Permission configuration method, device and computer readable storage medium

Abstract

The present application discloses a permission configuration method, device and computer-readable storage medium. The permission configuration method provided by the present application includes: sending an authentication request to a client; receiving terminal identity information sent by the client according to the authentication request; forwarding the received terminal identity information to a server; receiving background identity information sent by the server according to the terminal identity information; forwarding the received background identity information to the client; receiving a random number sent by the client according to the background identity information; forwarding the received random number to the server; receiving a permission signature file sent by the server according to the random number; forwarding the received permission signature file to the client, so that the client performs permission configuration according to the permission signature file. The permission configuration method provided by the present application reduces the burden of device permission management and maintenance.

Description

Technical Field

[0001] The present application relates to, but is not limited to, the field of computers, and in particular to a permission configuration method, device, and computer-readable storage medium. Background Art

[0002] In traditional IoT security solutions, IoT terminal devices use solidified code and imported established and unchanging permission files to control the permissions of terminal devices according to different user needs.

[0003] As the business continues to expand, the permission management business of the IoT system has increased, resulting in the need to constantly change the software design of IoT devices, and even the need to recycle devices and uniformly replace device permission configurations, which will bring a huge burden to the device management and maintenance of IoT terminals. Summary of the invention

[0004] The present application aims to solve at least one of the technical problems existing in the prior art. To this end, the present application proposes a permission configuration method, device and computer-readable storage medium, which can reduce the burden of device permission management and maintenance.

[0005] The first aspect of the present application provides a permission configuration method, including: sending an authentication request to a client; receiving terminal identity information sent by the client according to the authentication request; forwarding the received terminal identity information to a server; receiving background identity information sent by the server according to the terminal identity information; forwarding the received background identity information to the client; receiving a random number sent by the client according to the background identity information; forwarding the received random number to the server; receiving a permission signature file sent by the server according to the random number; forwarding the received permission signature file to the client, so that the client performs permission configuration according to the permission signature file.

[0006] According to the permission configuration method of the embodiment of the present application, there are at least the following technical effects: the permission configuration method provided by the present application starts the permission configuration process according to the authentication request, verifies the identity information of the terminal and the background in turn, and generates a permission signature file according to the random number, thereby completing the permission configuration of the client, improving the efficiency of permission configuration, reducing the burden of device management and maintenance, and ensuring the security of device management.

[0007] According to some embodiments of the present application, the permission configuration method further includes: receiving authentication failure information sent by the client; and ending the permission configuration according to the authentication failure information.

[0008] The second aspect of the present application provides a permission configuration method, including: receiving terminal identity information forwarded by a configuration end from a client; forwarding background identity information to the client through the configuration end according to the terminal identity information; receiving a random number forwarded by the configuration end from the client according to the background identity information; generating a permission signature file according to the random number; forwarding the permission signature file to the client through the configuration end, so that the client performs permission configuration according to the permission signature file.

[0009] According to some embodiments of the present application, generating a permission signature file based on the random number includes: obtaining permission data sent by the configuration end; and generating a permission signature file based on the permission data and the received random number.

[0010] The third aspect of the present application provides a permission configuration method, including: receiving an authentication request sent by a configuration end; forwarding the terminal identity information of the client to the server through the configuration end according to the authentication request; receiving the background identity information sent by the server according to the terminal identity information forwarded by the configuration end; forwarding a random number to the server through the configuration end according to the background identity information; receiving the permission signature file sent by the server according to the random number forwarded by the configuration end; and performing permission configuration according to the permission signature file.

[0011] According to some embodiments of the present application, the performing permission configuration according to the permission signature file includes: performing a legitimacy authentication on the permission signature file to obtain a legitimacy authentication result; and performing permission configuration according to the legitimacy authentication result.

[0012] The fourth aspect of the present application provides a permission configuration device, including: an authentication request module, used to send an authentication request to a client; a first receiving module, used to receive terminal identity information sent by the client according to the authentication request; a first sending module, used to forward the received terminal identity information to a server; a second receiving module, used to receive background identity information sent by the server according to the terminal identity information; a second sending module, used to forward the received background identity information to the client; a third receiving module, used to receive a random number sent by the client according to the background identity information; a third sending module, used to forward the received random number to the server; a fourth receiving module, used to receive a permission signature file sent by the server according to the random number; a fourth sending module, used to forward the received permission signature file to the client, so that the client performs permission configuration according to the permission signature file.

