Device access control method and apparatus, electronic device, and storage medium

Abstract

Embodiments of the present application disclose a device access control method and device, an electronic device and a storage medium. The device access control method can include: receiving an access request, wherein the access request includes first user attribute information of a requestor; querying a blockchain storing an access control policy of a controlled device according to the access request; determining whether the requestor is an authorized access user according to the first user attribute information and the queried access control policy; when the requestor is the authorized access user, allocating a use right of virtual power to the requestor from a virtual power resource pool established based on the capability of the controlled device; and sending a control instruction to the controlled device according to right range information of the use right, wherein the control instruction is used to control the controlled device to accept the access of the requestor within the use right. In this way, the access control policy is stored based on the blockchain, the security of storage is improved, and thus the security of device capability sharing based on the virtual power resource pool is improved.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) technology, and in particular to a device access control method and apparatus, electronic device and storage medium. Background Technology

[0002] In existing technologies, access control methods for smart devices often employ a centralized authorization decision-making entity, meaning a central trusted entity grants access control permissions. Currently, many smart devices lack two-way authentication or strong passwords to protect data security. For example, in daily use of smart home devices, simple four-digit PIN codes or QR code scanning are often used to verify the user and authorize network access. Furthermore, each smart home device often operates independently, failing to share its individual resources and capabilities. This access control method makes it relatively easy for third parties to crack, and the software applications controlling the devices have relatively low security, making it easy for malicious third-party devices to infiltrate. This poses a significant threat to the data security of smart devices. Therefore, current technologies cannot guarantee security while achieving integrated collaborative operation between smart devices. Summary of the Invention

[0003] In view of this, embodiments of the present invention provide a device access control method and apparatus, an electronic device, and a storage medium.

[0004] The technical solution of this invention is implemented as follows:

[0005] In a first aspect, embodiments of the present invention provide a device access control method, comprising:

[0006] Receive an access request, wherein the access request includes: the requester's first user attribute information;

[0007] The access request is used to query the blockchain that stores the access control policies for the controlled devices;

[0008] Based on the first user attribute information and the access control policy queried, determine whether the requester is an authorized user.

[0009] When the requester is an authorized user, the user is granted access rights to virtual capabilities from a virtual capability resource pool established based on the capabilities of the controlled device.

[0010] Based on the scope of the usage permission information, a control instruction is sent to the controlled device, wherein the control instruction is used to control the controlled device to accept access from the requester within the scope of the usage permission.

[0011] Further, determining whether the requester is an authorized user based on the first user attribute information and the queried access control policy includes:

[0012] Based on the access control policy queried, determine the second user attribute information of the authorized access user of the controlled device;

[0013] The first user attribute information is compared with the second user attribute information to determine whether the requester is an authorized user.

[0014] Furthermore, the step of allocating virtual capability usage rights to the requester from a virtual capability resource pool established based on the capabilities of the controlled device includes:

[0015] Based on the access request, determine the required target capabilities;

[0016] Identify the target devices that can provide the target capabilities, as recorded in the virtual capability resource pool established based on the capabilities of the controlled devices;

[0017] Grant the requester access to the target device.

[0018] Further, the step of sending control commands to the controlled device based on the permission scope information of the usage permission includes:

[0019] Obtain the list of authorized devices corresponding to the requester;

[0020] If the target device exists in the list of authorized devices, a control command is sent to the target device according to the permission scope information of the usage permission.

[0021] Furthermore, the method also includes:

[0022] Query the public key of the controlled device in the blockchain;

[0023] The step of sending control commands to the controlled device based on the permission scope information of the usage permissions includes:

[0024] The controlled device is authenticated based on the device's public key;

[0025] If the verification is successful, a control command is sent to the controlled device according to the permission scope information of the usage permission.

[0026] Furthermore, the method also includes:

[0027] A virtual capability resource pool is established based on the capabilities of at least one of the controlled devices;

[0028] Based on the second user attribute information of the authorized user of the controlled device and the device attribute information of the controlled device, the access control policy of the controlled device recorded in the virtual capability resource pool is determined.

[0029] The access control policy is stored in at least one block of the blockchain.

[0030] Furthermore, the method also includes:

[0031] After storage is completed, a hash operation is performed on each block based on the access control policy stored in each block to obtain the updated hash value of the block; wherein, the hash value of the block is stored in the next block in the blockchain;

[0032] Based on the updated hash value of the block, the hash value stored in the next block in the blockchain is updated.

[0033] Furthermore, the method also includes:

[0034] Based on the InterPlanetary File System (IPFS), operational data generated during the access control process of the controlled device is stored.

[0035] In a second aspect, embodiments of the present invention provide a device access control apparatus, comprising:

[0036] A receiving unit is configured to receive an access request, wherein the access request includes: the requester's first user attribute information;

[0037] The query unit is used to query the blockchain that stores the access control policies of the controlled devices based on the access request;

[0038] The determining unit is configured to determine whether the requester is an authorized user based on the first user attribute information and the queried access control policy.

