The invention discloses a lightweight access control method and system for the industrial internet of things without a certificate. According to the idea of OAuth, the local central server responsible for authorization authenticates both parties. Unlike ACE‑OAuth, which requires traditional (such as certificate-based) communication key negotiation before authentication, this method uses the local server as a trusted first Three parties, use public key-based challenge responses, tokens and passwords to realize two-way authentication between users and resource servers, and integrate communication key negotiation into the authentication process, while ensuring security, resource servers do not need to distribute and receive certificates and verification, which can effectively reduce the number of interactive rounds in the authentication process, thereby effectively reducing the amount of communication data transmission and key negotiation calculation consumption, including CPU occupation, disk occupation, memory occupation, etc., which is more advantageous in terms of security and practicability , more suitable for resource-constrained environments such as the Industrial Internet of Things.