A method for sharing control authority of IoT devices

Abstract

The present invention relates to a method for sharing control authority of an IoT device, which belongs to the field of IoT technology. The function is that a master user shares the control authority of an IoT device with a non-master user, and the steps are as follows: the IoT device generates an encryption code and reports it to a cloud server; the cloud server uses the encryption code to encrypt the master user ID and the sharing information of the control authority to generate an authority access key; the non-master user requests the authority access key from the server, and the server feeds back the authority access key to the non-master user after receiving the request; the non-master user logs in to the IoT device using the authority access key to obtain the control authority. The method allows the IoT device to also perceive the user's control authority, thereby realizing direct control without the need for cloud server transfer, improving the user experience and reducing the risk of being illegally controlled.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and in particular to a method for sharing control permissions of Internet of Things devices. Background Art

[0002] An important meaning of "Internet of Everything" is "sharing": each IoT device can easily share its own information with other IoT devices or users, and can also easily obtain information from other IoT devices.

[0003] The implementation of the sharing function involves the control of the permissions of IoT devices, because different levels of users have different control permissions for the same IoT device. Currently, when user 1 shares an IoT device with user 2, the mainstream solution is as follows:

[0004] In the first step, the IoT device connects to the cloud server and opens all control permissions to the cloud server, which then decides what operations to perform.

[0005] In the second step, user 1 sets the permission information and validity period for user 2 on the control terminal such as mobile app, Windows software or web page, and saves this information on the cloud server;

[0006] In the third step, after user 2 connects to the cloud server, the cloud server determines what permissions user 2 has and what operations he can perform based on the permission information and validity period set by user 1.

[0007] There are three main problems with this solution:

[0008] (1) IoT devices are completely controlled by cloud servers. IoT devices themselves have no way of knowing what control permissions users have, nor how long these control permissions can be used. Therefore, there is a security risk of illegal control.

[0009] (2) Users’ control over IoT devices needs to be transferred through cloud servers, which reduces real-time performance. If the network conditions are poor, the user experience will be very poor.

[0010] (3) If the IoT device loses connection with the cloud server during use, the user will not be able to perform any operations.

[0011] "Access Permission Control Method for Offline Sharing of IoT Devices" (CN104580478A) mentions a method for offline control of IoT devices. The idea is as follows: user information including account name and password is stored in the IoT device; in the offline state, the user can connect to the IoT device through Bluetooth or other means, and the IoT device can determine whether the user is a legitimate user based on the internally stored user information.

[0012] There are three main problems with this approach:

[0013] (1) This method creates a shared list in the IoT device to store user accounts and passwords. Obviously, this increases the risk of user information leakage;

[0014] (2) This method only addresses one type of permission: access. If the number of permissions increases and different permissions need to be assigned to different users, this method will become unsuccessful, as the shared table and control logic will become extremely cumbersome. If the number of users increases exponentially, the shared table will become unimaginably bloated. While a database might be a good solution to this problem, installing a database in an IoT device is unrealistic. Therefore, this method is only suitable for application scenarios where the number of permissions and users is small.

[0015] (3) This method changes the sharing list in the IoT device and updates it to the server. When the IoT device is offline, this method will not be able to change the sharing permissions of non-primary users. Summary of the Invention

[0016] In response to the above-mentioned problems existing in the prior art, the present invention provides a method that allows IoT devices to obtain the control authority and validity period of a shared user without having to store a large amount of user information locally, thereby achieving direct connection control without the need for cloud server transit.

[0017] The technical solutions of the present invention are as follows:

[0018] A method for sharing control rights among IoT devices, wherein the IoT device generates an encryption code for encrypting and decrypting shared information about the control rights, and reports the encryption code together with an encryption protocol version number to a cloud server;

[0019] When the master user sets up sharing permission control for non-master users, the cloud server selects the corresponding encryption protocol based on the encryption protocol version number, and uses the encryption protocol and encryption code to encrypt the master user ID and sharing information of the control permission to generate the permission access key;

[0020] After the non-master user obtains the permission access key from the cloud server, he or she can log in to the IoT device using the device username, device password and permission access key to obtain control permissions.

[0021] Preferably, the specific steps are as follows:

[0022] (1) The IoT device generates an encryption code for encrypting and decrypting the shared information of the control authority and stores it locally on the device;

[0023] (2) The IoT device reports the encryption code and encryption protocol version number to the cloud server, which then stores the data.

