Access control method, apparatus, device, and storage medium

Abstract

The present disclosure provides an access control method, device, equipment and storage medium, the access control method comprising: receiving a registration request of a device, registering the device according to the registration request; obtaining a data type of the device, the data type comprising one or more data types; determining an access control policy of data of at least one data type of the device, wherein the access control policy comprises a corresponding relationship between a data type and an application type, and for a target application type and a target data type existing in the corresponding relationship, an application of the target application type is configured to allow access to data of the target data type.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of communication, and particularly relates to an access control method and device, equipment and storage medium. BACKGROUND

[0002] In the Internet of Things technology, data usually needs to be transmitted in a targeted manner according to application types, for example, energy-related sensor data is only transmitted to energy-related applications. At present, there are two ways for the targeted transmission of data, namely, a subscription mode and an acquisition mode, but in the two modes, the setting of the access permission of resources by the application is involved. In the subscription mode, the application needs to have the permission to create a subscription resource under a target resource, and in the query mode, the application needs to have the permission to query the target resource. SUMMARY

[0003] Therefore, the purpose of the present disclosure is to provide an access control method, device, equipment and storage medium.

[0004] According to a first aspect of the present disclosure, an access control method is provided, comprising: receiving a registration request of a device, and registering the device according to the registration request; obtaining a data type of the device, the data type comprising one or more data types; determining an access control policy of data of at least one data type of the device, wherein the access control policy comprises a corresponding relationship between a data type and an application type, and for a target application type and a target data type existing in the corresponding relationship, an application of the target application type is configured to allow access to data of the target data type.

[0005] Optionally, the method further comprises: receiving a creation application template request sent by an application, the creation application template request comprising a corresponding relationship between a data type and an application type; and creating an application template for the application according to the creation application template request.

[0006] Optionally, the application template comprises a plurality of application types, and the plurality of application types correspond to at least one data type respectively; or the application template comprises one application type, and the one application type corresponds to at least one data type.

[0007] Optionally, determining the access control policy of data of at least one data type of the device comprises: determining a first application type corresponding to a first data type of the device according to the application template; determining that an application conforming to the first application type is allowed to access data of the first data type of the device; and adding an identifier of the first application type in the access control policy.

[0008] Optionally, the determining the access control policy of at least one type of data of the device comprises: sending the data type of the device to the client, so that the client determines the access control policy according to the application template; and receiving the access control policy sent by the client.

[0009] Optionally, the method further comprises: receiving a data acquisition request sent by an application, wherein the data acquisition request comprises a second data type of data requested to be acquired; determining whether a second application type of the application corresponds to the second data type according to the access control policy; and in response to the second application type corresponding to the second data type, determining that the application of the second application type is allowed to access data of the second data type of the device.

[0010] Optionally, the method further comprises: before receiving the registration request of the device, receiving a subscription request of the client for the device newly registered to the server, or receiving a subscription request of the client for at least one type of data.

[0011] Optionally, the registration request comprises the data type of the device, and the obtaining the data type of the device comprises: obtaining the data type of the device from the registration request; or the method further comprises: receiving a container resource creation request sent by the device, wherein the container resource creation request comprises the data type of the device; creating a container for the device according to the container resource creation request; and obtaining the data type of the device comprises: obtaining the data type of the device from the container resource creation request.

[0012] According to a second aspect of the present disclosure, an access control method is provided, comprising: sending a resource subscription request to a server, wherein the resource subscription request is used to request to subscribe to a device newly registered to the server, or is used to request to subscribe to data of at least one type of data; receiving a notification sent by the server, wherein the notification comprises a data type of a device registered to the server; determining an application type corresponding to the data type according to a pre-stored application template, wherein the application template comprises a correspondence between an application type and a data type; and sending an access control policy of at least one type of data of the device to the server, wherein the access control policy comprises a correspondence between a data type and an application type, and for a target application type and a target data type existing in the correspondence, an application of the target application type is configured to be allowed to access data of the target data type.

[0013] Optionally, the application template includes a plurality of application types, and each of the plurality of application types corresponds to at least one data type; or the application template includes one application type, and the one application type corresponds to at least one data type; and the method further includes: sending, to the server, a subscription request, including sending, to the server, a subscription request for a device newly registered to the server, or sending, to the server, a subscription request for data of at least one data type.

