A device management method, system and apparatus

Abstract

The application discloses a device management method, system and device, and effectively protects the data privacy and security of the device by realizing the automatic management of the device. The method comprises the following steps: a second device sends an identity file to a first access control node, so as to instruct the first access control node to save the identity file into a file system, wherein the identity file comprises identity information of a first device and a public key of the second device; the second device receives a first identifier sent by the first access control node, the first identifier is used to read the identity file from the file system, the first identifier is generated by the file system after the first access control node sends the identity file to the file system, the first access control node sends the identity file to the file system after verifying that the second device and the information of the device associated with the first device in the association information are consistent and the verification is successful, and the association information is saved in a database node and a block chain.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of artificial intelligence, and in particular to a device management method, system and device. BACKGROUND

[0002] With the development of communication networks, more and more devices are connected to the network. For example, Internet of Things (IoT) devices are the cornerstone of the digital world and the interface between the digital world and the physical world. They are responsible for perceiving information from the physical world and sending it to the digital world, and also for receiving feedback from the digital world and performing actions.

[0003] Commonly used artificial-based methods for identity management of devices include identity issuance, recycling, and identity transfer, which are difficult to cope with the challenges brought by massive device identity management. Therefore, how to achieve more efficient identity management is a major challenge currently faced. SUMMARY

[0004] The present application provides a device management method, system and device, which effectively protects the data privacy and security of the device by realizing the automatic management of the device.

[0005] Therefore, the first aspect of the present application provides a device management system, comprising: a first device, a second device, a first access control node, a file system, a database node and a blockchain node, wherein the database node is deployed with a database for storing data;

[0006] The second device is configured to send an identity file to the first access control node, wherein the identity file comprises identity information of the first device and a public key of the second device.

[0007] The first access control node is configured to request associated information of the first device from the database node based on the identity file, wherein the associated information comprises public keys of devices associated with the first device, and the associated information is obtained from the blockchain node by the database node.

[0008] If the first access control node determines that the first device is associated with the second device through the associated information, the first access control node is further configured to send the identity file to the file system.

[0009] The file system is configured to save the identity file and feed back a first identifier corresponding to the identity file to the first access control node, wherein the first identifier is used to read the identity file from the file system.

[0010] In the embodiment of the present application, the database node can obtain the association information of the first device from the data stored in the blockchain node, and the association information includes the information of the device associated with the first device, which means that the first device has been registered with the blockchain service provider. After receiving the identity file of the first device, the first access control node can request the association information of the first device from the database node and perform verification. After successful verification, the identity file of the first device can be saved to the file system, and the first identifier fed back by the file system can be sent to the second device, so that the second device or other devices can use the first identifier to read the identity file from the file system. Therefore, in the device management system provided by the present application, the access control node can be used to control the access of the device accessing the system or the second device, verify the access rights of the device accessing the system, and only allow the device to perform further processing such as data storage or data reading when it has the access rights to the system, thereby improving the privacy and security of data transmission in the system.

[0011] In a possible implementation, before sending the identity file to the first access control node, the second device is further configured to send registration information to the blockchain node, and the registration information includes the public key of the first device and the public key of the second device.

[0012] The blockchain node is configured to, after verifying the public key of the second device and successful verification, write the public key of the device and the public key of the second device into the transaction information of the blockchain through the smart contract corresponding to the first device to register the first device.

[0013] The database node is configured to obtain the transaction information of the blockchain node, and save the public key of the first device and the public key of the second device included in the transaction information to the association information.

[0014] Therefore, in the embodiment of the present application, before the second device saves the identity file of the first device to the file system, the first device is also registered in the blockchain node, so that the blockchain node can select the smart contract matched with the first device to write the information of the first device into the transaction information of the blockchain, so that the database node can obtain the transaction information of the blockchain node to generate the association information of the first device, which can be used to indicate the device associated with the first device. Therefore, in the subsequent process, the access control node can verify the ownership of the first device according to the association information saved in the database, thereby improving the security of the data of the first device. Moreover, the first device can be automatically registered in combination with the smart contract of the blockchain, which can be applied to scenarios with a large number of devices and has strong generalization ability.

[0015] In a possible scenario, the second device is further configured to send the first identifier to the blockchain node.

[0016] The blockchain node is further configured to update the first identifier into the locally stored transaction information of the first device through the smart contract corresponding to the first device.

[0017] Therefore, in the embodiments of the present application, after the second device stores the identity file of the first device into the file system, the second device further stores the first identifier fed back by the file system into the blockchain node, so that the blockchain node stores the first identifier into the transaction information of the first device through the smart contract, and the database node can update the first identifier into the association information of the first device when the database node acquires the transaction information again, so that the association information of the first device has more complete information of the first device.

[0018] In a possible scenario, the second device is further configured to send an identity request message to the first access control node, the identity request message carrying information of the first device and a public key of the second device, the identity request message being used to request the identity file, and the information of the first device can include a public key, a name or other identifier of the first device, etc.

[0019] The first access control node is further configured to acquire the first identifier.

[0020] The first access control node is further configured to send the first identifier to the file system and receive the identity file fed back by the file system.

[0021] If the public key included in the identity file matches the public key of the second device, the first access control node is further configured to send the identity file to the second device.

[0022] In the embodiments of the present application, the second device can further request the identity file of the first device from the access control node, and the access control node can verify the public key carried in the received identity file and the public key carried in the identity request message, and if the two match, it indicates that the device corresponding to the identity file belongs to the second device, and the identity file can be transmitted to the second device. Therefore, in the embodiments of the present application, the access control node can verify the ownership of the device, thereby ensuring the security of the identity file of the device.

[0023] In a possible scenario, the first device is further configured to send an identity credential to the first access control node, the identity credential including an identifier of the first device, so as to request the identity file from the first access control node, and the identifier of the first device can include a name, a public key or a unique identifier allocated to the first device, etc.

[0024] The first access control node is further configured to send a second request message to the database node if the identity credential is verified and the verification is successful, the second request message including the identifier of the first device.

[0025] The database node is further configured to feed back the first identifier to the first access control node.

[0026] The first access control node is further configured to send the first identifier to the file system and receive an identity file fed back by the file system.

[0027] If the identifier included in the identity file matches the identifier in the identity credential, the first access control node is further configured to send the identity file to the first device.

[0028] In the embodiments, the first device can query the identity file from the access control node, the access control node can verify the identity credential of the first device, and the identity file is sent to the first device only after the verification is successful, thereby improving the data security of the first device.

[0029] In a possible implementation, the device management system further includes a registration server.

[0030] The first device is specifically configured to send the identity credential to the registration server through an encrypted pipe.

[0031] The registration server is configured to forward the identity credential to the access control server through the encrypted pipe.

[0032] The first access control node is specifically configured to send the identity file to the registration server.

[0033] The registration server is specifically configured to forward the identity file to the first device.

[0034] Therefore, in the embodiments, the data transmitted between the first device and the first access control node can be transmitted through the encrypted pipe between the first device and the registration server, thereby improving the security of the data transmitted between the first device and the first access control node.

[0035] In a possible implementation, the device management system further includes a second access control node.

[0036] The first device is configured to send a third request message to the second access control node.

[0037] The second access control node is configured to obtain a second identifier of the identity file after verifying the third request message and the verification is successful.

[0038] The second access control node is further configured to feed back the second identifier to the first device.

[0039] The first device is further configured to save the identity file when the first identifier and the second identifier match.

[0040] In the embodiments of the present application, a plurality of access control nodes can be set in the device management system, and after obtaining the identity file through the first access control node, the second identity can be obtained through the second access control node. Then, it is verified whether the first identity and the second identity match, and if they match, it is determined that the identity file is a correct file, and the identity file can be saved, so that the accuracy of the obtained identity file can be ensured.

[0041] In a possible implementation, the first access control node is specifically configured to send a first request message to the database node and receive the first identity fed back by the database node, and the first request message includes the public key of the first device.

[0042] Therefore, in the embodiments of the present application, the first access control node can obtain the first identity from the database, so that the identity file of the first device can be requested from the file system based on the first identity, and the identity file can be successfully obtained.

[0043] In a possible implementation, the first identity can also be sent to the first access control node by the second device, or the first access control node can save the first identity in the registration process of the first device, and then the first identity can be extracted from the locally saved data when the identity file is queried.

[0044] In a possible implementation, the device management system further includes a third device;

[0045] The second device is further configured to add the information of the third device in the identity file to obtain an updated identity file, and the information of the third device includes the public key of the third device;

[0046] The second device is further configured to send the updated identity file to the first access control node;

[0047] The first access control node is further configured to send the updated identity file to the file system and receive the third identity fed back by the file system;

[0048] The first access control node is further configured to send the third identity to the second device;

[0049] The second device is further configured to send the third identity to the third device, and the third identity is used to request the updated identity file from the file system;

[0050] The second device is further configured to send the update information to the blockchain node, and the update information includes the public key of the first device, the public key of the third device, and the third identity;

[0051] The blockchain node updates the transaction information using the update information to obtain updated transaction information;

[0052] The database node is also configured to obtain the updated transaction information, update the association information according to the updated transaction information, and obtain updated association information.

[0053] In this embodiment, the second device can transfer the first device to the third device, the second device writes the information of the third device into the identity file of the first device, and sends the identity file to the access control node to inform the blockchain node that the first device has been transferred, so that the database node obtains the transaction information of the blockchain node and updates the association information of the first device. Therefore, in the embodiment of the application, the transfer of the device can be completed by the second device by modifying the identity file of the first device, without manual operation, and the ownership transfer of the device can be completed.

[0054] In a possible implementation, the first identifier is obtained by performing an operation on the identity file by a hash algorithm.

[0055] Second aspect. The application provides a device management method, applied to a device management system, the device management system comprising: a second device, a first access control node, a file system, a first device, a database node and a blockchain node, the database node being deployed with a database for storing data, the first device being associated with the second device, the method comprising:

[0056] The second device sends the identity file to the first access control node to instruct the first access control node to save the identity file to the file system, the identity file comprising the public key of the first device and the public key of the second device; the second device receives the first identifier sent by the first access control node, the first identifier being used to read the identity file from the file system, wherein the first identifier is generated by the file system after the first access control node sends the identity file to the file system, the identity file being sent by the first access control node to the file system after verifying that the second device is associated with the information of the device in the association information and the verification is successful, the association information being obtained by the first access control node from the blockchain node, and the association information being saved in the database node.

[0057] Therefore, in the embodiments of the present application, the database node can obtain the association information of the first device from the data stored in the blockchain node, and the association information includes the information of the device associated with the first device, which means that the first device has been registered with the blockchain service provider. After receiving the identity file of the first device, the first access control node can request the association information of the first device from the database node and perform verification. After successful verification, the identity file of the first device can be saved to the file system, and the first identifier fed back by the file system can be sent to the second device, so that the second device or other devices can use the first identifier to read the identity file from the file system. Therefore, the device management method provided by the present application can use the access control node to perform access control on the device accessing the system or the second device, verify the access rights of the device accessing the system, and only allow the device to perform further processing such as data storage or data reading when it has the access rights to the system, thereby improving the privacy and security of data transmission in the system.

[0058] In a possible implementation, before the second device sends the identity file to the first access control node, the above method can further include: the second device sends registration information to the blockchain node, the registration information including the information of the first device (such as the public key, name or other identifier of the first device, etc.) and the public key of the second device, the registration information being used to instruct the blockchain node to save the information of the first device and the public key of the second device in the transaction information of the first device through the smart contract corresponding to the first device, and the transaction information being used for the database node to generate the association information of the first device.

[0059] Therefore, in the embodiments of the present application, before the second device uploads the identity file of the device, the device can also be registered with the blockchain node, so that the database node has the association information of the device, and the access control server can verify whether the second device has the permission to upload the identity file based on the association information of the device, thereby avoiding unauthorized devices to modify the identity file of the device and improving the data security of the device.

[0060] In a possible implementation, the above method can further include: the second device sends the first identifier to the blockchain node to instruct the blockchain node to update the first identifier to the transaction information of the first device.

[0061] In the embodiments of the present application, the first identifier indicating the identity file can also be updated to the association information of the device through the blockchain, so that the association information of the device includes more complete information.

[0062] In a possible implementation, the method further includes: the second device sending the first identification to the first access control node; and the second device receiving an identity file sent by the first access control node, the identity file being obtained by the first access control node from the file system by using the first identification.

[0063] In the implementation, the second device can query the identity file by using the first identification, so that the second device can query the identity file of the device.

[0064] In a possible implementation, the device management system further includes a second access control node, and the method further includes: the second device sending a third request message to the second access control node; the second device receiving a second identification sent by the second access control node; and the second device saving the identity file if the second identification matches the first identification.

[0065] Therefore, in the implementation, the second device can request the identity file and the corresponding identification from the plurality of access control nodes respectively, and when the identifications fed back by the plurality of access control nodes match, it indicates that the received identity file is accurate, and the accurate identity file can be saved.

[0066] In a possible implementation, the method further includes: the second device receiving information of a third device, the information of the third device including a public key of the third device; the second device adding the public key of the third device in the identity file to obtain an updated identity file, the updated identity file indicating that the first device is associated with the third device; the second device sending the updated identity file to the first access control node, to instruct the first access control node to send the updated identity file to the file system and receive a third identification fed back by the file system; and the second device receiving the third identification sent by the first access control node, the third identification being used to request the updated identity file from the file system.

[0067] Therefore, in the implementation, when the device requests its identity file by itself, the access control node can verify whether the device has the access right of the identity file according to the identity credential of the requester, and after the verification succeeds, the identity file can be fed back to the requester, thereby improving the security of the identity file of the device.

[0068] In a third aspect, the present application provides a device management method applied to a device management system, the device management system comprising a second device, a first access control node, a file system, a first device, a database node and a blockchain node, the database node being deployed with a database for storing data, the first device being associated with the second device, and the method comprising: receiving, by the first access control node, an identity file sent by the second device, the identity file comprising identity information of the first device and a public key of the second device, the identity file being indicative of the association between the first device and the second device; requesting, by the first access control node, the association information of the first device from the database node based on the identity file, the association information comprising public keys of devices associated with the first device, the association information being obtained by the database node from the blockchain node; if the first access control node determines that the first device is associated with the second device through the association information, requesting, by the first access control node, the file system to send the identity file to indicate the file system to save the identity file; receiving, by the first access control node, a first identifier fed back by the file system, and sending, by the first access control node, the first identifier to the second device, the first identifier being used to read the identity file from the file system.

