Authentication system, method and apparatus for accessing internet of things device data

Abstract

The application discloses an authentication system, method and device for accessing Internet of Things equipment data, and relates to the technical field of data security. The authentication system for accessing Internet of Things equipment data comprises a data request platform and a request authentication platform. The data request platform is used for initiating a data authentication request comprising a first equipment node, a first user node and a subject node to the request authentication platform. The request authentication platform is used for performing node matching on the first equipment node, the first user node and the subject node through a preset node relationship tree to obtain a node relationship matching result. The request authentication platform is further used for judging whether authorization information of a user is received. When the authorization information is not received, the data authentication request is not passed. When the authorization information is received, it is judged whether the authorization node in the authorization information and the node relationship matching result are matched. If the matching result is matched, the request is passed; otherwise, the request is not passed. The application can improve the personal data security of a user.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, and in particular to an authentication system, method and device for accessing data of Internet of Things devices. BACKGROUND

[0002] In recent years, with the continuous development of the Internet of Things industry, various Internet of Things systems have emerged, and the operation of the Internet of Things systems is based on various Internet of Things devices, and many Internet of Things devices collect some private data of users. At the same time, many Internet of Things systems or applications sometimes need to transmit personal private data generated by Internet of Things devices between different Internet of Things systems or different applications due to business needs. Therefore, in order to protect personal private data, the authorization information of the user is required to make the request valid when the data is accessed between the Internet of Things systems, but due to the lack of reliable authentication function of the Internet of Things system, it is difficult to verify the authenticity of the authorization information, resulting in low security of personal private data. SUMMARY

[0003] The present application aims to at least solve one of the technical problems existing in the prior art. To this end, the present application provides an authentication system, method and device for accessing data of Internet of Things devices, which can improve the security of personal data of users in the Internet of Things system.

[0004] In one aspect, the present application provides an authentication system for accessing data of Internet of Things devices, comprising a data request platform and a request authentication platform.

[0005] The data request platform is configured to initiate a data authentication request to the request authentication platform, wherein the data authentication request comprises a first device node, a first user node and a subject node.

[0006] The request authentication platform is configured to perform node matching on the first device node, the first user node and the subject node through a pre-set node relationship tree to obtain a node relationship matching result.

[0007] The request authentication platform is further configured to judge whether the authorization information of the user is received, and if the authorization information is not received, the data authentication request is not passed; if the authorization information is received, it is judged whether the authorization node in the authorization information matches the node relationship matching result, and if the authorization node matches the node relationship matching result, the data authentication request is passed, otherwise the data authentication request is not passed.

[0008] According to some embodiments of the present application, the request authentication platform comprises an authorization server and a relationship server.

[0009] The authorization server is configured to construct a path directed graph of the first device node, the first user node and the subject node according to a preset hierarchical relationship, wherein the subject node and the first user node are in an upper and lower hierarchical relationship, the subject node and the first device node are in an upper and lower hierarchical relationship, and the first user node and the first device node are in a parallel hierarchical relationship.

[0010] The relationship server is configured to traverse the node relationship tree according to a path in the path directed graph, determine a feedback value for representing whether the path exists, and obtain the node relationship matching result according to feedback values of all paths in the path directed graph.

[0011] According to some embodiments of the present application, the authorization server is configured with a first encryption algorithm and a first private key, and the relationship server is configured with a first decryption algorithm and a first public key.

[0012] The authorization server is configured to encrypt the path directed graph according to the first encryption algorithm and the first private key, and obtain a path directed graph data packet.

[0013] The relationship server is configured to receive the path directed graph data packet, decrypt the path directed graph data packet according to the first decryption algorithm and the first public key, and obtain the path directed graph.

[0014] According to some embodiments of the present application, the relationship server is configured with a second encryption algorithm and a second private key, and the authorization server is configured with a second decryption algorithm and a second public key.

[0015] The relationship server is configured to encrypt the node relationship matching result according to the second encryption algorithm and the second private key, and obtain a node relationship matching result data packet.

[0016] The authorization server is configured to receive the node relationship matching result data packet, decrypt the node relationship matching result data packet according to the second decryption algorithm and the second public key, and obtain the node relationship matching result.

