Session establishment method and system, storage medium and electronic device

Abstract

The present application discloses a session establishment method and system, a storage medium and an electronic device, and relates to the field of smart home technology. The session establishment method includes: when it is determined that the session established between the edge gateway and the target application has expired, receiving the signature certificate and encrypted identification information sent by the target application, wherein the identification information is used to identify the target object; verifying the signature certificate through the saved root certificate, and decrypting the encrypted identification information using the saved private key; when the verification of the signature certificate passes and the decryption of the encrypted identification information is successful, re-establishing the session between the edge gateway and the target application based on the identification information. The above technical solution solves the problem in the prior art that the edge computing engine cannot normally establish a session with the application after being disconnected from the external network for a long time or restarted after a power outage, resulting in the inability of the edge scenario to operate normally.

Description

Technical Field

[0001] The present application relates to the field of smart home technology, and more specifically, to a session establishment method and system, a storage medium, and an electronic device. Background Art

[0002] Edge scenarios run on the edge computing engine of edge gateways, closer to the device side and running faster. At the same time, because it runs within the user's home local area network, it is not affected by public network fluctuations or server anomalies, and its operation is more stable and reliable.

[0003] In existing technologies, user authentication and authorization are typically performed through cloud-based user services, generating a token and distributing it to the application. For edge use cases, the application typically sends the token to the resource provider to establish a session (or possibly directly request resources). The resource provider then asks the user service to verify the validity of the token. Once the verification is successful, the resource provider establishes a session with the application, and subsequently requests the resource provider to provide resource services directly to the application through the session. When the session expires, the application requests another session with the resource provider, requiring further verification of the token.

[0004] The existing technology for token verification needs to rely on the cloud and the network. Therefore, the edge computing engines on the market can usually trigger the operation of edge scenarios normally when they are normally connected to the Internet or briefly disconnected from the Internet. However, due to the lack or imperfect edge authentication and authorization system, after a long period of disconnection from the Internet or when the edge gateway is powered off and restarted, the session cannot be established again after the session is disconnected, resulting in the communication terminal between the edge gateway and the application party being unable to operate the edge scenario normally.

[0005] In existing technologies, there are problems such as the edge computing engine being unable to establish a session with the application normally after being disconnected from the external network for a long time or restarted due to power outage, resulting in the edge scenario being unable to operate normally. No effective solution has been proposed yet. Summary of the Invention

[0006] Embodiments of the present invention provide a session establishment method and system, a storage medium, and an electronic device to at least solve the problem in the prior art that the edge computing engine cannot normally establish a session with the application after being disconnected from the external network for a long time or restarted due to power outage, resulting in the edge scenario being unable to operate normally.

[0007] According to one embodiment of the present invention, a session establishment method is provided, comprising: upon determining that an established session between an edge gateway and a target application has expired, receiving a signature certificate and encrypted identification information sent by the target application, wherein the identification information is used to identify the target object; verifying the signature certificate using a stored root certificate, and decrypting the encrypted identification information using a stored private key; and re-establishing the session between the edge gateway and the target application based on the identification information when the verification of the signature certificate passes and the decryption of the encrypted identification information is successful.

[0008] In an exemplary embodiment, before receiving the signature certificate and encrypted identification information sent by the target application, the method further includes: obtaining the identification information of the target object and the authorization matrix of the target object from a cloud server based on the identity token carried in the session establishment request sent by the target application, wherein the identity token is used to indicate that the target object has the permission to establish a session; determining the session permission of the target application based on the authorization matrix, and establishing a session with the target application based on the session permission and the identification information of the target object, wherein the session permission is used to indicate the resources that the target application can access through the session.

[0009] In an exemplary embodiment, after establishing a session with the target application based on the identification information of the target object, the method further includes: receiving the root certificate and the private key sent by the certificate server, wherein the root certificate and the private key are generated by the certificate server based on the identification information of the target object sent by the cloud server.

[0010] In an exemplary embodiment, before receiving the signature certificate and encrypted identification information sent by the target application, the method also includes: determining the encryption level supported by the edge gateway by detecting the hardware performance of the edge gateway; sending the encryption level to the cloud server to instruct the cloud server to determine the encryption method for encrypting the identification information of the target object based on the encryption level.