[0069] Therefore, in the embodiments of the present application, the database node can obtain the association information of the first device from the data saved in the blockchain node, the association information comprising information of devices associated with the first device, which is equivalent to that the first device has been registered with the blockchain service provider, and after receiving the identity file of the first device, the first access control node can request the association information of the first device from the database node and perform verification, and after the verification is successful, the first access control node can save the identity file of the first device to the file system and send the first identifier fed back by the file system to the second device, so that the second device or other devices can use the first identifier to read the identity file from the file system. Therefore, the device management method provided by the present application can use the access control node to perform access control on the devices or the second device accessing the system, verify the permission of the devices accessing the system, and only allow the devices to perform further processing such as data storage or data reading when the devices have the permission to access the system, thereby improving the privacy and security of data transmission in the system.

[0070] In a possible implementation, the first access control node can request the association information of the first device from the database node based on the identity file, which can comprise: if the first access control node determines that the identity file is complete according to the signature carried in the identity file, requesting the association information of the first device from the database node based on the identity file.

[0071] Therefore, in the embodiments of the present application, the access control node requests the association information of the device from the database node after determining that the identity file is complete, which is equivalent to requesting the association information of the device only when it is ensured that the identity file is complete.

[0072] In a possible implementation, the method further includes: the first access control node receiving an identity request message sent by the second device, the identity request message carrying a public key of the first device and a public key of the second device, the identity request message being used to request an identity file; the first access control node sending a first request message to the database node, the first request message including information of the first device, such as the public key, name or other identifier of the first device; the first access control node receiving the first identifier sent by the database node; the first access control node sending the first identifier to the file system and receiving the identity file fed back by the file system; and the first access control node sending the identity file to the second device if the public key included in the identity file matches the public key of the second device.

[0073] Therefore, in the embodiments of the present application, the access control node can request the first identifier from the database node, and thus the identity file can be read from the file system based on the first identifier.

[0074] In a possible implementation, the method further includes: the first access control node receiving an identity credential sent by the first device, the identity credential including an identifier of the first device; the first access control node verifying the identity credential; the first access control node sending a second request message to the database node if the identity credential is verified successfully, the second request message including the identifier of the first device; the first access control node receiving the first identifier sent by the database node; the first access control node sending the first identifier to the file system and receiving the identity file fed back by the file system; and the first access control node sending the identity file to the first device if the identifier included in the identity file matches the public key identifier of the first device.

[0075] Therefore, in the embodiments of the present application, the access control node can perform access control on the identity file queried by the device, and the identity file is transmitted to the device only after the identity credential is verified successfully, thereby improving the data security of the device.

[0076] In a possible implementation, the device management system further includes: a registration server;

[0077] The first access control node receiving an identity credential sent by the first device includes: the first access control node receiving an identity credential forwarded by the registration server, the identity credential being sent by the first device to the registration server through an encrypted pipe between the first device and the registration server;

[0078] The first access control node sending an identity file to the first device can include: the first access control node sending the identity file to the first device through the registration server.

[0079] Therefore, in the embodiments of the present application, the data transmitted between the first device and the first access control node can be transmitted through the encrypted channel with the registration server, thereby improving the security of the data transmission between the first device and the first access control node.

[0080] In a possible implementation, the method can further include: the first access control node receiving the updated identity file sent by the second device; the first access control node sending the updated identity file to the file system and receiving the third identifier fed back by the file system; and the first access control node sending the third identifier to the second device, the third identifier being used to request the updated identity file.

[0081] In the embodiments, the second device can transfer the first device to a third device, the second device writes the information of the third device into the identity file of the first device and sends the information to the access control node to inform the blockchain node that the first device has been transferred, so that the database node obtains the transaction information of the blockchain node and updates the association information of the first device. Therefore, in the embodiments of the present application, the transfer of the device can be completed by the second device by modifying the identity file of the first device, without manual operation, and the ownership transfer of the device can be completed.

[0082] In a fourth aspect, the present application provides a device management method applied to a device management system, the device management system including a second device, a first access control node, a file system, a first device, a database node and a blockchain node, the database node being deployed with a database for storing data, the first device being associated with the second device, and the method including: the blockchain node receiving registration information sent by the second device, the registration information including a public key of the first device and a public key of the second device; the blockchain node writing the public key of the first device and the public key of the second device into the transaction information of the blockchain through a smart contract corresponding to the first device, so that, after the database node obtains the transaction information of the blockchain node, the database node saves the public key of the first device and the public key of the second device included in the transaction information into the association information of the first device, the association information including the information of the device associated with the first device.

[0083] In the embodiments of the present application, the database node can obtain the association information of the first device from the data stored in the blockchain node, and the association information includes the information of the device associated with the first device, which means that the first device has been registered with the blockchain service provider. After receiving the identity file of the first device, the first access control node can request the association information of the first device from the database node and perform verification. After successful verification, the identity file of the first device can be saved to the file system, and the first identifier fed back by the file system can be sent to the second device, so that the second device or other devices can use the first identifier to read the identity file from the file system. Therefore, in the device management system provided by the present application, the access control node can be used to control the access of the device accessing the system or the second device, verify the access rights of the device accessing the system, and only allow the device to perform further processing such as data storage or data reading when it has the access rights to the system, thereby improving the privacy and security of data transmission in the system.

[0084] In a possible implementation, the above method can further include: receiving, by the blockchain node, the first identifier, the first identifier being used to request the identity file of the first device, the first identifier being generated by the file system after saving the identity file; and writing, by the blockchain node, the first identifier into the transaction information of the first device through the smart contract corresponding to the first device, so that the database node saves the first identifier into the association information after obtaining the transaction information of the blockchain node.

[0085] Therefore, in the embodiments of the present application, the first device is registered in the blockchain node before the second device saves the identity file of the first device to the file system, so that the blockchain node can select the smart contract matched with the first device to write the information of the first device into the transaction information of the blockchain, so that the database node can obtain the association information of the first device by obtaining the transaction information of the blockchain node, and the association information can be used to indicate the device associated with the first device. Therefore, in the subsequent process, the access control node can verify the ownership of the first device according to the association information saved in the database, thereby improving the security of the data of the first device. Moreover, the first device can be automatically registered in combination with the smart contract of the blockchain, which can be applied to scenarios with a large number of devices and has strong generalization ability.

[0086] In a fifth aspect, the application provides a device management method applied to a device management system, the device management system comprising a second device, a first access control node, a file system, a first device, a database node, and a blockchain node, the database node being configured to store a database, the first device being associated with the second device, and the method comprising: obtaining, by the database node, transaction information in a blockchain of the blockchain node; and storing, by the database node, a public key of the first device and a public key of the second device included in the transaction information into association information of the first device, the association information being used to indicate information of devices associated with the first device.

[0087] In the embodiments of the application, the database node can obtain the association information of the first device from the data stored in the blockchain node, the association information comprising information of devices associated with the first device, which means that the first device has been registered with the blockchain service provider. After receiving the identity file of the first device, the first access control node can request the association information of the first device from the database node and perform verification, and after the verification is successful, the first access control node can save the identity file of the first device into the file system and send the first identifier fed back by the file system to the second device, so that the second device or other devices can use the first identifier to read the identity file from the file system. Therefore, in the device management system provided by the application, the access control node can be used to perform access control on the devices accessing the system or the second device, verify the access rights of the devices accessing the system, and only allow the devices to perform further processing, such as data storage or data reading, when the devices have the access rights to the system, thereby improving the privacy and security of data transmission in the system.

[0088] In a possible implementation, the method can further comprise: receiving, by the database node, a home request message sent by the first access control node, the home request message carrying an identifier of the first device; and sending, by the database node, the association information of the first device to the first access control node according to the identifier of the first device.

[0089] Therefore, in the embodiments of the application, after receiving the home request message, the database node searches for the association information according to the public key of the device carried in the message and feeds back the association information to the access control node.

[0090] In a sixth aspect, the embodiments of the application provide a second device having the functions of the device management method of the second aspect. The functions can be implemented by hardware, or by hardware executing corresponding software. The hardware or software comprises one or more modules corresponding to the functions.

[0091] In a seventh aspect, an embodiment of the present application provides an access control node having a function of implementing the device management method of the third aspect. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0092] In an eighth aspect, an embodiment of the present application provides a blockchain node having a function of implementing the device management method of the fourth aspect. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0093] In a ninth aspect, an embodiment of the present application provides a database node having a function of implementing the device management method of the fifth aspect. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0094] In a tenth aspect, an embodiment of the present application provides a second device including a processor and a memory, wherein the processor and the memory are interconnected through a circuit, and the processor invokes program code in the memory to perform functions related to processing in the device management method of any one of the second aspect. Optionally, the second device can be a chip.

[0095] In an eleventh aspect, an embodiment of the present application provides an access control node including a processor and a memory, wherein the processor and the memory are interconnected through a circuit, and the processor invokes program code in the memory to perform functions related to processing in the device management method of any one of the third aspect. Optionally, the access control node can be a chip.

[0096] In a twelfth aspect, an embodiment of the present application provides a blockchain node including a processor and a memory, wherein the processor and the memory are interconnected through a circuit, and the processor invokes program code in the memory to perform functions related to processing in the device management method of any one of the fourth aspect. Optionally, the blockchain node can be a chip.

[0097] In a thirteenth aspect, an embodiment of the present application provides a database node including a processor and a memory, wherein the processor and the memory are interconnected through a circuit, and the processor invokes program code in the memory to perform functions related to processing in the device management method of any one of the fifth aspect. Optionally, the database node can be a chip.

[0098] In a fourteenth aspect, an apparatus, which can also be referred to as a digital processing chip or a chip, is provided. The chip includes a processing unit and a communication interface. The processing unit obtains program instructions via the communication interface. The program instructions are executed by the processing unit. The processing unit is configured to perform the processing-related functions described in any of the optional implementation forms of the second aspect to the fifth aspect.

[0099] In a fifteenth aspect, a computer-readable storage medium is provided. The computer-readable storage medium includes instructions that, when executed on a computer, cause the computer to perform the method described in any of the optional implementation forms of the first aspect to the fifth aspect.

[0100] In a sixteenth aspect, a computer program product is provided. The computer program product includes instructions that, when executed on a computer, cause the computer to perform the method described in any of the optional implementation forms of the first aspect to the fifth aspect. BRIEF DESCRIPTION OF DRAWINGS

[0101] Figure 1 A structural schematic diagram of an equipment management system provided by the present application is shown in FIG. 1.

[0102] Figure 2 A structural schematic diagram of another equipment management system provided by the present application is shown in FIG. 2.

[0103] Figure 3 A structural schematic diagram of another equipment management system provided by the present application is shown in FIG. 3.

[0104] Figure 4 A structural schematic diagram of another equipment management system provided by the present application is shown in FIG. 4.

[0105] Figure 5 A structural schematic diagram of another equipment management system provided by the present application is shown in FIG. 5.

[0106] Figure 6 A flowchart of an equipment management method provided by the present application is shown in FIG. 6.

[0107] Figure 7 A flowchart of another equipment management method provided by the present application is shown in FIG. 7.

[0108] Figure 8 A flowchart of another equipment management method provided by the present application is shown in FIG. 8.

[0109] Figure 9 A flowchart of another equipment management method provided by the present application is shown in FIG. 9.

[0110] Figure 10 A flowchart of another equipment management method provided by the present application is shown in FIG. 10.

[0111] Figure 11Another device management method provided in the present application is shown in the flowchart of FIG. 2;

[0112] Figure 12 Another device management method provided in the present application is shown in the flowchart of FIG. 2;

[0113] Figure 13 Another device management method provided in the present application is shown in the flowchart of FIG. 2;

[0114] Figure 14 Another device management method provided in the present application is shown in the flowchart of FIG. 2;

[0115] Figure 15 Another device management method provided in the present application is shown in the flowchart of FIG. 2;

[0116] Figure 16 Another device management method provided in the present application is shown in the flowchart of FIG. 2;

[0117] Figure 17 Another device management method provided in the present application is shown in the flowchart of FIG. 2;

[0118] Figure 18 Another device management method provided in the present application is shown in the flowchart of FIG. 2;

[0119] Figure 19 Another device management method provided in the present application is shown in the flowchart of FIG. 2;

[0120] Figure 20 Another device management method provided in the present application is shown in the flowchart of FIG. 2. DETAILED DESCRIPTION

[0121] The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of the present application.

[0122] The system and method provided in the present application can adapt to various communication networks, and the number of devices accessing the communication network will increase significantly, so the management of devices accessing the network becomes an important issue.

[0123] For example, in some commonly used manners, identity management of devices is manually managed, including identity issuance, recovery, identity transfer, etc., which is difficult to cope with the challenges brought by massive device identity management. Some platforms can be used to support device automatic acquisition of startup identity, but these platforms are private platforms, and the protocols and platforms are private, which are not open enough, small-scale device manufacturers are difficult to replicate, and the requirements for users are also high, so it is difficult to promote on a large scale.

[0124] For example, in order to overcome the shortcomings of proprietary platforms, it is necessary to develop a zero-touch onboarding standard for Internet of Things devices, such as a bootstrapping remote secure key infrastructure (BRSKI). When a manufacturer produces a device, it only needs to follow this standard. When the user also deploys the device according to the standard, the device can automatically acquire the device identity when it first accesses the network, and the buyer can configure the device in advance. However, this standard also has defects. Each manufacturer needs to deploy a set of identity management platforms, and needs to interface with multiple manufacturers. Therefore, it faces challenges in terms of cost and ecological construction, and has weak generalization ability.

[0125] In the scenarios provided in the present application, multiple manufacturers, operators, and cloud service providers can use blockchain technology to jointly build a public identity management platform, and realize device initialization identity issuance, ownership transfer, and other functions through the identity management platform.

[0126] A blockchain is composed of a series of growing records, which become blocks. These blocks are linked together through cryptographic techniques, and each block contains the hash value of the previous block, a timestamp, and transaction data. The blockchain is essentially a distributed and multi-backup database, but the biggest difference from the database is that the data is stored through multi-party consensus and protected by a hash chain, so that the data cannot be tampered with. Compared with traditional database technology, the tamper-proof feature of blockchain data makes it easier to gain the trust of users, and thus better supports multi-party cooperation. Another feature of blockchain technology is the support of smart contracts, which are computer programs that automatically execute on the blockchain. Using smart contracts can reduce the intermediate links of transactions and achieve transaction automation.

[0127] The inter planet file system (IPFS) protocol is a file storage and content distribution network protocol, which integrates various distributed systems to provide users with a unified addressable data storage. IPFS is essentially a P2P distributed storage system, which accesses file resources in the network through a unique code generated based on file content. IPFS can be combined with decentralized blockchain technology to solve the problems of data storage security, timeliness of user collaboration, and storage and bandwidth costs under the centralized Internet architecture. The IPFS system uses a redundancy backup technology called Erasure coding (EC). n parts of original data, increase m parts of check data, can recover the original data through any n parts of data in n+m parts of data, that is, the maximum number of tolerable failed data is m.