[0039] The allocation unit is used to allocate virtual capability usage rights to the requester from a virtual capability resource pool established based on the capabilities of the controlled device when the requester is an authorized access user.

[0040] The sending unit is configured to send a control command to the controlled device according to the permission scope information of the usage permission, wherein the control command is configured to control the controlled device to accept the access of the requester within the usage permission.

[0041] Thirdly, embodiments of the present invention provide an electronic device, the electronic device comprising: a processor and a memory for storing a computer program capable of running on the processor;

[0042] When the processor runs the computer program, it performs the steps of the method described in one or more of the foregoing technical solutions.

[0043] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing computer-executable instructions; after being executed by a processor, the computer-executable instructions can implement the methods described in one or more of the foregoing technical solutions.

[0044] The device access control method provided in this invention includes: receiving an access request, wherein the access request includes: first user attribute information of the requester; querying a blockchain storing access control policies for controlled devices based on the access request; determining whether the requester is an authorized access user based on the first user attribute information and the queried access control policy; if the requester is an authorized access user, allocating virtual capability usage rights to the requester from a virtual capability resource pool established based on the capabilities of the controlled devices; and sending a control command to the controlled devices based on the scope information of the usage rights. Thus, based on the virtual capability resource pool, the open sharing and unified allocation of capabilities of multiple controlled devices can be realized, improving the utilization rate of device capability resources. Furthermore, by storing the access control policies of controlled devices on a blockchain, the decentralized storage characteristics of the blockchain effectively suppress the dependence of controlled devices on a centralized single authorization decision-making entity, greatly improving the security of device-related data storage and multi-device capability resource sharing. Attached Figure Description

[0045] Figure 1 This is a flowchart illustrating the device access control method provided in an embodiment of the present invention.

[0046] Figure 2 This is a flowchart illustrating the device access control method provided in an embodiment of the present invention.

[0047] Figure 3 This is a flowchart illustrating the device access control method provided in an embodiment of the present invention.

[0048] Figure 4 This is a flowchart illustrating the device access control method provided in an embodiment of the present invention.

[0049] Figure 5 This is a flowchart illustrating the device access control method provided in an embodiment of the present invention.

[0050] Figure 6 This is a flowchart illustrating the device access control method provided in an embodiment of the present invention.

[0051] Figure 7 This is a flowchart illustrating the device access control method provided in an embodiment of the present invention.

[0052] Figure 8 This is a schematic diagram of the structure of the device access control device provided in an embodiment of the present invention;

[0053] Figure 9 This is a schematic diagram of the process for smart home management in a residential setting, provided by an embodiment of the present invention.

[0054] Figure 10 This is a schematic diagram of the smart home management process in a visitor scenario provided by an embodiment of the present invention;

[0055] Figure 11 A flowchart illustrating the smart home device access control method provided in an embodiment of the present invention;

[0056] Figure 12 A schematic diagram of the blockchain storage process provided in an embodiment of the present invention;

[0057] Figure 13 This is a schematic diagram of the code implementation for storing operation data provided in an embodiment of the present invention;

[0058] Figure 14 This is a schematic diagram of the code implementation for obtaining operation data provided in an embodiment of the present invention;

[0059] Figure 15 This is a schematic diagram of UPnP device attributes provided in an embodiment of the present invention;

[0060] Figure 16 This is a schematic diagram of the process for obtaining virtual capability resources provided in an embodiment of the present invention. Detailed Implementation

[0061] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on this invention. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0062] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0063] In the following description, the terms "first, second, third" are used merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first, second, third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of the invention described herein can be implemented in an order other than that illustrated or described herein.

[0064] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein is for the purpose of describing embodiments of the invention only and is not intended to limit the invention.

[0065] like Figure 1 As shown, an embodiment of the present invention provides a device access control method, including:

[0066] S110: Receive an access request, wherein the access request includes: the requester's first user attribute information;

[0067] S120: Query the blockchain storing the access control policies of the controlled device according to the access request;

[0068] S130: Based on the first user attribute information and the queried access control policy, determine whether the requester is an authorized access user;

[0069] S140: When the requester is an authorized access user, allocate virtual capability usage rights to the requester from the virtual capability resource pool established based on the capabilities of the controlled device;

[0070] S150: Based on the permission scope information of the usage permission, send a control instruction to the controlled device, wherein the control instruction is used to control the controlled device to accept the access of the requester within the usage permission.

[0071] Here, the controlled device can be various smart devices, such as Universal Plug and Play (UPnP) devices and other Internet of Things (IoT) devices. The requester can be a user requesting access to and / or use of the controlled device. The first user attribute information is attribute information that identifies the user, such as the user's identity document (ID).

