium.

In the several embodiments provided in this application, it should be understood that the disclosed devices and methods may be implemented in other ways. The device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods, such as: multiple units or components can be combined, or May be integrated into another system, or some features may be ignored, or not implemented. In addition, the coupling, or direct coupling, or communication connection between the components shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be electrical, mechanical or other forms of.

The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units; Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present invention can be integrated into one processing module, or each unit can be used as a single unit, or two or more units can be integrated into one unit; the above-mentioned integration The unit can be realized in the form of hardware or in the form of hardware plus software functional unit.

In some cases, if any two of the above technical features do not conflict, they can be combined into a new method and technical solution.

In some cases, if any two of the above-mentioned technical features do not conflict, they can be combined into a new equipment technical solution.

Those of ordinary skill in the art can understand that all or part of the steps for realizing the above-mentioned method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the Including the steps of the foregoing method embodiments; and the aforementioned storage medium includes: various storage devices, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk A medium on which program code can be stored.

The above is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Anyone skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present invention. Should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims.

Claims (11)

1. A device access control method, characterized in that, comprising: receiving an access request, wherein the access request includes: first user attribute information of the requesting party; Querying the block chain storing the access control policy of the controlled device according to the access request; Determine whether the requesting party is an authorized access user according to the first user attribute information and the queried access control policy; When the requesting party is an authorized access user, assigning the requesting party the right to use the virtual capability from the virtual capability resource pool established based on the capabilities of the controlled device; Sending a control instruction to the controlled device according to the permission range information of the usage permission, where the control instruction is used to control the controlled device to accept the requester's access within the usage permission. 2. The method according to claim 1, wherein the determining whether the requesting party is an authorized access user according to the first user attribute information and the queried access control policy comprises: determining second user attribute information of authorized access users of the controlled device according to the queried access control policy; Comparing the first user attribute information with the second user attribute information to determine whether the requester is an authorized access user. 3. The method according to claim 1, wherein the assigning the requester the right to use the virtual capability from the virtual capability resource pool established based on the capability of the controlled device comprises: Determining required target capabilities based on the access request; determining a target device capable of providing the target capability recorded in the virtual capability resource pool established based on the capability of the controlled device; Allocating the use rights of the target device to the requesting party. 4. The method according to claim 3, wherein the sending a control command to the controlled device according to the authority scope information of the use authority comprises: Obtain an authorized device list corresponding to the requesting party; If the target device exists in the authorized device list, a control instruction is sent to the target device according to the authority range information of the usage authority. 5. The method according to claim 1, wherein the method further comprises: querying the device public key of the controlled device in the block chain; The sending a control command to the controlled device according to the authority range information of the use authority includes: performing identity verification on the controlled device based on the device public key; If the verification is successful, a control instruction is sent to the controlled device according to the authority range information of the use authority. 6. The method according to claim 1, further comprising: Establishing a virtual capability resource pool based on the capability of at least one controlled device; Based on the second user attribute information of the authorized access user of the controlled device and the device attribute information of the controlled device, determine the access control policy of the controlled device recorded in the virtual capability resource pool; The access control policy is stored in at least one block of the block chain. 7. The method according to claim 6, further comprising: After the storage is completed, based on the access control policy stored in each of the blocks, a hash operation is performed on the blocks to obtain an updated hash value of the blocks; wherein, the block's The hash value is stored in the next block in the blockchain; Based on the updated hash value of the block, the hash value stored in the next block in the blockchain is updated. 8. The method according to any one of claims 1 to 7, characterized in that the method further comprises: Based on the interplanetary file system IPFS, the operation data generated during the access control process of the controlled device is stored. 9. A device access control device, characterized in that the device comprises: A receiving unit, configured to receive an access request, wherein the access request includes: first user attribute information of the requesting party; a query unit, configured to query a block chain storing the access control policy of the controlled device according to the access request; A determining unit, configured to determine whether the requester is an authorized access user according to the first user attribute information and the queried access control policy; An allocating unit, configured to allocate the requester the right to use the virtual capability from the virtual capability resource pool established based on the capability of the controlled device when the requester is an authorized access user; A sending unit, configured to send a control instruction to the controlled device according to the authorization range information of the usage authorization, wherein the control instruction is used to control the controlled device to accept the request within the usage authorization party visits. 10. An electronic device, characterized in that the electronic device comprises: a processor and a memory for storing a computer program that can run on the processor; wherein, When the processor runs the computer program, it executes the steps of the device access control method according to any one of claims 1 to 8. 11. A computer-readable storage medium, characterized in that, the computer-readable storage medium stores computer-executable instructions; after the computer-executable instructions are executed by a processor, any one of claims 1 to 8 can be implemented. The device access control method described in the item.

Images