[0128] In some data storage scenarios, blockchain and IPFS can be used for file storage. The blockchain system is mainly used to store file hashes and file sharing group IDs, and the IPFS system is responsible for storing files. At the same time, the system introduces a key node, IPFS_Proxy. However, IPFS_Proxy can obtain user stored file information, and the ability of file record on-chain also depends on IPFS_Proxy. The power of IPFS_Proxy is too large, which can easily cause system security risks, such as data content leakage and other threats.

[0129] Therefore, the present application provides a device management system and a device management method, which can automatically complete the access of devices combined with the smart contract of the blockchain, and can be applied to the scene of massive access devices, and is more conducive to data privacy protection.

[0130] Firstly, the device management system and the device management method provided by the present application can be applied to various communication networks with multiple access devices, such as distributed networks, Internet of Things, etc. The present application exemplarily takes the Internet of Things as an example for exemplary description.

[0131] Generally, after the current Internet of Things device is produced and sold to customers, the customer needs to manually configure the identity issued to the device, such as purchasing a SIM card from an operator and inserting it into the SIM card slot of the device, and then the device can access the network with the above identity. The present application provides a trusted identity information sharing platform for device manufacturers, users, operators, devices, etc., to realize automatic access to the network and business identity, home confirmation, etc., and realize zero-touch access of the device.

[0132] Exemplarily, the device management system provided by the present application is as follows Figure 1As shown, after manufacturing the equipment, manufacturers can embed the device's identity into it. Manufacturers can then register the equipment with the device management platform or transfer ownership. Both the device owner and the device itself can obtain the device's identity file from the device management platform.

[0133] The equipment can be transferred from the manufacturer to the user. The user can provide their own identity information to the device management platform, which will then update the device owner to the user in the device's associated information. The device owner, such as the user, can purchase services from operators or IoT servers. For example, the device can access the network through an operator or upload data through an IoT service provider.

[0134] The devices can communicate with each other through wired or wireless networks, such as 5th-Generation (5G) systems, Long Term Evolution (LTE) systems, Global System for Mobile Communication (GSM) or Code Division Multiple Access (CDMA) networks, Wideband Code Division Multiple Access (WCDMA) networks, Wireless Fidelity (WiFi), Bluetooth, Zigbee, Radio Frequency Identification (RFID), Long Range (Lora) wireless communication, and Near Field Communication (NFC), among other combinations.

[0135] For example, the functions of the device management platform can be as follows: Figure 2 As shown.

[0136] The device management platform can be divided into several parts, such as a blockchain component and an IPFS storage component. Figure 2 (Not shown in the image), database section, and access control section.

[0137] Blockchain component: Typically, the identity files stored on a device management platform are the core of device management; therefore, the trustworthiness of the information must be guaranteed. This application utilizes the immutability of blockchain to ensure the trustworthiness of device information recorded on the shared platform, and uses smart contracts to ensure that key data is recorded on the blockchain.

[0138] IPFS part: In order to overcome the limitation of the storage capacity of the blockchain, the application can use the IPFS decentralized file system to store the identity file of the color plate, and use the blockchain to save the identity of the device, the ownership and the hash value of the identity file, and the data occupying less storage, so as to realize the reasonable distribution of data and maximize the use of resources of each part.

[0139] Database part: In order to ensure the correctness of the identity information, the application uses a decentralized database system to filter the correctness of the device information. A plurality of nodes run independent databases for saving the device identity information obtained from the database. The database information is derived from the stored device identity management information on the blockchain. The insertion of data does not depend on manual modification, realizes high efficiency, and avoids human error, so that the data of each device is more reliable.

[0140] Access control part: In order to ensure the privacy of the data, the application sets access control so that only users with access rights can access the identity file of the device.

[0141] Referring to Figure 3 , the application provides a structural diagram of a device management system.

[0142] The device management system can include a first device 31, a second device 32, a first access control node 33, a file system 34, a database node 35 and a blockchain node 36.

[0143] The second device 32 is configured to send an identity file to the first access control node 33, the identity file including identity information of the first device 31 and a public key of the second device 32.

[0144] The first access control node 33 is configured to request associated information of the first device 31 from the database node 35 based on the identity file, the associated information including public keys of devices associated with the first device 31, and the associated information being obtained from the blockchain node 36 by the database node 35.

[0145] If the first access control node 33 determines that the first device 31 is associated with the second device 32 through the associated information, the first access control node 33 is further configured to request the file system 34 to send the identity file.

[0146] The file system 34 is configured to save the identity file and feed back a first identifier corresponding to the identity file to the first access control node 33, the first identifier being used to read the identity file from the file system 34.

[0147] In the embodiment of the present application, the database node can obtain the association information of the first device from the data stored in the blockchain node, and the association information includes the information of the device associated with the first device, which means that the first device has been registered with the blockchain service provider. After receiving the identity file of the first device, the first access control node can request the association information of the first device from the database node and perform verification. After successful verification, the identity file of the first device can be saved to the file system, and the first identifier fed back by the file system can be sent to the second device, so that the second device or other devices can use the first identifier to read the identity file from the file system. Therefore, in the device management system provided by the present application, the access control node can be used to control the access of the device accessing the system or the second device, verify the access rights of the device accessing the system, and only allow the device to perform further processing such as data storage or data reading when it has the access rights to the system, thereby improving the privacy and security of data transmission in the system.

[0148] In a possible scenario, the second device 32 is further configured to send registration information to the blockchain node 36 before sending the identity file to the first access control node 33, and the registration information includes the public key of the first device 31 and the public key of the second device 32.

[0149] The blockchain node 36 is configured to write the public key of the device and the public key of the second device 32 into the transaction information of the blockchain through the smart contract corresponding to the first device 31 to register the first device.

[0150] The database node 35 is configured to obtain the transaction information of the blockchain node 36, and save the public key of the first device 31 and the public key of the second device 32 included in the transaction information to the association information.

[0151] Therefore, in the embodiment of the present application, the first device is registered in the blockchain node before the second device saves the identity file of the first device to the file system, so that the blockchain node can select the smart contract matched with the first device to write the information of the first device into the transaction information of the blockchain, so that the database node can obtain the transaction information of the blockchain node to generate the association information of the first device, and the association information can include the information of the device associated with the first device. Therefore, in the subsequent process, the access control node can verify the ownership of the first device according to the association information saved in the database, thereby improving the security of the data of the first device. Moreover, the first device can be automatically registered in combination with the smart contract of the blockchain, which can be applied to scenarios with a large number of devices and has strong generalization ability.

[0152] In a possible scenario, the second device 32 is further configured to send the first identifier to the blockchain node 36.

[0153] The blockchain node 36 is further configured to update the first identifier into the locally stored transaction information of the first device 31 by the smart contract corresponding to the first device.

[0154] Therefore, in the embodiments of the present application, after the second device saves the identity file of the first device into the file system, the second device further saves the first identifier fed back by the file system into the blockchain node, so that the blockchain node saves the first identifier into the transaction information of the first device by the smart contract, and the database node can update the first identifier into the association information of the first device when obtaining the transaction information again, so that the association information of the first device has more complete information of the first device.

[0155] In a possible scenario, the second device 32 is further configured to send an identity request message to the first access control node 33, the identity request message carrying information (such as a public key, a name, a serial number or other identifiers of the first device, etc.) of the first device 31 and a public key of the second device 32, the identity request message being used to request the identity file;

[0156] The first access control node 33 is further configured to send a first request message to the database node 35, the first request message including the information of the first device 31.

[0157] The database node 35 is further configured to feed back a first identifier to the first access control node 33.

[0158] The first access control node 33 is further configured to send the first identifier to the file system 34 and receive an identity file fed back by the file system 34.

[0159] If the public key included in the identity file matches the public key of the second device 32, the first access control node 33 is further configured to send the identity file to the second device 32.

[0160] In the embodiments of the present application, the second device can further request the identity file of the first device from the access control node, and the access control node can verify the public key carried in the received identity file and the public key carried in the identity request message, and if they match, it indicates that the ownership of the device corresponding to the identity file is the second device, and the identity file can be transmitted to the second device. Therefore, in the embodiments of the present application, the access control node can verify the ownership of the device, thereby ensuring the security of the identity file of the device.

[0161] In a possible scenario, the first device 31 is further configured to send an identity credential to the first access control node 33, the identity credential including a public key of the first device 31, so as to request the identity file from the first access control node 33.

[0162] The first access control node 33 is further configured to send a second request message to the database node 35 if the identity credential is verified and the verification is successful, and the second request message comprises an identifier of the first device 31 (such as a public key, a name, a serial number, or a unique identifier assigned to the first device, etc.).

[0163] The database node 35 is further configured to feed back the first identifier to the first access control node 33.

[0164] The first access control node 33 is further configured to send the first identifier to the file system 34 and receive the identity file fed back by the file system 34.

[0165] If the identifier comprised in the identity file matches the identifier comprised in the identity credential, the first access control node 33 is further configured to send the identity file to the first device 31.

[0166] In the embodiments of the present application, the first device can query the identity file from the access control node, the access control node can verify the identity credential of the first device, and the identity file is sent to the first device only after the verification is successful, thereby improving the data security of the first device.

[0167] In a possible implementation, the first access control node 33 is specifically configured to send a first request message to the database node and receive the first identifier fed back by the database node, and the first request message comprises a public key of the first device.

[0168] Therefore, in the embodiments of the present application, the first access control node can obtain the first identifier from the database, and thus can request the identity file of the first device from the file system based on the first identifier, thereby successfully obtaining the identity file.

[0169] Of course, the first identifier can also be sent to the first access control node by the second device, or the first access control node can save the first identifier in the registration process of the first device, and then the first identifier can be extracted from the locally saved data when the identity file is queried.

[0170] In a possible implementation, the device management system further comprises a registration server.

[0171] The first device 31 is specifically configured to send an identity credential to the registration server through an encrypted pipe.

[0172] The registration server is configured to forward the identity credential to the access control server through the encrypted pipe.

[0173] The first access control node 33 is specifically configured to send the identity file to the registration server.

[0174] The registration server is specifically configured to forward the identity file to the first device 31.

[0175] Therefore, in the embodiments of the present application, the data transmitted between the first device and the first access control node can be transmitted through the encrypted channel between the registration server and the first device, thereby improving the security of the data transmitted between the first device and the first access control node.

[0176] In a possible scenario, the device management system further includes a second access control node;

[0177] The first device 31 is configured to send a third request message to the second access control node;

[0178] The second access control node is configured to obtain a second identifier of the identity file based on the verification of the third request message being successful;

[0179] The second access control node is further configured to feed back the second identifier to the first device 31.

[0180] The first device 31 is further configured to save the identity file when the first identifier and the second identifier match.

[0181] In the embodiments of the present application, a plurality of access control nodes can be arranged in the device management system, and after obtaining the identity file through the first access control node, the second identifier can be obtained through the second access control node. Then, it is verified whether the first identifier and the second identifier match. If they match, it is determined that the identity file is a correct file, and the identity file can be saved, thereby ensuring the accuracy of the obtained identity file.

[0182] In a possible scenario, the device management system further includes a third device;

[0183] The second device 32 is further configured to add information of the third device in the identity file to obtain an updated identity file. The information of the third device can include a public key of the third device, and the updated identity file indicates that the first device is associated with the third device, i.e., the device associated with the first device is changed from the second device to the third device.

[0184] The second device 32 is further configured to send the updated identity file to the first access control node 33.

[0185] The first access control node 33 is further configured to send the updated identity file to the file system 34 and receive a third identifier fed back by the file system 34.

[0186] The first access control node 33 is further configured to send the third identifier to the second device 32.

[0187] The second device 32 is further configured to send a third identifier to the third device, the third identifier being used to request an updated identity file from the file system 34.

[0188] The second device 32 is further configured to send update information to the blockchain node 36, the update information including the public key of the first device 31, the public key of the third device, and the third identifier.

[0189] The blockchain node 36 updates the transaction information using the update information to obtain updated transaction information.

[0190] The database node 35 is further configured to obtain the updated transaction information and update the association information according to the updated transaction information to obtain updated association information.

[0191] In the embodiment, the second device can transfer the first device to the third device, the second device writes the information of the third device into the identity file of the first device and sends it to the access control node to inform the blockchain node that the first device has been transferred, so that the database node obtains the transaction information of the blockchain node and updates the association information of the first device. Therefore, in the embodiment of the application, the transfer of the device can be completed by modifying the identity file of the first device by the second device, without manual operation, and the ownership transfer of the device can be completed.

[0192] In a possible implementation, the first identifier is obtained by performing an operation on the identity file by a hash algorithm.

[0193] For ease of understanding, the device management system provided by the application is exemplarily introduced by taking the file system as IPFS. Referring to Figure 4 , another structural diagram of the device management system provided by the application is provided.

[0194] The access control node, the IPFS, the database, and the blockchain node can constitute a device management platform, which provides authentication, identity management, and other services for devices and device owners.

[0195] The functions of each device or the services provided by each device are introduced as follows.

[0196] 1. Device (i.e. first device)

[0197] The device mainly needs to be authenticated and information queried.

[0198] Authentication: A pre-embedded key such as an X.509 certificate or a private key corresponding to an IBS public key can be used to generate a signature and authenticate with an external node such as an access control system, and at the same time, it is confirmed that the external node is a node authorized by the device to access, for example, the domain name or IP address of the external node is the domain name or IP address embedded by the device during production.

[0199] Information query: Obtain the identity information of the device from the access control node.

[0200] 2. Home device (i.e. second device, or called device owner)

[0201] The home device is associated with the device, which can be a server or terminal, or other means, such as web page, APP, and services provided to users, etc.

[0202] The home device usually needs to be authenticated, information queried, information stored, registered, or updated, etc.

[0203] Authentication: A signature can be generated using a pre-generated private key to authenticate with external nodes such as access control nodes, and also to confirm whether the external device is an authorized access device.

[0204] Information query: Can assist other devices in obtaining the identity file of the device from the access control node.

[0205] Information storage: Can send the identity file of the device to the access control node.

[0206] Device registration and home update: Can call the smart contract deployed on the blockchain node to write the home, identity file, or hash value of the identity file of the device.

[0207] 3. Access control node

[0208] Can be used for access control of devices accessing the foregoing device control platform, authentication of devices accessing the device control platform, or information query, etc.

[0209] Authentication and access control: Can confirm the identity of the device or the home device, and also sign using its own controlled private key to prove its identity to the device or the home device.

[0210] Information query: Can obtain the identity file of the device from IPFS, and after receiving the identity query request of the inquirer and confirming that the inquirer has the right to access the identity file, the identity file can be fed back to the inquirer.

[0211] Information upload: Can receive the identity file of the device sent by the device owner, and after determining that the device owner has the right to update or upload the identity file of the device, write the identity file to IPFS, and feedback the file verification code returned by IPFS, such as hash value or other ways generated address, etc.

