Device access authentication method, device, and electronic device

Abstract

The present disclosure relates to a method, apparatus, and electronic device for device access authentication, and particularly to the field of computer technology; wherein the method comprises: receiving an access authentication request sent by a master device, the access authentication request including a token, first user identification information of the master device, and first device identification information, the token being generated and sent to the master device after the controlled device receives an instruction from the master device to obtain the token; verifying the remaining validity period of the token, the first user identification information, and the first device identification information, and sending a message to the master device indicating that the access authentication is passed after the verification is passed. The embodiment of the present disclosure determines whether the device's access authentication is passed by verifying the remaining validity period of the token, the first user identification information, and the first device identification information, without the need to record and maintain a whitelist, thereby reducing resource usage and improving the security level.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a method and apparatus for authenticating access to a device, and an electronic device. Background Art

[0002] The continuous development of the smart home industry has made people's lives more convenient and intelligent. Smart homes contain multiple smart devices, which can communicate with each other through the Message Queuing Telemetry Transport (MQTT) protocol.

[0003] For security reasons, the MQTT protocol stipulates that when a master device (such as a mobile phone or smart central control screen, etc.) is connected to a controlled device (such as a TV), the master device needs to provide its own identification information, user name and password so that the controlled device can verify the master device's identification information, user name and password, and send a MQTT connection success message to the master device after the verification is passed. Furthermore, in order to explicitly obtain the user's consent to authorize the master device, after the controlled device sends an MQTT connection success message to the master device, the controlled device pops up a interface to let the user choose whether to authorize the master device, or the controlled device verifies the random number check code sent by the master device. If the verification is correct, the master device is marked as a trusted device, added to the whitelist, and authorized.

[0004] In the prior art, when a controlled device receives an access authentication request from a master device, it checks its own stored whitelist to determine whether the current master device is an authorized trusted device, thereby determining whether the current master device is allowed to control the controlled device. However, the storage of the whitelist not only wastes resources, but also reduces the security level of remote control. If the whitelist is lost, the user can only re-authorize the master device, which is not very secure and is relatively cumbersome. Summary of the Invention

[0005] In order to solve the above-mentioned technical problems or at least partially solve the above-mentioned technical problems, the present disclosure provides a device access authentication method, apparatus and electronic device, which determines whether the device access authentication is passed by verifying the remaining validity period of the token, the first user identification information and the first device identification information. There is no need to record the whitelist, which reduces resource usage, can improve the security level, and is not limited by the physical storage of the device, and there is no need to re-maintain the whitelist.

[0006] To achieve the above objectives, the technical solutions provided by the embodiments of the present disclosure are as follows:

[0007] In a first aspect, the present disclosure provides a device access authentication method, applied to a controlled device, the method comprising:

[0008] Receiving an access authentication request sent by a master device, wherein the access authentication request includes a token, first user identification information of the master device, and first device identification information, and the token is generated by the controlled device after receiving an instruction from the master device to obtain the token and sent to the master device;

[0009] The remaining validity period of the token, the first user identification information, and the first device identification information are verified, and after the verification is passed, a message indicating that the access authentication is passed is sent to the main control device.

[0010] In a second aspect, the present disclosure provides a device access authentication method, applied to a master control device, the method comprising:

[0011] Sending an access authentication request to the controlled device, so that the controlled device verifies the remaining validity period of the token, the first user identification information of the master device, and the first device identification information, and sending a message to the master device indicating that the access authentication is passed after the verification is passed, wherein the access authentication request includes the token, the first user identification information of the master device, and the first device identification information, and the token is generated by the controlled device after receiving the instruction from the master device to obtain the token and sent to the master device;

[0012] Receive a message sent by the controlled device indicating that the access authentication is passed.

[0013] In a third aspect, the present disclosure provides a device access authentication apparatus, which is applied to a controlled device. The apparatus includes:

[0014] A first receiving module is configured to receive an access authentication request sent by a master device, wherein the access authentication request includes a token, first user identification information of the master device, and first device identification information; the token is generated by the controlled device after receiving an instruction from the master device to obtain the token and sent to the master device;

[0015] The verification module is used to verify the remaining validity period of the token, the first user identification information and the first device identification information, and send a message of access authentication passing to the main control device after the verification passes.

[0016] In a fourth aspect, the present disclosure provides an access authentication device for a device, which is applied to a master control device, and includes:

[0017] a sending module, configured to send an access authentication request to a controlled device, so that the controlled device verifies the remaining validity period of the token, the first user identification information of the master device, and the first device identification information, and sends a message to the master device indicating that the access authentication is successful after the verification is successful, wherein the access authentication request includes the token, the first user identification information of the master device, and the first device identification information, and the token is generated by the controlled device after receiving a token acquisition instruction from the master device and sent to the master device;

[0018] The second receiving module is configured to receive the access authentication passed message sent by the controlled device.

[0019] In a fifth aspect, the present disclosure further provides an electronic device, including:

[0020] one or more processors;

[0021] a storage device for storing one or more programs,

[0022] When the one or more programs are executed by the one or more processors, the one or more processors implement the access authentication method for the device as described in the first aspect and the second aspect.

[0023] In a sixth aspect, the present disclosure further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the access authentication method for the device as described in the first and second aspects.