[0072] In this embodiment of the invention, the access request includes the requester's first user attribute information, and may also carry information such as the device information to be accessed or the capability resources to be obtained. The access control policy for the controlled device can be information set based on the user attribute information of the authorized user accessing the controlled device and the device attribute information of the controlled device, used to manage the requester's access to the controlled device.

[0073] In one embodiment, the blockchain is used to store access control policies for controlled devices. The responses to access requests and the device access control methods are all implemented within the blockchain, thus enabling automated policy control processes. Processing through smart contracts on the blockchain requires no human intervention; only the requirements recorded in the smart contracts need to be met. This significantly saves time, reduces costs, and ensures the overall process and user privacy are secure, as the policies are immutable.

[0074] In another embodiment, the controlled device is a smart home device that supports the UPnP protocol, such as a television or projector. Multiple smart home devices form a smart home system based on the UPnP protocol. Within the smart home system, a virtual capability resource pool is formed based on the capability resources of each smart home device, so as to realize the sharing and centralized allocation of capability resources among multiple devices.

[0075] For example, the access control policy of the corresponding controlled device can be queried from the blockchain based on the device information requested in the access request; or, the access control policy of each controlled device can be queried from the blockchain based on the virtual capabilities requested in the access request.

[0076] In one embodiment, based on the first user attribute information, a search or match can be performed within the queried access control policy to determine whether the first user attribute information belongs to the authorized access user information recorded in the access control policy. If the first user attribute information belongs to the authorized access user information recorded in the access control policy, then the requester corresponding to the first user attribute information is the authorized access user of the controlled device.

[0077] If the requester is determined to be an authorized user, the user rights to use the virtual capabilities required by the requester can be allocated to the requester in the virtual capability resource pool formed based on the UPnP protocol. For example, based on the virtual capability requested in the access request, a matching query is performed in the virtual capability resource pool to obtain the access permissions, usage permissions, etc. corresponding to the virtual capability, and then sent to the requester.

[0078] In another embodiment, upon determining that the requester is an authorized user, the virtual capability access permissions recorded in the access control policy are first obtained and sent to the requester. Based on the access permissions, the requester can learn about or browse the related controlled devices that possess the virtual capability, and thus can request access to one or more of these controlled devices again. Therefore, upon receiving a subsequent request, the user's access permission for the virtual capability can be returned to the requester.

[0079] In one embodiment, the usage permission includes permission scope information. For example, the permission scope information may record the instructions that the controlled device is allowed to respond to when the requester has usage permission to the controlled device and issues instructions to the controlled device. For instance, if the controlled device is a television, the corresponding permission scope information may include allowing the requester to perform control operations such as screen mirroring and volume adjustment on the controlled device, but not allowing the requester to perform operations such as restoring factory settings on the controlled device.

[0080] In another embodiment, the scope of access permissions can also be set according to access control policies. For example, the access control policy records the callable resources of the controlled device at different time periods, so different scopes of access permissions can be set accordingly, allowing the requester to perform different operations at different time periods. Alternatively, the access control policy records different levels of authorized access users of the controlled device, such as adults as level 1, minors as level 2, and guest members as level 3 among family members. Then, different scopes of access permissions can be set for different levels of authorized access users. After determining the level of authorized access user based on the requester's first user attribute information, the corresponding scope of access information is determined according to the level to provide different access permissions in a targeted manner.

[0081] It is understandable that control commands sent to the controlled device are used to instruct the controlled device to respond to the requester's instructions, and may include access commands, control commands, etc.

[0082] Thus, by establishing a virtual capability resource pool based on the capabilities of controlled devices, the systematization of controlled devices and the unified allocation and sharing of virtual capability resources among multiple devices are achieved, improving the utilization rate of capability resources and the responsiveness to capability resource demands. Building upon this, access control policies used as the basis for controlled device access decisions are stored using blockchain. Leveraging the distributed storage characteristics of blockchain, the dependence on centralized authorization decision-making entities is significantly reduced, improving the security and tamper-proof capabilities of information storage. Furthermore, by verifying the identity information of the requester based on blockchain storage, the privacy protection of information related to controlled devices and the security of device access are improved while optimizing device resource utilization. This enhances overall security performance while enabling integrated collaborative work among devices.

[0083] In some embodiments, such as Figure 2 As shown, S130 includes:

[0084] S131: Based on the access control policy queried, determine the second user attribute information of the authorized access user of the controlled device;

[0085] S132: Compare the first user attribute information with the second user attribute information to determine whether the requester is an authorized user.

[0086] In this embodiment of the invention, the access control policy may record second user attribute information of authorized users who are allowed to access the controlled device. The second user attribute information may be information with the same format as the first user attribute information, such as the user's ID information.

[0087] In one embodiment, the access control policy may record second user attribute information for at least one authorized user, and then compare the first user attribute information with at least one second user attribute information. If none of them match, the requester is not an authorized user; if a match is found with one of the second user attribute information during the comparison process, the requester is an authorized user.