[0212] Device ownership confirmation: a database can be initiated to query the association information of the device, the hash value of the device and other information, so as to determine the ownership of the device.

[0213] 4, database node

[0214] Can be used for inserting or querying information of the device.

[0215] Device information filtering and insertion: transaction information related to the identity of the device can be extracted from the blockchain node and saved to the database. Generally, if the association information of the device already exists in the database, the association information of the device can be updated after the transaction information including the identity information of the device is obtained. If the association information of the device does not exist in the database, the association information of the device is generated after the transaction information including the identity information of the device is obtained. When inserting data into the database, it is necessary to confirm whether the initiator of the transaction record is the owner of the device. If yes, update the association information of the device, if not, do not update the association information of the device.

[0216] Device information query: if the device or the device owner queries the identity file of the device, the database node can provide the identity file of the device to the access control node.

[0217] 5, blockchain node

[0218] Can be used for device registration and information update. It can be responsible for interacting with the smart contract module deployed on the blockchain node, selecting a smart contract matched with the device or the manufacturer of the production device, registering the device, writing the information of the device, the hash value of the identity file and the updated information of the owner of the device into the blockchain.

[0219] Exemplarily, the deployment mode of the device management system provided by the application can refer to Figure 5 .

[0220] Among them, the device management system includes N nodes, all of which include a blockchain node, IPFS, a database node (DB) and an access control node, and each node is connected through wired or wireless network.

[0221] Therefore, the application provides a decentralized device management system, which realizes the functions of device management such as device registration, information update, identity verification or information query through multiple independently running nodes. The management of the device is realized through the smart contract, which has strong generalization ability and can be applied to various scenes. And through the access control node, the authority of the inquirer of the data of the device is verified, which can improve the security of the data of the device.

[0222] The foregoing introduces the architecture of the device management system provided in the application. Next, the device management system and the device management method provided in the application are introduced in more detail in terms of the flow.

[0223] Referring to Figure 6 The flowchart of the device management method provided in the application is as follows.

[0224] 601. The second device sends an identity file to the first access control node.

[0225] The second device is a user associated with the first device, i.e., the owner of the first device, and the user can be carried on a server or a terminal. For example, the device management system provided in the application can provide services for users in the form of a client, and the user can log in to an account on a local PC, i.e., the local client can be used as the second device. For another example, the device management system provided in the application can provide services for users through an APP installed on a user terminal, and the user can register or query the identity of the device owned by the user on the APP, i.e., the terminal can be used as the second device.

[0226] The identity file can include the identity information of the first device and / or the information of the second device. The identity information of the first device can include, for example, the public key, name, serial number, address or unique identifier allocated to the first device of the first device; and the information of the second device, for example, the public key, name, unique identifier or address of the second device.

[0227] The identity file can indicate that the first device is associated with the second device. For example, the second device can be a device carrying the account of the user. After the user purchases the first device, the second device belongs to the user, and the user can bind the first device in the account, i.e., by adding the information of the second device in the identity file of the first device and uploading it to the device management platform, to associate the first device with the second device on the platform.

[0228] In a possible implementation, before sending the identity file to the first access control node, the second device also sends registration information to the blockchain node, and the registration information can include information of the first device and information of the second device, such as a public key, a unique identifier, or a serial number of the first device, and a public key, a unique identifier, or a serial number of the second device; the blockchain node registers the first device by writing information of the first device and the public key of the second device into transaction information of the blockchain through a smart contract corresponding to the first device, and the smart contract corresponding to the first device can indicate a registration manner of the first device, and the smart contract corresponding to each device can be determined through a preconfigured mapping relationship; the database node obtains the transaction information of the blockchain node, and saves the public key of the first device and the public key of the second device included in the transaction information into the association information, thereby completing the registration of the first device.

[0229] The smart contract is a computer protocol designed to spread, verify, or execute contracts in an informationized manner. The smart contract allows trusted transactions without a third party, and the transactions are traceable and irreversible. A plurality of smart contracts can be preconfigured in the blockchain node, and each manufacturer or each device can be subject to the same or different smart contract, which can indicate a registration manner, a transaction manner, or a data saving format of the device. In the embodiments of the application, the method and the system provided in the application can be adapted to more scenarios and compatible with more devices produced by different manufacturers by means of the smart contract, and have strong generalization ability.

[0230] For example, after the manufacturer produces the device, the first device can be registered in the device management system, the registration information is sent to the blockchain node by the manufacturer (i.e., the second device), the blockchain node determines a smart contract matched with the first device, and writes information of the first device into the blockchain through the smart contract, and when the database node obtains the transaction information of the blockchain, the association information of the first device is generated, which includes information of the first device and information of the device associated with the first device, so that the access control node can know the ownership of the first device based on the association information of the first device saved in the database, and determine the device having the permission to update or query the information of the first device.

[0231] 602、The first access control node requests the association information of the first device from the database node.

[0232] After receiving the identity file sent by the second device, the first access control node can send an ownership request message to the database node to request the association information of the first device from the database node, and the association information includes information of the device associated with the first device, and the first access control node can know the information of the device associated with the first device through the association information.

[0233] For example, the association information can include the information of the first device and the information of the second device, such as the name, serial number, public key or hash value of the first device, the certificate, public key or hash value of the second device, etc.

[0234] 603、The first access control node verifies the permission of the second device.

[0235] After obtaining the association information of the first device from the database node, the first access control node can obtain the information of the device associated with the first device, such as the public key, name or other identifier, etc., and determine whether the second device is associated with the first device. If it is determined that the first device is associated with the second device, it means that the second device has the permission to upload the identity file of the first device. If it is determined that the second device is not associated with the first device, it means that the second device does not have the permission to upload the identity file of the first device, and the identity file sent by the second device can be discarded at this time.

[0236] For example, if the public key of the owner included in the association information is the same as the public key of the second device, it can be determined that the first device is associated with the second device, and if the public key of the owner included in the association information is not the same as the public key of the second device, it is determined that the first device is not associated with the second device, and the received identity file can be discarded at this time.

[0237] 604、If the verification is successful, the first access control node sends the identity file to the file system.

[0238] If the first access control node determines that the first device is associated with the second device, the access control node can determine that the second device can upload the identity file of the first device, and the identity file can be sent to the file system to save the identity file in the file system.

[0239] 605、The file system saves the identity file.

[0240] After receiving the identity file sent by the first access control node, the file system saves the identity file.

[0241] Specifically, the file system can be a file system deployed on a server, can be a distributed storage system, or can be a centralized storage system. After receiving the identity file, the identity file can be saved in the file system.

[0242] 606、The file system feeds back the first identifier corresponding to the identity file to the first access control node.

[0243] After saving the identity file of the first device, the file system can generate the first identifier of the identity file and feed back to the first access control node.

[0244] The first identifier can be a storage address of the identity file in the file system, can be an identifier generated according to the storage address of the identity file, or can be an identifier generated according to the content of the identity file, etc. For example, there are various ways to generate the first identifier, and the specific generation method can be based on a hash algorithm such as a message-digest algorithm (MD4), MD5, secure Hash algorithm (SHA), etc. For example, the storage address of the identity file is input into the above algorithm, and the first identifier is output. Alternatively, the content of the identity file is input into the above algorithm, and the first identifier is output.

[0245] For ease of understanding, the first identifier is exemplarily described as a hash value in the following embodiments of the present application. The first identifier, the second identifier, or the third identifier mentioned below can be an identifier obtained by the above algorithm. The hash value is exemplarily described below.

[0246] 607、The first access control node feeds back the first identifier to the second device.

[0247] After receiving the first identifier, the first access control node can feed back the first identifier to the second device, so that the second device can subsequently request the first access control node to query the identity file according to the first identifier.

[0248] Therefore, in the embodiments of the present application, the database node can obtain the association information of the first device from the data stored in the blockchain node, and the association information includes the information of the device associated with the first device, which means that the first device has been registered with the blockchain service provider. After receiving the identity file of the first device, the first access control node can request the association information of the first device from the database node and perform verification. After successful verification, the identity file of the first device can be stored in the file system, and the first identifier fed back by the file system can be sent to the second device, so that the second device or other devices can use the first identifier to read the identity file from the file system. Therefore, the device management method provided by the present application can use the access control node to perform access control on the devices accessing the system or the home devices, verify the access rights of the devices accessing the system, and only allow the devices to perform further processing such as data storage or data reading when the devices have the access rights to the system, thereby improving the privacy and security of data transmission in the system.

[0249] In a possible implementation, the second device further sends the first identifier to the blockchain node; the blockchain node records the first identifier into the transaction information of the first device through the smart contract; the database node can periodically acquire the transaction information, or acquires the transaction information after detecting that the transaction information is updated, so as to update the information of the first device in the transaction information to the association information of the first device, that is, update the first identifier to the association information of the first device, thereby obtaining the complete association information of the first device.

[0250] In a possible implementation, the second device can further send an identity request message to the first access control node, the identity request message carrying the information of the first device and the public key of the second device, the identity request message requesting the identity file; the first access control node can further acquire the first identifier and send the first identifier to the file system to receive the identity file fed back by the file system; if the public key of the owner of the device included in the identity file matches the public key of the second device, that is, the first device is associated with the second device, the first access control node further sends the identity file to the second device. If the public key included in the identity file does not match the public key of the second device, the identity file can not be sent to the second device or the second device is fed back that the query fails. Therefore, in the embodiment of the application, the first access control node can verify whether the requester requesting the identity file of the first device has the permission to read the identity file of the device, and feeds back the identity file to the requester only when the requester has the permission to read the identity file, thereby improving the data security of the device and protecting the privacy of the device.

[0251] In a possible implementation, in order to further increase the security of the data, the foregoing device management system can further include a second access control node, and the second device can further send a third request message to the second access control node; the second access control node acquires the second identifier of the identity file based on that the third request message is verified and the verification is successful; the second access control node further feeds back the second identifier to the first device; and the second device saves the identity file when the first identifier and the second identifier are verified to match. Therefore, in the embodiment of the application, the second device can request the identity file and the identifier corresponding to the identity file from multiple access control nodes respectively, and when the identifiers fed back by the multiple access control nodes match, it indicates that the received identity file is accurate, that is, the accurate identity file can be saved.

[0252] In a possible implementation, the first device can further send an identity credential to the first access control node, the identity credential comprising an identity of the first device, which can be a public key, a serial number or other unique identity of the first device, to request an identity file of the first device from the first access control node; the first access control node, if the identity credential is verified and the verification is successful, sends a second request message to the database node, the second request message comprising the public key of the first device; the database node, in return, feeds back the first identity to the first access control node; the first access control node, in return, sends the first identity to the file system and receives the identity file fed back by the file system; if the identity comprised in the identity file matches the identity of the first device, the first access control node, in return, sends the identity file to the first device. Thus, in the implementation of the present application, when a device requests its identity file by itself, the access control node can verify whether the device has the permission to access the identity file according to the identity credential of the requester, and after the verification is successful, the access control node can feed back the identity file to the requester, thereby improving the security of the identity file of the device.

[0253] In a possible implementation, in order to further increase the security of the data, the foregoing device management system can further comprise a second access control node, and the first device can further send a third request message to the second access control node; the second access control node, after verifying the third request message and the verification being successful, acquires a second identity of the identity file; the second access control node, in return, feeds back the second identity to the first device; when the first identity and the second identity are verified to match, the first device saves the identity file; when the first identity and the second identity do not match, the first device can request the identity file from the first access control node or the second access control node again until the accurate identity file is obtained. Thus, in the implementation of the present application, the first device can request the identity file and the identity corresponding to the identity file from multiple access control nodes respectively, and when the identities fed back by the multiple access control nodes match, it indicates that the received identity file is accurate, and the accurate identity file can be saved.

[0254] In a possible implementation, the first access control node can specifically send a first request message to the database node to request the first identifier from the database node, the first request message can include the public key of the first device, and after receiving the first request message, the database node can query the association information of the first device from the locally saved data based on the public key carried in the first request message, and feed back the first identifier included in the information to the first access control node. Therefore, in the implementation of the present application, the access control node can obtain the accurate association information of the device from the database, and obtain the identity file of the device from the file system based on the association information, which means that the process of obtaining the file needs the participation of multiple nodes, and the possibility of data leakage can be reduced. The access control node verifies the reading permission, thereby increasing the data security of the device.

[0255] In a possible implementation, the second device also adds the information of the third device in the identity file to obtain an updated identity file, the information of the third device includes the public key of the third device; the second device also sends the updated identity file to the first access control node; the first access control node also sends the updated identity file to the file system and receives the third identifier fed back by the file system; the first access control node also sends the third identifier to the second device; the second device also sends the third identifier to the third device, the third identifier points to the file system to request the updated identity file; the second device also sends update information to the blockchain node, the update information includes the public key of the first device, the public key of the third device, and the third identifier; the blockchain node updates the transaction information using the update information to obtain updated transaction information; the database node also obtains the updated transaction information, and updates the association information according to the updated transaction information to obtain updated association information.

[0256] In the implementation of the present application, the ownership of the first device can be converted to the third device by the second device, the second device adds the information of the third device in the identity file, that is, modifies the owner of the first device to the third device, and uploads the updated identity file to the file system and updates the association information saved in the database, to complete the transfer of the device. Therefore, by using the method provided in the present application, the transfer of the device can be accurately and efficiently completed, which can adapt to the scene of device transfer and has strong generalization ability.

[0257] The foregoing introduces the flow of the device management method provided in the present application. The device management method provided in the present application can register, update, query and transfer the device, etc. For example, after the device is registered, the identity of the device can be queried or transferred.

[0258] For ease of understanding, the following will be introduced respectively for registration, identity query and device transfer processes. For example, the file system described above can be various file systems for storing data, such as a distributed file system, IPFS, etc. The device owner can be a manufacturer or a user. For example, the device owner is a manufacturer.

[0259] It should be noted that the device registration, identity query and device transfer processes mentioned in the following embodiments can be implemented in combination or independently, and can be adjusted according to actual application scenarios. The following embodiments of the present application are not limited.

[0260] I. Device registration

[0261] Referring to Figure 7 The present application provides a flowchart of a device management method.

[0262] 701. The device owner sends the information of the device and the information of the device owner to the blockchain.

[0263] The device owner (i.e. the second device described above, referred to as the device owner for ease of understanding) can send registration information to the blockchain, which can include the information of the device and the information of the device owner, to register the device with the blockchain.

[0264] The information of the device can include the public key of the device, or the hash value of the public key, the certificate of the device, the serial number of the device, the device name or the device identifier, etc.

[0265] The information of the device owner can include the public key of the device owner, or the hash value of the public key, the certificate of the device owner, or the identifier of the device owner, etc.