[0014] According to a third aspect of the present disclosure, an access control apparatus is provided, including: a first receiving module configured to receive a registration request of a device, and register the device according to the registration request; a obtaining module configured to obtain a data type of the device, the data type including one or more data types; and a first determining module configured to determine an access control policy of data of at least one data type of the device, wherein the access control policy includes a correspondence between data types and application types, and for a target application type and a target data type that exist in the correspondence, an application of the target application type is configured to allow access to data of the target data type.

[0015] Optionally, the apparatus further includes: a second receiving module configured to receive a creation application template request sent by an application, the creation application template request including the correspondence between data types and application types; and a creating module configured to create an application template for the application according to the creation application template request.

[0016] According to a fourth aspect of the present disclosure, an access control apparatus is provided, including: a first sending module configured to send, to a server, a subscription request, wherein the resource subscription request is used to request subscription of a device newly registered to the server, or is used to request subscription of data of at least one data type; a third receiving module configured to receive a notification sent by the server, the notification including a data type of a device registered to the server; a second determining module configured to determine, according to a pre-stored application template, an application type corresponding to the data type, wherein the application template includes a correspondence between application types and data types; and a second sending module configured to send, to the server, an access control policy of data of at least one data type of the device, wherein the access control policy includes the correspondence between data types and application types, and for a target application type and a target data type that exist in the correspondence, an application of the target application type is configured to allow access to data of the target data type.

[0017] According to a fifth aspect of the present disclosure, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the access control method according to any one of the first aspect and the second aspect of the present disclosure when executing the program.

[0018] According to a sixth aspect of the present disclosure, there is provided a non-transitory computer-readable storage medium storing computer instructions for causing a computer to perform the access control method according to the first aspect of the present disclosure and any one of the second aspect of the present disclosure.

[0019] From the above, it can be seen that the access control method according to the embodiments of the present disclosure, after a device is registered to a server, the data type of the device is learned, an access control policy of at least one data type of the device is determined according to the data type, an application type of an application that can access data of a target data type of the device is determined, so that when a new device is registered to the server, it is not necessary to open access permissions of the device for data of a specified type for various types of applications in sequence, and the efficiency of access control is improved. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, brief descriptions will be given to the drawings needed to be used in the embodiments or prior art descriptions. Obviously, the drawings in the following description are only some embodiments of the present disclosure, and for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0021] Figure 1 is a flowchart of an access control method according to an exemplary embodiment;

[0022] Figure 2 is a signaling flowchart of an access control method according to an exemplary embodiment of the present disclosure;

[0023] Figure 3 is a flowchart of an access control method according to an exemplary embodiment of the present disclosure;

[0024] Figure 4 is a flowchart of an access control method according to an exemplary embodiment of the present disclosure;

[0025] Figure 5 is a block diagram of an access control device according to an exemplary embodiment of the present disclosure;

[0026] Figure 6 is a block diagram of an access control device according to an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0027] In order to make the purposes, technical solutions and advantages of the present disclosure clearer, the present disclosure will be further described in detail below with reference to specific embodiments and drawings.

[0028] It should be noted that, unless otherwise defined, technical terms or scientific terms used in the embodiments of the present disclosure shall have the common meaning understood by one of ordinary skill in the art to which the present disclosure belongs. The terms "first", "second", and similar terms used in the present disclosure do not denote any order, quantity, or importance, but are used to distinguish different components. The terms "include", "contain", and similar terms mean that the elements or objects before the terms encompass the elements or objects listed after the terms and their equivalents, and do not exclude other elements or objects. The terms "connect" or "connected" and similar terms are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. The terms "upper", "lower", "left", "right", and the like are used only to represent relative positional relationships, and when the absolute positions of the described objects are changed, the relative positional relationships can also be changed accordingly.

[0029] Figure 1 is a flowchart of an access control method according to an exemplary embodiment, which can be performed by a server, for example, can be performed by a CSE (smart home management server), as shown in Figure 1 The method comprises:

[0030] Step 101: receiving a registration request of a device, and registering the device according to the registration request;

[0031] In step 101, for example, a registration request of a device requesting to register to a server is received, and the request can include the identity of the device and other information for indicating the identity of the device, wherein the device can be a sensor, or an electronic device provided with at least one sensor, and the device can have the function of collecting data.