[0017] According to some embodiments of the present application, the data request platform comprises a data resource request server.

[0018] The data resource request server is configured to initiate a data authentication request to the authorization server.

[0019] The authorization server is configured with a third encryption algorithm and a third private key.

[0020] The authorization server is configured to encrypt the node relationship matching result according to the third encryption algorithm and the third private key to obtain an authorization data packet, and send the authorization data packet to the data resource request server.

[0021] According to some embodiments of the present application, the data request platform further comprises a user operation terminal.

[0022] The user operation terminal is configured to obtain the authorization information, wherein the authorization information comprises an authorized node, and the authorized node comprises a second user node and a second device node.

[0023] The data resource request server is further configured to encapsulate the authorization information and the authorization data packet to obtain a to-be-authenticated data packet.

[0024] According to some embodiments of the present application, the data request authentication platform further comprises an authentication server.

[0025] The authentication server is configured to receive the to-be-authenticated data packet, judge whether the to-be-authenticated data packet comprises the authorization information of the user, when the authorization information is not received, the data authentication request is not passed, and an authentication failure information is returned to the data resource request server.

[0026] According to some embodiments of the present application, the authentication server is configured with a third decryption algorithm and a third public key.

[0027] The authentication server is further configured to, when the authorization information is received, decrypt the authorization data packet in the to-be-authenticated data packet according to the third decryption algorithm and the third public key to obtain the node relationship matching result.

[0028] The authentication server is further configured to judge whether the authorized node in the authorization information and the node relationship matching result match, if the authorized node and the node relationship matching result match, the data authentication request is passed, otherwise, the data authentication request is not passed.

[0029] On the other hand, the embodiments of the present application further provide an authentication method for accessing data of an Internet of Things device, comprising the following steps:

[0030] Obtaining a data authentication request, wherein the data authentication request comprises a first device node, a first user node and a subject node.

[0031] Performing node matching on the first device node, the first user node and the subject node through a preset node relationship tree to obtain a node relationship matching result.

[0032] Judging whether authorization information of the user is received.

[0033] When the authorization information is not received, the data authentication request is not passed.

[0034] When the authorization information is received, it is judged whether the authorization node in the authorization information and the node relationship matching result match, if the authorization node and the node relationship matching result match, the data authentication request is passed, otherwise, the data authentication request is not passed.

[0035] In another aspect, the embodiment of the present application also provides an authentication device for accessing Internet of Things device data, comprising:

[0036] At least one processor;

[0037] At least one memory for storing at least one program;

[0038] When the at least one program is executed by the at least one processor, at least one processor implements the authentication method for accessing Internet of Things device data as described above.

[0039] The technical solution of the present application has at least one of the following advantages or beneficial effects: When the data request platform needs to request the Internet of Things device data of the user, the data request platform initiates a data authentication request to the request authentication platform, which includes the first device node, the first user node and the subject node to be requested, the request authentication platform is used to match the first device node, the first user node and the subject node through the preset node relationship tree to obtain the node relationship matching result, and then the request authentication platform further judges whether the authorization information of the user is received, if the authorization information is not received, the data authentication request is not passed, if the authorization information is received, it is judged whether the authorization node in the authorization information and the node relationship matching result match, if the authorization node and the node relationship matching result match, the data authentication request is passed, otherwise, the data authentication request is not passed. The request authentication platform matches the first device node, the first user node and the subject node through the preset node relationship tree to determine the legality of the device and the user to be accessed, and judges whether the authorization information of the user is received, and determines whether the data authentication request is passed based on the authorization node of the user, so that the user can perceive whether the related device data is accessed by the Internet of Things system, thereby improving the security of the personal data of the user in the Internet of Things system. BRIEF DESCRIPTION OF DRAWINGS

[0040] Figure 1 is the authentication system for accessing Internet of Things device data provided by the embodiment of the present application;

[0041] Figure 2 is the authentication method flow chart for accessing Internet of Things device data provided by the embodiment of the present application;

[0042] Figure 3 is a schematic diagram of an authentication device for accessing data of an Internet of Things device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0043] Embodiments of the present application are described in detail below with reference to examples shown in the drawings, wherein the same or similar notations represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the drawings are exemplary and are only used to explain the present application and cannot be understood as a limitation of the present application.