[0088] In another embodiment, the access control policy may also record at least one second user attribute information in the form of a table, and then perform an existence query between the first user attribute information and the table. If the first user attribute information exists in the table, then the requester is an authorized user.

[0089] In this way, the identity of the requester can be verified based on the access control policies stored in the blockchain, which can not only ensure the security of access to the controlled device, but also improve the privacy of the authorized user's identity information storage based on the blockchain.

[0090] In some embodiments, such as Figure 3 As shown, S140 includes:

[0091] S141: When the requester is an authorized access user, determine the required target capability based on the access request;

[0092] S142: Determine the target devices that can provide the target capabilities, recorded in the virtual capability resource pool established based on the capabilities of the controlled devices;

[0093] S143: Assign usage rights to the target device to the requesting party.

[0094] In this embodiment of the invention, the target capability requested in the access request can be determined. Then, based on this target capability, a matching or search is performed in a virtual capability resource pool formed by the UPnP protocol and the capabilities of multiple controlled devices to determine whether the target capability exists in the virtual capability resource pool, and to identify the controlled device capable of providing the target capability as the target device. Here, the virtual capability resource pool may contain a correspondence between controlled devices and their capabilities.

[0095] In one embodiment, the controlled device is a smart home device equipped with the UPnP protocol. Based on the access request, the target capability required by the requester is determined to be the ability to project and display content within a certain size and resolution range. A search is performed in the virtual capability resource pool based on this target capability. If it is determined that a television can provide this target capability, then the television is identified as the target device.

[0096] In another embodiment, since a device possessing the target capability may not necessarily be able to provide that capability at the current moment, after identifying a controlled device with the target capability, a target device capable of providing the target capability can be determined based on parameters such as the controlled device's workload, resource consumption, and distance from the location where the requester issued the access request. For example, when a user needs to project their video onto a larger screen during a video conference on their mobile phone, they can choose the television closest to their current mobile phone location as the target device.

[0097] For example, determining the target device recorded in the virtual capability resource pool that can provide the target capability may include: determining the controlled device recorded in the virtual capability resource pool that has the target capability; if there is one controlled device that has the target capability, then the controlled device is determined to be the target device; if there are multiple controlled devices that have the target capability, then the controlled device with the lowest current resource occupancy rate is determined to be the target device.

[0098] Thus, a virtual capability resource pool built upon the capabilities of controlled devices can effectively establish a mapping relationship between controlled devices and virtual capability resources, enabling more granular and clear access control over devices. Based on this, the virtual capabilities required by the requester can be clearly identified, allowing for accurate searching within the virtual capability resource pool and providing the requester with the most suitable device to meet their current virtual capability needs.

[0099] In some embodiments, such as Figure 4 As shown, S150 includes:

[0100] S151: Obtain the list of authorized devices corresponding to the requester;

[0101] S152: If the target device exists in the list of authorized devices, then a control command is sent to the target device according to the permission scope information of the usage permission.

[0102] In this embodiment of the invention, the second user attribute information of the authorized user corresponds to an authorized device list. Optionally, different authorized users may have different authorized device lists, so as to provide different accessible devices to different users. For example, for children, for safety reasons, it may be undesirable for children to access or control smart cooking devices, so the smart cooking device may not be included in the authorized device list for children.

[0103] In one embodiment, after identifying the target device capable of providing the target capability, the system verifies whether the target device is within the requester's permitted access range based on the authorized device list corresponding to the requester. Here, the authorized device list may record device attribute information, such as that of the devices accessible to the authorized user. If the target device is found in the authorized device list, it is determined that the target device is accessible to the requester.

[0104] In this way, after the authorized user of the controlled device verifies the identity and permissions of the requester, the availability of the target device is verified based on the authorized device of the requester, thereby realizing two-way authentication between the requester and the device and further optimizing the control of device access.

[0105] In some embodiments, such as Figure 5 As shown, the method further includes:

[0106] S160: Query the public key of the controlled device in the blockchain;

[0107] The S150 includes:

[0108] S153: Authenticate the controlled device based on the device public key;

[0109] S154: If the verification is successful, a control command is sent to the controlled device according to the permission scope information of the usage permission.

[0110] In this embodiment of the invention, the device public key can be stored in the blockchain along with the access control policy of the controlled device, and used to verify the identity and validity of the controlled device to be provided with virtual capability resources.

[0111] In one embodiment, after determining the required target capability based on the access request and identifying the target device based on the target capability, the corresponding device public key can be queried in the blockchain based on the device attribute information of the target device, and the identity of the target device can be verified using the device public key. If the verification is successful, it indicates that the target device is a secure device that matches the public key recorded in the blockchain, and control commands can then be sent to it.