[0032] Step 102: obtaining the data type of the device, wherein the data type comprises one or more data types;

[0033] For example, in the case that the registration request of the device received in step 101 includes the data type of the device, the data type of the device can be obtained from the above-mentioned registration request. In the case that the data type of the device is not included in the above-mentioned registration request, the server can obtain the data type of the device from other messages sent by the device, which will be described in detail below.

[0034] The data type of the device can be the data type of the data that the device can provide. For example, a smart watch can provide health data, location data, motion data, multimedia data, and energy data (for example, the current remaining power of the device) of the user, and these data types are the data types of the smart watch.

[0035] Step 103: determining an access control policy of at least one data type of data of the device, wherein the access control policy comprises a correspondence between a data type and an application type, and for a target application type and a target data type in the correspondence, an application of the target application type is configured to allow access to data of the target data type.

[0036] In step 103, after learning that a new device is registered and learning the data type of data that the device can provide, the server can determine the application type corresponding to the data type according to the pre-stored application template. Alternatively, the server can send the data type of the device to the client, and after the client learns the data type of the device registered on the server, the client determines the application type corresponding to the data type according to the pre-stored application template. In the application template, the application type corresponding to the data type can be pre-defined, for example, one application type can correspond to multiple data types, or one data type can correspond to multiple application types.

[0037] For example, the application type can be divided into energy application, health application, security application, social application, image processing application, transaction application, multimedia application, and the like according to the function of the application.

[0038] The access control method of the embodiments of the present disclosure can determine the access control policy of at least one data type of the device after the device is registered on the server and the data type of the device is learned, to determine the application type of the application that can access the data of the target data type of the device, so that when a new device is registered on the server, the access permission of the specified type of data of the device for various types of applications does not need to be opened in sequence, and the efficiency of access control is improved.

[0039] In one implementation manner, the above access control method can further include: receiving a creation application template request sent by an application, wherein the creation application template request comprises an application type and a data type corresponding to the application type; and creating an application template for the application according to the creation application template request. For example, the application template comprises multiple application types, and at least one data type corresponding to each of the multiple application types; or the application template comprises one application type, and at least one data type corresponding to the one application type. Figure 2 is a signaling flowchart of an access control method according to an example embodiment of the present disclosure, as shown in Figure 2 For example, the application can include energy management application, health application, and smart home management application (as an example of the above client), the server takes a smart home management server as an example, and the device takes a sensor as an example, as shown in Figure 2As shown, the energy management application and the health application respectively send a create application template request to the smart home management server; the smart home management server checks the create application template request and creates an application template, the application template including an application type and a data type, and sends a create application template response to the energy management application and the health application. The smart home server can be preconfigured with a correspondence between a device type and a data type, so as to check the create application template request according to the correspondence to determine the legality of the request.

[0040] In an implementation, determining an access control policy of at least one type of data of the device can include: determining, according to the application template, a first application type corresponding to a first data type of the device; determining that an application conforming to the first application type is allowed to access data of the first data type of the device; and adding an identification of the first application type in the access control policy. For example, the device is a smart watch, and the data types provided by the smart watch include physiological data (as an example of the first data type), and a template of a certain health application defines that data types corresponding to the health application include motion data and physiological data, so it can be determined that an application of the health application (as an example of the first application type) is an application allowed to access the physiological data of the device, and the identification of the health application can be added in the access control policy of the smart watch.

[0041] In an implementation, the access control method can further include: receiving a data acquisition request sent by an application, wherein the data acquisition request includes a second data type of data requested to be acquired; determining whether a second application type of the application corresponds to the second data type according to the access control policy of the device; and in response to the second application type corresponding to the second data type, determining that the application of the second type is allowed to access data of the second data type of the device. Still taking the access control method as an example, the energy management application sends a resource acquisition request (as an example of the data acquisition request) of a sensor (as an example of the device) to the smart home management server, and checks the application according to the access control policy of the sensor. If it is determined according to the access control policy of the sensor that the second application type corresponds to the second data type requested to be acquired, the smart home management server sends a sensor resource acquisition response to the energy management application. Figure 2 In order to enable the server to save data of the device, the device can report the data collected by the device to the server, and the server can send the data requested by the application to the application when it is determined that the data acquisition request is legal according to the access control policy of the device.