[0044] In the description of the present application, it should be understood that the orientation description, such as the orientation or position relationship indicated by up, down, left, right, etc., is based on the orientation or position relationship shown in the drawings, and is only for the purpose of facilitating the description of the present application and simplifying the description, and does not indicate or imply that the device or element referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as a limitation of the present application.

[0045] In the description of the present application, if there is a description of first, second, etc., it is only for the purpose of distinguishing technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated or the order of technical features indicated.

[0046] An authentication system for accessing data of an Internet of Things device is provided by an embodiment of the present application, with reference to Figure 1 , the authentication system for accessing data of an Internet of Things device comprises a data request platform and a request authentication platform;

[0047] The data request platform is configured to initiate a data authentication request to the request authentication platform, wherein the data authentication request comprises a first device node, a first user node and a subject node;

[0048] The request authentication platform is configured to perform node matching on the first device node, the first user node and the subject node through a preset node relationship tree to obtain a node relationship matching result;

[0049] The request authentication platform is further configured to judge whether the authorization information of the user is received, and if the authorization information is not received, the data authentication request is not passed; if the authorization information is received, it is judged whether the authorization node in the authorization information and the node relationship matching result match, if the authorization node and the node relationship matching result match, the data authentication request is passed, otherwise, the data authentication request is not passed.

[0050] In the embodiment, when the data request platform needs to request the data of the Internet of Things device of the user, the data request platform initiates a data authentication request to the request authentication platform, wherein the data authentication request includes the first device node, the first user node and the subject node to be requested, the request authentication platform is configured to perform node matching on the first device node, the first user node and the subject node through a preset node relationship tree to obtain a node relationship matching result, and then the request authentication platform further judges whether the authorization information of the user is received. When the authorization information is not received, the data authentication request is not passed. When the authorization information is received, it is judged whether the authorization node in the authorization information and the node relationship matching result match. If the authorization node and the node relationship matching result match, the data authentication request is passed. Otherwise, the data authentication request is not passed. The request authentication platform determines the legality of the device and the user to be accessed by performing node matching on the first device node, the first user node and the subject node through the preset node relationship tree, and judges whether the authorization information of the user is received, and determines whether the data authentication request is passed based on the authorization node of the user, so that the user can perceive whether the data of the related device is accessed by the Internet of Things system, thereby improving the security of the personal data of the user in the Internet of Things system.

[0051] According to some specific embodiments of the present application, referring to Figure 1 , the request authentication platform includes an authorization server and a relationship server;

[0052] The authorization server is configured to construct a path directed graph of the first device node, the first user node and the subject node according to a preset hierarchical relationship, wherein the subject node and the first user node are in an upper and lower hierarchical relationship, the subject node and the first device node are in an upper and lower hierarchical relationship, and the first user node and the first device node are in a parallel hierarchical relationship.

[0053] The relationship server is configured to traverse the node relationship tree according to the paths in the path directed graph, determine a feedback value for representing whether the paths exist, and obtain the node relationship matching result according to the feedback values of all the paths in the path directed graph.

[0054] Exemplarily, the data request platform initiates a data authentication request to the authorization server, and the data authentication request includes the first device node, the subject node and the first user node. The subject node can be a scene including any user node and device node, for example, the subject node can be a company, a community, a park, etc. In the above subject, there are devices and personnel in operation.

[0055] The authorization service end models according to the first device node, the first user node and the principal node. The preset hierarchical relationship is used to represent the hierarchical levels of different nodes, the hierarchical level of the principal node is the highest, the hierarchical levels of the first device node and the first user node are both upper and lower hierarchical relationship with the principal node, and the hierarchical levels of the first device node and the first user node are parallel relationship. The preset hierarchical relationship is used for path modeling, and the modeling result is a path directed graph between the three, so that there is a path from the principal node to the first device node, there is a path from the principal node to the first node, and there is a path between the first device node and the first user node. The authorization service end needs to authenticate the path directed graph, verify the authenticity between the three relationships, and whether there is permission, so the authorization service end needs to verify the relationship to the relationship service end.