[0024] The technical solution provided by the embodiment of the present disclosure has the following advantages compared with the existing technology: first, an access authentication request sent by the main control device is received, and the access authentication request includes a token, the first user identification information of the main control device, and the first device identification information. The token is generated and sent to the main control device after the controlled device receives the instruction to obtain the token sent by the main control device, and then the remaining validity period of the token, the first user identification information and the first device identification information are verified, and after the verification is passed, a message of access authentication passing is sent to the main control device. In the above solution, by verifying the remaining validity period of the token, the first user identification information and the first device identification information, it is determined whether the access authentication of the device is passed. There is no need to record and maintain a whitelist, which reduces resource usage and can improve the security level. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0026] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0027] Figure 1A A schematic diagram of an application scenario of an access authentication method for a device according to an embodiment of the present disclosure;

[0028] Figure 1B A schematic diagram of a device access authentication method provided in the prior art;

[0029] Figure 1C This is one of the explicit authorization methods provided in the prior art;

[0030] Figure 1D This is another explicit authorization method provided in the prior art;

[0031] Figure 2A A hardware configuration block diagram of an electronic device according to one or more embodiments of the present disclosure;

[0032] Figure 2B A schematic diagram of software configuration of an electronic device according to one or more embodiments of the present disclosure;

[0033] Figure 2C A schematic diagram showing an icon control interface of an application included in a controlled device according to one or more embodiments of the present disclosure;

[0034] Figure 3A A flowchart of a device access authentication method applied to a controlled device provided in an embodiment of the present disclosure;

[0035] Figure 3B A schematic diagram of the interaction process between a controlled device and a master device provided in an embodiment of the present disclosure;

[0036] Figure 4A A flowchart of another device access authentication method applied to a controlled device provided by an embodiment of the present disclosure;

[0037] Figure 4B A schematic diagram of the interaction process between another controlled device and a master device provided in an embodiment of the present disclosure;

[0038] Figure 5A A flowchart of a device access authentication method applied to a master device provided in an embodiment of the present disclosure;

[0039] Figure 5BA schematic diagram of the interaction process between a master device and a controlled device provided in an embodiment of the present disclosure;

[0040] Figure 6A A flowchart of a device access authentication method applied to a master device provided by another embodiment of the present disclosure;

[0041] Figure 6B A schematic diagram of an interaction process between a master device and a controlled device provided in another embodiment of the present disclosure;

[0042] Figure 6C A flowchart of a method for updating a token provided in an embodiment of the present disclosure;

[0043] Figure 6D A schematic diagram of updating a token through interaction between a master device and a controlled device according to an embodiment of the present disclosure;

[0044] Figure 7 A schematic diagram of the structure of an access authentication device for a controlled device provided in an embodiment of the present disclosure;

[0045] Figure 8 This is a structural diagram of an access authentication device for a device provided by an embodiment of the present disclosure and applied to a master device;

[0046] Figure 9 It is a structural diagram of an electronic device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0047] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features therein can be combined with each other in the absence of conflict.

[0048] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0049] The terms "first" and "second" in this disclosure are used to distinguish different objects rather than to describe a specific order of objects. For example, the terms "first user identification information" and "second user identification information" are used to distinguish different user identification information rather than to describe a specific order of user identification information.

[0050] The smart home industry is booming, and many families are opting for a complete smart home system, bringing significant intelligence and convenience to their lives. To control the multiple smart devices (i.e., smart appliances) included in a smart home, it's necessary to establish a control-and-controlled relationship between them. This inevitably requires information exchange between these devices, and the MQTT protocol facilitates this communication. MQTT is a client-server publish / subscribe messaging protocol. Any smart device that needs to communicate can connect to an MQTT server as a client, and the server forwards messages to the designated client based on the publish / subscribe mechanism. For example, consider the commonly used simulated remote control feature in televisions. A mobile phone, acting as a virtual remote control, can control the TV (a type of controlled device). A mobile phone (a type of master device) can act as an MQTT client, connecting to the TV's MQTT server and communicating with the TV's remote control module's MQTT client. Alternatively, a smart central control panel (a type of master device) can act as an MQTT client, connecting to the TV's MQTT server and communicating with the MQTT clients of other TV modules.

[0051] For security reasons, when client devices such as mobile phones and smart central control screens connect to a TV, the MQTT protocol requires the client device's username and password to be provided upon connection. However, connecting based solely on a username and password does not explicitly require user consent before authorizing the connected device (i.e., mobile phone, smart central control screen, etc.). Existing technologies prompt the user for authorization through a pop-up interface on the TV after the MQTT connection is established. For example, a prompt may appear stating, "Client device X is attempting to connect to your TV. Do you agree to authorize?" The user can then choose whether to authorize the client device as needed. Furthermore, for user experience reasons, user authorization should not be required every time a client device connects. Therefore, authorization is only requested for new devices, eliminating the need for re-authorization for previously authorized devices. Therefore, authorized client devices are typically marked as trusted devices and stored in a whitelist. This whitelist can be stored in a database so that when a controlled device receives an access authentication request from the master device, it can verify whether the master device is an authorized trusted device by consulting its stored whitelist.

[0052] Figure 1A A schematic diagram of an application scenario of an access authentication method for a device in an embodiment of the present disclosure. Figure 1A The mobile phone 100 serves as the main control device and the display device (ie, TV) 200 serves as the controlled device. When the mobile phone 100 wants to control the display device 200, access authentication of the mobile phone 100 is required to determine whether the mobile phone 100 is allowed to control the display device 200.

[0053] Figure 1B The present invention is a schematic diagram of an access authentication method for a device provided in the prior art. The master device sends an access authentication request to the controlled device. After receiving the access authentication request, the controlled device checks the stored whitelist to determine whether the master device is an authorized trusted device. If so, a message indicating that the access authentication is passed is sent to the master device, and the master device can then control the controlled device. However, in this method, the practice of storing the whitelist not only wastes resources, but also has a relatively low security level for remote control. Although there is explicit authorization from the user, it is only the first explicit authorization. If the master device is attacked by a hacker, it will continue to control the controlled device, and the user will be unable to resolve the problem. At the same time, the practice of storing the whitelist is limited by the physical storage of the machine. If a clearing operation such as restoring factory settings occurs, the whitelist will be cleared, and the user can only be asked to re-authorize and re-maintain the whitelist. The operation is relatively cumbersome and the security is not high.

[0054] Figure 1C It is one of the explicit authorization methods provided in the prior art. Figure 1C As shown, the first interface pops up on the controlled device. The first interface contains the message "Please enter the following number in your mobile device. 8788", a countdown of 20 in the upper right corner, and a cancellation option in the lower right corner. The mobile device is the master device that wants to control the controlled device. After seeing the first interface, the user enters "8788" in the mobile device. The controlled device verifies the "8788" sent by the mobile device. If the verification is correct, an authorization success message is sent to the mobile device, and the mobile device is marked as a trusted device and added to the whitelist.