[0042] In an implementation, the access control method further includes: before receiving the registration request of the device, receiving a subscription request of the client for the device newly registered to the server, or receiving a subscription request of the client for at least one type of data. In the case of receiving the subscription request of the client for the device newly registered to the server, after the new device is registered to the server, the server can send the data type of the device to the client. In the case of receiving the subscription request of the client for at least one type of data, after the new device is registered to the server, the data type of the device is also sent to the client.

[0043] In an implementation, the access control method further includes: the data type of the device is included in the registration request, based on which, the data type of the device is obtained, including: obtaining the data type of the device from the registration request; or the method further includes: receiving a container resource creation request sent by the device, wherein the data type of the device is included in the container resource creation request; creating a container for the device according to the container resource creation request; based on which, the data type of the device is obtained, including: obtaining the data type of the device from the container resource creation request. Still taking the access control method as an example, Figure 2 As shown in the access control method, Figure 2 As shown in the access control method, Figure 3 As shown in the access control method, Figure 3 As shown in the access control method,

[0044] In an implementation, determining the access control policy of at least one type of data of the device includes: sending the data type of the device to the client, so that the client determines the access control policy according to the application template; receiving the access control policy sent by the client. As shown in the access control method, Figure 2 As shown in the access control method, Figure 3As shown, after receiving the container resource creation request of the sensor, the smart home management server obtains the data type of the sensor from the request, sends the data type of the sensor to the smart home management application, so that the smart home management application can determine the application type of the application that can access at least one data type of the sensor according to the application template, to determine the access control policy of the sensor according to the application type.

[0045] Figure 4 is a flowchart of an access control method according to an example embodiment of the present disclosure, which can be executed by a client, for example, in Figure 2 and Figure 3 As shown in the method, which can be executed by the smart home management application, the method comprises:

[0046] Step 401: Send a subscription request to the server, wherein the resource subscription request is used to request to subscribe to a device newly registered to the server, or is used to request to subscribe to data of at least one data type;

[0047] Step 402: Receive the notification sent by the server, wherein the notification includes the data type of the device registered to the server;

[0048] After the device sends a registration request to the server, or sends a container resource creation request to the server, the server can send the data type information carried in the registration request or the container resource creation request to the client in the form of a notification.

[0049] Step 403: Determine the application type corresponding to the data type according to the pre-stored application template, wherein the application template includes the corresponding relationship between the application type and the data type;

[0050] In step 403, the access control policy of the data of at least one data type of the device is sent to the server, wherein the access control policy includes the corresponding relationship between the data type and the application type, and for the target application type and the target data type that exist in the corresponding relationship, the application of the target application type is configured to allow access to the data of the target data type. Wherein, the client locally pre-stores an application template, which defines the corresponding relationship between the application type and the data type, which can be a one-to-many or many-to-one relationship, and the application template can be sent by the server to the client.

[0051] In an implementation manner,

[0052] The application template includes a plurality of application types, and the plurality of application types correspond to at least one data type respectively; or the application template includes one application type, and the one application type corresponds to at least one data type; the method further includes: sending a subscription request to the server, including: sending a subscription request for a device newly registered to the server to the server, or sending a subscription request for data of at least one data type to the server.

[0053] The following will be described in detail respectively Figure 2 and Figure 3 The access control method of the present disclosure is exemplarily illustrated.

[0054] Figure 2 The illustrated access control method includes the following processes:

[0055] The CSE (smart home management server) receives a create application template request sent by an application, wherein the application template can include a correspondence between an application type and a data type;

[0056] The CSE verifies the create application template request, and after verification, creates an application template, wherein the CSE can also send the application template request to a smart home management application for verification;

[0057] The CSE sends a create application template response to the application;

[0058] The smart home management application sends a subscription request to subscribe to a new sensor accessing the system;

[0059] The CSE sends a subscription response to the smart home management application;

[0060] The sensor sends a registration request to the CSE, and the registration request includes a data type of the sensor;

[0061] The smart home server sends a registration response to the sensor;

[0062] The CSE sends a notification request to the smart home management application, and the request includes a sensor ID and a data type of the sensor;

[0063] The smart home management application sends a notification response to the CSE;

[0064] The smart home management application determines a corresponding application type (the determined application type can include one or more) according to the application template and the data type of the sensor, and sends an update request to the CSE to update an access control policy of the sensor, so as to allow an application of the corresponding application type to access data of a specified data type of the sensor;

[0065] The CSE receives a resource acquisition request of an application, and checks the application according to an access control policy of a sensor. If the checking is passed, the CSE returns a successful resource acquisition response to the application.