[0266] For example, if the device owner is a manufacturer, the manufacturer can initiate a registration request to the smart contract deployed on the blockchain through its own blockchain account, which can carry the identity of the device and the device identifier of the manufacturer, such as the public key of the device or the hash value of the device public key, or the public key of the manufacturer or the hash value of the manufacturer public key, etc.

[0267] 702. The blockchain (i.e. the blockchain node) writes the received information into the block through the smart contract.

[0268] After receiving the registration information sent by the device owner, the blockchain can determine the smart contract matched with the device, and write the received registration information, i.e. the information of the device and the information of the device owner, into the block through the smart contract.

[0269] The way of determining the smart contract can be through a pre-set mapping relationship, which can be a mapping relationship between the device and the smart contract, or a mapping relationship between the manufacturer of the manufacturing device and the smart contract, or the address or interface of the smart contract carried in the registration information. The smart contract can indicate the registration method or device management method of the device, etc., such as the registration information, encryption method, data format required for registering the device, etc.

[0270] Therefore, in the embodiments of the present application, different smart contracts can be used to register devices of different manufacturers, so that different manufacturers of devices can be adapted, different manufacturers can be introduced by accessing corresponding smart contracts, and the management of devices of different manufacturers can be realized, and the generalization ability is strong.

[0271] 703、The blockchain feeds back the transaction number or block number to the device owner.

[0272] The blockchain writes the registration information into the block through the smart contract, generates a transaction number or block number, and feeds it back to the device owner, thereby notifying the device owner that the registration information has been written into the block.

[0273] 704、The database scans the block transaction information.

[0274] The database is usually carried in a server, and the server can read the transaction information in the block.

[0275] Specifically, the database can periodically read the transaction information in the block, or read the transaction information after detecting the update of the transaction information. For example, the database can periodically send a read request to the blockchain, and receive the transaction information fed back by the blockchain.

[0276] Specifically, for example, the database can periodically obtain the information recorded in each block of the blockchain. Whenever a new block is generated by the blockchain, the database can extract the identity information from the new block and filter it to screen out available information. If the device association information identified by the device public key does not exist in the database, the association information of the device is generated and added to the database. If the device association information identified by the device public key already exists in the database, the blockchain account address of the device owner can be verified. If the address is the same as the blockchain account address of the device owner when the last interaction is performed, the information of the device in the transaction information is determined to be updated to the association information. When the device is transferred, the new owner address after the update can be different from the original owner address.

[0277] 705、The database records or updates the association information of the device.

[0278] After the database determines the transaction information update in the block, the database can generate or update the association information of the device according to the transaction information in the block. The association information can be used to indicate the information of the user associated with the device.

[0279] If the association information of the device already exists in the database, the new information of the device can be updated in the association information of the device after the new information of the device is detected in the transaction information. If the association information of the device does not exist in the database, the association information of the device can be generated after the block including the information of the device is detected in the transaction information.

[0280] Specifically, the association information can include the information of the device itself, such as the public key of the device, the hash value of the public key, the serial number, the name or other identifier, and the information of the owner of the device, such as the public key of the owner, the hash value of the public key, the serial number, the name or other identifier.

[0281] 706、The device owner generates an identity file.

[0282] The device owner can generate an identity file of the device, which includes the identity information of the device and the identity information of the device owner, and other information that can identify the identity of the device or the ownership of the device.

[0283] The identity file can include various identity attributes of the device. The identity file needs to be encrypted. The encryption method can be various, and the device public key or the device owner public key can be used for encryption. For example, the symmetric key K and the general encryption algorithm such as AES can be used for encryption. The encryption key itself is encrypted using the public key of the device and the device owner, and is saved in the identity file.

[0284] In addition, in order to ensure the integrity of the identity file, the private key of the device owner can be used for signature, so that the received device can be verified using the device public key contained therein, such as verification by RSA algorithm or Elliptic Curve Digital Signature Algorithm (ECDSA) algorithm. In general, the identity file of the device can be saved in Jason format.

[0285] For example, the information included in the identity file of the device and the encryption method of each item of information can be as shown in Table 1:

[0286]

[0287] Table 1

[0288] 707、The device owner uploads the identity file to the access control node.

[0289] The device owner uploads the identity file to the access control node after generating the identity file, to instruct the access control node to save the identity file into the IPFS.

[0290] The access control node can authenticate the identity of the device owner, which can be completed by the identity certificate and signature provided by the device owner. The identity certificate can include a public key, which can be the same as the public key of the device owner or generated by a certificate chain. The access control node can use the public key of the device owner and the signature carried in the identity file for verification. For example, assuming that the public key of the device owner is the same as the public key stored in the identity file, a common signature verification step such as RSA is used to operate the public key and the signature of the file, and then a numerical value (i.e. hash value) is obtained. The hash operation is performed on the file data to obtain the hash value of the file, and then the two hash values are compared to determine whether they are the same. If they are the same, the signature is passed. Otherwise, the signature verification fails.

[0291] 708、The access control node verifies the signature integrity of the identity file.

[0292] The signature carried in the identity file can be used to verify the identity file by the signature and the public key of the device owner, to confirm whether the identity file is tampered with. If the identity file is complete, the subsequent steps can be continued. If the identity file is not complete, the identity file can be discarded, or the device owner can be notified to resend the identity file, or the communication failure can be replied.

[0293] For example, the device owner can use his own private key and encryption algorithm to generate the signature of the identity file when generating the identity file. The access control node uses the public key of the device owner and the signature to perform signature verification operation on the identity file after receiving the identity file, to verify whether the identity file is complete.

[0294] 709、The access control node sends a home query request to the database.

[0295] The home query request can carry the public key of the device, or can also carry the hash value of the public key, to request the association information of the device from the database.

[0296] 710、The database feeds back the association information of the device to the access control node.

[0297] After the database receives the home query request sent by the access control node, the public key carried in the home query request is used to query the locally saved data, to extract the association information of the device, and to feed back the association information of the device to the access control node.

[0298] The association information can include information of the device and information of the owner associated with the device. The association information can specifically include a public key of the device, or a hash value of the public key of the device, a public key of the owner, or a hash value of the public key of the owner, etc.

[0299] 711. The access control node verifies the identity of the device owner and the identity of the identity file uploader.

[0300] After receiving the association information of the device, the access control node can verify whether the identity of the device owner is consistent with the identity of the identity file uploader. For example, the public key of the owner included in the association information can be matched with the public key of the device owner. If they are consistent, it indicates that the device belongs to the identity file uploader, i.e., the device is associated with the identity file uploader, and the subsequent steps can be continued. If they are not consistent, it indicates that the device does not belong to the identity file uploader, and at this time, the identity file can be discarded, or the device owner can be notified to resend the identity file, or a communication failure can be replied, etc.

[0301] 712. The access control node sends the identity file of the device to the IPFS.

[0302] After the access control node verifies that the device is associated with the device owner, the device owner has the right to upload the identity file of the device. At this time, the access control node can send the identity file to the IPFS to save the identity file in the IPFS.

[0303] 713. The IPFS feeds back the hash value of the identity file to the access control node.

[0304] After receiving and saving the identity file of the device sent by the access control node, the IPFS can generate a hash value (i.e., a first identifier) corresponding to the identity file and feed back to the access control node. The hash value can be used to read the identity file of the device saved in the IPFS. For example, after receiving the hash value, the IPFS can calculate the saving address of the file based on the hash value and the corresponding analysis operation, so as to read the identity file of the device based on the address.

[0305] Specifically, the specific way of generating the hash value can be a hash algorithm, such as MD4, MD5, or SHA algorithm, etc. For example, the content or saving address of the identity file can be taken as the input of the algorithm, and the corresponding hash value is output.

[0306] For example, the way of generating the hash value by using the MD5 algorithm can include MD5 ("file name + data content"). For example, MD5 (" / sdcard / youku / offlinedata / test.txt&showdemotesttxt") = f96b697d7cb7938d525a2f31aaf161d0 (i.e. the hash value).

[0307] 714、The access control node feeds back the hash value of the identity file to the device owner.

[0308] After receiving the hash value fed back by the IPFS, the access control node can feed back the hash value to the device.

[0309] 715、The device owner sends the hash value of the identity file to the blockchain.

[0310] After receiving the hash value sent by the access control node, the device owner can send the hash value to the blockchain, so that the blockchain writes the hash value into a block through a smart contract.

[0311] In addition, the device owner can also send the information of the device or the information of the device owner to the blockchain to indicate the identity of the device owner, so that the blockchain can identify the source of the hash value and determine the ownership of the hash value.

[0312] 716、The blockchain writes the hash value of the identity file into a block through a smart contract.

[0313] After receiving the hash value sent by the device owner, the blockchain can write the hash value into a block through a smart contract, and can also identify the information of the device or the information of the device owner corresponding to the identity file indicated by the hash value.

[0314] 717、The blockchain feeds back a transaction number or a block number to the device owner.

[0315] After writing the hash value of the device identity file into a block, the blockchain can feed back a transaction number or a block number to the device owner to inform the device owner that the hash value has been saved into a block.

[0316] 718、The database scans the block transaction information.

[0317] The step 718 is similar to the aforementioned step 704, and will not be described here.

[0318] 719、The database updates the associated information of the device.

[0319] In the transaction information of the scanned block, the hash value of the identity file is added, and the hash value is updated to the association information of the device, so that the association information of the device is more complete, and other devices can obtain the saved identifier of the identity file from the association information saved in the database.

[0320] Therefore, in the embodiment of the present application, the device owner can register the device with the blockchain, and the blockchain uses the matching smart contract to write the information of the device and the owner into the block. The database can obtain the association information of the first device from the data saved in the blockchain, which includes the information of the devices associated with the first device, which is equivalent to that the first device has been registered with the blockchain service provider. After receiving the identity file of the first device, the first access control node can request the association information of the first device from the database node and perform verification. After successful verification, the identity file of the first device can be saved to the file system, and the first identifier fed back by the file system is sent to the second device, so that the second device or other devices can use the first identifier to read the identity file from the file system. Therefore, the device management method provided by the present application can use the access control node to perform access control on the devices accessing the system or the home devices, verify the access rights of the devices accessing the system, and only allow the devices to perform further processing such as data storage or data reading when they have the access rights to the system, thereby improving the privacy and security of data transmission in the system.

[0321] II. Identity query

[0322] Among them, the identity query can be divided into many cases, which can be queried by the device itself or by the device owner. For example, when the device owner needs to modify the identity file of the device, the device owner can request the identity file saved on the device management platform from the access control node, or when the device owner does not save the identity file of the device locally or the local data is lost, the device owner can request the identity file of the device from the access control node. For another example, when the device accesses the network for the first time, the device can query the identity file from the access control node through the default network. The identity file can include the identity information of the first device itself and the identity information of the second device associated with it, and can also include the information of the operator providing the network, so that the device can access the network provided by the operator based on the identity file in the future.

[0323] The following will illustrate the scenarios of the device and the device owner requesting to query the identity file.

[0324] 1. Device owner queries identity file

[0325] Referring to Figure 8 , the flowchart of another device management method provided by the present application.

[0326] 801. The device owner sends an identity query request to the access control node.

[0327] The identity query request can carry information of the device or information of the device owner, etc., to request the access control node to query the identity file of the device.

[0328] The information of the device and the information of the device owner can refer to the related description of the foregoing step 701, which will not be described here again.

[0329] 802. The access control node sends the device public key to the database.

[0330] After receiving the identity query request from the device owner, the access control node can request the hash value of the identity file from the database. Specifically, the access control node can send a first request message to the database, and the first request message can carry the public key of the device to request the database to provide the hash value of the identity file of the device.

[0331] Of course, the first request message can also carry information of the device owner, such as the public key, serial number or identifier of the device owner, etc., so that the database can identify the device owner and read the associated information of the device owned by the device owner. Therefore, in the embodiments of the present application, the access control node can request the first identifier from the database node, so as to read the identity file from the file system based on the first identifier.

[0332] 803. The database feeds back the hash value of the identity file to the access control node.

[0333] After receiving the first request message, the database can query the associated information corresponding to the public key in the saved data based on the public key carried in the first request message, so as to extract the hash value of the identity file from the associated information, or directly feed back the associated information to the access control node.

[0334] 804. The access control node sends the hash value of the identity file to the IPFS.

[0335] After receiving the hash value of the identity file, the access control node can send the hash value to the IPFS to request the identity file corresponding to the hash value from the IPFS.

[0336] 805. The IPFS issues the identity file to the access control node.

[0337] After receiving the hash value sent by the access control node, the IPFS can determine the address corresponding to the hash value, read the identity file of the device from the address, and issue the identity file to the access control node.

[0338] Specifically, the specific manner of determining the address corresponding to the hash value can comprise querying the address corresponding to the hash value using a pre-set mapping relationship, or calculating the address saved in the identity file of the device using the inverse operation of the aforementioned operation of generating the hash value, thereby extracting the identity file of the device.

[0339] 806、The access control node verifies the consistency of the public key of the owner in the identity file with the public key of the requester.

[0340] The access control node can also verify whether the device owner has the permission to query the identity file of the device. That is, to determine whether the information of the user associated with the device included in the identity file matches the information of the requester.

[0341] For example, it can be determined whether the public key of the owner of the device included in the identity file is consistent with the public key of the requester. If they are consistent, the requester is identified as the owner of the device, and the requester has the permission to query the identity file of the device. If the public key of the owner of the device included in the identity file is not consistent with the public key of the requester, it indicates that the requester can not have the permission to query the identity file of the device. At this time, the identity file can not be fed back to the requester, or a message of no permission to query or communication failure can be replied.

[0342] 807、The access control node feeds back the identity file to the device owner.

[0343] After the access control node verifies the association between the device and the device owner, the access control node can issue the identity file to the device owner, so that the device owner can obtain the identity file of the device.

[0344] Therefore, in the embodiments of the present application, the device owner can request to query the identity file of the device through the access control node, the access control node can verify the permission of the requester, and only when the requester has the permission to query the identity file of the device, the access control node feeds back the identity file of the device to the requester, thereby improving the data security and privacy of the device.

[0345] 2、Device itself queries the identity file

[0346] In the scenario of the device itself querying the identity file, the device can directly communicate with the access control node, or communicate with the access control node through the registration server. The different scenarios will be described below.

[0347] (1) The device directly communicates with the access control node

[0348] Referring to Figure 9 , the present application provides another flowchart of a device management method.

[0349] 901. The device sends identity credentials to the access control node.

[0350] The device's identity credentials may include information about the device itself, which is used to request the device's identity file from the access control node, such as the device's public key, the hash value of the public key, serial number, unique identifier, timestamp, random value, and signature generated using the private key.

[0351] For example, a device can retrieve the domain name or address of the access control node from its memory, and then initiate a connection to the access control node through that domain name or address, uploading the device's identity credentials, including the device's certificate, timestamp, random value, and signature generated using a private key. The timestamp can be used to prevent replay attacks and increase the security of data transmission within the system.