[0013] The fifth aspect embodiment of the present application provides a permission configuration device, including: a first receiving module, used to receive terminal identity information sent by a client and forwarded by a configuration end; a first sending module, used to forward background identity information to the client through the configuration end according to the terminal identity information; a second receiving module, used to receive a random number sent by the client according to the background identity information and forwarded by the configuration end; a permission signature file generation module, used to generate a permission signature file according to the random number; a second sending module, used to forward the permission signature file to the client through the configuration end, so that the client performs permission configuration according to the permission signature file.

[0014] The sixth aspect embodiment of the present application provides a permission configuration device, including: a first receiving module, used to receive an authentication request sent by a configuration end; a first sending module, used to forward the terminal identity information of the client to the server through the configuration end according to the authentication request; a second receiving module, used to receive the background identity information sent by the server according to the terminal identity information and forwarded by the configuration end; a second sending module, used to forward a random number to the server through the configuration end according to the background identity information; a third receiving module, used to receive the permission signature file sent by the server according to the random number and forwarded by the configuration end; a permission configuration module, used to perform permission configuration according to the permission signature file.

[0015] According to the computer-readable storage medium of the seventh aspect embodiment of the present application, computer executable instructions are stored, and the computer executable instructions are used to: execute the permission configuration method described in the first aspect embodiment; or, execute the permission configuration method described in the second aspect embodiment; or, execute the permission configuration method described in the third aspect embodiment.

[0016] Additional aspects and advantages of the present application will be given in part in the following description, and in part will become apparent from the following description, or will be learned through practice of the application. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The present application is further described below with reference to the accompanying drawings and embodiments, wherein:

[0018] Figure 1 is a flowchart of a method for configuring permissions of a configuration terminal provided by an embodiment of the present application;

[0019] Figure 2 is a flowchart of a method for configuring permissions of a configuration terminal provided by another embodiment of the present application;

[0020] Figure 3 It is a flowchart of a method for configuring permissions on a server side provided by an embodiment of the present application;

[0021] Figure 4 yes Figure 3 Step S340 in the flowchart of an embodiment;

[0022] Figure 5 is a flowchart of a method for configuring permissions for a client provided by an embodiment of the present application;

[0023] Figure 6 yes Figure 5 Step S550 in a flowchart of an embodiment;

[0024] Figure 7 This is a schematic diagram of the permission configuration service provided by an embodiment of the present application. DETAILED DESCRIPTION

[0025] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be understood as limiting the present application.

[0026] In the description of this application, "several" means more than one, "more" means more than two, "greater than", "less than", "exceed", etc. are understood to exclude the number itself, and "above", "below", "within", etc. are understood to include the number itself. If there is a description of "first" or "second", it is only used for the purpose of distinguishing technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features or implicitly indicating the order of the indicated technical features.

[0027] In the description of this application, unless otherwise clearly defined, terms such as setting, installing, connecting, etc. should be understood in a broad sense, and technicians in the relevant technical field can reasonably determine the specific meanings of the above terms in this application based on the specific content of the technical solution.

[0028] In the description of the present application, the description with reference to the terms "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0029] A digital signature (also known as a public key digital signature) is a string of numbers that can only be generated by the sender of the information and cannot be forged by others. This string of numbers is also an effective proof of the authenticity of the information sent by the sender. It is a method for authenticating digital information similar to an ordinary physical signature written on paper, but it uses the technology in the field of public key encryption to achieve it. A set of digital signatures usually defines two complementary operations, one for signing and the other for verification. Digital signatures are the application of asymmetric key encryption technology and digital summary technology.

[0030] In order to ensure the data security of the IoT cloud, pipe, edge and end, in addition to its own data encryption and anti-tampering mechanisms, it is also necessary to classify and control permissions for different sensitive functions. Each different permission corresponds to a special permission owned by a certain person or a certain category. The corresponding permission categories can be divided according to different dimensions such as different usage scenarios, different user roles, sensitive operations allowed in different modes, different device types, etc. By distinguishing these permissions, different implementation strategies can be customized.

[0031] In traditional IoT security solutions, IoT terminal devices use fixed codes and import fixed permission files to control the permissions of terminal devices according to different user needs. With the continuous enrichment of business, the permission control business of IoT systems has increased, resulting in the need for IoT devices to constantly change software design, and even the need to recycle devices and uniformly replace device permission configurations. This will bring a great burden to the device management and maintenance of IoT terminals, and may also cause a series of equipment security management issues. The permission control of IoT devices and IoT platforms is not flexible enough, which is easy to cause the problem of excessive maintenance work burden, and there are security risks when upgrading business scenarios.