[0066] Figure 3 The access control method shown includes the following processes:

[0067] The CSE receives a registration request sent by an application;

[0068] The CSE sends a registration response to the application;

[0069] The smart home management application sends a subscription request to the CSE, and subscribes to a resource of a certain data type;

[0070] The CSE sends a subscription response to the smart home management application;

[0071] The sensor sends a registration request to the CSE and receives a registration response of the CSE;

[0072] The sensor sends a container resource creation request to the CSE, and the request includes a data type;

[0073] The CSE sends a resource creation response to the sensor;

[0074] The CSE sends a notification request to the smart home management application, and the request includes a sensor ID and a data type of the sensor;

[0075] The smart home management application determines an application type allowed to access the data type according to the data type;

[0076] The smart home management application sends an update request to the CSE, and updates an access control policy of the sensor, so that an application of the application type matched with the data type of the sensor can access data of the data type;

[0077] The smart home management application receives an update response sent by the CSE;

[0078] The energy management application sends a resource operation request to the CSE;

[0079] The CSE judges whether an application type of the energy management application meets a requirement of an access control policy of the sensor. If the requirement is met, the energy management application is allowed to access; if the requirement is not met, the energy management application is rejected to access.

[0080] Figure 5 is a block diagram of an access control device according to an exemplary embodiment of the present disclosure. As shown in the figure, the device 50 includes: Figure 5

[0081] A first receiving module 51 is configured to receive a registration request of a device, and register the device according to the registration request; ​

[0082] The acquisition module 52 is configured to acquire a data type of the device, and the data type comprises one or more data types.

[0083] The first determination module 53 is configured to determine an access control policy of data of at least one data type of the device, wherein the access control policy comprises a correspondence between a data type and an application type, and for a target application type and a target data type in the correspondence, an application of the target application type is configured to allow access to data of the target data type.

[0084] In an implementation, the access control apparatus further comprises a second receiving module configured to receive a creation application template request sent by an application, and the creation application template request comprises the correspondence between the data type and the application type; and a creation module configured to create an application template for the application according to the creation application template request.

[0085] In an implementation, the application template comprises a plurality of application types, and the plurality of application types correspond to at least one data type respectively; or the application template comprises one application type, and the one application type corresponds to at least one data type.

[0086] In an implementation, the first determination module is configured to: determine a first application type corresponding to a first data type of the device according to the application template; determine that an application conforming to the first application type is allowed to access data of the first data type of the device; and add an identifier of the first application type in the access control policy.

[0087] In an implementation, the first determination module is configured to: send the data type of the device to the client; and receive an access control policy sent by the client.

[0088] In an implementation, the access control apparatus further comprises a fourth receiving module configured to receive a data acquisition request sent by an application, and the data acquisition request comprises a second data type of data requested to be acquired; a third determination module configured to determine whether a second application type of the application corresponds to the second data type according to the access control policy; and a fourth determination module configured to determine that an application of the second application type is allowed to access data of a second data type of the device in response to the second application type corresponding to the second data type.

[0089] In an implementation, the access control apparatus further includes a fifth receiving module configured to receive, before receiving the registration request of the device, a subscription request of a client for the device newly registered to the server, or a subscription request of the client for at least one type of data.

[0090] In an implementation, the access control apparatus further includes that the data type of the device is included in the registration request, and the obtaining module is configured to obtain the data type of the device from the registration request, or the apparatus further includes a sixth receiving module configured to receive a container resource creation request sent by the device, wherein the data type of the device is included in the container resource creation request, and a container creation module configured to create a container for the device according to the container resource creation request, and the obtaining module is configured to obtain the data type of the device from the container resource creation request.