[0352] 902. Access control nodes verify identity credentials.

[0353] After receiving the identity credentials uploaded by the device, the access control node can verify those credentials. If verification is successful, subsequent steps are executed. If verification fails, no further steps are required, or the node can send a message to the device to resend the identity credentials or report a communication failure.

[0354] Specifically, if the identity credential includes a timestamp, it can be verified whether a message containing that timestamp has been received. If so, the identity credential can be discarded. If not, the signature can be verified using the device's public key. If the verification is successful, subsequent steps can be executed.

[0355] 903. The access control node sends the device public key to the database.

[0356] 904. The database sends the hash value of the identity file back to the access control node.

[0357] 905. The access control node sends the hash value of the identity file to IPFS.

[0358] 906. IPFS distributes identity files to the access control node.

[0359] Steps 903-906 can be referred to in steps 802-805 above, and will not be repeated here.

[0360] 907. The access control node verifies the consistency between the device public key in the identity file and the requester's public key.

[0361] After obtaining the device's identity file, the access control node can verify whether the device information included in the identity file matches the requester's information, such as verifying whether the device's public key in the identity file is consistent with the requester's public key. If they are consistent, the node will continue to execute subsequent steps; if they are inconsistent, the node will not need to execute subsequent steps and can send a message to the requester such as communication failure or lack of permission.

[0362] 908. The access control node sends the identity file back to the device.

[0363] Once the access control node determines that the device public key in the identity file matches the requester's public key, it means that the device requesting the identity file belongs to the device with the permission to query the identity file, and can then send the identity file back to the device.

[0364] Therefore, in this embodiment of the application, the device can request to query the device's identity file through the access control node. The access control node can verify the requester's permissions and only provide the requester with the device's identity file when the requester has the permission to query the device's identity file, thereby improving the device's data security and privacy.

[0365] Furthermore, to further improve the reliability of the obtained identity files, the hash values ​​of the device identity files can be obtained from multiple databases through multiple access control nodes. The hash values ​​returned by these multiple access control nodes can then be compared to see if they match. If they match, the queryer can save the identity file. See also... Figure 10 This application provides a flowchart of another equipment management method.

[0366] 1001. The device sends identity credentials to the first access control node.

[0367] 1002. The first access control node verifies the identity credentials.

[0368] 1003. The first access control node sends the device public key to the first database.

[0369] 1004. The first database sends the hash value of the identity file back to the first access control node.

[0370] 1005. The first access control node sends the hash value of the identity file to IPFS.

[0371] 1006. IPFS sends the identity file to the first access control node.

[0372] 1007. The first access control node verifies the consistency between the device public key in the identity file and the requester's device public key.

[0373] 1008. The first access control node sends the identity file back to the device.

[0374] Steps 1001-1008 can be referred to the description of steps 901-908 above, and will not be repeated here.

[0375] 1009. The device sends identity credentials to the second access control node.

[0376] Step 1010 is similar to step 1001, except that in step 1001, the device sends its identity credentials to the first access control node to request its identity file, while in step 1010, the device sends its identity credentials to the second access control node to request the hash value of its identity file. Of course, in step 1010, the device can also request its identity file from the second access control node; the specific approach can be adjusted according to the actual application scenario. This embodiment is merely an illustrative example.

[0377] 1010. The second access control node verifies the message signature.

[0378] 1011. The second access control node sends the device public key to the second database.

[0379] 1012. The second database sends the hash value of the identity file back to the second access control node.

[0380] 1013. The access control server sends the hash value of the identity file to the device.

[0381] Steps 1010-1013 can be referred to as steps 902-904 above, the difference being that the requested database is different.

[0382] 1014. The hash value included in the identity file in device verification step 1008 is consistent with the hash value received in step 1013.

[0383] After receiving the identity file fed back by the first access control node and the hash value of the identity file fed back by the second access control node, the device verifies whether the hash value included in the identity file fed back by the first access control node is consistent with the hash value fed back by the second access control node. If they are consistent, the identity file can be saved. If they are inconsistent, the identity file can be discarded and the aforementioned steps 1001-1013 can be re-executed until an accurate identity file is obtained.

[0384] Therefore, in this embodiment, the identifiers of the identity files returned by multiple access control nodes can be compared to see if they are consistent. The device saves the identity file only when the identifiers of the identity files returned by multiple access control nodes are consistent, thereby enabling the device to obtain a more accurate identity file.

[0385] (2) The device communicates with the access control node through the registration server.

[0386] The device can connect to a registration server and communicate with the device management platform through the registration server. This registration server can be a server specifically configured for the device to communicate with it, thereby reducing the load on the access control server; alternatively, the registration server can be a node in the network the device accesses, such as a network administrator within a WiFi network.

[0387] See Figure 11 This application provides a flowchart of another equipment management method.

[0388] 1101. The device sends its identity credentials to the registration server.

[0389] The device can send identity credentials to the registration server to request the device's identity file.

[0390] Specifically, prior to step 1101, an encrypted channel can be established between the device and the registration server, such as a Transport Layer Security (TLS) encrypted pipe or a channel encrypted using other encryption methods, thereby improving the security of the data transmitted between the device and the registration server.

[0391] 1102. The registration server forwards the device's identity credentials to the access control node.

[0392] The registration server can forward the identity credentials sent by the device to the access control node through an encrypted channel.

[0393] Prior to step 1102, an encrypted channel is established between the registration server and the access control node. The encryption method of this encrypted channel can be the same as or different from the encryption method of the encrypted channel between the device and the registration server. The specific method can be adjusted according to the actual application scenario.

[0394] It should be noted that the difference between steps 1101-1102 and the aforementioned step 901 is that in step 901, the device can directly send identity credentials to the access control node, while in steps 1101-1102, the identity credentials need to be forwarded by the registration server. Similar details will not be elaborated here.

[0395] 1103. Access control nodes verify identity credentials.

[0396] 1104. The access control node sends the device public key to the database.

[0397] 1105. The database sends the hash value of the identity file back to the access control node.

[0398] 1106. The access control node sends the hash value of the identity file to IPFS.

[0399] 1107. IPFS distributes identity files to the access control node.

[0400] 1108. The access control node verifies the consistency between the device public key in the identity file and the requester's public key.

[0401] Steps 1103-1108 can be referred to in steps 902-907 above, and will not be repeated here.

[0402] 1108. The access control node sends the identity file back to the registration server.

[0403] 1109. The registration server forwards the identity file to the device.

[0404] The access control node can send the identity file back to the registration server through an encrypted channel between the access control node and the registration server, and the registration server can also forward the identity file to the device through an encrypted channel between the registration server and the device. Of course, the identity file can also be transmitted without an encrypted channel, and the specific method can be adjusted according to the actual application scenario.

[0405] It should be noted that steps 1108-1109 are similar to step 908 mentioned above, and will not be described again here. The difference is that in step 908, the access control node directly sends the identity file to the device, while in steps 1108-1109, the registration server forwards the identity file.

[0406] Therefore, in this embodiment of the application, a registration server can be used to forward the data transmitted between the device and the access control node, and the data can be transmitted through an encrypted channel, which can improve the security of the data transmitted between the device and the access control node.

[0407] III. Equipment Transfer

[0408] In this application, the equipment owner may transfer the equipment to other users. This application exemplifies this by taking the example of a manufacturer (i.e., the first equipment owner) transferring the equipment to a user (i.e., the second equipment owner). Regarding the aforementioned... Figures 8-11 Similar steps will not be elaborated upon here; the differences will only be illustrated by example.

[0409] See Figure 12 This application provides a flowchart of another equipment management method.

[0410] 1201. The user sends its own user certificate to the manufacturer.

[0411] Once the user and the manufacturer agree to transfer the equipment, the user can provide the manufacturer with their identity certificate, which is called the user certificate for easy identification. The user certificate may include the user's information, such as the user's public key, username, or user identifier.

[0412] 1202. The manufacturer obtains the device's identity file from the access control node.

[0413] Manufacturers can obtain the device's identity file from the access control node; the specific process can be found in the aforementioned document. Figure 8 The steps involved are not repeated here.

[0414] 1203. Manufacturers add user information to the identity file.

[0415] Once the manufacturer obtains the identity file, it can add the user's information to the device's identity file.

[0416] For example, as shown in Table 1 above, the manufacturer can add the user's certificate, including the user's public key, to the "Next Owner Information" section of the identity file to obtain an updated identity file, indicating that the device is being transferred to the next owner, i.e., the user.

[0417] In addition, symmetric encryption can be performed using the user's public key, and the updated identity file can be signed so that subsequent users can use their own public key to decrypt or verify the identity file after obtaining it.

[0418] 1204. The vendor sends the updated identity file to the access control node.

[0419] 1205. The access control node retrieves the device association information from the database.

[0420] 1206. The access control node uploads the updated identity file to IPFS and receives the updated hash value.

[0421] 1207. The access control node sends the updated hash value to the vendor.

[0422] Steps 1204-1207 are similar to steps 707-713 above, except that the identity file updated by the manufacturer is uploaded here, while the identity file generated by the device owner is uploaded in steps 707-713 above.

[0423] 1208. Manufacturers send user information to the blockchain.

[0424] The user's information may include their public key, name, or other identifiers. Additionally, manufacturers can simultaneously send the device's public key and updated hash value to the blockchain to instruct it to update the device's transaction information.

[0425] 1209. Blockchain uses smart contracts to write user information into blocks.

[0426] In this context, blockchain can use smart contracts to write user information into blocks, such as designating a user as the next owner of a device and identifying them in transaction information.

[0427] 1210. Update the database with the associated information of the devices.

[0428] Referring to step 704 above, the database can scan the transaction information of the blockchain, thereby updating the device-related information included in the transaction information to the device's association information, and obtaining the updated association information.

[0429] 1212. The manufacturer sends the updated hash value to the user.

[0430] In addition, the manufacturer sends the updated hash value (i.e., the third identifier) ​​to the user, allowing the user to read the device's identity file based on the third identifier.

[0431] 1212. The user requests an identity file from the access control node using the updated hash value.

[0432] Users can send a request message to the control server, carrying an updated hash value, to request the access control node to read the device's identity file. This request message can also include user information, such as the user's public key, name, or other identifiers.

[0433] 1213. The access control node reads the identity file from IPFS.

[0434] 1214. The access control node reads device association information from the database.

[0435] Steps 1213-1214 can be referred to in steps 804-805 above, and will not be repeated here.

[0436] 1215. The access control node verifies the consistency between the device owner and the user.

[0437] In steps 1203-1209, the owner of the device in the device association information in the database has been changed to the user. Therefore, the owner of the device has been replaced by the user. At this time, it can be verified whether the owner information included in the association information matches the user information. For example, it can be determined whether the public key of the next owner included in the association information is consistent with the user's public key. If they are consistent, it means that the device belongs to the user, and the subsequent steps can be continued. If they are inconsistent, it means that the device does not belong to the user, and the subsequent steps do not need to be executed.

[0438] 1216. The access control node issues identity files to users.

[0439] If the access control node determines that the device belongs to the user, the access control node can send the device's identity file issued by IPFS to the user so that the user can obtain the identity file of the device they own.

[0440] 1217. The user updates the device ownership in the identity file.

[0441] After obtaining the identity document, the user can change the device's owner information in the identity document to the user's information.

[0442] For example, referring to Table 1 above, the information included in the device owner information can be replaced with the user's information, such as the user's name, identity certificate, etc.

[0443] 1218. The user uploads a new identity file to the access control node and receives a new hash value.

[0444] 1219. The user uploads a new hash value to the blockchain.

[0445] 1220. The blockchain party writes the new hash value into the block through a smart contract.

[0446] 1221. The database updates the device's association information with the new hash value.

[0447] Steps 1218-1221 are similar to steps 1103-1109 mentioned above, except that the identity file uploaded by the user is replaced by the identity file uploaded by the manufacturer. This will not be described in detail below.

[0448] Therefore, the implementation of this application allows for the transfer of equipment, that is, the transfer of equipment from the current owner to the next owner. This makes it adaptable to a wider range of scenarios, including equipment registration, transfer, and information retrieval, demonstrating strong generalization capabilities.

[0449] The foregoing has provided a detailed description of the system and method provided in this application. The following section describes the apparatus provided in this application.

[0450] See Figure 13 This application provides a schematic diagram of the structure of a second device.

[0451] The second device includes:

[0452] The transceiver module 1301 is used to send an identity file to the first access control node to instruct the first access control node to save the identity file to the file system. The identity file includes the identity information of the first device and the public key of the second device.

[0453] The transceiver module 1301 is also used to receive a first identifier sent by the first access control node. The first identifier is used to read the identity file from the file system. The first identifier is generated by the file system after the first access control node sends the identity file to the file system. The identity file is sent to the file system by the first access control node after verifying the information of the device associated with the first device in the association information of the second device and the verification is successful. The association information is obtained by the first access control node from the blockchain node and is stored in the database node.

[0454] In one possible implementation, the transceiver module 1301 is further configured to send registration information to the blockchain node before the second device sends the identity file to the first access control node. The registration information includes the information of the first device and the public key of the second device. The registration information is used to instruct the blockchain node to save the information of the first device and the public key of the second device in the transaction information of the first device through the smart contract corresponding to the first device. The transaction information is used by the database node to generate the association information of the first device.

[0455] In one possible implementation, the transceiver module 1301 is further configured to send a first identifier to the blockchain node to instruct the blockchain node to update the first identifier in the transaction information of the first device.

[0456] In one possible implementation, the transceiver module 1301 is further configured to: send a first identifier to the first access control node; and receive an identity file sent by the first access control node, wherein the identity file is obtained by the first access control node from the file system through the first identifier.

[0457] In one possible implementation, the device management system further includes: a second access control node; the second device further includes: a storage module 1302;

[0458] The transceiver module 1301 is also used to send a third request message to the second access control node;

[0459] The transceiver module 1301 is also used to receive the second identifier sent by the second access control node;

[0460] The storage module 1302 is used to save the identity file if the second identifier matches the first identifier.

[0461] In one possible implementation, the second device may further include: a processing module 1303;

[0462] The transceiver module 1301 is also used to receive information from a third device, including the third device's public key.

[0463] Processing module 1303 is used to add the public key of the third device to the identity file to obtain the updated identity file;

[0464] The transceiver module 1301 is also used to send the updated identity file to the first access control node, so as to instruct the first access control node to send the updated identity file to the file system and receive the third identifier fed back by the file system;

[0465] The transceiver module 1301 is also used to receive a third identifier sent by the first access control node, which is used to request an updated identity file from the file system.

[0466] See Figure 14 This application provides a schematic diagram of the structure of an access control node.

[0467] The transceiver module 1401 is used to receive an identity file sent by the second device, which includes the public key of the first device and the public key of the second device.