[0055] Figure 1D This is another explicit authorization method provided in the prior art. Figure 1D As shown, a second interface pops up on the controlled device. This second interface contains the message "Client device X is trying to connect to your TV. Do you agree to the authorization?" In the lower right corner, you can choose to reject or accept. If the user selects "Agree" after seeing this second interface, a message indicating successful authorization is sent to client device X, and client device X is marked as a trusted device and added to the whitelist. If the user selects "Reject", a message indicating failed authorization is sent to client device X.

[0056] In order to solve the problems existing in the prior art, this embodiment proposes an access authentication method for a device. First, the controlled device receives an access authentication request sent by the master device. The access authentication request includes a token, the first user identification information of the master device, and the first device identification information. The token is generated and sent to the master device after the controlled device receives the instruction to obtain the token sent by the master device; then the controlled device verifies the remaining validity period of the token, the first user identification information, and the first device identification information, and sends an access authentication passed message to the master device after the verification is passed. By verifying the remaining validity period of the token, the first user identification information, and the first device identification information, it is determined whether the access authentication of the device is passed. There is no need to record and maintain a whitelist, which reduces resource usage and can improve the security level.

[0057] The device access authentication method provided by the embodiments of the present disclosure may be implemented based on the electronic device, or a functional module or functional entity in the electronic device.

[0058] The electronic device may be a personal computer (PC), a server, a mobile phone, a tablet computer, a laptop computer, a mainframe computer, etc., and the embodiments of the present disclosure do not specifically limit this.

[0059] For example, Figure 2A FIG. 1 is a block diagram of a hardware configuration of an electronic device according to one or more embodiments of the present disclosure. Figure 2AAs shown, the electronic device includes at least one of a tuner and demodulator 210, a communicator 220, a detector 230, an external device interface 240, a controller 250, a display 260, an audio output interface 270, a memory, a power supply, and a user interface 280. The controller 250 includes a central processing unit (CPU), a video processor, an audio processor, a graphics processor, RAM, ROM, and first to nth interfaces for input / output. The display 260 can be at least one of a liquid crystal display (LCD), an OLED display, a touch display, and a projection display, and can also be a projection device and a projection screen. The tuner and demodulator 210 receives broadcast television signals via wired or wireless reception, and demodulates audio and video signals, such as EPG audio and video data signals, from multiple wireless or wired broadcast television signals. The communicator 220 is a component used to communicate with external devices or servers using various communication protocols. For example, the communicator can include at least one of a Wi-Fi module, a Bluetooth module, a wired Ethernet module, or other network communication protocol chips or near-field communication protocol chips, as well as an infrared receiver. The electronic device can establish transmission and reception of control signals and data signals with the server 203 or the local control device 205 via the communicator 220. The detector 230 is used to collect signals from the external environment or external interactions. The controller 250 and the tuner 210 can be located in different separate devices. That is, the tuner 210 can also be located in an external device of the main device where the controller 250 is located, such as an external set-top box. The user interface 280 can be used to receive control signals from a control device (such as an infrared remote control).

[0060] In some embodiments, the controller 250 controls the operation of the electronic device and responds to user operations through various software control programs stored in the memory. The controller 250 controls the overall operation of the electronic device. The user can enter user commands through the graphical user interface (GUI) displayed on the display 260, and the user input interface receives the user input commands through the graphical user interface (GUI). Alternatively, the user can enter user commands by inputting specific sounds or gestures, and the user input interface recognizes the sounds or gestures through sensors to receive the user input commands.

[0061] In some embodiments, the "user interface" is a medium interface for interaction and information exchange between an application or operating system and a user, which realizes the conversion between the internal form of information and the form acceptable to the user. The commonly used form of user interface is the graphical user interface (GUI), which refers to a user interface related to computer operations displayed in a graphical manner. It can be an interface element such as an icon, window, and control displayed on the display screen of an electronic device, where the control can include at least one of the visual interface elements such as icons, buttons, menus, tabs, text boxes, dialog boxes, status bars, navigation bars, widgets, etc.

[0062] Figure 2B FIG. 1 is a schematic diagram of software configuration of an electronic device according to one or more embodiments of the present disclosure, such as Figure 2B As shown in the figure, the system is divided into four layers, from top to bottom: the application layer (referred to as the "application layer"), the application framework layer (referred to as the "framework layer"), the Android runtime (Android runtime) and system library layer (referred to as the "system runtime library layer"), and the kernel layer.

[0063] In some embodiments, at least one application program runs in the application layer. These applications can be window programs, system settings programs, clock programs, etc. that come with the operating system, or applications developed by third-party developers. In specific implementations, the applications in the application layer include but are not limited to the above examples.

[0064] In some embodiments, the system runtime layer provides support for the upper layer, namely the framework layer. When the framework layer is used, the Android operating system will run the C / C++ library contained in the system runtime layer to implement the functions to be implemented by the framework layer.

[0065] In some embodiments, the kernel layer is a layer between hardware and software, and includes at least one of the following drivers: audio driver, display driver, Bluetooth driver, camera driver, WIFI driver, USB driver, HDMI driver, sensor driver (such as fingerprint sensor, temperature sensor, pressure sensor, etc.), and power driver, etc.

[0066] Figure 2C This is a schematic diagram showing an icon control interface of an application included in a controlled device (mainly a smart playback device, such as a smart TV, a digital cinema system, or an audio and video server, etc.) according to one or more embodiments of the present disclosure, as shown in FIG. Figure 2CAs shown in , the application layer includes at least one application that can display corresponding icon controls on the display, such as: live TV application icon controls, video on demand (VOD) application icon controls, media center application icon controls, application center icon controls, game application icon controls, etc. Live TV applications can provide live TV through different signal sources. Video on demand (VOD) applications can provide videos from different storage sources. Unlike live TV applications, video on demand provides video display from certain storage sources. Media center applications can provide applications for playing various multimedia content. Application center can provide storage for various applications.

[0067] The device access authentication method provided in the embodiment of the present application can be implemented based on the above-mentioned electronic device.