[0011] According to another embodiment of the present invention, a session establishment method is provided, comprising: upon determining that an established session between an edge gateway and a target application has expired, encrypting identification information of the target object using a stored public key to obtain encrypted identification information; and sending the stored signature certificate and the encrypted identification information to the edge gateway to instruct the edge gateway to re-establish the session between the edge gateway and the target application.

[0012] In an exemplary embodiment, the identification information of the target object is encrypted using a stored public key. Before obtaining the encrypted identification information, the method further includes: when the cloud server passes the identity authentication of the target application, receiving an identity token sent by the cloud server, wherein the identity token is used to indicate that the target object has the permission to establish a session; sending a session establishment request to the edge gateway, wherein the session establishment request carries the identity token, and the session establishment request is used to request to establish a session with the edge gateway.

[0013] In an exemplary embodiment, after sending a session establishment request to the edge gateway, the method further includes: when a session is successfully established with the edge gateway, receiving the signature certificate and the public key sent by the certificate server, wherein the signature certificate and the public key are generated by the certificate server based on the identification information of the target object sent by the cloud server.

[0014] According to another embodiment of the present invention, a session establishment system is also provided, including: a target application, which is used to encrypt the identification information of the target object using a stored public key when it is determined that the session established with the edge gateway has expired, and send the stored signature certificate and the encrypted identification information to the edge gateway; an edge gateway, which is used to receive the signature certificate and the encrypted identification information sent by the target application, verify the signature certificate through a stored root certificate, and decrypt the encrypted identification information using a stored private key, and re-establish the session with the target application based on the identification information when the verification of the signature certificate passes and the decryption of the encrypted identification information is successful.

[0015] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored. The computer program is configured to execute the above-mentioned session establishment method when running.

[0016] According to another aspect of an embodiment of the present invention, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the session establishment method through the computer program.

[0017] In an embodiment of the present application, when it is determined that the session established between the edge gateway and the target application has expired, the signature certificate and encrypted identification information sent by the target application are received, and the signature certificate is verified by means of a pre-saved root certificate, and the encrypted identification information is decrypted by means of a pre-saved private key; if the signature certificate verification passes and the encrypted identification information is successfully decrypted, it proves that the target application has the authority to establish a session, and the session between the edge gateway and the target application is re-established based on the decrypted identification information; the above technical solution is adopted to solve the problem in the prior art that the edge computing engine cannot normally establish a session with the application after being disconnected from the external network for a long time or after a power outage and restart, resulting in the inability of the edge scenario to operate normally; and the technical effect of achieving normal operation of the edge computing engine by being able to perform authorization and authentication in the case of a long-term disconnection from the external network or a power outage and restart of the edge gateway is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0019] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0020] Figure 1 1 is a schematic diagram of a hardware environment for an optional session establishment method according to an embodiment of the present application;

[0021] Figure 2 is a flowchart of an optional session establishment method according to an embodiment of the present invention;

[0022] Figure 3 is a flowchart of another optional session establishment method according to an embodiment of the present invention;

[0023] Figure 4 1 is a flow chart of an optional session establishment method according to an embodiment of the present invention (I);

[0024] Figure 5 1 is a flow chart of an optional session establishment method according to an embodiment of the present invention (II);

[0025] Figure 6 1 is a flow chart of an optional session establishment method according to an embodiment of the present invention (III);

[0026] Figure 74 is a flow chart of an optional session establishment method according to an embodiment of the present invention;

[0027] Figure 8 A structural block diagram of an optional session establishment system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] According to one aspect of the embodiment of the present application, a session establishment method is provided. The session establishment method is widely used in smart home (Smart Home), smart home, smart home device ecology, smart home (IntelligenceHouse) ecology and other whole-house intelligent digital control application scenarios. Optionally, in this embodiment, the above-mentioned session establishment method can be applied to Figure 1 In the hardware environment shown in FIG. 1 , which is composed of a terminal device 102 and a server 104. Figure 1 As shown, the server 104 is connected to the terminal device 102 via a network, and can be used to provide services (such as application services, etc.) for the terminal or the client installed on the terminal. A database can be set up on the server or independently of the server to provide data storage services for the server 104. Cloud computing and / or edge computing services can be configured on the server or independently of the server to provide data computing services for the server 104.