[0056] The relationship service end records the binding relationship of various information in the Internet of Things system when carrying out business for the Internet of Things system, so the binding relationship between the principal and the device, the principal and the personnel, and the device and the personnel is recorded to form a relationship tree. The relationship service end obtains the path directed graph from the authorization service end, splits the path directed graph into different paths, and performs traversal query in the node relationship tree based on different paths. First, it is verified whether the principal node exists, and after the principal node is found, a depth-first query is performed according to the path from the corresponding principal node to the first device node to the first personnel node and the path from the principal node to the first personnel node. According to the result of the depth-first query, each path of the path directed graph is fed back correspondingly, assuming that the path exists, positive feedback is performed, and assuming that the path does not exist, negative feedback is performed, so as to determine a feedback value used to represent whether the path exists. According to the feedback values of all paths in the path directed graph, a node relationship matching result is obtained, wherein the node relationship matching result includes a plurality of triplets, each triplet includes two elements representing two different nodes and a feedback value element representing whether the node exists, such as <first device node A, feedback value, second user node B>, wherein the feedback value has two definitions, namely, exists and does not exist.

[0057] Exemplarily, the data authentication request includes a principal node of community A, a first user node of personnel A, a first device node of device A and device B, and after processing by the authorization service end and the relationship service end, the node relationship matching result can be <community A, True, device A>, <community A, True, device B>, <community A, True, personnel A>, <personnel A, True, device A>, <personnel A, True, device B>.

[0058] According to some embodiments of the application, the authorization service end is configured with a first encryption algorithm and a first private key, and the relationship service end is configured with a first decryption algorithm and a first public key.

[0059] The authorization server is configured to encrypt the path directed graph according to a first encryption algorithm and a first private key, to obtain a path directed graph data packet.

[0060] The relationship server is configured to receive the path directed graph data packet, decrypt the path directed graph data packet according to a first decryption algorithm and a first public key, and obtain the path directed graph.

[0061] Exemplarily, after the authorization server constructs the path directed graph, the authorization server generates a piece of fingerprint information according to a first private key of the authorization server itself, encrypts and encapsulates the path directed graph and the fingerprint information into the path directed graph data packet according to a first encryption algorithm, and sends the path directed graph data packet to the relationship server.

[0062] The relationship server is configured with a first decryption algorithm corresponding to the first encryption algorithm and a first public key of the authorization server, and after receiving the path directed graph data packet, the relationship server obtains the path directed graph after decryption succeeds according to the first decryption algorithm and the first public key and matching the corresponding fingerprint information.

[0063] According to some specific embodiments of the present application, the relationship server is configured with a second encryption algorithm and a second private key, and the authorization server is configured with a second decryption algorithm and a second public key.

[0064] The relationship server is configured to encrypt the node relationship matching result according to a second encryption algorithm and a second private key, to obtain a node relationship matching result data packet.

[0065] The authorization server is configured to receive the node relationship matching result data packet, decrypt the node relationship matching result data packet according to a second decryption algorithm and a second public key, and obtain the node relationship matching result.

[0066] In the present embodiment, in the process of returning the node relationship matching result from the relationship server to the authorization server, the data in the transmission process is also encrypted based on the peer-to-peer second encryption algorithm and the second decryption algorithm, to improve the security in the data interaction process.

[0067] According to some specific embodiments of the present application, with reference to Figure 1 , the data request platform comprises a data resource request server;

[0068] The data resource request server is configured to initiate a data authentication request to the authorization server.

[0069] The authorization server is configured with a third encryption algorithm and a third private key.

[0070] The authorization server is configured to encrypt the node relationship matching result according to a third encryption algorithm and a third private key to obtain an authorization data packet, and send the data authorization packet to the data resource request server.

[0071] In the embodiment, the data request platform comprises a data resource request server, and the data resource request server is configured to initiate a data authentication request to the authorization server. After the authorization server receives the node relationship matching result from the relationship server, the authorization server encrypts the node relationship matching result according to a third encryption algorithm agreed by the authorization server and the authentication server and a third private key of the authorization server to obtain an authorization data packet, and sends the authorization data packet to the data resource request server.

[0072] According to some specific embodiments of the present application, referring to Figure 1 , the data request platform further comprises a user operation terminal;

[0073] The user operation terminal is configured to obtain authorization information, wherein the authorization information comprises an authorized node, and the authorized node comprises a second user node and a second device node.