[0032] In view of this, the present application proposes a permission configuration method, device and computer-readable storage medium, which improve the efficiency of permission configuration, reduce the burden of device management and maintenance, and ensure the security of device management.

[0033] The embodiment of the present application provides a permission configuration method for a configuration end, including: sending an authentication request to a client; receiving terminal identity information sent by the client according to the authentication request; forwarding the received terminal identity information to a server; receiving background identity information sent by the server according to the terminal identity information; forwarding the received background identity information to the client; receiving a random number sent by the client according to the background identity information; forwarding the received random number to the server; receiving a permission signature file sent by the server according to the random number; forwarding the received permission signature file to the client, so that the client performs permission configuration according to the permission signature file.

[0034] like Figure 1 As shown, Figure 1 1 is a flowchart of a method for configuring permissions of a configuration terminal provided by an embodiment of the present application. The method for configuring permissions includes but is not limited to steps S110 to S190, and specifically includes:

[0035] S110, sending an authentication request to the client;

[0036] S120, receiving terminal identity information sent by the client according to the authentication request;

[0037] S130, forwarding the received terminal identity information to the server;

[0038] S140, receiving background identity information sent by the server according to the terminal identity information;

[0039] S150, forwarding the received background identity information to the client;

[0040] S160, receiving a random number sent by the client according to the background identity information;

[0041] S170, forwarding the received random number to the server;

[0042] S180, receiving the permission signature file sent by the server according to the random number;

[0043] S190, forwarding the received permission signature file to the client.

[0044] It should be noted that the permission configuration method provided in this application can be applied to scenarios and fields involving different permission hierarchical management and permission changes, such as finance, the Internet of Things, and information security. For example, in the Internet of Things system, it includes but is not limited to the server side, the configuration side, and the client side, wherein the server side is connected to the configuration side in communication, and the configuration side is connected to the client side in communication, and the configuration side serves as an information transmission medium and interactive display platform between the server side and the client side to complete the permission configuration task.

[0045] In step S110, when the client needs to change permissions, it logs in to the server and initiates a two-way authentication request to the client.

[0046] Specifically, steps S110 to S150 describe the process of the configuration end participating in two-way authentication. The process of two-way authentication is: the client sends its own certificate information to the server for identity authentication, the server verifies the legality of the client identity, and sends the certificate information specified by the server to the client. After the client verifies the legality of the background, the two-way authentication is completed. The entire authentication process is based on GmSSL (an open source cryptographic toolbox) technology. Before the IoT device and platform conduct business, a connection is established through a two-way identity authentication based on the national secret algorithm and a private handshake protocol to confirm the authority. A valid dynamic authority signature file is issued from the background. Only after the authority file is confirmed to be legal can the IoT device process various business software to ensure the security of the authority configuration.

[0047] In step S190, the authority signature file is used by the client to perform authority configuration according to the authority signature file.

[0048] The permission configuration method provided in this application starts the permission configuration process according to the authentication request, verifies the identity information of the terminal and the background in turn, and generates a permission signature file based on a random number, thereby completing the permission configuration of the client, thereby improving the efficiency of permission configuration, reducing the burden of device management and maintenance, and ensuring the security of device management.

[0049] According to some embodiments of the present application, the permission configuration method further includes: receiving authentication failure information sent by the client; and ending the permission configuration according to the authentication failure information.

[0050] like Figure 2 As shown, Figure 2 : is a flowchart of a method for configuring permissions for a configuration terminal provided by another embodiment of the present application, and the method for configuring permissions further includes:

[0051] S210, receiving authentication failure information sent by the client;

[0052] S220, ending the authority configuration according to the authentication failure information.

[0053] In a specific embodiment, if the two-way authentication fails, the client will return authentication failure information to the configuration end, and the configuration end will end the permission configuration according to the authentication failure information and will not continue the subsequent process.

[0054] An embodiment of the present application provides a permission configuration method for a server side, including: receiving terminal identity information sent by a client side forwarded by a configuration side; forwarding background identity information to the client side through the configuration side according to the terminal identity information; receiving a random number sent by the client side according to the background identity information forwarded by the configuration side; generating a permission signature file according to the random number; and forwarding the permission signature file to the client side through the configuration side, so that the client performs permission configuration according to the permission signature file.