[0068] In order to explain this solution in more detail, the following will be combined with the following examples. Figure 3A To explain, it is understandable that Figure 3A The steps involved may include more steps or fewer steps in actual implementation, and the order of these steps may also be different, so as to be able to implement the access authentication method for the device applied to the controlled device provided in the embodiment of the present application.

[0069] Figure 3A This is a flowchart of a method for access authentication of a controlled device, provided in an embodiment of the present disclosure. This embodiment is applicable to situations where information contained in an access authentication request is verified on the controlled device side. This method can be performed by an access authentication device for the controlled device, which can be implemented in hardware or software and can be configured in an electronic device.

[0070] like Figure 3A As shown, the method specifically includes the following steps:

[0071] S310, receiving an access authentication request sent by the master device, wherein the access authentication request includes a token, first user identification information of the master device, and first device identification information. The token is generated by the controlled device after receiving an instruction to obtain the token sent by the master device and sent to the master device.

[0072] Among them, the master device can be understood as a smart device that wants to control the controlled device in a scene with multiple smart devices such as a smart home scene or a smart office scene, such as a mobile phone, a smart central control screen, etc., and this embodiment does not limit this. The controlled device can be understood as a smart device that the master device wants to control, such as a TV, a personal computer, a digital cinema system or an audio and video server, etc., and this embodiment does not limit this. The first user identification information can be understood as information such as the user name, email address or mobile phone number corresponding to the user using the master device, and this embodiment does not limit this. The first device identification information can be understood as information that can uniquely represent the master device, such as the device name or device serial number of the master device. The token (TOKEN) can be an encrypted string, which contains information such as the device information of the master device that sends an instruction to obtain the token to the controlled device, user identification information, and the validity period of the token.

[0073] When the master device wants to control the controlled device, it sends an access authentication request containing a token, the master device's first user identification information, and the first device identification information to the controlled device. This access authentication request is sent based on the MQTT protocol. In response, the controlled device will receive the access authentication request sent by the master device.

[0074] S320: Verify the remaining validity period of the token, the first user identification information, and the first device identification information, and send a message indicating that the access authentication is passed to the main control device after the verification is passed.

[0075] The token has an expiration date, which is the maximum duration of use. If the remaining expiration date is 0, the token cannot be used and needs to be renewed. The remaining expiration date can be determined based on the token's expiration date and the difference between the current time of the controlled device and the time the token was generated.

[0076] After receiving the access authentication request from the master device, the controlled device verifies the remaining validity period of the token, the first user identification information, and the first device identification information. Specifically, the verification process determines whether the remaining validity period of the token is within a preset time and whether the first user identification information and the first device identification information are correct. If the verification is successful, the controlled device sends a message to the master device indicating that the access authentication has been passed. In response, the master device receives the access authentication has been passed message from the controlled device and can then control the controlled device.

[0077] The access authentication method for a device provided in this embodiment is as follows: first, the controlled device receives an access authentication request sent by the master device, the access authentication request includes a token, the first user identification information of the master device, and the first device identification information. The token is generated and sent to the master device after the controlled device receives the instruction to obtain the token sent by the master device; then the controlled device verifies the remaining validity period of the token, the first user identification information, and the first device identification information, and sends a message of access authentication success to the master device after the verification is passed. By verifying the remaining validity period of the token, the first user identification information, and the first device identification information, it is determined whether the access authentication of the device is passed. There is no need to record and maintain a whitelist, which reduces resource usage, can improve the security level, and is not limited by the physical storage of the device.

[0078] Figure 3B A schematic diagram of the interaction process between a controlled device and a master device provided in an embodiment of the present disclosure. Figure 3B The steps shown in have been described in detail in the above embodiments. To avoid repetition, they will not be repeated here.

[0079] Figure 4A The present disclosure provides a flowchart of another method for access authentication of a device, applied to a controlled device, provided in accordance with an embodiment of the present disclosure. This embodiment further expands and optimizes the above-described embodiment. Optionally, this embodiment can be applied to the controlled device to verify the remaining validity period of the token, the first user identification information, and the first device identification information, and to illustrate the specific process of sending a message indicating that access authentication has been passed to the master device if the verification passes.

[0080] like Figure 4A As shown, the method specifically includes the following steps:

[0081] S410: Receive an access authentication request sent by a master control device.

[0082] S420: Decrypt the access token to obtain second user identification information and second device identification information.

[0083] The token carries the second user identification information and second device identification information of the master device. The second user identification information can be understood as the user identification information corresponding to the master device that sends the instruction to obtain the token to the controlled device, such as a username, email address, or mobile phone number. The second device identification information can be understood as the device name or device serial number of the master device that sends the instruction to obtain the token to the controlled device, such as information that can uniquely identify the master device. The token includes an access token (access token). The access token can be understood as a token used to access the controlled device.

[0084] Since the token is an encrypted string, after the controlled device receives the access authentication request sent by the master device, it decrypts the token in the access authentication request and can obtain the device information (i.e., the second device identification information) of the master device that sends the instruction to obtain the token to the controlled device, the user identification information (i.e., the second user identification information) and the validity period of the token.

[0085] S430: Determine a first remaining validity period of the token according to a first difference between the current time of the controlled device and the generation time of the access token.

[0086] The access token is generated when the controlled device receives the token acquisition instruction from the master device. The timestamp included in the access token is the generation time of the access token.

[0087] The controlled device subtracts the current time of the controlled device from the generation time of the access token to obtain a first difference, and subtracts the validity period of the token from the first difference to obtain a first remaining validity period of the token.

[0088] For example, if the generation time of the access token is 8:00 a.m. on July 1, and the current time of the controlled device is 8:00 a.m. on July 2, the validity period of the token is 3 days, that is, 72 hours. Then, the current time of the controlled device and the generation time of the access token are subtracted, and the first difference obtained is 24 hours. The validity period of the token is subtracted from the first difference, and the first remaining validity period of the token is 48 hours.