[0031] The aforementioned network may include, but is not limited to, at least one of the following: a wired network and a wireless network. The aforementioned wired network may include, but is not limited to, at least one of the following: a wide area network, a metropolitan area network, and a local area network. The aforementioned wireless network may include, but is not limited to, at least one of the following: Wi-Fi (Wireless Fidelity) and Bluetooth. The terminal device 102 may be, but is not limited to, a PC, a mobile phone, a tablet computer, a smart air conditioner, a smart range hood, a refrigerator, a smart oven, a smart stove, a smart washing machine, a smart water heater, a smart washing machine, a smart dishwasher, a smart projection device, a smart TV, a smart clothes drying rack, smart curtains, smart audio and video, a smart socket, a smart speaker, a smart fresh air device, smart kitchen and bathroom equipment, smart bathroom equipment, a smart sweeping robot, a smart window cleaning robot, a smart mopping robot, a smart air purifier, a smart steamer, a smart microwave oven, a smart kitchen treasure, a smart purifier, a smart water dispenser, a smart door lock, etc.

[0032] In this embodiment, a session establishment method is provided, which is applied to an edge gateway. Figure 2 4 is a flow chart of an optional session establishment method according to an embodiment of the present invention, the process comprising the following steps:

[0033] Step S202: When it is determined that the session established between the edge gateway and the target application has expired, receiving a signature certificate and encrypted identification information sent by the target application, wherein the identification information is used to identify the target object;

[0034] It should be noted that the above-mentioned target application refers to the resource consumer, that is, the application party, which is usually the app that interacts with the user. In the edge scenario, it is the app used by the user to trigger the scenario execution.

[0035] It should be noted that the aforementioned edge gateway refers to the resource or service provider. Applications generally require authentication to obtain resources or services, and can only consume resources or services after passing authentication. In edge scenarios, this refers to the scenario execution engine and edge computing engine.

[0036] Step S204: verifying the signature certificate using the stored root certificate, and decrypting the encrypted identification information using the stored private key;

[0037] Step S206 : When the verification of the signature certificate passes and the decryption of the encrypted identification information is successful, re-establish the session between the edge gateway and the target application according to the identification information.

[0038] In an embodiment of the present application, when it is determined that the session established between the edge gateway and the target application has expired, the signature certificate and encrypted identification information sent by the target application are received, and the signature certificate is verified by means of a pre-saved root certificate, and the encrypted identification information is decrypted by means of a pre-saved private key; if the signature certificate verification passes and the encrypted identification information is successfully decrypted, it proves that the target application has the authority to establish a session, and the session between the edge gateway and the target application is re-established based on the decrypted identification information; the above technical solution is adopted to solve the problem in the prior art that the edge computing engine cannot normally establish a session with the application after being disconnected from the external network for a long time or after a power outage and restart, resulting in the inability of the edge scenario to operate normally; and the technical effect of achieving normal operation of the edge computing engine by being able to perform authorization and authentication in the case of a long-term disconnection from the external network or a power outage and restart of the edge gateway is achieved.

[0039] Optionally, before executing step S202 above: receiving the signature certificate and encrypted identification information sent by the target application, the method further includes: obtaining the identification information of the target object and the authorization matrix of the target object from the cloud server according to the identity token carried in the session establishment request sent by the target application, wherein the identity token is used to indicate that the target object has the permission to establish a session; determining the session permission of the target application according to the authorization matrix, and establishing a session with the target application according to the session permission and the identification information of the target object, wherein the session permission is used to indicate the resources that the target application can access through the session.

[0040] After the user completes login authentication through the target application, the cloud server will save the identification information of the user corresponding to the target application and the user role authorization matrix of the user corresponding to the target application; when receiving a session establishment request sent by the target application, the cloud server obtains the identification information and authorization matrix of the target object from the cloud server based on the identity token carried in the session establishment request. The identity token is used to indicate that the target object has the session establishment permission; based on the authorization matrix, the target application bound to the target object is determined to be granted access to the resources or services through the session, and a session is established with the target application based on the session permission and the identification information of the target object.

[0041] Based on the above steps, the above session establishment step is performed: after establishing a session with the target application according to the identification information of the target object, the method further includes: receiving the root certificate and the private key sent by the certificate server, wherein the root certificate and the private key are generated by the certificate server based on the identification information of the target object sent by the cloud server.

[0042] After establishing a session with the target application, the certificate server will receive the identification information of the target object sent by the cloud server to instruct the certificate server to generate a signing certificate and secret key based on the identification information of the target object, and receive the root certificate of the signing certificate and the private key in the secret key sent by the certificate server.