[0055] like Figure 3 As shown, Figure 3 1 is a flowchart of a method for configuring permissions on a server side provided by an embodiment of the present application. The method for configuring permissions includes but is not limited to steps S310 to S350, and specifically includes:

[0056] S310, receiving the terminal identity information forwarded by the configuration end from the client;

[0057] S320, forwarding the background identity information to the client through the configuration end according to the terminal identity information;

[0058] S330, receiving a random number forwarded by the configuration end from the client according to the background identity information;

[0059] S340, generating an authority signature file according to the random number;

[0060] S350, forwarding the permission signature file to the client through the configuration end.

[0061] In step S310, the server receives the terminal identity information as authentication data, and the terminal identity information is used to represent the identity of the client to achieve two-way authentication between the server and the client.

[0062] In step S320, after receiving the terminal identity information, the server authenticates the legitimacy of the terminal based on the terminal identity information. If the terminal identity information is not legal, the two-way authentication process ends and the authentication failure result is returned to the configuration end. If the terminal identity information is legal, the server sends its own background identity information to allow the client to verify the identity of the server.

[0063] In steps S330 to S340, after the client successfully verifies the server identity, it will generate and send a random number for synthesizing the permission signature file. After receiving the random number, the server will fill the random number into the permission data to generate a dynamic permission signature file. The algorithms used to generate the permission signature file include but are not limited to: SM2 cryptographic algorithm, SM3 cryptographic algorithm, and GMSSL-based digital identity authentication technology.

[0064] In step S350, when the permission details need to be changed, the server side dynamically regenerates the permission signature file and re-sends it to the client side to solve the maintenance problem caused by the device permission change of the client side.

[0065] In step S350, the authority signature file is used by the client to perform authority configuration according to the authority signature file.

[0066] The permission configuration method provided in this application starts the permission configuration process according to the authentication request, verifies the identity information of the terminal and the background in turn, and generates a permission signature file based on a random number, thereby completing the permission configuration of the client, thereby improving the efficiency of permission configuration, reducing the burden of device management and maintenance, and ensuring the security of device management.

[0067] According to some embodiments of the present application, generating a permission signature file based on a random number includes: obtaining permission data sent by a configuration end; and generating a permission signature file based on the permission data and the received random number.

[0068] like Figure 4 As shown, Figure 4 yes Figure 3 In the flowchart of step S340 in one embodiment, Figure 4 The illustrated step S340 includes but is not limited to steps S410 to S420:

[0069] S410, obtaining permission data sent by the configuration end;

[0070] S420, generating an authority signature file according to the authority data and the received random number.

[0071] In step S410, the permission data is the permission selected on the configuration end to be assigned to the client to be configured. Specifically, the permission configuration method provided in the present application supports the subdivision of permissions for various types of services, different functions, and different strategies, and follows the principle of minimizing permissions, that is, only opening what permissions are needed, thereby realizing flexible configuration of terminal permissions.

[0072] In step S420, the permission configuration method provided in this application supports generating dynamic signatures for various types of permission plain texts and sending them to various types of devices.

[0073] In a specific embodiment, the client generates a random number and sends it to the IoT system. The server fills the random number and permission data into the permission list for signing to generate a permission signature file. It should be noted that the dynamic permission signature file generated at this time is only valid once and can only be used once on the client, thereby ensuring the security of permission allocation.

[0074] An embodiment of the present application provides a permission configuration method for a client, including: receiving an authentication request sent by a configuration end; forwarding the terminal identity information of the client to a server through the configuration end according to the authentication request; receiving background identity information sent by the configuration end according to the terminal identity information sent by the server through the configuration end; forwarding a random number to the server through the configuration end according to the background identity information; receiving a permission signature file sent by the configuration end according to the random number sent by the server; and performing permission configuration according to the permission signature file.

[0075] like Figure 5 As shown, Figure 5 : is a flowchart of a method for configuring permissions for a client provided by an embodiment of the present application. The method for configuring permissions includes but is not limited to steps S510 to S560, and specifically includes:

[0076] S510, receiving an authentication request sent by a configuration terminal;

[0077] S520, forwarding the terminal identity information of the client to the server through the configuration end according to the authentication request;

[0078] S530, receiving the background identity information forwarded by the configuration end from the server end according to the terminal identity information;

[0079] S540, forwarding the random number to the server through the configuration end according to the background identity information;

[0080] S550, receiving the permission signature file forwarded by the configuration end from the server end according to the random number;

[0081] S560, performing permission configuration according to the permission signature file.

[0082] In step S510, the authentication request is a two-way authentication request, that is, the authentication of the server and the client is completed. Compared with one-way authentication, during two-way authentication, in addition to downloading the server's public key certificate from the server for verification, the client also needs to upload the client's public key certificate to the server for verification. After both parties have passed the authentication, a secure communication channel is established for data transmission.