[0024] (3) The primary user sends a query request to the cloud server through the control terminal to query the relevant information of the control authority of the IoT device that can be shared;

[0025] (4) After receiving the query request from the main user's control terminal, the cloud server feeds back the relevant information of the shareable control rights of the IoT device to the main user's control terminal;

[0026] (5) After the master user sets the sharing information and sharing validity period of the control authority of the non-master user of the IoT device on the control terminal, it sends a request to the cloud server to configure the control authority information of the non-master user;

[0027] (6) After receiving the control permission information request for the non-master user from the master user control terminal, the cloud server uses the corresponding encryption protocol according to the encryption protocol version number, and uses the encryption protocol and encryption code to encrypt the master user ID, the sharing information of the control permission and the sharing validity period to generate the permission access key for storage;

[0028] (7) The non-master user requests the latest device list including the permission access key from the server on the control terminal;

[0029] (8) After the non-primary user receives the latest device list from the cloud server, the control terminal establishes a connection with the IoT device through a direct connection. After the connection is successful, the non-primary user's control terminal sends a login request, device username, device password, and permission access key to the device.

[0030] (9) After receiving the login request from the non-primary user control terminal, the IoT device verifies whether the device username and device password are consistent. If so, it feeds back the successful login information to the non-primary user control terminal and uses the encryption code to decrypt the permission access key, thereby obtaining the sharing information and sharing validity period of the control permission;

[0031] (10) After the non-primary user receives the feedback information of successful login from the IoT device, he / she sends an operation instruction to the device through the control terminal; the device determines whether the non-primary user has the control authority of the operation instruction and whether the control authority is within the sharing validity period. If so, the operation is executed.

[0032] Preferably, the control terminal includes a mobile phone APP, a tablet computer APP, Windows software, and a web page.

[0033] Preferably, the direct connection mode of step (8) includes Bluetooth, infrared, 232 serial port, 485 serial port, CAN bus, wired Ethernet, and WIFI.

[0034] Preferably, in step (11), after receiving the login request from the non-primary user control terminal, the IoT device verifies whether the device user name and device password are consistent. If not, it feeds back the information of "wrong user name" or "wrong password" to the non-primary user control terminal.

[0035] Preferably, in step (12), the device determines whether the non-master user has the control authority for the operation instruction and whether the control authority is within the sharing validity period. If not, the device feeds back the information "does not have the control authority for the operation instruction" or "the control authority is not within the validity period" to the control end of the non-master user.

[0036] In the above technical solution, the encryption and decryption methods adopt the symmetric encryption algorithm commonly used in the prior art.

[0037] The beneficial effects of the present invention are:

[0038] (1) Compared with mainstream solutions, this invention only requires connecting to a cloud server when performing a sharing operation. After successful sharing, users can directly control IoT devices through methods such as Bluetooth, infrared, and WIFI, without the need for cloud server transfer. This not only increases speed and provides a better experience, but also reduces the risk of illegal control.

[0039] (2) Compared with the “Access Permission Control Method for Offline Sharing of Internet of Things Devices” (CN104580478A), the present invention does not need to establish a shared list for storing user account names and passwords within the Internet of Things device. This not only reduces the risk of leaking user information and saves system resources, but also has better adaptability and can be well applied to application scenarios with a large number of permissions and users without making any modifications to the source code.

[0040] (3) Compared with the "Access Permission Control Method for Offline Sharing of IoT Devices" (CN104580478A), after user 2 adds an IoT device, user 1 can still request the server to configure user 2's sharing permissions. User 2 obtains the latest sharing permissions from the server and then sends them to the IoT device. This allows user 1 to change user 2's sharing permissions even when the device is offline. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Attachment Figure 1This is a schematic diagram of the module functions of the present invention, which is used to illustrate the functions of the three modules: mobile phone APP, cloud server, and Internet of Things device.

[0042] Attachment Figure 2 This is a network structure diagram of the present invention, which is used to illustrate how the three modules of mobile phone APP, cloud server and Internet of Things device are connected.

[0043] Attachment Figure 3 This is a functional flow chart of the present invention, which is used to illustrate the information interaction process between the three modules of mobile phone APP, cloud server and Internet of Things device. DETAILED DESCRIPTION

[0044] The following is combined with Figure 1-3 , the present invention is described in detail.