[0043] Optionally, before executing step S202 above: receiving the signature certificate and encrypted identification information sent by the target application, the method further includes: determining the encryption level supported by the edge gateway by detecting the hardware performance of the edge gateway; sending the encryption level to the cloud server to instruct the cloud server to determine the encryption method for encrypting the identification information of the target object based on the encryption level.

[0044] It is understandable that the hardware performance of different edge gateways is different, and the quality of the hardware performance determines the encryption method it can support. Therefore, the encryption level of the encryption method supported by the edge gateway can be determined by detecting the hardware performance of the edge gateway, and the encryption level can be sent to the cloud server to instruct the cloud server to determine the encryption method for encrypting the identification information of the target object based on the encryption level.

[0045] It should be noted that the above encryption levels can be divided into three levels: high, medium and low; if the encryption level is high, encryption can be performed by generating a signature certificate; if the encryption level is medium, encryption can be performed through asymmetric encryption; if the encryption level is low, symmetric encryption can be supported.

[0046] In this embodiment, another session establishment method is provided, which is applied to the target application. Figure 3 FIG. 1 is a flow chart of another optional session establishment method according to an embodiment of the present invention, the flow comprising the following steps:

[0047] Step S302: When it is determined that the session established between the edge gateway and the target application has expired, encrypt the identification information of the target object using the stored public key to obtain encrypted identification information;

[0048] Step S304: Send the saved signature certificate and the encrypted identification information to the edge gateway to instruct the edge gateway to re-establish the session between the edge gateway and the target application.

[0049] In an embodiment of the present application, when the target application determines that the session established between it and the edge gateway has expired, it first uses a pre-saved public key to encrypt the identification information of the target object to obtain the encrypted identification information; the pre-saved signature certificate and the encrypted identification information are sent to the edge gateway to instruct the edge gateway to re-establish the session between the edge gateway and the target application; the above solution is adopted to solve the problem in the prior art that the edge computing engine cannot normally establish a session with the application after being disconnected from the external network for a long time or after a power outage and restart, resulting in the edge scenario being unable to operate normally; and it is achieved that in the case of a long-term disconnection from the external network or a power outage and restart of the edge gateway, the edge computing engine can still perform authorization and authentication, thereby achieving the technical effect of normal operation.

[0050] Optionally, execute the above step S302: use the saved public key to encrypt the identification information of the target object, and before obtaining the encrypted identification information, the method also includes: when the cloud server passes the identity authentication of the target application, receiving the identity token sent by the cloud server, wherein the identity token is used to indicate that the target object has the permission to establish a session; sending a session establishment request to the edge gateway, wherein the session establishment request carries the identity token, and the session establishment request is used to request to establish a session with the edge gateway.

[0051] The target application guides the user to perform login authentication (such as scanning a code to log in, etc.). The application party submits the user's authentication information to the cloud server. The cloud server checks the user authentication information. If it is legal, it issues a corresponding authorization token (equivalent to the above-mentioned identity token) and receives the identity token sent by the cloud server, where the identity token is used to indicate that the target object has the right to establish a session; a session establishment request is sent to the edge gateway, which carries the identity token and is used to request to establish a session with the edge gateway.

[0052] Optionally, based on the above steps, after sending a session establishment request to the edge gateway, the method also includes: when a session is successfully established with the edge gateway, receiving the signature certificate and the public key sent by the certificate server, wherein the signature certificate and the public key are generated by the certificate server based on the identification information of the target object sent by the cloud server.

[0053] When a session is successfully established with the edge gateway, the signature certificate and public key sent by the certificate server are received. The signature certificate and public key are generated by the certificate server based on the identification information of the target object sent by the cloud server.

[0054] In this embodiment, an optional session establishment method is provided. Figure 41 is a flow chart of an optional session establishment method according to an embodiment of the present invention (I), such as Figure 4 As shown, specifically including:

[0055] Step 1: The user initiates authentication and authorization from the account service (equivalent to the cloud server) through the application (equivalent to the target application). If the authorization is successful, the user obtains the token (equivalent to the identity token) issued by the account service.

[0056] Step 2: The application sends a request to the resource provider (equivalent to the edge gateway) with the token to establish a session.

[0057] Step 3: The resource provider checks the validity of the token in the account service. If it is valid, a session is established with the application.

[0058] Step 4: The resource provider provides resource services directly to the application through the session.