[0112] In another embodiment, sending control commands to the controlled device may include: sending control commands to the controlled device and monitoring the status of the controlled device, for example, receiving information generated and fed back by the controlled device based on the processing actions performed.

[0113] Thus, by storing the device's public key on the blockchain and verifying the identity of the target device based on the device's public key, the security of device information storage and device access control is further improved.

[0114] In some embodiments, such as Figure 6 As shown, the method further includes:

[0115] S101: Establish a virtual capability resource pool based on the capabilities of at least one of the controlled devices;

[0116] S102: Based on the second user attribute information of the authorized user of the controlled device and the device attribute information of the controlled device, determine the access control policy of the controlled device recorded in the virtual capability resource pool;

[0117] S103: Store the access control policy in at least one block of the blockchain.

[0118] In this embodiment of the invention, the capabilities of at least one controlled device can be obtained through the device attribute information of at least one controlled device. The device attribute information can be used to record the identification information, capability information, etc., of the controlled device. For example, if the controlled device is a smart home device under the UPnP protocol, the device attribute information of the controlled device can be obtained based on a preset UPnP discovery protocol, thereby determining the capabilities of the controlled device.

[0119] Here, the controlled device is a smart home device under the UPnP protocol, which can be a hardware device manufactured according to the UPnP standard. The device attribute information can be a device description file in Extensible Markup Language (XML) format, which records detailed information about the controlled device and its virtual capabilities, including the device name, original equipment manufacturer (OEM) or original design manufacturer (ODM), service information list, etc.

[0120] In one embodiment, obtaining the capabilities of at least one controlled device through device attribute information of at least one controlled device may include: receiving device attribute information sent by multicast from at least one controlled device, and obtaining the capabilities of the controlled device based on the device attribute information.

[0121] For example, if the controlled device is a smart home device under the UPnP protocol, it can send device attribute information via multicast to announce its online status and describe its functions. By monitoring and recording the fixed address and port used by the controlled device to send its device attribute information, controlled devices with the target capability can be located after the target capability is determined. Detailed information about the controlled device and its related virtual capabilities can be obtained from the device attribute information provided by the controlled device, and this information is recorded and integrated to establish a virtual capability resource pool.

[0122] In another embodiment, the access control policy may record second user attribute information and device attribute information. When determining the target capability based on the access request and determining the corresponding target device based on the target capability, the device attribute information recorded in the access control policy can be queried to obtain the virtual capability resource information of the controlled device. By comparing this information with the target capability, the target device capable of providing the target capability can be determined.

[0123] In one embodiment, the access control policy is signed and encrypted, for example, by using a message-digest algorithm (MD5), a secure hash algorithm (SHA), etc., and the encrypted access control policy is stored in at least one block of the blockchain.

[0124] Thus, a virtual capability resource pool built upon device capabilities enables resource sharing and seamless connectivity among multiple devices, facilitating unified processing and scheduling of access requests, and simplifying network implementation through unified allocation. Furthermore, storing relevant information on a blockchain and using the blockchain for requester and device authentication processes significantly enhances the security of controlled device capability resource sharing.

[0125] In some embodiments, such as Figure 7 As shown, the method further includes:

[0126] S104: After storage is completed, perform a hash operation on the block based on the access control policy stored in each block to obtain the updated hash value of the block; wherein, the hash value of the block is stored in the next block in the blockchain;

[0127] S105: Based on the updated hash value of the block, update the hash value stored in the next block in the blockchain.

[0128] In this embodiment of the invention, after the access control policy of a newly added controlled device is stored in the blockchain, since the block storage content has been updated, a hash operation can be performed on the block based on the block storage content to obtain the updated hash value. In the blockchain, except for the first block, each block stores the hash value of the previous block, thus forming a chain.

[0129] After storage is complete, a hash operation is performed on the block, and the updated hash value is stored in the next block. For example, after block 2 stores the access control policy for new controlled devices, a hash operation is performed on block 2 to obtain a new hash value. Since block 3 stores the old hash value of block 2, the new hash value is then stored in block 3, replacing the old hash value, thus updating the content of block 3. Further, a hash operation is performed on block 3, and the new hash value of block 3 is used to update block 4, and so on.

[0130] In another embodiment, each block may store not only the hash value of the previous block but also the hash value of the current block, serving as a basis for address backtracking. Therefore, after obtaining the updated hash value of a block, the hash values ​​stored in the current block and the hash values ​​stored in the next block must be updated synchronously.

[0131] In this way, by storing the hash value of the previous block in each block of the blockchain, the correlation and directional nature of each block are greatly improved. Based on this, if a malicious third-party device attempts to join the blockchain, its storage in a block will cause changes to the content of that block, resulting in a change in the hash value of that block, which in turn will change the hash value stored in the next block. This process continues, significantly increasing the cost for malicious third-party devices to enter the blockchain and effectively suppressing malicious intrusion by other devices.