[0468] The transceiver module 1401 is also used to request the association information of the first device from the database node based on the identity file. The association information includes the public key of the owner of the first device. The association information is obtained by the database node from the blockchain node.

[0469] Processing module 1402 is used to determine the association between the first device and the second device through association information;

[0470] If the processing module 1402 determines that the first device belongs to the second device through the association information, the transceiver module 1401 is also used to request the file system to send the identity file, so as to instruct the file system to save the identity file;

[0471] The transceiver module 1401 is also used to receive the first identifier fed back by the file system and send the first identifier to the second device. The first identifier is used to read the identity file from the file system.

[0472] In one possible implementation, the transceiver module 1401 is further configured to request the association information of the first device from the database node based on the identity file if the processing module 1402 determines that the identity file is complete based on the signature carried in the identity file.

[0473] In one possible implementation,

[0474] The transceiver module 1401 is also used to receive an identity request message sent by the second device. The identity request message carries information of the first device and the public key of the second device. The identity request message is used to request an identity file.

[0475] The transceiver module 1401 is also used to send a first request message to the database node, the first request message including information about the first device;

[0476] The transceiver module 1401 is also used to receive the first identifier sent by the database node;

[0477] The transceiver module 1401 is also used to send the first identifier to the file system and receive the identity file returned by the file system;

[0478] If the public key included in the identity file matches the public key of the second device, the transceiver module 1401 is also used to send the identity file to the second device.

[0479] In one possible implementation, the transceiver module 1401 is further configured to receive an identity credential sent by the first device, the identity credential including the identifier of the first device;

[0480] Processing module 1402 is also used for verifying identity credentials;

[0481] If the identity credential verification is successful, the transceiver module 1401 is also used to send a second request message to the database node, the second request message including the identifier of the first device;

[0482] The transceiver module 1401 is also used to receive the first identifier sent by the database node;

[0483] The transceiver module 1401 is also used to send the first identifier to the file system and receive the identity file returned by the file system;

[0484] If the public key included in the identity file matches the public key of the first device, the transceiver module 1401 is also used to send the identity file to the first device.

[0485] In one possible implementation, the device management system further includes: a registration server;

[0486] The transceiver module 1401 is specifically used to receive the identity credentials forwarded by the registration server. The identity credentials are sent by the first device to the registration server through an encrypted pipe between the first device and the registration server.

[0487] The transceiver module 1401 is specifically used to send an identity file to the first device;

[0488] The transceiver module 1401 is specifically used to send an identity file to the first device through the registration server.

[0489] In one possible implementation, the transceiver module 1401 is further configured to: receive an updated identity file sent by the second device; send the updated identity file to the file system and receive a third identifier fed back by the file system; and send the third identifier to the second device, the third identifier being used to request the updated identity file.

[0490] See Figure 15 This application provides a schematic diagram of a blockchain node structure, including:

[0491] The transceiver module 1501 is used to receive registration information sent by the second device, which includes the public key of the first device and the public key of the second device.

[0492] The processing module 1502 is used to write the public key of the first device and the public key of the second device into the transaction information of the blockchain through the smart contract corresponding to the first device, so that after the database node obtains the transaction information of the blockchain node, it saves the public key of the first device and the public key of the second device included in the transaction information into the association information of the first device. The association information includes the information of the devices associated with the first device.

[0493] In one possible implementation, the transceiver module 1501 is further configured to receive a first identifier, which is used to request the identity file of the first device. The first identifier is generated by the file system after saving the identity file.

[0494] The processing module 1502 is also used to write the first identifier into the transaction information of the first device through a smart contract corresponding to the first device, so that the database node can save the first identifier into the associated information after obtaining the transaction information of the blockchain node.

[0495] See Figure 16 This application provides a schematic diagram of a database node structure, including:

[0496] The transceiver module 1601 is used to obtain transaction information from the blockchain of the blockchain node;

[0497] The processing module 1602 is used to save the public key of the first device and the public key of the second device included in the transaction information to the association information of the first device, and the association information includes the information of the devices associated with the first device.

[0498] In one possible implementation, the transceiver module 1601 is further configured to receive a home request message sent by the first access control node, the home request message carrying the public key of the first device.

[0499] The transceiver module 1601 is also used to send the association information of the first device to the first access control node based on the public key of the first device.

[0500] Please see Figure 17 The structural schematic diagram of another second device provided in this application is as follows.

[0501] The second device may include a processor 1701 and a memory 1702. The processor 1701 and the memory 1702 are interconnected via a circuit. The memory 1702 stores program instructions and data.

[0502] The aforementioned are stored in memory 1702 Figures 6-12 The steps in the code include the corresponding program instructions and data.

[0503] Processor 1701 is used to perform the aforementioned Figures 6-12 The method steps performed by the second device shown in any of the embodiments.

[0504] The transceiver 1703 is used to receive or send data.

[0505] Alternatively, the aforementioned Figure 17 The second device shown can be a chip.

[0506] Please see Figure 18 The following is a schematic diagram of another access control node structure provided in this application.

[0507] The access control node may include a processor 1801 and a memory 1802. The processor 1801 and the memory 1802 are interconnected via a line. The memory 1802 stores program instructions and data.

[0508] The aforementioned memory 1802 stores Figures 6-12 The steps in the code include the corresponding program instructions and data.

[0509] Processor 1801 is used to perform the aforementioned Figures 6-12 The method steps executed by the access control node shown in any of the embodiments.

[0510] The transceiver 1803 is used to receive or send data.

[0511] Alternatively, the aforementioned Figure 18 The access control node shown can be a chip.

[0512] Please see Figure 19 The following is a schematic diagram of another blockchain node structure provided in this application.

[0513] The blockchain node may include a processor 1901 and a memory 1902. The processor 1901 and the memory 1902 are interconnected via a circuit. The memory 1902 stores program instructions and data.

[0514] The aforementioned are stored in memory 1902 Figures 6-12 The steps in the code include the corresponding program instructions and data.

[0515] Processor 1901 is used to perform the aforementioned Figures 6-12 The method steps performed by a blockchain node as shown in any of the embodiments.

[0516] The transceiver 1903 is used to receive or send data.

[0517] Alternatively, the aforementioned Figure 19 The blockchain node shown can be a chip.

[0518] Please see Figure 20 Another schematic diagram of the structure of a database node provided in this application is shown below.

[0519] The database node may include a processor 2001 and a memory 2002. The processor 2001 and the memory 2002 are interconnected via a line. The memory 2002 stores program instructions and data.

[0520] The aforementioned are stored in memory 2002 Figures 6-12 The steps in the code include the corresponding program instructions and data.

[0521] Processor 2001 is used to execute the aforementioned Figures 6-12 The method steps executed by the database node shown in any of the embodiments.

[0522] Transceiver 2003 is used to receive or send data.

[0523] Alternatively, the aforementioned Figure 20 The database node shown can be a chip.

[0524] This application also provides a computer-readable storage medium storing a program that, when run on a computer, causes the computer to perform the aforementioned actions. Figures 6-12 The steps in the method described in the illustrated embodiment.

[0525] This application embodiment also provides a device management apparatus, which may also be referred to as a digital processing chip or a chip. The chip includes a processing unit and a communication interface. The processing unit obtains program instructions through the communication interface, and the program instructions are executed by the processing unit. The processing unit is used to perform the aforementioned... Figures 6-12 The method steps shown in any of the embodiments.

[0526] This application also provides a digital processing chip. This digital processing chip integrates circuitry for implementing the aforementioned processor or processor functions, and one or more interfaces. When the digital processing chip integrates a memory, it can perform the method steps of any one or more of the foregoing embodiments. When the digital processing chip does not integrate a memory, it can be connected to an external memory via a communication interface. The digital processing chip implements the above-described functionality based on the program code stored in the external memory. Figures 6-12 The method steps shown in any of the embodiments.

[0527] This application also provides a computer program product that, when run on a computer, causes the computer to perform the aforementioned actions. Figures 6-12 The steps in the method described in the illustrated embodiment.

[0528] The device management device provided in this application embodiment can be a chip, which includes a processing unit and a communication unit. The processing unit can be, for example, a processor, and the communication unit can be, for example, an input / output interface, pins, or circuits. The processing unit can execute computer execution instructions stored in a storage unit to cause the chip within the server to perform the aforementioned operations. Figures 6-12 The method described in the illustrated embodiment. Optionally, the storage unit is a storage unit within the chip, such as a register, cache, etc. The storage unit can also be a storage unit located outside the chip within the wireless access device, such as a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (RAM), etc.

[0529] Specifically, the aforementioned processing unit or processor can be a central processing unit (CPU), a neural-network processing unit (NPU), a graphics processing unit (GPU), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0530] It should also be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. In addition, in the device embodiment drawings provided in this application, the connection relationship between modules indicates that they have a communication connection, which can be implemented as one or more communication buses or signal lines.

[0531] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware, or it can be implemented by special-purpose hardware including application-specific integrated circuits, special-purpose CPUs, special-purpose memory, special-purpose components, etc. Generally, any function performed by a computer program can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be diverse, such as analog circuits, digital circuits, or special-purpose circuits. However, for this application, software program implementation is more often the preferred implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a readable storage medium, such as a computer floppy disk, USB flash drive, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0532] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product.

[0533] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk (SSD)).

[0534] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0535] Finally, it should be noted that the above are only specific embodiments of this application, but the protection scope of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the protection scope of this application.

Claims

1. An equipment management system, characterized in that, include: The system comprises a first device, a second device, a first access control node, a file system, a database node, and a blockchain node, wherein a database for storing data is deployed in the database node; The second device is configured to send an identity file to the first access control node, the identity file including the identity information of the first device and the public key of the second device; The first access control node is configured to request association information of the first device from the database node based on the identity file. The association information includes the public key of the device associated with the first device. The association information is obtained by the database node from the blockchain node. If the first access control node determines that the first device is associated with the second device through the association information, the first access control node is further configured to send the identity file to the file system; The file system is used to store the identity file and to feed back a first identifier corresponding to the identity file to the first access control node. The first identifier is used to read the identity file from the file system.

2. The system according to claim 1, characterized in that, Before sending the identity file to the first access control node, the second device is also used to send registration information to the blockchain node, the registration information including the information of the first device and the public key of the second device; The blockchain node is used by the second device to register by writing the information of the first device and the public key of the second device into the transaction information of the blockchain through a smart contract corresponding to the first device. The database node is used to obtain the transaction information of the blockchain node and save the public key of the first device and the public key of the second device included in the transaction information to the associated information.

3. The system according to claim 1 or 2, characterized in that, The second device is also used to send the first identifier to the blockchain node; The blockchain node is also used to update the first identifier to the transaction information of the first device stored locally through a smart contract corresponding to the first device.

4. The system according to any one of claims 1-2, characterized in that, The second device is further configured to send an identity request message to the first access control node, the identity request message carrying information of the first device and the public key of the second device, the identity request message being used to request the identity file; The first access control node is also used to obtain the first identifier; The first access control node is also configured to send the first identifier to the file system and receive the identity file fed back by the file system; If the public key included in the identity file matches the public key of the second device, the first access control node is further configured to send the identity file to the second device.

5. The system according to any one of claims 1-2, characterized in that, The first device is further configured to send an identity credential to the first access control node, the identity credential including an identifier of the first device, in order to request the identity file from the first access control node; The first access control node is further configured to send a second request message to the database node if the identity credential is verified and the verification is successful, the second request message including the identifier of the first device; The database node is also used to feed back the first identifier to the first access control node; The first access control node is also configured to send the first identifier to the file system and receive the identity file fed back by the file system; If the identifier included in the identity file matches the identifier in the identity credential, the first access control node is further configured to send the identity file to the first device.

6. The system according to claim 5, characterized in that, The device management system also includes: a registration server; The first device is specifically used to send the identity credential to the registration server through an encrypted pipe; The registration server is used to forward the identity credentials to the access control server through an encrypted pipe; The first access control node is specifically used to send the identity file to the registration server; The registration server is specifically used to forward the identity file to the first device.

7. The system according to claim 6, characterized in that, The device management system further includes: a second access control node; The first device is configured to send a third request message to the second access control node; The second access control node is used to obtain the second identifier of the identity file after verifying the third request message and the verification is successful; The second access control node is also used to feed back the second identifier to the first device; The first device is further configured to save the identity file when verifying that the first identifier and the second identifier match.

8. The system according to claim 7, characterized in that, The first access control node is specifically configured to send a first request message to the database node and receive the first identifier fed back by the database node, wherein the first request message includes the public key of the first device.

9. The system according to claim 2, characterized in that, The equipment management system also includes: a third device; The second device is further configured to add information of the third device to the identity file to obtain an updated identity file, wherein the information of the third device includes the public key of the third device, and the updated identity file indicates that the first device is associated with the third device; The second device is also used to send the updated identity file to the first access control node; The first access control node is also configured to send the updated identity file to the file system and receive a third identifier from the file system. The first access control node is also configured to send the third identifier to the second device; The second device is further configured to send the third identifier to the third device, the third identifier being used to request the updated identity file from the file system; The second device is further configured to send update information to the blockchain node, the update information including the public key of the first device, the public key of the third device, and the third identifier; The blockchain node uses the update information to update the transaction information, thereby obtaining the updated transaction information; The database node is also used to obtain the updated transaction information and update the association information according to the updated transaction information to obtain the updated association information.

10. A method for managing equipment, characterized in that, An application is made to a device management system, the device management system comprising: a first device, a first access control node, a file system, a second device, a database node, and a blockchain node, wherein a database for storing data is deployed in the database node, and the first device is associated with the second device, the method comprising: The second device sends an identity file to the first access control node to instruct the first access control node to save the identity file to the file system. The identity file includes the identity information of the first device and the public key of the second device. The second device receives a first identifier sent by the first access control node. The first identifier is used to read the identity file from the file system. The first identifier is generated by the file system after the first access control node sends the identity file to the file system. The identity file is sent by the first access control node to the file system after verifying the information of the second device and the device associated with the first device in the association information and the verification is successful. The association information is obtained by the first access control node from the blockchain node and is stored in the database node.

11. The method according to claim 10, characterized in that, Before the second device sends the identity file to the first access control node, the method further includes: The second device sends registration information to the blockchain node. The registration information includes the information of the first device and the public key of the second device. The registration information is used to instruct the blockchain node to save the information of the first device and the public key of the second device in the transaction information through the smart contract corresponding to the first device. The transaction information is used by the database node to generate the association information of the first device.

12. The method according to claim 10 or 11, characterized in that, The method further includes: The second device sends the first identifier to the blockchain node to instruct the blockchain node to update the first identifier in the transaction information of the first device.

13. The method according to any one of claims 10-11, characterized in that, The method further includes: The second device sends the first identifier to the first access control node; The second device receives the identity file sent by the first access control node, which is obtained by the first access control node from the file system through the first identifier.