[0059] It should be noted that when the session expires, the application party needs to verify the Token again when requesting to establish a session with the resource provider again.

[0060] Based on the above steps, it can be seen that the establishment of a session in the prior art is completely dependent on the verification of the Token, and the verification of the Token in the prior art needs to rely on the cloud (equivalent to the above-mentioned cloud server) and the smoothness of the network, which results in that when the edge scenario is disconnected from the external network or the edge gateway is restarted, the session will not be able to be established again, resulting in the communication terminal between the edge gateway and the application party, and the edge gateway cannot be triggered and executed normally.

[0061] In order to solve the above problem, the embodiment of the present application provides another session establishment method. Figure 5 1 is a flow chart of an optional session establishment method according to an embodiment of the present invention (II), such as Figure 5 As shown, specifically including:

[0062] Step 1: The application guides the user to log in and authenticate (or perform authentication methods, such as scanning a QR code to log in). The application submits the user's authentication information to the account service. The account service checks the user's authentication information and, if it is legitimate, issues a corresponding authorization token. The application saves the token and uses it for subsequent authentication.

[0063] It should be noted that the account service usually issues two tokens: one is the Refresh Token, which is used to refresh and obtain a new Access Token when the Access Token expires, and is usually valid for a longer period; the other is the Access Token, which is used for authentication when requesting services provided by the resource party, and is usually valid for a shorter period.

[0064] Step 2: The application sends the token to the resource provider to establish a session. Once the session is established, no further authentication is required for requests to the resource provider during the session validity period. For security reasons, the session validity period is usually shorter than the token validity period.

[0065] It should be noted that when the application initiates a session establishment request, it also needs to carry other necessary information. For example, in order to identify the identity of different applications, different applications are usually assigned different app IDs and app secrets. The app ID is used to pass when requesting resource services, and the app secret is used for encryption and signing so that the resource provider can check whether the application is a legitimate requester.

[0066] Step 3: After receiving the token provided by the application, the resource provider requests the account service to obtain the basic information of the token, the user ID, and the user role authorization matrix (as shown in the table below), and saves the relevant information in the resource provider's storage;

[0067] Table 1 Basic information table of Token

[0068] Role Add a device Query device Create a new scene Execution scenario Family members √ √ Family Manager √ √ √ √

[0069] Step 4: After the session is established, the resource provider will no longer authenticate the application when accessing resources within the authorized scope. In this case, even if the external network is disconnected, the resource provider at the edge can still provide services to the application normally. The edge scenario can be triggered and executed normally. However, when the session expires or after a power outage and restart (usually the session will also be terminated), the resource provider will no longer provide services to the application and a new session will need to be established.

[0070] Step 5: After the account service authenticates the user, it will request the certificate service to generate a user-specific private key and signature certificate based on the user's identification information. This allows the edge to independently verify the user's legitimacy through the certificate, replacing the authentication process.

[0071] Step 6: The certificate service (equivalent to the certificate server mentioned above) distributes the system's root certificate to the resource provider for subsequent authentication and use in an offline state;

[0072] Step 7: The certificate service distributes the user's exclusive signing certificate and secret key to the application for subsequent offline authentication.

[0073] In step 8, when disconnected from the external network and the session between the application and the resource provider expires, the authentication process for reestablishing the session is different from authentication through the cloud account service. The application encrypts and signs the user ID (or other verification information) using its own private key and sends the signature certificate to the resource provider for verification. The resource provider uses the root certificate to verify the legitimacy of the signature certificate and asymmetrically decrypts the encrypted signature using the signature certificate's public key. The resource provider then verifies the legitimacy of the user ID (or other verification information). If verified to be legitimate, the session is established and services are provided according to the user role authorization matrix.

[0074] Through the above steps, when it is found that the session established between the target application and the edge gateway is disconnected, the target application is authenticated and authorized by the signature certificate and public key and private key that are sent to the target application and the edge gateway in advance, so as to re-establish the session between the edge gateway and the target application; the above solution solves the problem in the related technology that the edge computing engine cannot normally establish a session with the application after being disconnected from the external network for a long time or restarted by power outage, resulting in the failure of the edge scenario to operate normally; and achieves the technical effect that the edge computing engine can still perform authorization and authentication in the case of long-term disconnection from the external network or restart of the edge gateway, thereby operating normally.