[0132] In some embodiments, the method further includes:

[0133] Based on the InterPlanetary File System (IPFS), operational data generated during the access control process of the controlled device is stored.

[0134] In this embodiment of the invention, during the access control process of the controlled device, each processing action generates corresponding operation data, which is large in volume and often requires a significant amount of storage space. The operation data is stored using the InterPlanetary File System (IPFS), which is essentially a content-addressable, versioned, peer-to-peer hypermedia distributed storage and transmission protocol. A uniquely mapped hash identifier can be generated by hashing the operation data. The operation data can be stored on the public IPFS network, while the hash identifier of the operation data is stored in local storage space. When operation data needs to be retrieved, it can be searched based on the hash identifier to obtain the corresponding operation data.

[0135] Thus, IPFS-based storage allows operational data to be stored across the entire public network, eliminating the need for multi-level directories and instead using a unique hash identifier to access the corresponding operational data. This can save storage space to some extent.

[0136] like Figure 8 As shown, an embodiment of the present invention provides a device access control apparatus, characterized in that the apparatus includes:

[0137] The receiving unit 110 is configured to receive an access request, wherein the access request includes: the requester's first user attribute information;

[0138] Query unit 120 is used to query the blockchain that stores the access control policies of the controlled device according to the access request;

[0139] The determining unit 130 is used to determine whether the requester is an authorized access user based on the first user attribute information and the queried access control policy;

[0140] The allocation unit 140 is used to allocate virtual capability usage rights to the requester from a virtual capability resource pool established based on the capabilities of the controlled device when the requester is an authorized access user.

[0141] The sending unit 150 is configured to send a control command to the controlled device according to the permission scope information of the usage permission, wherein the control command is configured to control the controlled device to accept the access of the requester within the usage permission.

[0142] In some embodiments, the apparatus further includes:

[0143] A query unit is used to query the device public key of the controlled device in the blockchain;

[0144] The sending unit is specifically used to authenticate the controlled device based on the device public key;

[0145] If the verification is successful, a control command is sent to the controlled device according to the permission scope information of the usage permission.

[0146] In some embodiments, the apparatus further includes:

[0147] A setup unit is used to establish a virtual capability resource pool based on the capabilities of at least one of the controlled devices;

[0148] The decision unit is used to determine the access control policy of the controlled device recorded in the virtual capability resource pool based on the second user attribute information of the authorized user of the controlled device and the device attribute information of the controlled device.

[0149] A storage unit is used to store the access control policy in at least one block of the blockchain.

[0150] In some embodiments, the apparatus further includes:

[0151] A computing unit is configured to perform a hash operation on each block after storage is completed, based on the access control policy stored in each block, to obtain an updated hash value for the block; wherein the hash value of the block is stored in the next block in the blockchain;

[0152] An update unit is used to update the hash value stored in the next block in the blockchain based on the updated hash value of the block.

[0153] In some embodiments, the storage unit is further configured to:

[0154] Based on the InterPlanetary File System (IPFS), operational data generated during the access control process of the controlled device is stored.

[0155] The following provides a specific example in conjunction with any of the above embodiments:

[0156] This invention provides a blockchain-based distributed capability sharing access control method for smart homes, combining blockchain technology, the UPnP protocol, and access control. The system topology of this invention is as follows: Figure 9 and 10 As shown, the control process of smart home devices is described in two scenarios: resident and visitor.

[0157] 1. Core Process: The smart home management system, combined with blockchain technology, operates through four modules: smart home resource information module, smart home resource management module, smart home resource execution module, and smart home resource decision-making module. These modules work collaboratively, using relevant components to process user requests, such as... Figure 11 As shown, it consists of nine steps:

[0158] Step 1: The smart home owner (resident) uploads access control permission information for smart home devices through the resource information module, including user attribute information and UPnP device information. At the same time, the resource management module is used to configure access control policies corresponding to users and capability resources, and this information is stored in the blockchain.

[0159] Step 2: The smart home user (resident / visitor) initiates an access request to the smart home device through the resource execution module;

[0160] Step 3: The resource decision module calls the resource management module to obtain the access control policies corresponding to users and capability resources, and at the same time calls the resource information module to obtain the relevant attribute information of the smart home user;

[0161] Step 4: The resource decision module compares the attribute information of the smart home user with the attribute information set in the access control policy. If the determination result shows that the user is allowed, the correct result will be returned to the resource execution module.

[0162] Step 5: The resource execution module receives the decision results sent by the resource decision module, sorts out the open virtual capability usage permissions specified in the access control policy, and returns these permissions to the user. The smart home user can then obtain the permission to access the open virtual capabilities.

[0163] Step 6: Smart home users apply for access to open virtual capabilities through the resource execution module;

[0164] Step 7: The resource execution module transmits the request from the smart home device user to the resource decision module;

[0165] Step 8: The resource decision module searches for UPnP devices with relevant virtual capabilities, compares them with the smart home user's list of acquired resources, determines whether they are within the permitted range and confirms them, and returns the confirmation information to the resource execution module.