14. The method according to claim 13, characterized in that, The device management system further includes: a second access control node; the method further includes: The second device sends a third request message to the second access control node; The second device receives the second identifier sent by the second access control node; If the second identifier matches the first identifier, the second device saves the identity file.

15. The method according to any one of claims 10-11, characterized in that, The method further includes: The second device receives information from the third device, the information of which includes the public key of the third device; The second device adds the public key of the third device to the identity file to obtain an updated identity file, which indicates that the first device is associated with the third device; The second device sends the updated identity file to the first access control node to instruct the first access control node to send the updated identity file to the file system and receive the third identifier fed back by the file system; The second device receives the third identifier sent by the first access control node, the third identifier being used to request the updated identity file from the file system.

16. A method for managing equipment, characterized in that, An application is made in a device management system, the device management system comprising: a second device, a first access control node, a file system, a first device, a database node, and a blockchain node, wherein a database for storing data is deployed in the database node, and the first device is associated with the second device, the method comprising: The first access control node receives an identity file sent by the second device, the identity file including the identity information of the first device and the public key of the second device; The first access control node requests the association information of the first device from the database node based on the identity file. The association information includes the public key of the device associated with the first device. The association information is obtained by the database node from the blockchain node. If the first access control node determines that the first device is associated with the second device through the association information, the first access control node sends the identity file to the file system to instruct the file system to save the identity file; The first access control node receives a first identifier fed back by the file system and sends the first identifier to the second device. The first identifier is used to read the identity file from the file system.

17. The method according to claim 16, characterized in that, The first access control node requests the association information of the first device from the database node based on the identity file, including: If the first access control node determines that the identity file is complete based on the signature carried in the identity file, it then requests the association information of the first device from the database node based on the identity file.

18. The method according to claim 16 or 17, characterized in that, The method further includes: The first access control node receives an identity request message sent by the second device. The identity request message carries information about the first device and the public key of the second device. The identity request message is used to request the identity file. The first access control node sends a first request message to the database node, the first request message including information about the first device; The first access control node receives the first identifier sent by the database node; The first access control node sends the first identifier to the file system and receives the identity file from the file system. If the public key included in the identity file matches the public key of the second device, the first access control node sends the identity file to the second device.

19. The method according to any one of claims 16-17, characterized in that, The method further includes: The first access control node receives the identity credential sent by the first device, the identity credential including the identifier of the first device; The first access control node verifies the identity credentials; If the identity credential verification is successful, the first access control node sends a second request message to the database node, the second request message including the identifier of the first device; The first access control node receives the first identifier sent by the database node; The first access control node sends the first identifier to the file system and receives the identity file from the file system. If the identifier included in the identity file matches the identifier of the first device, the first access control node sends the identity file to the first device.

20. The method according to claim 19, characterized in that, The device management system also includes: a registration server; The first access control node receives the identity credentials sent by the first device, including: The first access control node receives the identity credential forwarded by the registration server, and the identity credential is sent by the first device to the registration server through an encrypted pipe between the first device and the registration server; The first access control node sends the identity file to the first device, including: The first access control node sends the identity file to the first device through the registration server.

21. The method according to any one of claims 16-17, characterized in that, The method further includes: The first access control node receives the updated identity file sent by the second device; The first access control node sends the updated identity file to the file system and receives the third identifier from the file system. The first access control node sends the third identifier to the second device, the third identifier being used to request the updated identity file.

22. A method for managing equipment, characterized in that, An application is made to a device management system, the device management system comprising: a second device, a first access control node, a file system, a database node, and a blockchain node. The database node deploys a database for storing data. The first device is associated with the second device. The second device sends an identity file to the first access control node, instructing the first access control node to save the identity file to the file system. The identity file includes the public key of the first device and the public key of the second device. The second device receives a first identifier sent by the first access control node. The first identifier is used to read the identity file from the file system. The first identifier is generated by the file system after the first access control node sends the identity file to the file system. The identity file is sent by the first access control node to the file system after verifying the information of the second device and the device associated with the first device in the association information, and the verification is successful. The association information is obtained by the first access control node from the blockchain node and is stored in the database node. The method includes: The blockchain node receives registration information sent by the second device, the registration information including information of the first device and the public key of the second device; The blockchain node writes the public key of the first device and the public key of the second device into the blockchain transaction information through the smart contract corresponding to the first device. After the database node obtains the transaction information of the blockchain node, it saves the public key of the first device and the public key of the second device included in the transaction information into the association information of the first device. The association information includes information about devices associated with the first device.

23. The method according to claim 22, characterized in that, The method further includes: The blockchain node receives a first identifier, which is used to request the identity file of the first device. The first identifier is generated by the file system after saving the identity file. The blockchain node writes the first identifier into the transaction information through a smart contract corresponding to the first device, so that the database node saves the first identifier into the associated information after obtaining the transaction information of the blockchain node.

24. A method for managing equipment, characterized in that, An application is made to a device management system, the device management system comprising: a second device, a first access control node, a file system, a database node, and a blockchain node. The database node deploys a database for storing data. The first device is associated with the second device. The second device sends an identity file to the first access control node, instructing the first access control node to save the identity file to the file system. The identity file includes the public key of the first device and the public key of the second device. The second device receives a first identifier sent by the first access control node. The first identifier is used to read the identity file from the file system. The first identifier is generated by the file system after the first access control node sends the identity file to the file system. The identity file is sent by the first access control node to the file system after verifying the information of the second device and the device associated with the first device in the association information, and the verification is successful. The association information is obtained by the first access control node from the blockchain node and is stored in the database node. The method includes: The database node obtains transaction information from the blockchain of the blockchain node; The database node saves the public key of the first device and the public key of the second device included in the transaction information to the association information of the first device, and the association information includes information about devices associated with the first device.

25. The method according to claim 24, characterized in that, The method further includes: The database node receives a home request message sent by the first access control node, the home request message carrying the identifier of the first device; The database node sends the association information of the first device to the first access control node based on the identifier of the first device.

26. A second device, characterized in that, This is applied to a device management system, which includes: a second device, a first access control node, a file system, a first device, a database node, and a blockchain node. The database node deploys a database for storing data. The first device is associated with the second device, and the second device includes: The transceiver module is used to send an identity file to the first access control node to instruct the first access control node to save the identity file to the file system. The identity file includes the identity information of the first device and the public key of the second device. The transceiver module is further configured to receive a first identifier sent by the first access control node. The first identifier is used to read the identity file from the file system. The first identifier is generated by the file system after the first access control node sends the identity file to the file system. The identity file is sent by the first access control node to the file system after verifying the information of the second device and the device associated with the first device in the association information and the verification is successful. The association information is obtained by the first access control node from the blockchain node and is stored in the database node.

27. The second device according to claim 26, characterized in that, The transceiver module is further configured to send registration information to the blockchain node before sending the identity file to the first access control node. The registration information includes information about the first device and the public key of the second device. The registration information is used to instruct the blockchain node to save the information about the first device and the public key of the second device in the transaction information of the first device through a smart contract corresponding to the first device. The transaction information is used by the database node to generate association information for the first device.

28. The second device according to claim 26 or 27, characterized in that, The transceiver module is further configured to send the first identifier to the blockchain node, instructing the blockchain node to update the first identifier to the transaction information of the first device.

29. The second device according to any one of claims 26-27, characterized in that, The transceiver module is also used for: Send the first identifier to the first access control node; The system receives the identity file sent by the first access control node, which is obtained by the first access control node from the file system through the first identifier.

30. The second device according to claim 29, characterized in that, The device management system further includes: a second access control node; the second device further includes: a storage module; The transceiver module is also used to send a third request message to the second access control node; The transceiver module is also used to receive a second identifier sent by the second access control node; The storage module is used to save the identity file if the second identifier matches the first identifier.

31. The second device according to any one of claims 26-27, characterized in that, The second device further includes: a processing module; The transceiver module is also used to receive information from a third device, the information of which includes the public key of the third device; The processing module is used to add the public key of the third device to the identity file to obtain the updated identity file; The transceiver module is further configured to send the updated identity file to the first access control node, instructing the first access control node to send the updated identity file to the file system and receive the third identifier fed back by the file system; The transceiver module is further configured to receive the third identifier sent by the first access control node, the third identifier being used to request the updated identity file from the file system.

32. An access control node, characterized in that, This is applied to a device management system, which includes: a second device, a first access control node, a file system, a database node, and a blockchain node. The database node deploys a database for storing data. The first device is associated with the second device. The access control node includes: The transceiver module is used to receive an identity file sent by the second device, the identity file including the public key of the first device and the public key of the second device; The transceiver module is further configured to request association information of the first device from the database node based on the identity file. The association information includes the public key of the owner of the first device, and the association information is obtained by the database node from the blockchain node. The processing module is used to determine the association between the first device and the second device through the association information; If the processing module determines that the first device and the second device are associated through the association information, the transceiver module is further configured to send the identity file to the file system to instruct the file system to save the identity file; The transceiver module is further configured to receive a first identifier fed back by the file system and send the first identifier to the second device, wherein the first identifier is used to read the identity file from the file system.

33. The access control node according to claim 32, characterized in that, The transceiver module is further configured to request the association information of the first device from the database node based on the identity file if the processing module determines that the identity file is complete according to the signature carried in the identity file.

34. The access control node according to claim 32 or 33, characterized in that, The transceiver module is further configured to receive an identity request message sent by the second device, the identity request message carrying information of the first device and the public key of the second device, the identity request message being used to request the identity file; The transceiver module is further configured to send a first request message to the database node, the first request message including information about the first device; The transceiver module is also used to receive the first identifier sent by the database node; The transceiver module is further configured to send the first identifier to the file system and receive the identity file fed back by the file system; If the public key included in the identity file matches the public key of the second device, the transceiver module is further configured to send the identity file to the second device.

35. The access control node according to any one of claims 32-33, characterized in that, The transceiver module is further configured to receive an identity credential sent by the first device, wherein the identity credential includes the identifier of the first device; The processing module is also used to verify the identity credential; If the identity credential verification is successful, the transceiver module is further configured to send a second request message to the database node, the second request message including the identifier of the first device; The transceiver module is also used to receive the first identifier sent by the database node; The transceiver module is further configured to send the first identifier to the file system and receive the identity file fed back by the file system; If the public key included in the identity file matches the public key of the first device, the transceiver module is further configured to send the identity file to the first device.

36. The access control node according to claim 35, characterized in that, The device management system also includes: a registration server; The transceiver module is specifically used to receive the identity credential forwarded by the registration server. The identity credential is sent by the first device to the registration server through an encrypted pipe between the first device and the registration server. The transceiver module is specifically used to send the identity file to the first device; The transceiver module is specifically used to send the identity file to the first device through the registration server.

37. The access control node according to any one of claims 32-33, characterized in that, The transceiver module is also used to receive the updated identity file sent by the second device; The transceiver module is also used to send the updated identity file to the file system and receive the third identifier fed back by the file system; The transceiver module is further configured to send the third identifier to the second device, the third identifier being used to request the updated identity file.

38. A blockchain node, characterized in that, An application is provided for a device management system, comprising: a second device, a first access control node, a file system, a database node, and a blockchain node. The database node deploys a database for storing data. The first device is associated with the second device. The second device sends an identity file to the first access control node, instructing the first access control node to save the identity file to the file system. The identity file includes the public key of the first device and the public key of the second device. The second device receives a first identifier sent by the first access control node. The first identifier is used to read the identity file from the file system. The first identifier is generated by the file system after the first access control node sends the identity file to the file system. The identity file is sent by the first access control node to the file system after verifying the information of the second device and the device associated with the first device in the association information, and the verification is successful. The association information is obtained by the first access control node from the blockchain node and is stored in the database node. The blockchain node includes: A transceiver module is used to receive registration information sent by the second device, the registration information including the public key of the first device and the public key of the second device; The processing module is configured to write the public key of the first device and the public key of the second device into the transaction information of the blockchain through a smart contract corresponding to the first device, so that after the database node obtains the transaction information of the blockchain node, it saves the public key of the first device and the public key of the second device included in the transaction information into the association information of the first device, wherein the association information includes information of devices associated with the first device.

39. The blockchain node according to claim 38, characterized in that, The transceiver module is further configured to receive a first identifier, which is used to request the identity file of the first device. The first identifier is generated by the file system after saving the identity file. The processing module is further configured to write the first identifier into the transaction information of the first device through a smart contract corresponding to the first device, so that the database node saves the first identifier into the associated information after obtaining the transaction information of the blockchain node.

40. A database node, characterized in that, An application is provided for a device management system, comprising: a second device, a first access control node, a file system, a database node, and a blockchain node. The database node deploys a database for storing data. The first device is associated with the second device. The second device sends an identity file to the first access control node, instructing the first access control node to save the identity file to the file system. The identity file includes the public key of the first device and the public key of the second device. The second device receives a first identifier sent by the first access control node. The first identifier is used to read the identity file from the file system. The first identifier is generated by the file system after the first access control node sends the identity file to the file system. The identity file is sent by the first access control node to the file system after verifying the information of the second device and the device associated with the first device in the association information, and the verification is successful. The association information is obtained by the first access control node from the blockchain node and is stored in the database node. The database node includes: The transceiver module is used to obtain transaction information from the blockchain of the blockchain node; The processing module is configured to save the public key of the first device and the public key of the second device included in the transaction information to the association information of the first device, wherein the association information includes information about devices associated with the first device.

41. The database node according to claim 40, characterized in that, The transceiver module is further configured to receive a home request message sent by the first access control node, wherein the home request message carries the public key of the first device. The transceiver module is further configured to send the association information of the first device to the first access control node based on the public key of the first device.

42. A second device, characterized in that, The method includes a processor coupled to a memory storing a program, wherein the program instructions stored in the memory are executed by the processor to implement the method of any one of claims 10 to 15.

43. An access control node, characterized in that, The method includes a processor coupled to a memory storing a program, wherein the program instructions stored in the memory are executed by the processor to implement the method of any one of claims 16 to 21.

44. A blockchain node, characterized in that, The method includes a processor coupled to a memory storing a program, wherein the program instructions stored in the memory are executed by the processor to implement the method of any one of claims 22 to 23.

45. A database node, characterized in that, The system includes a processor coupled to a memory storing a program that, when executed by the processor, implements the method of any one of claims 24 to 25.

46. ​​A computer-readable storage medium comprising a program, which, when executed by a processing unit, performs the method as claimed in any one of claims 10 to 25.

47. An equipment management device, characterized in that, The system includes a processing unit and a communication interface. The processing unit obtains program instructions through the communication interface, and when the program instructions are executed by the processing unit, the system implements the method of any one of claims 10 to 25.

48. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the method as described in any one of claims 10 to 25.

Images