[0083] In step S520, the client sends its own terminal identity information as authentication data to implement two-way authentication with the server, so that the server can verify the identity of the client.

[0084] In step S530, after completing the legitimacy authentication of the terminal identity information, the server uses the configuration end to forward the background identity information to the client.

[0085] In step S540, after the client receives the background identity information as authentication data, it verifies the legitimacy of the background identity information. If the background identity information is not legal, the two-way authentication process is terminated and the result of authentication failure is returned to the configuration end. If the background identity information is legal, a random number is generated for the server-side synthetic authority signature file, and the random number is forwarded to the server through the configuration end.

[0086] In steps S550 to S560, the client receives the permission signature file sent from the server and verifies the legitimacy of the permission configuration file. If the permission signature file is legal, a random number is extracted from it and matched with the random number stored in the client. If the random number matches successfully, the plaintext data of the permission list is extracted from the permission signature file to complete the permission configuration task for the client device.

[0087] It should be noted that after the permission list is extracted, the random number is deleted to ensure the security of the permission configuration. In step S560, if the permission signature file is illegal or the random number match fails, the permission configuration task is directly exited and the random number is deleted.

[0088] The permission configuration method provided in this application starts the permission configuration process according to the authentication request, verifies the identity information of the terminal and the background in turn, and generates a permission signature file based on a random number, thereby completing the permission configuration of the client, thereby improving the efficiency of permission configuration, reducing the burden of device management and maintenance, and ensuring the security of device management.

[0089] According to some embodiments of the present application, performing permission configuration according to a permission signature file includes: performing a legitimacy authentication on the permission signature file to obtain a legitimacy authentication result; and performing permission configuration according to the legitimacy authentication result.

[0090] Figure 6 yes Figure 5 In the flowchart of step S550 in one embodiment, Figure 6 The illustrated step S550 includes but is not limited to steps S610 to S620:

[0091] S610, performing legality authentication on the authority signature file to obtain a legality authentication result;

[0092] S620: Perform authority configuration according to the legitimacy authentication result.

[0093] In steps S610 to S620, the legality authentication result includes legal and illegal.

[0094] In a specific embodiment, the permission signature file includes but is not limited to a dynamic permission file; after the client receives the permission signature file, it verifies the legitimacy of the dynamic permission file and verifies whether the random number is consistent; if the verification is successful, the corresponding permission list is extracted from the dynamic file, and if the verification is unsuccessful, it is not used.

[0095] It should be noted that no matter whether the legality verification of the dynamic permission file is successful or not, the random number is deleted and a new random number is regenerated next time for generating the dynamic permission file to ensure the security of the permission configuration.

[0096] The permission configuration method provided in this application realizes hierarchical management of different permissions of IoT devices by adopting an independently controllable national secret algorithm, and the permission verification adopts a one-time valid dynamic password method to prevent the permissions of IoT terminal devices from being replayed.

[0097] In different scenarios, even the same device has different permissions. In order to facilitate unified management of devices and better support device permission control, the permission configuration method provided in this application supports the terminal and the background to confirm their identity through a valid identity permission dynamic password to ensure the reasonable use of the device.

[0098] An embodiment of the present application provides a permission configuration device for a configuration end, including: an authentication request module, used to send an authentication request to a client; a first receiving module, used to receive terminal identity information sent by the client according to the authentication request; a first sending module, used to forward the received terminal identity information to a server; a second receiving module, used to receive background identity information sent by the server according to the terminal identity information; a second sending module, used to forward the received background identity information to the client; a third receiving module, used to receive a random number sent by the client according to the background identity information; the third sending module, used to forward the received random number to the server; a fourth receiving module, used to receive a permission signature file sent by the server according to the random number; and a fourth sending module, used to forward the received permission signature file to the client, so that the client performs permission configuration according to the permission signature file.

[0099] The embodiment of the present application provides a permission configuration device, which implements a permission configuration method for a configuration terminal, starts the permission configuration process according to an authentication request, verifies the identity information of the terminal and the background in turn, and generates a permission signature file according to a random number, thereby completing the permission configuration of the client, improving the efficiency of permission configuration, reducing the burden of device management and maintenance, and ensuring the security of device management.