[0166] Step 9:

[0167] 9-1. The resource execution module returns a call permission response to the smart home user and sends a control behavior request to the relevant UPnP device.

[0168] 9-2. Once the smart home user receives the feedback, they can use the smart home devices with the granted permissions, and the process ends.

[0169] 2. The aforementioned smart home control system encrypts user and device attribute information on the blockchain. Since the hash of the previous block is used to calculate the hash of this block, the cost for a third party to add a malicious device to the blockchain would be extremely high. The blockchain adopts a block-chain data structure, where transactions occurring within a certain period are stored in blocks, and these blocks are linked together in chronological order using cryptographic algorithms. When storing data on the blockchain, trusted data signing is required, using digital fingerprint technologies such as MD5 and SHA to obtain the corresponding signature value. Therefore, each data block stores relevant information: the hash of the previous block and the hash of this block, user access control policies, device authorization public key information, etc. This allows for backtracking using the address of the previous block, thereby storing this data in a chain and improving data security. The signature processing in each block is as follows... Figure 12 As shown, 00006yjabc, 000007jlabc, 000008baced, and 000009yycae are all hash values ​​generated by hash operations.

[0170] 3. The aforementioned smart home management system will distribute and store the large amount of operational data that may be generated during the use of smart homes through IPFS. IPFS is essentially a content-addressable, versioned, peer-to-peer hypermedia distributed storage and transmission protocol. It features content addressability, generating unique hash identifiers through file content, thus saving on space costs to some extent. IPFS performs hash calculations on the smart home operational data, then uses this hash value to look up the corresponding stored content, and the returned hash value maps to the stored operational data.

[0171] For example, it can be achieved through, as Figure 13 The pseudocode shown implements the storage of operational data.

[0172] The hash value can be obtained by hashing the operation data of smart home devices.

[0173] When you need to retrieve uploaded smart home operation data, you can do so through methods such as... Figure 14 The code shown is used to obtain it.

[0174] 4. The smart home management system uses the UPnP protocol for device discovery and control. As a universal UPnP control point, UPnP has a standard protocol for automatic discovery and control, enabling zero-configuration for smart home devices. When a smart home device is added to the network, the UPnP discovery protocol allows it to multicast an announcement to the smart home management system indicating that the device is online and describing its functions. Simultaneously, the smart home management system monitors the fixed addresses and ports used by the devices to send messages, thereby identifying devices with the required virtual capabilities within the network. Through the device description file provided by the device, detailed information about the device and its related virtual capabilities is obtained and recorded in the smart home resource information module. After the user of the device has been verified and granted permission to use the smart home device, the smart home management system uses the device's public key on the blockchain for signature verification. Based on the device description, it selects the operation to be performed and learns about the services provided by the device, transmitting a control request to the designated smart home device, requesting the device to start the service and monitor the device's status. When the status changes, it takes corresponding actions. Simultaneously, the smart home device will return relevant information to the management system after executing the command.

[0175] 5. The smart home device mentioned is a hardware device manufactured according to the UPnP standard. It can be viewed as a "container" associated with services and containing regular devices, including a series of sub-devices and various services. Typically, detailed information about the device and its virtual capabilities is recorded in XML device description files. These device description files are generally processed by the manufacturer and contain device-related attributes, such as... Figure 15 As shown, this includes, for example, the device name, the equipment manufacturer (OEM) or solution provider (ODM), the device's Universally Unique Identifier (UUID), the device type (model name), and the service list (serviceList). The service list can record the service type (serviceType), service ID (serviceId), the Uniform Resource Locator (SCPDURL) for the service description, and the URL for service control (controlURL), etc.

[0176] After obtaining detailed descriptions of devices and services, the smart home control system can invoke corresponding service actions to control and operate smart home devices. This enables seamless connectivity between devices within a home or company network and simplifies network implementation. For example, when receiving a video conference call, the smart home control system can help switch a colleague's video feed from the small screen of a mobile phone to a television screen, providing a better interactive experience. The user submits a request to obtain the corresponding virtual capabilities, and the process is as follows... Figure 16 As shown in the figure. The virtual capability resource pool may include capability resources such as display, network communication, microphone, speaker, central processing unit (CPU), and global positioning system (GPS).

[0177] 6. The method for opening and sharing the capabilities of smart home devices can avoid "denial-of-service" attacks. These attacks are caused by third-party hackers making online announcements to the system, inducing it to request and download service content, thus consuming a large amount of system resources and causing the entire system's service speed to slow down or even stop. This method introduces blockchain and smart contract strategies into the automatic discovery and control process of UPnP devices. Device information is also encrypted and signed; only after device verification and confirmation can it be added to the blockchain, effectively preventing malicious device intrusion. Furthermore, device users can only operate UPnP devices after authorization, greatly improving device security and reliability.