[0074] The data resource request server is further configured to encapsulate the authorization information and the authorization data packet to obtain a to-be-authenticated data packet.

[0075] In the embodiment, after receiving the encrypted authorization data packet, the data resource request server needs to obtain the authorization information of the device data of the user through the user operation terminal. The authorization information should be provided to the data resource request server after being manually authorized by the user on the user operation terminal, wherein the authorization information comprises an authorized node, and the authorized node comprises a second user node and a second device node authorized by the user. The data resource request server encapsulates the authorization data packet and the authorization information of the user into a to-be-authenticated data packet, and sends the to-be-authenticated data packet to the authentication server.

[0076] According to some specific embodiments of the present application, referring to Figure 1 , the data request authentication platform further comprises an authentication server;

[0077] The authentication server is configured to receive the to-be-authenticated data packet, and determine whether the to-be-authenticated data packet comprises the authorization information of the user. When the authorization information is not received, the data authentication request is not passed, and an authentication failure information is returned to the data resource request server.

[0078] In the embodiment, the authentication server receives the to-be-authenticated data packet of the data resource request server, and then verifies whether the authorization information exists in the message. When the authorization information does not exist, an authentication failure information is directly returned to the data resource request server.

[0079] According to some specific embodiments of the present application, the authentication server is configured with a third decryption algorithm and a third public key.

[0080] The authentication server is further configured to, when the authorization information is received, decrypt the authorization data packet in the to-be-authenticated data packet according to the third decryption algorithm and the third public key to obtain the node relationship matching result.

[0081] The authentication server is also configured to determine whether the authorized node and the node relationship matching result in the authorization information match, and if the authorized node and the node relationship matching result match, the data authentication request is passed, otherwise, the data authentication request is not passed.

[0082] In the embodiment, when the to-be-authenticated data packet has authorization information, the authentication server decrypts the authorized data packet in the to-be-authenticated data packet according to a third decryption algorithm that is equal to the authorization server and a third public key of the authorization server, to obtain a node relationship matching result. The triple of the node relationship matching result is authenticated, and if any triple has a feedback value indicating that the path does not exist, the authentication fails. After it is determined that all paths in the node relationship matching result exist, the authorized node is structured and processed in a triple, such as generating a triple <second device node A, permission flag, second user node B>. The triple of the authorization information is compared with the triple in the node relationship matching result, if the first device node and the second device node in the triple of the node relationship matching result match the second device node and the second user node in the triple of the authorization information, and the feedback value is exist, the authentication is passed. After the authentication is passed, the related device data can be returned to the data resource request server.

[0083] In some other embodiments, the data encryption mode negotiated between the authorization server and the relationship server can be asymmetric encryption or symmetric encryption. Similarly, the data encryption mode negotiated between the authorization server and the authentication server can be asymmetric encryption or symmetric encryption.

[0084] In the embodiment of the application, the authentication system for accessing data of Internet of Things devices has the following beneficial effects:

[0085] User personal data is not misused, and the acquisition of user personal privacy data is perceptible to the user;

[0086] The acquisition of data permission needs to satisfy multi-end authorization, and the user operation end and the authorization server are associated, and any party cannot pass the authentication without authorization.

[0087] In the process of data authorization, the authorization operation is also completed for a user authorization request, and the authentication server is configured to reject the permission operation, so that the processing pressure on the authorization server is reduced.

[0088] The embodiment of the application also provides an authentication method for accessing data of Internet of Things devices, which is described with reference to Figure 2 The authentication method for accessing data of Internet of Things devices includes but is not limited to steps S100, S200, S300, S400, S500 and S600.

[0089] In step S100, a data authentication request is obtained, wherein the data authentication request comprises a first device node, a first user node and a subject node.

[0090] In step S200, the first device node, the first user node and the subject node are matched by a preset node relationship tree to obtain a node relationship matching result.

[0091] In step S300, it is judged whether the authorization information of the user is received, and when the authorization information is not received, step S400 is executed, and when the authorization information is received, step S500 is executed.

[0092] In step S400, the data authentication request is not passed.