[0045] As attached Figure 1-3 As shown in the figure, the functions of each module are as follows:

[0046] Mobile APP: directly establishes a connection with the IoT device, generates an encryption code, sends binding information, encryption code, and control instructions to the IoT device, requests the server to share the device, and obtains information such as the device list and permission access key from the server.

[0047] IoT devices: Receive and respond to control commands from mobile apps, and send binding requests, encryption codes, and other information to the cloud server.

[0048] Cloud server: manages the binding of user information and device information, encrypts user permission information with a password to generate permission access keys and sends them to the mobile app.

[0049] Mobile apps, cloud servers, and IoT devices can be connected to each other. Both IoT devices and mobile apps can connect to cloud servers via Wi-Fi and wired Ethernet; IoT devices and mobile apps can connect via Bluetooth, Wi-Fi, and other methods.

[0050] Example:

[0051] User 1 shares the control rights of the IoT camera's playback PB and intercom TK functions with user 2. The steps are as follows:

[0052] (1) The IoT camera generates an encryption code (3kjfdfj) and saves it locally;

[0053] (2) If the IoT camera can access the network and communicate normally with the cloud server, the IoT camera will automatically report the encryption code and encryption protocol version number (v1.0) to the cloud server, and the cloud server will save it after receiving it; the encryption protocol version number is used to stipulate that the device and server directly use the same encryption and decryption protocol, such as v1.0 for AES encryption protocol

[0054] (3) User 1 connects to the cloud server through a mobile phone APP and queries the information related to the control permissions that can be shared by the IoT camera;

[0055] (4) After receiving the query request from user 1, the cloud server feeds back the relevant information of the shareable control rights of the IoT camera to user 1's mobile phone APP, including playback PB, intercom TK, pan / tilt TPZ and many other functions;

[0056] (5) User 1 sets the "non-sharing" status of User 2's playback PB and intercom TK functions to "sharing" on the mobile app, and sets the sharing validity period to 20210723. After the setting is completed, the mobile app sends the sharing information of these two functions (PB-TK-20210723) together with User 1's ID (10248773) to the cloud server, and requests the cloud server to configure User 2's control permission information.

[0057] (6) After receiving the control permission information request from user 1 to configure user 2, the cloud server selects the corresponding encryption protocol according to the encryption protocol version number (v1.0), such as AES encryption, and uses the encryption code (3kjfdfj) to encrypt the user 1 ID (10248773), the sharing information of playback PB and intercom TK, and the sharing validity period (10248773-PB-TK-20210723) to generate the permission access key (U2FsdGVkX1+CDkQJRo0ZwR7 / HkrckPShqdz8PYoziuorcG+q7xLklsHvSjVr7ll / ) for storage;

[0058] (7) User 2 requests the latest device list including the permission access key from the server through the mobile app;

[0059] (8) After receiving the latest device list from the cloud server, user 2's mobile app establishes a connection with the IoT camera via Bluetooth. After the connection is successful, user 2's mobile app sends a login request, device username, device password, and permission access key (U2FsdGVkX1+CDkQJRo0ZwR7 / HkrckPShqdz8PYoziuorcG+q7xLklsHvSjVr7ll / ) to the IoT camera.

[0060] (9) After receiving the login request from the mobile APP of user 2, the IoT camera verifies whether the device username and device password are consistent. If so, it feeds back the information of "login successful" to the mobile APP of user 2, and uses the encryption code (3kjfdfj) to decrypt the permission access key (U2FsdGVkX1+CDkQJRo0ZwR7 / HkrckPShqdz8PYoziuorcG+q7xLklsHvSjVr7ll / ) using AES encryption, thereby knowing that the control permissions obtained by user 2 are playback function PB and intercom function TK, and the permission sharing validity period is 20210723, and saves this information in the current session; if not, it feeds back the information of "user name error" or "password error" to the mobile APP of user 2;

[0061] (10) After user 2's mobile phone APP receives the feedback information of "login successful" from the IoT camera, it can directly send operation instructions to the IoT camera via Bluetooth. The IoT camera determines whether user 2 has the control authority for the operation instruction and whether the control authority is within the validity period of the permission sharing. If so, it executes the operation; if not, it feeds back the information of "not having the control authority for the operation instruction" or "control authority is not within the validity period" to user 2's mobile phone APP. For example: when user 2 sends a pan-tilt control instruction to the IoT camera, the camera can determine that user 2 does not have the pan-tilt control authority based on the permission sharing information in the current session, and thus does not respond to the pan-tilt control instruction; when user 2 sends a playback request to the camera on July 24, 2021, the camera can determine that the authority obtained by user 2 has expired based on the validity period of the permission sharing in the current session, and thus does not respond to the playback instruction.