[0075] For different edge gateways or edge devices, their hardware performance is different. Not all edge gateways or edge devices can support the authorization and authentication method of the above-mentioned signature certificate. Therefore, the embodiment of the present application also provides two encryption methods during the session establishment process, such as Figure 6 and Figure 7 As shown:

[0076] Steps 1-4 in these two session establishment methods are the same as Figure 5 Steps 1-4 of the session establishment method shown are the same, except that Figure 5 The user's signature certificate is created through the certificate service, and Figure 6 The public key and private key are created through the key pair service, and are distributed to the edge gateway and the application party respectively. When re-establishing the session, the application party only carries the user ID encrypted by the private key, and the edge gateway verifies it through the saved public key and user ID. Figure 6 The session establishment method shown is based on an asymmetric encryption system to complete authorization and authentication; Figure 7 In the middle, authorization and authentication are performed through a symmetric encryption system, and encryption keys are distributed to edge gateways and applications through key services. The same key is used to verify user identities.

[0077] Through the above solution, encryption methods with different security levels are provided. At the same time, different encryption methods have different hardware performance requirements for edge gateways and edge devices, thereby reducing the hardware performance requirements for edge gateways and edge devices.

[0078] Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods of various embodiments of the present invention.

[0079] This embodiment also provides a session establishment system for implementing the above-mentioned embodiments and preferred implementations. Details already described will not be repeated. As used below, the term "module" may refer to a combination of software and / or hardware that implements a predetermined function. Although the systems described in the following embodiments are preferably implemented in software, implementation using hardware, or a combination of software and hardware, is also possible and contemplated.

[0080] Figure 8 is a structural block diagram of an optional session establishment system according to an embodiment of the present invention; Figure 8 Shown, including:

[0081] The target application 82 is configured to, upon determining that the session established with the edge gateway has expired, encrypt the identification information of the target object using the stored public key, and send the stored signature certificate and the encrypted identification information to the edge gateway;

[0082] The edge gateway 84 is used to receive the signature certificate and the encrypted identification information sent by the target application, verify the signature certificate through the stored root certificate, and decrypt the encrypted identification information using the stored private key. When the verification of the signature certificate passes and the decryption of the encrypted identification information is successful, the session with the target application is re-established based on the identification information.

[0083] Through the above system, when it is determined that the session established between the edge gateway and the target application has expired, the signature certificate and encrypted identification information sent by the target application are received, and the signature certificate is verified by the pre-stored root certificate, and the encrypted identification information is decrypted by the pre-stored private key; if the signature certificate verification passes and the encrypted identification information is successfully decrypted, it is proved that the target application has the authority to establish a session, and the session between the edge gateway and the target application is re-established based on the decrypted identification information; the above technical solution is adopted to solve the problem in the prior art that the edge computing engine cannot normally establish a session with the application after being disconnected from the external network for a long time or after a power outage and restart, resulting in the edge scenario being unable to operate normally; and the technical effect of achieving normal operation of the edge computing engine by being able to perform authorization and authentication in the case of a long-term disconnection from the external network or a power outage and restart of the edge gateway is achieved.

[0084] Optionally, the edge gateway 84 is further used to obtain the identification information of the target object and the authorization matrix of the target object from the cloud server based on the identity token carried in the session establishment request sent by the target application, wherein the identity token is used to indicate that the target object has the permission to establish a session; determine the session permission of the target application based on the authorization matrix, and establish a session with the target application based on the session permission and the identification information of the target object, wherein the session permission is used to indicate the resources that the target application can access through the session.

[0085] After the user completes login authentication through the target application, the cloud server will save the identification information of the user corresponding to the target application and the user role authorization matrix of the user corresponding to the target application; when receiving a session establishment request sent by the target application, the cloud server obtains the identification information and authorization matrix of the target object from the cloud server based on the identity token carried in the session establishment request. The identity token is used to indicate that the target object has the session establishment permission; based on the authorization matrix, the target application bound to the target object is determined to be granted access to the resources or services through the session, and a session is established with the target application based on the session permission and the identification information of the target object.

[0086] Optionally, the edge gateway 84 is further configured to receive the root certificate and the private key sent by the certificate server, wherein the root certificate and the private key are generated by the certificate server based on the identification information of the target object sent by the cloud server.