[0089] S440: If it is determined that the first remaining validity period of the token does not exceed the first threshold, the first user identification information is consistent with the second user identification information, and the first device identification information is consistent with the second device identification information, then the verification passes.

[0090] The first threshold is a value corresponding to the validity period of the token, which can be preset, such as three days, or can be determined according to specific circumstances, and this embodiment does not limit this.

[0091] The controlled device compares the first remaining validity period of the token, that is, the first difference and the first threshold, and can determine the size relationship between the two, compare the first user identification information and the second user identification information, and compare the first device identification information and the second device identification information. If the first remaining validity period of the token does not exceed the first threshold, the first user identification information is consistent with the second user identification information, and the first device identification information is consistent with the second device identification information, it means that the verification is passed.

[0092] S450: Send a message indicating that the access authentication is successful to the main control device.

[0093] When the controlled device passes the verification, it sends a message of access authentication passed to the master device. Accordingly, the master device can control the controlled device.

[0094] The access authentication method for the device provided in this embodiment is as follows: first, the controlled device receives the access authentication request sent by the master device, decrypts the access token, and obtains the second user identification information and the second device identification information; then the controlled device determines the first remaining validity period of the token based on the first difference between the current time of the controlled device and the generation time of the access token; then the controlled device determines that the first remaining validity period of the token does not exceed the first threshold, the first user identification information is consistent with the second user identification information, and the first device identification information is consistent with the second device identification information, and then the verification is passed; finally, the controlled device sends a message of access authentication success to the master device. Through the above process, it is possible to determine whether the first remaining validity period of the token exceeds the first threshold, whether the master device sending the access authentication request and the master device sending the instruction to obtain the token to the controlled device are the same device, and whether the user identification information is consistent, so as to determine whether the access authentication of the master device sending the access authentication request is passed. The above process does not require recording and maintaining a whitelist, reduces resource usage, can improve the security level, and improve the user experience.

[0095] Figure 4B A schematic diagram of the interaction process between another controlled device and a master device provided in an embodiment of the present disclosure. Figure 4B The steps shown in have been described in detail in the above embodiments. To avoid repetition, they will not be repeated here.

[0096] In some embodiments, the token includes an access token and a refresh token, and the method further comprises:

[0097] receiving a token update message sent by a master device, wherein the token update message is sent based on the refresh token when the master device determines that a second remaining validity period of the token is less than a second threshold, or a second difference between a current time of the master device and a generation time of the access token exceeds the first threshold, and the second threshold is less than the first threshold;

[0098] According to the message of updating the token, the token is updated to obtain a target token, and the target token is sent to the main control device.

[0099] The refresh token is used to update the token. The second threshold can be preset, for example, 12 hours, or can be determined according to specific circumstances, which is not limited in this embodiment.

[0100] Specifically, the master device subtracts the current time of the master device from the generation time of the access token to obtain a second difference between the two, and subtracts the validity period of the token from the second difference to obtain the second remaining validity period of the token. When the master device determines that the second remaining validity period is less than the second threshold, it means that the token is about to expire, or when the master device determines that the second difference exceeds the first threshold, it means that the token has expired. At this time, the master device sends a message to the controlled device to update the token based on the refresh token. Accordingly, the controlled device can receive the message to update the token sent by the master device. After receiving the message to update the token sent by the master device, the controlled device updates the token based on the refresh token, mainly updates the timestamp, obtains the target token, and sends the target token to the master device. The corresponding master device can receive the target token sent by the controlled device. In the update process, the access token and refresh token will be updated at the same time.

[0101] In this embodiment, the token is updated by the above method, and there is no need to ask the user to explicitly authorize again when the token expires. A new access token and refresh token can be obtained directly, and the token can be updated when the token is about to expire, which can improve the user experience and avoid wasting time.

[0102] Figure 5A This is a flowchart of a method for authenticating device access to a master device, as provided in an embodiment of the present disclosure. This embodiment is applicable to situations where a method for authenticating device access to a master device is described. This method can be performed by a device authenticating device access device, as applied to the master device. This device can be implemented in hardware or software and can be configured in an electronic device.

[0103] like Figure 5A As shown, the method specifically includes the following steps:

[0104] S510, sending an access authentication request to the controlled device, so that the controlled device verifies the remaining validity period of the token, the first user identification information of the master device, and the first device identification information, and sends a message of access authentication success to the master device after the verification is passed, wherein the access authentication request includes the token, the first user identification information of the master device, and the first device identification information, and the token is generated and sent to the master device after the controlled device receives the instruction to obtain the token sent by the master device.

[0105] S520: Receive a message indicating that access authentication is passed, which is sent by the controlled device.

[0106] In this embodiment, the above S510-S520 illustrate the access authentication method for the device from the main control device side. The specific implementation process refers to S310-S320. In order to avoid repetition, it is not described here.

[0107] The access authentication method for the device provided in this embodiment is as follows: first, the master device sends an access authentication request to the controlled device, so that the controlled device verifies the remaining validity period of the token, the first user identification information of the master device, and the first device identification information, and sends a message of access authentication success to the master device after the verification is passed, wherein the access authentication request includes the token, the first user identification information of the master device, and the first device identification information, and the token is generated and sent to the master device after the controlled device receives the instruction to obtain the token sent by the master device; then the master device receives the access authentication success message sent by the controlled device, and determines whether the access authentication of the device is passed by verifying the remaining validity period of the token, the first user identification information, and the first device identification information. There is no need to record and maintain a whitelist, which reduces resource usage, can improve the security level, and is not limited by the physical storage of the device.

[0108] Figure 5B A schematic diagram of the interaction process between a master device and a controlled device provided in an embodiment of the present disclosure. Figure 5B The steps shown in have been described in detail in the above embodiments. To avoid repetition, they will not be repeated here.

[0109] Figure 6A This embodiment provides a flowchart of another method for access authentication of a device, applied to a master device, provided in the present disclosure. This embodiment further expands and optimizes the above-mentioned embodiment. Optionally, this embodiment primarily describes the specific process before sending an access authentication request to a controlled device.