[0100] An embodiment of the present application provides a permission configuration device for use on a server side, comprising: a first receiving module for receiving terminal identity information sent by a client and forwarded by a configuration side; a first sending module for forwarding background identity information to the client through the configuration side according to the terminal identity information; a second receiving module for receiving a random number sent by the client and forwarded by the configuration side according to the background identity information; a permission signature file generating module for generating a permission signature file based on the random number; and a second sending module for forwarding the permission signature file to the client through the configuration side, so that the client performs permission configuration according to the permission signature file.

[0101] The embodiment of the present application provides a permission configuration device, which implements a permission configuration method for the server side, starts the permission configuration process according to the authentication request, verifies the identity information of the terminal and the background in turn, and generates a permission signature file according to a random number, thereby completing the permission configuration of the client, improving the efficiency of the permission configuration, reducing the burden of device management and maintenance, and ensuring the security of device management.

[0102] An embodiment of the present application provides a permission configuration device for a client, including: a first receiving module, used to receive an authentication request sent by a configuration end; a first sending module, used to forward the terminal identity information of the client to a server through the configuration end according to the authentication request; a second receiving module, used to receive the background identity information sent by the configuration end from the server according to the terminal identity information; a second sending module, used to forward a random number to the server through the configuration end according to the background identity information; a third receiving module, used to receive the permission signature file sent by the configuration end according to the random number; and a permission configuration module, used to perform permission configuration according to the permission signature file.

[0103] The embodiment of the present application provides a permission configuration device, which implements a permission configuration method for a client, starts the permission configuration process according to an authentication request, verifies the identity information of the terminal and the background in turn, and generates a permission signature file according to a random number, thereby completing the permission configuration of the client, improving the efficiency of permission configuration, reducing the burden of device management and maintenance, and ensuring the security of device management.

[0104] Figure 7 This is a schematic diagram of the permission configuration service provided by an embodiment of the present application. Figure 7 , a method for configuring permissions is described in detail with a specific embodiment. It is worth noting that the following description is only an exemplary description and not a specific limitation on the application.

[0105] like Figure 7 As shown, in a specific embodiment, the server side includes but is not limited to the IoT system backend, the configuration side includes but is not limited to the WEB side, and the client side includes but is not limited to the IoT terminal. The permission configuration process includes:

[0106] 1. The WEB terminal initiates a two-way authentication request to the terminal in the Internet of Things;

[0107] 2. The IoT terminal sends the terminal identity information to the WEB terminal;

[0108] 3. The WEB end forwards the terminal identity information to the IoT system backend to indicate the terminal identity;

[0109] 4. The IoT system background verifies the legitimacy of the IoT terminal and obtains the legitimacy verification result of the IoT terminal;

[0110] 5. The IoT system backend sends the backend identity information to the WEB end based on the legitimacy verification result of the IoT terminal;

[0111] 6. The WEB terminal forwards the received background identity information to the IoT terminal;

[0112] 7. The IoT terminal verifies the legitimacy of the IoT system backend based on the backend identity information and obtains the legitimacy verification result of the IoT system backend;

[0113] 8. The IoT terminal generates a random number for the IoT terminal based on the legitimacy verification result of the IoT system background;

[0114] 9. The IoT terminal sends the generated IoT terminal random number to the WEB terminal;

[0115] 10. The WEB end sends the received IoT terminal random number to the IoT system backend;

[0116] 11. The IoT system background adds the random number to the permission data, and signs the data with the national secret private key to generate a dynamic permission signature file;

[0117] 12. The IoT system backend sends the dynamic permission signature file to the WEB end;

[0118] 13. The WEB terminal forwards the received dynamic permission signature file to the IoT terminal;

[0119] 14. The IoT terminal verifies the legitimacy of the dynamic permission signature file;

[0120] 15. The IoT terminal extracts the random number from the dynamic permission signature file and matches it with the random number stored in the IoT terminal to verify the consistency of the random number of the IoT terminal;

[0121] 16. After completing the legitimacy and random number verification, delete the random number;

[0122] 17. Return the download results in the obtained permission list to the WEB end.

[0123] In a specific embodiment, the download result includes but is not limited to the download authority possessed by the IoT terminal.

[0124] In a specific embodiment, the permission allocation method provided in the embodiment of the present application provides an IoT device with a solution to prevent illegal abuse of the device, eliminate data security risks, and replay attacks; simplify the factory delivery process of IoT devices, reduce the pressure of software customization requirements, and subsequently perform policy upgrades through the IoT system background; through GMSSL technology, improve the autonomy and controllability of the security system of the IoT cloud, pipe, edge, and end; solve the problem of permission abuse caused by changes in scenarios, changes in requirements, changes in identity, etc., and solve possible security risks of the IoT in the future in real time through permission classification; reduce the maintenance pressure brought by terminal manufacturers' changes in IoT device usage policies.