[0093] In step S500, it is judged whether the authorization node in the authorization information and the node relationship matching result match, and when the authorization node and the node relationship matching result match, step S600 is executed, and when the authorization node and the node relationship matching result do not match, step S400 is executed.

[0094] In step S600, the data authentication request is passed.

[0095] In some embodiments, the authentication method for accessing data of an Internet of Things device can be applied to a request authentication platform. After the request authentication platform obtains a data authentication request comprising a first device node, a first user node and a subject node, the first device node, the first user node and the subject node are matched by a preset node relationship tree to obtain a node relationship matching result. Then, it is judged whether the authorization information of the user is received, and when the authorization information is not received, the data authentication request is not passed. When the authorization information is received, it is judged whether the authorization node in the authorization information and the node relationship matching result match. If the authorization node and the node relationship matching result match, the data authentication request is passed, otherwise, the data authentication request is not passed. The first device node, the first user node and the subject node are matched by the preset node relationship tree to determine the legitimacy of the device and the user to be accessed, and it is judged whether the authorization information of the user is received. Based on the authorization node of the user, it is determined whether the data authentication request is passed. The user can perceive whether the data of the related device is accessed by the Internet of Things system. The authentication method for accessing data of an Internet of Things device improves the security of personal data of the user in the Internet of Things system.

[0096] It can be understood that the content of the request authentication platform in the above-mentioned authentication system embodiment for accessing IoT device data is applicable to the authentication method embodiment for accessing IoT device data. The functions specifically implemented by the authentication method embodiment for accessing IoT device data are the same as the request authentication platform of the above-mentioned authentication system embodiment for accessing IoT device data, and the beneficial effects achieved are also the same as the beneficial effects achieved by the request authentication platform of the above-mentioned authentication system embodiment for accessing IoT device data.

[0097] Reference Figure 3 , Figure 3 The diagram of an authentication device for accessing IoT device data provided by an embodiment of the present invention is as follows. The authentication device for accessing IoT device data according to the embodiment of the present invention includes one or more control processors and a memory. Figure 3 A control processor and a memory are taken as an example.

[0098] The control processor and the memory can be connected via a bus or other means. Figure 3 The bus connection is taken as an example.

[0099] The memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer executable programs. In addition, the memory may include a high-speed random access memory and may also include a non-transitory memory, such as at least one disk storage device, a flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory may optionally include a memory remotely located relative to the control processor, and these remote memories may be connected to the authentication device for accessing IoT device data via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0100] Those skilled in the art will understand that Figure 3 The device structure shown in does not constitute a limitation on the authentication device for accessing IoT device data, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0101] The non-transient software program and instructions required to implement the authentication method for accessing IoT device data applied to the authentication device for accessing IoT device data in the above-mentioned embodiment are stored in the memory. When executed by the control processor, the authentication method for accessing IoT device data applied to the authentication device for accessing IoT device data in the above-mentioned embodiment is executed.

[0102] The embodiments of the present application are described in detail above with reference to the drawings, but the present application is not limited to the above-described embodiments, and various changes can be made within the knowledge of those skilled in the art without departing from the spirit of the present application.

Claims

1. An authentication system for accessing IoT device data, characterized in that: Including data request platform and request authentication platform; The data request platform is used to initiate a data authentication request to the request authentication platform, wherein the data authentication request includes a first device node, a first user node and a subject node; The request authentication platform is used to perform node matching on the first device node, the first user node and the subject node through a preset node relationship tree to obtain a node relationship matching result; The request authentication platform is further configured to determine whether the user's authorization information has been received. If the authorization information has not been received, the data authentication request is rejected. If the authorization information has been received, the authentication platform determines whether the authorization node in the authorization information matches the node relationship matching result. If the authorization node matches the node relationship matching result, the data authentication request is approved. Otherwise, the data authentication request is rejected. The authorization node includes a second user node and a second device node. Wherein, the request authentication platform includes an authorization server and a relationship server; The authorization server is configured to construct a path directed graph of the first device node, the first user node, and the subject node according to a preset hierarchical relationship, wherein the subject node and the first user node are in a hierarchical relationship, the subject node and the first device node are in a hierarchical relationship, and the first user node and the first device node are in a parallel hierarchical relationship; The relationship server is used to traverse the node relationship tree according to the path in the path directed graph, determine the feedback value used to characterize whether the path exists, and obtain the node relationship matching result according to the feedback values ​​of all paths in the path directed graph; the node relationship tree is used to record the binding relationship between the subject and the device, the subject and the person, and the device and the person in the Internet of Things system.