[0091] Figure 6 is a block diagram of an access control apparatus according to an example embodiment of the present disclosure, as shown in Figure 6 The apparatus 60 includes:

[0092] a first sending module 61 configured to send a subscription request to a server, wherein the resource subscription request is used to request to subscribe to a device newly registered to the server, or is used to request to subscribe to at least one type of data;

[0093] a third receiving module 62 configured to receive a notification sent by the server, wherein the notification includes a data type of a device registered to the server;

[0094] a second determining module 63 configured to determine an application type corresponding to the data type according to a pre-stored application template, wherein the application template includes a corresponding relationship between an application type and a data type;

[0095] a second sending module 64 configured to send an access control policy of at least one type of data of the device to the server, wherein the access control policy includes a corresponding relationship between a data type and an application type, and for a target application type and a target data type existing in the corresponding relationship, an application of the target application type is configured to allow to access data of the target data type.

[0096] In an implementation, the application template includes a plurality of application types, and each of the plurality of application types corresponds to at least one data type; or the application template includes one application type, and the one application type corresponds to at least one data type; and the second sending module is configured to send, to the server, a subscription request for a device newly registered to the server, or send, to the server, a subscription request for data of the at least one data type.

[0097] The disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the above-mentioned any access control method when executing the program.

[0098] The disclosure also provides a non-transitory computer readable storage medium, which stores computer instructions for causing the computer to execute any of the above-mentioned access control methods.

[0099] It should be noted that the method of the embodiments of the disclosure can be executed by a single device, such as a computer or a server, etc. The method of the embodiments can also be applied to a distributed scenario, and be completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only execute one or more steps in the method of the embodiments of the disclosure, and the multiple devices will interact with each other to complete the method.

[0100] The device of the above-mentioned embodiments is used to implement the corresponding method in the above-mentioned embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0101] Those skilled in the art should understand that the discussion of any of the above embodiments is only exemplary, and is not intended to imply that the scope of the disclosure (including claims) is limited to these examples; under the idea of the disclosure, the above embodiments or technical features in different embodiments can also be combined, the steps can be implemented in any order, and there are many other changes of different aspects of the disclosure as described above. In order to be brief, they are not provided in details.

[0102] Additionally, to simplify the description and discussion, and so as not to obscure the disclosure, well-known power / ground connections to integrated circuit (IC) chips and other components can or can not be shown in the provided figures. Furthermore, devices can be shown in block diagram form in order to avoid obscuring the disclosure, and also in view of the fact that details of implementation of the described devices are highly dependent on the platform within which the disclosure is to be implemented (i.e., these details should be apparent to those skilled in the art with the benefit of the present disclosure). Where specific details of such implementation are set forth in order to describe an illustrative embodiment of the disclosure, it will be apparent to one skilled in the art that the disclosure can be practiced without, or with variation of, these specific details. Thus, the description is to be considered as illustrative and not restrictive, and the scope of the disclosure to be indicated by the appended claims.

[0103] While the disclosure has been described in connection with specific embodiments thereof, many alternatives, modifications, and variations will be apparent to those skilled in the art in light of the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) can use the embodiments discussed.

[0104] Embodiments of the present disclosure are intended to cover all such alternatives, modifications, and variations as falling within the scope of the appended claims. Accordingly, any omission, modification, equivalent replacement, improvement, etc. made in the spirit and principle of the present disclosure should be included in the scope of the present disclosure.

Claims

1. An access control method, characterized in that: include: receiving a registration request from a device, and registering the device according to the registration request; In response to determining that the registration request includes a data type of the device, obtaining the data type of the device from the registration request, the data type including one or more data types; In response to the registration request not including the data type of the device and after the device is successfully registered, creating a container for the device according to a create container resource request sent by the device, and obtaining the data type of the device from the create container resource request, wherein the create container resource request includes the data type of the device; Determine an access control policy for data of at least one data type of the device, specifically comprising: creating an application template for the application according to a create application template request sent by a received application, determining a first application type corresponding to a first data type of the device, and determining that applications that conform to the first application type are allowed to access data of the first data type of the device, and adding an identifier of the first application type to the access control policy; wherein the create application template request includes a correspondence between a data type and an application type, and the access control policy includes a correspondence between a data type and an application type, and for a target application type and a target data type for which the correspondence exists, the application of the target application type is configured to allow access to data of the target data type.