[0087] After establishing a session with the target application, the certificate server will receive the identification information of the target object sent by the cloud server to instruct the certificate server to generate a signing certificate and secret key based on the identification information of the target object, and receive the root certificate of the signing certificate and the private key in the secret key sent by the certificate server.

[0088] Optionally, the edge gateway 84 is further used to determine the encryption level supported by the edge gateway by detecting the hardware performance of the edge gateway; and send the encryption level to the cloud server to instruct the cloud server to determine the encryption method for encrypting the identification information of the target object based on the encryption level.

[0089] It is understandable that the hardware performance of different edge gateways is different, and the quality of the hardware performance determines the encryption method it can support. Therefore, the encryption level of the encryption method supported by the edge gateway can be determined by detecting the hardware performance of the edge gateway, and the encryption level can be sent to the cloud server to instruct the cloud server to determine the encryption method for encrypting the identification information of the target object based on the encryption level.

[0090] It should be noted that the above encryption levels can be divided into three levels: high, medium and low; if the encryption level is high, encryption can be performed by generating a signature certificate; if the encryption level is medium, encryption can be performed through asymmetric encryption; if the encryption level is low, symmetric encryption can be supported.

[0091] Optionally, the target application 82 is also used to receive an identity token sent by the cloud server when the cloud server passes the identity authentication of the target application, wherein the identity token is used to indicate that the target object has the permission to establish a session; and send a session establishment request to the edge gateway, wherein the session establishment request carries the identity token, and the session establishment request is used to request to establish a session with the edge gateway.

[0092] The target application guides the user to perform login authentication (such as scanning a code to log in, etc.). The application party submits the user's authentication information to the cloud server. The cloud server checks the user authentication information. If it is legal, it issues a corresponding authorization token (equivalent to the above-mentioned identity token) and receives the identity token sent by the cloud server, where the identity token is used to indicate that the target object has the right to establish a session; a session establishment request is sent to the edge gateway, which carries the identity token and is used to request to establish a session with the edge gateway.

[0093] Optionally, the target application 82 is also used to receive the signature certificate and the public key sent by the certificate server when a session is successfully established with the edge gateway, wherein the signature certificate and the public key are generated by the certificate server based on the identification information of the target object sent by the cloud server.

[0094] When a session is successfully established with the edge gateway, the signature certificate and public key sent by the certificate server are received. The signature certificate and public key are generated by the certificate server based on the identification information of the target object sent by the cloud server.

[0095] An embodiment of the present invention further provides a storage medium, which includes a stored program, wherein the program executes any of the above methods when it is run.

[0096] Optionally, in this embodiment, the storage medium may be configured to store program codes for executing the following steps:

[0097] S1, when it is determined that the session established between the edge gateway and the target application has expired, receiving a signature certificate and encrypted identification information sent by the target application, wherein the identification information is used to identify the target object;

[0098] S2, verifying the signature certificate using the stored root certificate, and decrypting the encrypted identification information using the stored private key;

[0099] S3: If the signature certificate is verified successfully and the encrypted identification information is decrypted successfully, re-establish the session between the edge gateway and the target application according to the identification information.

[0100] Optionally, in this embodiment, the storage medium may also be configured to store program codes for executing the following steps:

[0101] S1, when it is determined that the session established between the edge gateway and the target application has expired, encrypt the identification information of the target object using the stored public key to obtain encrypted identification information;

[0102] S2: Send the saved signature certificate and the encrypted identification information to the edge gateway to instruct the edge gateway to re-establish a session between the edge gateway and the target application.

[0103] An embodiment of the present invention further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0104] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0105] Optionally, in this embodiment, the processor may be configured to execute the following steps through a computer program:

[0106] S1, when it is determined that the session established between the edge gateway and the target application has expired, receiving a signature certificate and encrypted identification information sent by the target application, wherein the identification information is used to identify the target object;

[0107] S2, verifying the signature certificate using the stored root certificate, and decrypting the encrypted identification information using the stored private key;

[0108] S3: If the signature certificate is verified successfully and the encrypted identification information is decrypted successfully, re-establish the session between the edge gateway and the target application according to the identification information.

[0109] Optionally, in this embodiment, the processor may be further configured to execute the following steps through a computer program:

[0110] S1, when it is determined that the session established between the edge gateway and the target application has expired, encrypt the identification information of the target object using the stored public key to obtain encrypted identification information;

[0111] S2: Send the saved signature certificate and the encrypted identification information to the edge gateway to instruct the edge gateway to re-establish a session between the edge gateway and the target application.