[0110] like Figure 6A As shown, the method specifically includes the following steps:

[0111] S610: Send a connection request to the controlled device, so that the controlled device verifies the first user identification information, password information and first device identification information of the master device carried in the connection request, and sends a connection success message to the master device after the verification is successful.

[0112] Before the master device sends an access authentication request to the controlled device, it sends a connection request to the controlled device based on the MQTT protocol. The connection request includes the master device's first user identification information, password information, and first device identification information. After receiving the connection request, the controlled device verifies the master device's first user identification information, password information, and first device identification information contained in the connection request to determine whether the first user identification information, password information, and first device identification information are correct. If they are correct, the verification succeeds. After the verification succeeds, the controlled device sends a connection success message to the master device.

[0113] It should be noted that after the connection is successful, if the user's explicit authorization is not obtained, the master device cannot control the controlled device and needs to go through the explicit authorization process of S620-S630.

[0114] S620: Receive a connection success message sent by the controlled device, send a verification code generation instruction to the controlled device, so that the controlled device generates a target verification code based on the verification code generation instruction, and sends the target verification code to the master device.

[0115] The target check code may be a random number with a preset number of bits generated based on a random number generation mechanism.

[0116] The master device receives a successful connection message from the controlled device and sends a verification code generation instruction to the controlled device. After receiving the verification code generation instruction, the controlled device generates a target verification code based on the verification code generation instruction and sends the target verification code to the master device so that the subsequent user can enter the target verification code in the master device.

[0117] S630, receiving the target verification code sent by the controlled device, sending the target verification code input by the user to the controlled device, so that the controlled device verifies the target verification code, and sends an authorization success message to the master device after the verification is successful.

[0118] After receiving the target verification code, the master device inputs it. In response, the master device sends the target verification code entered by the user to the controlled device. The controlled device verifies the target verification code entered by the user to determine whether it matches the target verification code generated by the controlled device. If they match, the verification passes. After the verification passes, the controlled device sends a message to the master device confirming the successful authorization.

[0119] S640, receiving the authorization success message sent by the controlled device, sending a token acquisition instruction to the controlled device, so that the controlled device generates a token corresponding to the master device based on the first user identification information, the first device identification information and the timestamp information, and sends the token to the master device.

[0120] The master device receives the authorization success message from the controlled device and sends a token acquisition instruction to the controlled device. After receiving the instruction, the controlled device generates a token corresponding to the master device based on the first user identification information, the first device identification information, and the timestamp information using a corresponding encryption algorithm, and sends the token to the master device.

[0121] It should be noted that the encryption algorithm is not limited in this embodiment.

[0122] S650: Receive a token sent by the controlled device.

[0123] The master device receives the token sent by the controlled device.

[0124] S660, sending an access authentication request to the controlled device, so that the controlled device verifies the remaining validity period of the token, the first user identification information of the master device, and the first device identification information, and sends an access authentication success message to the master device after the verification is successful.

[0125] S670: Receive a message indicating that access authentication is passed, which is sent by the controlled device.

[0126] The access authentication method for the device provided in this embodiment first authorizes the master device through the above-mentioned S610-S670, and then performs access authentication after authorization, thereby ensuring the security of the MQTT connection. At the same time, there is no need to record and maintain a whitelist, which reduces resource usage, can improve the security level, and is not limited by the physical storage of the device.

[0127] Figure 6B A schematic diagram of the interaction process between another master control device and a controlled device provided in an embodiment of the present disclosure. Figure 6B The steps shown in have been described in detail in the above embodiments. To avoid repetition, they will not be repeated here.

[0128] Figure 6C This is a flow chart of a method for updating a token provided in an embodiment of the present disclosure. This embodiment mainly describes the specific process of token updating. Figure 6C As shown, the method specifically includes the following steps:

[0129] S6001, when it is determined that the second remaining validity period of the token is less than the second threshold, or the second difference between the current time of the master device and the generation time of the access token exceeds the first threshold, a message for updating the token is sent to the controlled device based on the refresh token, so that the controlled device updates the token according to the message for updating the token, obtains the target token, and sends the target token to the master device.

[0130] S6002: Receive a target token sent by the controlled device.

[0131] It should be noted that the above S6001-S6002 have been described in detail in the above embodiments, and will not be repeated here to avoid repetition.

[0132] In this embodiment, the token is updated by the above method, and there is no need to ask the user to explicitly authorize again when the token expires. A new access token and refresh token can be obtained directly, and the token can be updated when the token is about to expire, which can improve the user experience and avoid wasting time.

[0133] Figure 6DA schematic diagram of updating a token through interaction between a master device and a controlled device provided in an embodiment of the present disclosure. Figure 6D The steps shown in have been described in detail in the above embodiments. To avoid repetition, they will not be repeated here.

[0134] In some embodiments, the token includes an access token and a refresh token, and the method further comprises:

[0135] After the preset time, if the token update failure message is received from the controlled device, a connection request is sent to the controlled device. If a connection success message is received from the controlled device, a verification code generation instruction is sent to the controlled device until an authorization success message is received from the controlled device.

[0136] The preset time may be three months, which is much longer than the validity period of the token, and is not specifically limited in this embodiment.

[0137] Specifically, if the user does not use the master device to control the controlled device after a preset time, the controlled device cannot refresh its token. Accordingly, after the preset time, the master device receives a message from the controlled device indicating a token update failure. It then sends a connection request to the controlled device. Upon receiving a connection success message from the controlled device, it sends a verification code generation instruction to the controlled device. This continues until it receives a message from the controlled device indicating authorization success. This repeats S610-S630.

[0138] In this embodiment, if the user does not use the master device to control the controlled device after the preset time, the master device needs to be re-authorized, which can avoid security risks such as hacker attacks, improve the security level of the token, and ensure the user experience.

[0139] Figure 7 This is a schematic diagram of a device access authentication apparatus for a controlled device provided in an embodiment of the present disclosure. The apparatus is configured in an electronic device and can implement the device access authentication method for a controlled device described in any embodiment of the present application. The apparatus specifically includes the following:

[0140] A first receiving module 701 is configured to receive an access authentication request sent by a master device, wherein the access authentication request includes a token, first user identification information of the master device, and first device identification information. The token is generated by the controlled device after receiving a token acquisition instruction from the master device and sent to the master device.