2. The method according to claim 1, characterized in that The application template includes multiple application types and at least one data type corresponding to each of the multiple application types; Alternatively, the application template includes an application type and at least one data type corresponding to the application type.

3. The method according to claim 1, characterized in that Determining an access control policy for at least one type of data of the device, including: Sending the data type of the device to the client, so that the client determines the access control policy according to the application template; Receive the access control policy sent by the client.

4. The method according to claim 1, wherein The method further comprises: receiving a data acquisition request sent by an application, wherein the data acquisition request includes a second data type of the data requested to be acquired; determining, according to the access control policy, whether the second application type of the application corresponds to the second data type; In response to the second application type corresponding to the second data type, it is determined that applications of the second application type are permitted to access data of the second data type of the device.

5. The method according to claim 1, wherein The method further comprises: Before receiving the registration request of the device, a subscription request from the client for the device newly registered with the server is received, or a subscription request from the client for at least one type of data is received.

6. An access control method, characterized in that: include: Sending a resource subscription request to a server, wherein the resource subscription request is used to request subscription to a device newly registered with the server, or to request subscription to data of at least one data type; In response to the server obtaining a data type of the device from a received registration request, or obtaining a data type of the device from a sent create container resource request, receiving a notification sent by the server, the notification including the data type of the device registered with the server; Determining an application type corresponding to the data type according to a pre-stored application template, and sending a request to create an application template to the application template, wherein the application template includes a correspondence between the application type and the data type; An access control policy for data of at least one data type of the device is sent to the server, wherein the access control policy includes a correspondence between a data type and an application type, and for a target application type and a target data type for which the correspondence exists, an application of the target application type is configured to allow access to data of the target data type.

7. The method according to claim 6, characterized in that The application template includes multiple application types and at least one data type corresponding to each of the multiple application types; Alternatively, the application template includes an application type and at least one data type corresponding to the application type; Send a subscription request to the server, including: A subscription request for a device newly registered with the server is sent to the server, or a subscription request for data of at least one data type is sent to the server.

8. An access control device, characterized in that: include: A first receiving module is configured to receive a registration request from a device and register the device according to the registration request; an acquisition module, configured to, in response to determining that the registration request includes a data type of the device, acquire the data type of the device from the registration request, where the data type includes one or more data types; and, in response to receiving a create container resource request sent by the device while the registration request does not include the data type of the device, create a container for the device according to the create container resource request, and acquire the data type of the device from the create container resource request, where the create container resource request includes the data type of the device; The first determination module is used to determine the access control policy for data of at least one data type of the device, specifically including: creating an application template for the application according to a create application template request sent by the received application, determining a first application type corresponding to the first data type of the device, and determining that applications that comply with the first application type are allowed to access data of the first data type of the device, and adding an identifier of the first application type to the access control policy; wherein the create application template request includes a correspondence between a data type and an application type, and the access control policy includes a correspondence between a data type and an application type, and for a target application type and a target data type with the correspondence, the application of the target application type is configured to allow access to data of the target data type.

9. The device according to claim 8, characterized in that The device further comprises: A second receiving module is configured to receive a request for creating an application template sent by an application, wherein the request for creating an application template includes a correspondence between a data type and an application type; A creation module is used to create an application template for the application according to the application template creation request.

10. An access control device, characterized in that: include: A first sending module is configured to send a resource subscription request to a server, wherein the resource subscription request is used to request subscription for a device newly registered with the server, or to request subscription for data of at least one data type; a third receiving module, configured to receive a notification sent by the server in response to the server obtaining the data type of the device from a received registration request, or obtaining the data type of the device from a sent create container resource request, wherein the notification includes the data type of the device registered with the server; a second determining module, configured to determine an application type corresponding to the data type based on a pre-stored application template, and send a request to the application template to create an application template, wherein the application template includes a correspondence between the application type and the data type; The second sending module is used to send an access control policy for data of at least one data type of the device to the server, wherein the access control policy includes a correspondence between a data type and an application type, and for a target application type and a target data type with the correspondence, the application of the target application type is configured to allow access to data of the target data type.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the access control method according to any one of claims 1 to 7 is implemented.

12. A non-transitory computer-readable storage medium, characterized in that The non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the access control method according to any one of claims 1 to 7.

Images