[0112] Optionally, in this embodiment, the above-mentioned storage medium may include but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store program codes.

[0113] Optionally, specific examples in this embodiment may refer to the examples described in the above embodiments and optional implementation modes, and this embodiment will not be described in detail here.

[0114] Obviously, those skilled in the art will appreciate that the various modules or steps of the present invention described above can be implemented using a general-purpose computing device, centralized on a single computing device, or distributed across a network of multiple computing devices. Alternatively, they can be implemented using program code executable by a computing device, which can then be stored in a storage device and executed by the computing device. In some cases, the steps shown or described can be performed in a different order than that shown, or can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0115] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A session establishment method, characterized in that: include: When it is determined that the session established between the edge gateway and the target application has expired, receiving a signature certificate and encrypted identification information sent by the target application, wherein the identification information is used to identify the target object; Verifying the signature certificate using the stored root certificate, and decrypting the encrypted identification information using the stored private key; If the signature certificate is verified and the encrypted identification information is decrypted successfully, re-establishing a session between the edge gateway and the target application according to the identification information; Before receiving the signature certificate and encrypted identification information sent by the target application, the method further includes: Obtaining identification information of the target object and an authorization matrix of the target object from a cloud server according to an identity token carried in a session establishment request sent by the target application, wherein the identity token is used to indicate that the target object has session establishment permission; Determining a session permission of a target application according to the authorization matrix, and establishing a session with the target application according to the session permission and identification information of the target object, wherein the session permission is used to indicate resources that the target application can access through the session; After establishing a session with the target application according to the identification information of the target object, the method further includes: Receive the root certificate and the private key sent by the certificate server, wherein the root certificate and the private key are generated by the certificate server according to the identification information of the target object sent by the cloud server.

2. The session establishment method according to claim 1, wherein: Before receiving the signature certificate and encrypted identification information sent by the target application, the method further includes: Determining the encryption level supported by the edge gateway by detecting the hardware performance of the edge gateway; The encryption level is sent to the cloud server to instruct the cloud server to determine an encryption method for encrypting the identification information of the target object according to the encryption level.

3. A session establishment method, characterized in that: include: When it is determined that the session established between the edge gateway and the target application has expired, the identification information of the target object is encrypted using the stored public key to obtain the encrypted identification information; Sending the saved signature certificate and the encrypted identification information to the edge gateway to instruct the edge gateway to re-establish a session between the edge gateway and the target application; Before encrypting the identification information of the target object using the stored public key to obtain the encrypted identification information, the method further includes: When the cloud server passes the identity authentication of the target application, receiving an identity token sent by the cloud server, wherein the identity token is used to indicate that the target object has the session establishment permission; Sending a session establishment request to the edge gateway, wherein the session establishment request carries the identity token and is used to request to establish a session with the edge gateway; After sending the session establishment request to the edge gateway, the method further includes: When a session is successfully established with the edge gateway, the signature certificate and the public key sent by the certificate server are received, wherein the signature certificate and the public key are generated by the certificate server according to the identification information of the target object sent by the cloud server.

4. A session establishment system, characterized in that: include: The target application is configured to, upon determining that the session established with the edge gateway has expired, encrypt the identification information of the target object using the stored public key, and send the stored signature certificate and the encrypted identification information to the edge gateway; an edge gateway, configured to receive the signature certificate and the encrypted identification information sent by the target application, verify the signature certificate using a stored root certificate, decrypt the encrypted identification information using a stored private key, and re-establish a session with the target application based on the identification information if the signature certificate verification passes and the encrypted identification information is successfully decrypted; The edge gateway is further configured to obtain identification information of the target object and an authorization matrix of the target object from a cloud server based on an identity token carried in a session establishment request sent by the target application, wherein the identity token is used to indicate that the target object has session establishment permission; determine the session permission of the target application based on the authorization matrix, and establish a session with the target application based on the session permission and the identification information of the target object, wherein the session permission is used to indicate the resources that the target application can access through the session; The edge gateway is further configured to receive the root certificate and the private key sent by the certificate server, wherein the root certificate and the private key are generated by the certificate server based on the identification information of the target object sent by the cloud server.

5. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein the method described in any one of claims 1 to 2 or 3 is executed when the program is executed.

6. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to execute the method according to any one of claims 1 to 2 or 3 through the computer program.

Images