[0125] According to the computer-readable storage medium of the embodiment of the present application, computer executable instructions are stored, and the computer executable instructions are used to: execute the permission configuration method for the configuration end of any of the above embodiments; or, execute the permission configuration method for the server side of any of the above embodiments; or, execute the permission configuration method for the client side of any of the above embodiments.

[0126] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0127] It will be appreciated by those skilled in the art that all or some of the steps and devices in the disclosed method above can be implemented as software, firmware, hardware and appropriate combinations thereof. Some physical components or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, and the computer-readable medium can include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassette, magnetic tape, disk storage or other magnetic storage device, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0128] The embodiments of the present application are described in detail above in conjunction with the accompanying drawings, but the present application is not limited to the above embodiments. Various changes can be made within the knowledge of ordinary technicians in the relevant technical field without departing from the purpose of the present application. In addition, the embodiments of the present application and the features in the embodiments can be combined with each other without conflict.

Claims

1. The permission configuration method is characterized by: Applied to the configuration end, the server end communicates with the configuration end, and the configuration end communicates with the client end. The configuration end is the information transmission medium and interactive display platform between the server end and the client end, including: Send an authentication request to the client; the authentication request is a two-way authentication request; Receiving the terminal identity information sent by the client according to the authentication request; the terminal identity information is used to represent the identity of the client to achieve two-way authentication between the server and the client; Forwarding the received terminal identity information to the server; Receiving background identity information sent by the server according to the terminal identity information; Forwarding the received background identity information to the client so that the client can verify the legitimacy of the background identity information. If the background identity information is not legal, the two-way authentication process is terminated. If the background identity information is legal, a random number is generated; Receiving a random number sent by the client according to the background identity information; Forwarding the received random number to the server; Receiving the authority signature file sent by the server according to the random number; Forwarding the received permission signature file to the client so that the client verifies the legitimacy of the permission signature file; if the permission signature file is legal, extracting the plaintext data of the permission list from the permission signature file, performing permission configuration according to the plaintext data, and deleting the random number after extracting the plaintext data of the permission list; If the two-way authentication fails, the authentication failure information sent by the client is received, and the permission configuration is terminated according to the authentication failure information.

2. The permission configuration method is characterized in that: Applied to the server side, including: The receiving configuration end forwards the terminal identity information sent by the client; the terminal identity information is used to represent the identity of the client to achieve two-way authentication between the server and the client; the server and the configuration end are connected in communication, and the configuration end is connected in communication with the client. The configuration end is the information transmission medium and interactive display platform between the server and the client; Forwarding the background identity information to the client through the configuration terminal according to the terminal identity information, so that the client verifies the legitimacy of the background identity information. If the background identity information is not legal, the two-way authentication process is terminated. If the background identity information is legal, a random number is generated; Receiving a random number forwarded by the configuration end from the client according to the background identity information; Obtaining permission data sent by the configuration terminal; Based on the SM2 cryptographic algorithm, the SM3 cryptographic algorithm or the GMSSL-based digital identity authentication technology, the received random number is filled into the permission data to generate a permission signature file; the permission data is the plaintext data of the permission list; The permission signature file is forwarded to the client through the configuration end so that the client verifies the legitimacy of the permission signature file. If the permission signature file is legal, the plaintext data of the permission list is extracted from the permission signature file, and the permission is configured according to the plaintext data. After the plaintext data of the permission list is extracted, the random number is deleted.

3. The permission configuration method is characterized in that: Applied to the client, including: Receive the authentication request sent by the configuration end; the authentication request is a two-way authentication request; According to the authentication request, the terminal identity information of the client is forwarded to the server through the configuration end; the server is connected to the configuration end in communication, and the configuration end is connected to the client in communication, and the configuration end is an information transmission medium and interactive display platform between the server and the client; Receiving the background identity information forwarded by the configuration end from the server end according to the terminal identity information; Performing a legality check on the background identity information, if the background identity information is legal, generating a random number, and forwarding the random number to the server through the configuration end; if the background identity information is illegal, ending the two-way authentication process; Receiving the permission signature file forwarded by the configuration end from the server end according to the random number; Performing a legitimacy authentication on the authority signature file to obtain a legitimacy authentication result; If the legitimacy authentication result indicates that the permission signature file is legal, a random number is extracted from the permission signature file, and the random number is matched with a random number stored in the client. If the random number matches successfully, the plaintext data of the permission list is extracted from the permission signature file to configure permissions according to the plaintext data. After the plaintext data of the permission list is extracted, the random number is deleted. If the legality authentication result indicates that the authority signature file is illegal, or the random number matching is unsuccessful, the authority configuration task is directly exited and the random number is deleted.