[0141] The verification module 702 is used to verify the remaining validity period of the token, the first user identification information and the first device identification information, and send a message of access authentication success to the main control device after the verification is passed.

[0142] As an optional implementation of the embodiment of the present disclosure, the token carries the second user identification information and the second device identification information of the master device; the token includes an access token; the verification module 702 is specifically configured to:

[0143] Decrypting the access token to obtain the second user identification information and the second device identification information;

[0144] determining a first remaining validity period of the token according to a first difference between a current time of the controlled device and a generation time of the access token;

[0145] Verification passes if it is determined that the first remaining validity period of the token does not exceed a first threshold, the first user identification information is consistent with the second user identification information, and the first device identification information is consistent with the second device identification information;

[0146] Send a message indicating that the access authentication is passed to the main control device.

[0147] As an optional implementation of the embodiment of the present disclosure, the token includes an access token and a refresh token, and the device further includes:

[0148] an update message receiving module, configured to receive a token update message sent by a master device, wherein the token update message is sent based on the refresh token when the master device determines that a second remaining validity period of the token is less than a second threshold, or a second difference between a current time of the master device and a generation time of the access token exceeds the first threshold, and the second threshold is less than the first threshold;

[0149] The target token sending module is used to update the token according to the message of updating the token, obtain the target token, and send the target token to the main control device.

[0150] The access authentication device for a controlled device provided in the embodiments of the present disclosure can execute the access authentication method for a controlled device provided in any embodiment of the present disclosure, and has functional modules and beneficial effects corresponding to the execution method. To avoid repetition, they will not be described here.

[0151] Figure 8This is a schematic diagram of a device access authentication apparatus for a master device provided in an embodiment of the present disclosure. The apparatus is configured in an electronic device and can implement the device access authentication method for a master device described in any embodiment of the present application. The apparatus specifically includes the following:

[0152] A sending module 801 is configured to send an access authentication request to a controlled device, so that the controlled device verifies the remaining validity period of the token, the first user identification information of the master device, and the first device identification information, and sends a message to the master device indicating that the access authentication is successful after the verification is successful. The access authentication request includes the token, the first user identification information of the master device, and the first device identification information. The token is generated by the controlled device after receiving a token acquisition instruction from the master device and sent to the master device.

[0153] The second receiving module 802 is configured to receive the access authentication passed message sent by the controlled device.

[0154] As an optional implementation of the embodiment of the present disclosure, the device further includes:

[0155] a connection request sending module, configured to send a connection request to the controlled device, so that the controlled device performs verification based on the first user identification information, password information, and first device identification information of the master device carried in the connection request, and sends a connection success message to the master device after the verification is successful;

[0156] a first instruction sending module, configured to receive a connection success message sent by the controlled device, send a verification code generation instruction to the controlled device, so that the controlled device generates a target verification code based on the verification code generation instruction, and send the target verification code to the master control device;

[0157] a verification code sending module, configured to receive the target verification code sent by the controlled device, send the target verification code input by the user to the controlled device, so that the controlled device verifies the target verification code, and send an authorization success message to the master device after the verification passes;

[0158] a second instruction sending module, configured to receive a message of successful authorization sent by the controlled device, and send an instruction to obtain a token to the controlled device, so that the controlled device generates a token corresponding to the master device based on the first user identification information, the first device identification information, and the timestamp information, and sends the token to the master device;

[0159] The token receiving module is configured to receive the token sent by the controlled device.

[0160] As an optional implementation of the embodiment of the present disclosure, the token includes an access token and a refresh token, and the device further includes:

[0161] an update message sending module, configured to send a token update message to the controlled device based on the refresh token when determining that a second remaining validity period of the token is less than a second threshold, or a second difference between the current time of the master device and the generation time of the access token exceeds a first threshold, so that the controlled device updates the token according to the token update message to obtain a target token, and sends the target token to the master device, wherein the second threshold is less than the first threshold;

[0162] The target token receiving module is configured to receive the target token sent by the controlled device.

[0163] As an optional implementation of the embodiment of the present disclosure, the token includes an access token and a refresh token, and the device further includes:

[0164] The authorization module is configured to, after a preset time, upon receiving a message from the controlled device indicating that the token update has failed, send a connection request to the controlled device, and upon receiving a message from the controlled device indicating that the connection has succeeded, send a verification code generation instruction to the controlled device, until receiving a message from the controlled device indicating that the authorization has succeeded.

[0165] The access authentication device for a device applied to a master device provided in an embodiment of the present disclosure can execute the access authentication method for a device applied to a master device provided in any embodiment of the present disclosure, and has functional modules and beneficial effects corresponding to the execution method. To avoid repetition, they will not be described here.

[0166] An embodiment of the present disclosure provides an electronic device, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the access authentication method for the device described in any one of the embodiments of the present disclosure.

[0167] Figure 9 Schematic diagram of the structure of an electronic device provided by an embodiment of the present disclosure. Figure 9 As shown, the electronic device includes a processor 910 and a storage device 920; the number of processors 910 in the electronic device can be one or more. Figure 9 A processor 910 is taken as an example; the processor 910 and the storage device 920 in the electronic device can be connected via a bus or other means. Figure 9 The bus connection is taken as an example.

[0168] The storage device 920, as a computer-readable storage medium, can be used to store software programs, computer-executable programs, and modules, such as the program instructions / modules corresponding to the device access authentication method in the embodiments of the present disclosure. The processor 910 executes the software programs, instructions, and modules stored in the storage device 920 to execute various functional applications and data processing of the electronic device, thereby implementing the device access authentication method provided in the embodiments of the present disclosure.

[0169] The storage device 920 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and at least one application required for a function; the data storage area may store data created based on the use of the terminal, etc. In addition, the storage device 920 may include a high-speed random access memory and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the storage device 920 may further include a memory remotely located relative to the processor 910, and these remote memories may be connected to the electronic device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0170] An electronic device provided in this embodiment can be used to execute the access authentication method of the device provided in any of the above embodiments, and has corresponding functions and beneficial effects.