2. The authentication system for accessing IoT device data according to claim 1, characterized in that: The authorization server is configured with a first encryption algorithm and a first private key, and the relationship server is configured with a first decryption algorithm and a first public key; The authorization server is used to encrypt the path directed graph according to the first encryption algorithm and the first private key to obtain a path directed graph data packet; The relationship server is used to receive the path directed graph data packet, decrypt the path directed graph data packet according to the first decryption algorithm and the first public key, and obtain the path directed graph.

3. The authentication system for accessing IoT device data according to claim 1, characterized in that: The relationship server is configured with a second encryption algorithm and a second private key, and the authorization server is configured with a second decryption algorithm and a second public key; The relationship server is used to encrypt the node relationship matching result according to the second encryption algorithm and the second private key to obtain a node relationship matching result data packet; The authorization server is used to receive the node relationship matching result data packet, decrypt the node relationship matching result data packet according to the second decryption algorithm and the second public key, and obtain the node relationship matching result.

4. The authentication system for accessing IoT device data according to claim 3, characterized in that: The data request platform includes a data resource request server; The data resource request server is used to initiate a data authentication request to the authorization server; The authorization server is configured with a third encryption algorithm and a third private key; The authorization server is used to encrypt the node relationship matching result according to the third encryption algorithm and the third private key to obtain an authorization data packet, and send the data authorization packet to the data resource request server.

5. The authentication system for accessing IoT device data according to claim 4, characterized in that: The data request platform also includes a user operation terminal; The user operating end user obtains the authorization information, wherein the authorization information includes an authorization node, and the authorization node includes a second user node and a second device node; The data resource request server is further configured to encapsulate the authorization information and the authorization data packet to obtain a data packet to be authenticated.

6. The authentication system for accessing IoT device data according to claim 5, characterized in that: The data request authentication platform also includes an authentication server; The authentication server is used to receive the data packet to be authenticated, determine whether the data packet to be authenticated includes the user's authorization information, and when the authorization information is not received, the data authentication request is rejected and authentication failure information is returned to the data resource request server.

7. The authentication system for accessing IoT device data according to claim 5, characterized in that: The authentication server is configured with a third decryption algorithm and a third public key; The authentication server is further configured to, upon receiving the authorization information, decrypt the authorization data packet in the data packet to be authenticated according to the third decryption algorithm and the third public key to obtain the node relationship matching result; The authentication server is further configured to determine whether the authorization node in the authorization information matches the node relationship matching result. If the authorization node matches the node relationship matching result, the data authentication request is passed; otherwise, the data authentication request is rejected.

8. An authentication method for accessing IoT device data, characterized in that: The following steps are involved: Obtaining a data authentication request, wherein the data authentication request includes a first device node, a first user node, and a subject node; Constructing a path directed graph of the first device node, the first user node, and the subject node according to a preset hierarchical relationship, wherein the subject node and the first user node are in a hierarchical relationship, the subject node and the first device node are in a hierarchical relationship, and the first user node and the first device node are in a parallel hierarchical relationship; Traversing the node relationship tree according to the path in the path directed graph, determining a feedback value used to characterize whether the path exists, and obtaining the node relationship matching result according to the feedback values ​​of all paths in the path directed graph; the node relationship tree is used to record the binding relationships between subjects and devices, subjects and personnel, and devices and personnel in the Internet of Things system; Determine whether the user's authorization information has been received; If the authorization information is not received, the data authentication request is rejected; When the authorization information is received, it is determined whether the authorization node in the authorization information matches the node relationship matching result. If the authorization node matches the node relationship matching result, the data authentication request is passed; otherwise, the data authentication request is not passed; the authorization node includes a second user node and a second device node.

9. An authentication device for accessing IoT device data, characterized in that: include: at least one processor; at least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the authentication method for accessing IoT device data as described in claim 8.

Images