[0178] This invention also provides an electronic device, which includes a processor and a memory for storing a computer program that can run on the processor. When the processor runs the computer program, it performs the steps of the methods described in one or more of the foregoing technical solutions.

[0179] This invention also provides a computer-readable storage medium storing computer-executable instructions. When executed by a processor, the computer-executable instructions can implement the methods described in one or more of the foregoing technical solutions.

[0180] The computer storage medium provided in this embodiment may be a non-instantaneous storage medium.

[0181] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0182] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0183] In addition, in the various embodiments of the present invention, each functional unit can be integrated into one processing module, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0184] In some cases, where any two of the above technical features do not conflict, they can be combined to form a new method or technical solution.

[0185] In some cases, where any one or two of the above technical features do not conflict, they can be combined to form a new equipment technical solution.

[0186] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0187] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A device access control method, characterized in that, include: Receive an access request, wherein the access request includes: the requester's first user attribute information; The access request is used to query the blockchain that stores the access control policies for the controlled devices; Based on the first user attribute information and the access control policy queried, determine whether the requester is an authorized user. When the requester is an authorized user, the user is granted access rights to virtual capabilities from a virtual capability resource pool established based on the capabilities of the controlled device. Based on the scope of the usage permission information, a control command is sent to the controlled device, wherein the control command is used to control the controlled device to accept access from the requester within the scope of the usage permission; The access control policy stored in at least one block of the blockchain is recorded in the virtual capability resource pool and determined based on the second user attribute information of the authorized user of the controlled device and the device attribute information of the controlled device. The step of allocating virtual capability usage rights to the requester from a virtual capability resource pool established based on the capabilities of the controlled device includes: Based on the access request, determine the required target capabilities; Identify the target devices that can provide the target capabilities, as recorded in the virtual capability resource pool established based on the capabilities of the controlled devices; Assign usage rights to the target device to the requesting party; The step of sending control commands to the controlled device based on the permission scope information of the usage permissions includes: Obtain the list of authorized devices corresponding to the requester; If the target device exists in the list of authorized devices, a control command is sent to the target device according to the permission scope information of the usage permission.

2. The method according to claim 1, characterized in that, The step of determining whether the requester is an authorized user based on the first user attribute information and the queried access control policy includes: Based on the access control policy queried, determine the second user attribute information of the authorized access user of the controlled device; The first user attribute information is compared with the second user attribute information to determine whether the requester is an authorized user.

3. The method according to claim 1, characterized in that, The method further includes: Query the public key of the controlled device in the blockchain; The step of sending control commands to the controlled device based on the permission scope information of the usage permissions includes: The controlled device is authenticated based on the device's public key; If the verification is successful, a control command is sent to the controlled device according to the permission scope information of the usage permission.

4. The method according to claim 1, characterized in that, The method further includes: After storage is completed, a hash operation is performed on each block based on the access control policy stored in each block to obtain the updated hash value of the block; wherein, the hash value of the block is stored in the next block in the blockchain; Based on the updated hash value of the block, the hash value stored in the next block in the blockchain is updated.

5. The method according to any one of claims 1 to 4, characterized in that, The method further includes: Based on the InterPlanetary File System (IPFS), operational data generated during the access control process of the controlled device is stored.

6. A device access control apparatus, characterized in that, The device includes: A receiving unit is configured to receive an access request, wherein the access request includes: the requester's first user attribute information; The query unit is used to query the blockchain that stores the access control policies of the controlled devices based on the access request; The determining unit is configured to determine whether the requester is an authorized user based on the first user attribute information and the queried access control policy. The allocation unit is used to allocate virtual capability usage rights to the requester from a virtual capability resource pool established based on the capabilities of the controlled device when the requester is an authorized access user. The sending unit is configured to send a control command to the controlled device according to the permission scope information of the usage permission, wherein the control command is configured to control the controlled device to accept the access of the requester within the usage permission; The access control policy stored in at least one block of the blockchain is recorded in the virtual capability resource pool and determined based on the second user attribute information of the authorized user of the controlled device and the device attribute information of the controlled device. The allocation unit is specifically used for: Based on the access request, determine the required target capabilities; Identify the target devices that can provide the target capabilities, as recorded in the virtual capability resource pool established based on the capabilities of the controlled devices; Assign usage rights to the target device to the requesting party; The sending unit is specifically used for: Obtain the list of authorized devices corresponding to the requester; If the target device exists in the list of authorized devices, a control command is sent to the target device according to the permission scope information of the usage permission.

7. An electronic device, characterized in that, The electronic device includes: a processor and a memory for storing computer programs capable of running on the processor; wherein, When the processor runs the computer program, it performs the steps of the device access control method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions; when executed by a processor, the computer-executable instructions can implement the device access control method as described in any one of claims 1 to 5.

Images