[0171] An embodiment of the present disclosure provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the various processes of the access authentication method of the above-mentioned device and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0172] The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0173] For ease of explanation, the above description has been made in conjunction with specific embodiments. However, the above discussion of some embodiments is not intended to be exhaustive or to limit the embodiments to the specific forms disclosed above. Based on the above teachings, various modifications and variations can be obtained. The selection and description of the above embodiments are intended to better explain the principles and practical applications, so that those skilled in the art can better use the embodiments and various different variations of the embodiments suitable for specific use considerations.

Claims

1. A device access authentication method, characterized in that: Applied to a controlled device, the method includes: After the controlled device is successfully connected to the master device and the controlled device authorizes the master device to control the controlled device, receiving an access authentication request sent by the master device, wherein the access authentication request includes a token, first user identification information of the master device, and first device identification information, and the token is generated by the controlled device based on the second user identification information and second device identification information of the master device after the controlled device receives an instruction from the master device to obtain the token, and sent to the master device; The remaining validity period of the token is verified, and whether the first user identification information and the first device identification information match the token is verified, and after the verification is passed, a message indicating that the access authentication is passed is sent to the main control device.

2. The method according to claim 1, characterized in that The token carries the second user identification information and the second device identification information of the master device; the token includes an access token; The verifying the remaining validity period of the token, the first user identification information, and the first device identification information, and sending a message indicating that access authentication is passed to the main control device if the verification passes, includes: Decrypting the access token to obtain the second user identification information and the second device identification information; determining a first remaining validity period of the token according to a first difference between a current time of the controlled device and a generation time of the access token; Verification passes if it is determined that the first remaining validity period of the token does not exceed a first threshold, the first user identification information is consistent with the second user identification information, and the first device identification information is consistent with the second device identification information; Send a message indicating that the access authentication is passed to the main control device.

3. The method according to claim 2, characterized in that The token includes an access token and a refresh token, and the method further includes: receiving a token update message sent by a master device, wherein the token update message is sent based on the refresh token when the master device determines that a second remaining validity period of the token is less than a second threshold, or a second difference between a current time of the master device and a generation time of the access token exceeds the first threshold, and the second threshold is less than the first threshold; According to the message of updating the token, the token is updated to obtain a target token, and the target token is sent to the main control device.

4. A device access authentication method, characterized in that: Applied to a master control device, the method includes: After the controlled device is successfully connected to the master device and the controlled device authorizes the master device to control the controlled device, an access authentication request is sent to the controlled device, so that the controlled device verifies the remaining validity period of the token and whether the first user identification information and the first device identification information of the master device match the token, and sends a message of access authentication success to the master device after the verification is passed, wherein the access authentication request includes the token, the first user identification information and the first device identification information of the master device, and the token is generated by the controlled device based on the second user identification information and the second device identification information of the master device after receiving the instruction to obtain the token sent by the master device, and sent to the master device; Receive a message sent by the controlled device indicating that the access authentication is passed.

5. The method according to claim 4, characterized in that Also includes: Sending a connection request to the controlled device, so that the controlled device performs verification based on the first user identification information, password information, and first device identification information of the master device carried in the connection request, and sending a connection success message to the master device after the verification is successful; receiving a connection success message sent by the controlled device, sending a verification code generation instruction to the controlled device, so that the controlled device generates a target verification code based on the verification code generation instruction, and sending the target verification code to the master control device; receiving the target verification code sent by the controlled device, sending the target verification code input by the user to the controlled device, so that the controlled device verifies the target verification code, and sending an authorization success message to the master device after the verification passes; receiving a message of successful authorization sent by the controlled device, sending a token acquisition instruction to the controlled device, so that the controlled device generates a token corresponding to the master device based on the first user identification information, the first device identification information, and the timestamp information, and sends the token to the master device; Receive the token sent by the controlled device.

6. The method according to claim 5, characterized in that The token includes an access token and a refresh token, and the method further includes: When it is determined that the second remaining validity period of the token is less than a second threshold, or a second difference between the current time of the master device and the generation time of the access token exceeds a first threshold, sending a token update message to the controlled device based on the refresh token, so that the controlled device updates the token according to the token update message to obtain a target token, and sends the target token to the master device, wherein the second threshold is less than the first threshold; Receive the target token sent by the controlled device.

7. The method according to claim 6, characterized in that The token includes an access token and a refresh token, and the method further includes: After the preset time, if the token update failure message is received from the controlled device, a connection request is sent to the controlled device. If a connection success message is received from the controlled device, a verification code generation instruction is sent to the controlled device until an authorization success message is received from the controlled device.

8. An access authentication device for a device, characterized in that: Applied to a controlled device, the apparatus comprises: a first receiving module, configured to receive an access authentication request sent by the master control device after the controlled device is successfully connected to the master control device and the controlled device authorizes the master control device to control the controlled device, wherein the access authentication request includes a token, first user identification information of the master control device, and first device identification information; the token is generated by the controlled device based on second user identification information and second device identification information of the master control device after the controlled device receives an instruction from the master control device to obtain the token, and is sent to the master control device; The verification module is used to verify the remaining validity period of the token and whether the first user identification information and the first device identification information match the token, and send a message of access authentication passing to the main control device after the verification is passed.

9. An access authentication device for a device, characterized in that: Applied to a main control device, the device includes: a sending module, configured to send an access authentication request to the controlled device after the controlled device is successfully connected to the master device and the controlled device authorizes the master device to control the controlled device, so that the controlled device verifies the remaining validity period of the token and whether the first user identification information and the first device identification information of the master device match the token, and sends a message to the master device indicating that the access authentication is passed after the verification is passed, wherein the access authentication request includes the token, the first user identification information and the first device identification information of the master device, and the token is generated by the controlled device based on the second user identification information and the second device identification information of the master device after receiving the instruction from the master device to obtain the token, and sent to the master device; The second receiving module is configured to receive the access authentication passed message sent by the controlled device.

10. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 7.

Images