4. The permission configuration device is characterized in that: Applied to the configuration end, the server end communicates with the configuration end, and the configuration end communicates with the client end. The configuration end is the information transmission medium and interactive display platform between the server end and the client end, including: The authentication request module is used to send an authentication request to the client; the authentication request is a two-way authentication request; A first receiving module is used to receive the terminal identity information sent by the client according to the authentication request; the terminal identity information is used to represent the identity of the client to achieve two-way authentication between the server and the client; A first sending module, used for forwarding the received terminal identity information to a server; A second receiving module is used to receive the background identity information sent by the server according to the terminal identity information; The second sending module is used to forward the received background identity information to the client, so that the client can verify the legitimacy of the background identity information. If the background identity information is not legal, the two-way authentication process is terminated; if the background identity information is legal, a random number is generated; A third receiving module, used to receive a random number sent by the client according to the background identity information; A third sending module, used for forwarding the received random number to the server; A fourth receiving module, used to receive the authority signature file sent by the server according to the random number; A fourth sending module, used for forwarding the received permission signature file to the client, so that the client verifies the legitimacy of the permission signature file, and if the permission signature file is legal, extracting the plaintext data of the permission list from the permission signature file, performing permission configuration according to the plaintext data, and deleting the random number after extracting the plaintext data of the permission list; If the two-way authentication fails, the authentication failure information sent by the client is received, and the permission configuration is terminated according to the authentication failure information.

5. The permission configuration device is characterized in that: Applied to the server side, including: The first receiving module is used to receive the terminal identity information sent by the client and forwarded by the configuration end; the terminal identity information is used to represent the identity of the client to achieve two-way authentication between the server and the client; the server is connected to the configuration end in communication, and the configuration end is connected to the client in communication, and the configuration end is an information transmission medium and interactive display platform for the server and the client; The first sending module is used to forward the background identity information to the client through the configuration terminal according to the terminal identity information, so that the client can verify the legitimacy of the background identity information. If the background identity information is not legal, the two-way authentication process is terminated; if the background identity information is legal, a random number is generated; A second receiving module is used to receive a random number sent by the client according to the background identity information and forwarded by the configuration end; The permission signature file generation module is used to obtain the permission data sent by the configuration terminal; based on the SM2 cryptographic algorithm, the SM3 cryptographic algorithm or the digital identity authentication technology based on GMSSL, fill the received random number into the permission data to generate a permission signature file; the permission data is the plaintext data of the permission list; The second sending module is used to forward the permission signature file to the client through the configuration end, so that the client can verify the legality of the permission signature file. If the permission signature file is legal, the plaintext data of the permission list is extracted from the permission signature file, and the permission is configured according to the plaintext data. After the plaintext data of the permission list is extracted, the random number is deleted.

6. The permission configuration device is characterized in that: Applied to the client, including: The first receiving module is used to receive an authentication request sent by the configuration end; the authentication request is a two-way authentication request; A first sending module is used to forward the terminal identity information of the client to the server through the configuration end according to the authentication request; the server end is connected to the configuration end in communication, and the configuration end is connected to the client end in communication, and the configuration end is an information transmission medium and interactive display platform between the server end and the client end; A second receiving module, used for receiving the background identity information sent by the server according to the terminal identity information and forwarded by the configuration end; The second sending module is used to verify the legitimacy of the background identity information. If the background identity information is legal, a random number is generated and forwarded to the server through the configuration end; if the background identity information is illegal, the two-way authentication process is terminated; A third receiving module is used to receive the permission signature file sent by the configuration end from the server end according to the random number; The authority configuration module is used to perform a legitimacy authentication on the authority signature file and obtain a legitimacy authentication result; If the legitimacy authentication result indicates that the permission signature file is legal, a random number is extracted from the permission signature file, and the random number is matched with the random number stored in the client. If the random number matches successfully, the plaintext data of the permission list is extracted from the permission signature file to perform permission configuration according to the plaintext data. After extracting the plaintext data of the permission list, the random number is deleted. If the legitimacy authentication result indicates that the permission signature file is illegal, or the random number match fails, the permission configuration task is directly exited and the random number is deleted.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to cause a computer to execute: The permission configuration method according to any one of claims 1 to 3.

Images