[0062] Although the embodiments of the present invention have been disclosed as above, they are not limited to the applications listed in the description and implementation methods. They can be fully applied to various fields suitable for the present invention. For those familiar with the art, for those of ordinary skill in the art, various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the present invention. Therefore, without departing from the general concept defined by the claims and the scope of equivalents, the present invention is not limited to specific details.

Claims

1. A method for sharing control authority of IoT devices, characterized in that: The IoT device generates an encryption code for encrypting and decrypting the shared information of the control authority, and reports the encryption code together with the encryption protocol version number to the cloud server; When the master user sets the sharing permission control for non-master users, the cloud server selects the corresponding encryption protocol according to the encryption protocol version number, and uses the encryption protocol and encryption code to encrypt the sharing information of the master user ID and control permission to generate a permission access key; After obtaining the permission access key from the cloud server, the non-master user can log in to the IoT device using the device username, device password and permission access key to obtain control permissions; The specific steps are as follows: (1) The IoT device generates an encryption code for encrypting and decrypting the shared information of the control authority and stores it locally on the device; (2) The IoT device reports the encryption code and encryption protocol version number to the cloud server, which then saves the information. (3) The main user sends a query request to the cloud server through the control terminal to query the relevant information of the shareable control rights of the IoT device; (4) After receiving the query request from the main user's control terminal, the cloud server feeds back the relevant information of the shareable control rights of the IoT device to the main user's control terminal; (5) After the master user sets the sharing information and sharing validity period of the control authority of the non-master user of the IoT device on the control end, it sends a request to the cloud server to configure the control authority information of the non-master user; (6) After receiving the control permission information request for configuring the non-master user from the master user's control terminal, the cloud server uses the corresponding encryption protocol according to the encryption protocol version number, and uses the encryption protocol and encryption code to encrypt the master user ID, the sharing information of the control permission and the sharing validity period to generate the permission access key for storage; (7) The non-master user requests the latest device list including the permission access key from the server on the control end; (8) After the non-primary user receives the latest device list from the cloud server on the control terminal, it establishes a connection with the IoT device through a direct connection. After the connection is successful, the non-primary user's control terminal sends a login request, device username, device password and permission access key to the device; (9) After receiving the login request from the non-primary user's control terminal, the IoT device verifies whether the device username and device password are consistent. If so, it feeds back the successful login information to the non-primary user's control terminal and uses the encryption code to decrypt the permission access key, thereby obtaining the sharing information and sharing validity period of the control permission; (10) After the non-primary user receives the feedback information of successful login from the IoT device, he / she sends an operation instruction to the device through the control terminal; the device determines whether the non-primary user has the control authority of the operation instruction and whether the control authority is within the sharing validity period. If so, the operation is executed.

2. A method for sharing control authority of IoT devices according to claim 1, characterized in that: The control terminal includes a mobile phone APP, a tablet computer APP, windows software, and a web page.

3. The method for sharing control authority of an IoT device according to claim 1, characterized in that: The direct connection method of step (8) includes Bluetooth, infrared, 232 serial port, 485 serial port, CAN bus, wired Ethernet, and WIFI.

4. The method for sharing control authority of an IoT device according to claim 1, characterized in that: In step (11), after receiving the login request from the non-primary user's control terminal, the IoT device verifies whether the device username and device password are consistent. If not, it feeds back the information of "wrong username" or "wrong password" to the non-primary user's control terminal.

5. The method for sharing control authority of IoT devices according to claim 1, characterized in that: In step (12), the device determines whether the non-primary user has the control authority for the operation instruction and whether the control authority is within the sharing validity period. If not, the device feeds back the information "does not have the control authority for the operation instruction" or "the control authority is not within the validity period" to the control terminal of the non-primary user.

Images