The granted method, the granted server, the resource server and the client device

Abstract

The embodiment of the application provides a kind of authorized method, authorization server, resource server and client device, can effectively improve the security performance of IoT system.The authorized method includes: authorization server receives the authorization request information sent by client device, and the authorization request information includes first identification information;The authorization server generates first token based on the authorization request information and sends the first token to the client device, and the first token is used to authorize the service request for first service to the client device;The authorization server receives the second identification information sent by resource server, and the second identification information is the identification information determined by the resource server;The authorization server determines that the second identification information corresponds to the first token;The authorization server sends the first token to the resource server.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of Internet of Things (IoT), and more particularly, to an authorization method, an authorization server, a resource server and a client device. BACKGROUND

[0002] Building Automation Control Network (BACnet) is a data communication protocol specified for the automatic control network of a building, and the goal is to integrate products of different manufacturers and different functions in a system and realize the interoperation between devices.

[0003] In BACnet, after an IoT device is added to an IoT system, it can perform all functions of the IoT system. This operation may have a large security risk, for example, after a malicious attacker is added to the IoT system, it can also perform all functions of the IoT system, so it can easily obtain the data of the IoT system or maliciously tamper with the data. SUMMARY

[0004] The present application provides an authorization method, an authorization server, a resource server and a client device, which can effectively improve the security performance of the IoT system.

[0005] In a first aspect, an authorization method is provided, comprising: an authorization server receiving authorization request information sent by a client device, the authorization request information comprising first identification information; the authorization server generating a first token based on the authorization request information and sending the first token to the client device, the first token being used to authorize the client device to make a service request for a first service; the authorization server receiving second identification information sent by a resource server, the second identification information being identification information determined by the resource server; the authorization server determining that the second identification information corresponds to the first token; and the authorization server sending the first token to the resource server.

[0006] The above technical solution, when the client device needs to access the first service, needs to request the authorization server for a token for authorizing the service request of the first service, and the resource server also requests the authorization server for a token. After the resource server receives the token, it can allocate resources for the client device to access the first service. Compared with the client device directly accessing the first service without any authorization, the security performance of the entire system is effectively improved.

[0007] Further, the client device sends the determined first identification information to the authorization server when requesting the token, so that the authorization server generates the token based on the first identification information. Moreover, the resource server also sends the determined second identification information to the authorization server, the second identification information corresponds to the same token as the first identification information, so that the authorization server can send the token sent to the client device to the resource server after receiving the second identification information. The technical solution enables the client device and the resource server to obtain the same token from the authorization server, so that the client device does not need to send the token to the resource server, thereby saving the signaling overhead between the client device and the resource server. In addition, the problem that the token cannot be transmitted if the client device sends the token to the resource server, which may need to be sent together with the message but the message has no additional field to store the token, is avoided.

[0008] In some possible implementation manners, the first identification information and the second identification information are the same.

[0009] In the above technical solution, the first identification information and the second identification information are the same, so that the authorization server can more easily determine the token corresponding to the second identification information after receiving the second identification information sent by the resource server, and the accuracy of the token sent to the resource server being the same as the token sent to the client device is improved.

[0010] In some possible implementation manners, the first identification information and the second identification information are an identity identification number ID of the first token.

[0011] Since the ID of the token uniquely corresponds to the token, in the above technical solution, the authorization server can only generate the first token through the first identification information, and can only find the first token through the second identification information, and cannot find other tokens, thereby ensuring that the token obtained by the client device and the token obtained by the resource server are the same, and the normal access of the client device to the first service is ensured.

[0012] In some possible implementation manners, the first identification information is obtained by the client device according to data in service request information sent to the resource server, and the second identification information is obtained by the resource server according to data in the received service request information.

[0013] In the above technical solution, the client device and the resource server obtain the identification information according to data in the service request information, so that the first identification information obtained by the client device and the second identification information obtained by the resource server can obtain the same token, thereby ensuring the normal access of the client device to the first service.

[0014] In some possible implementation manners, the first identification information is obtained by the client device from a transport layer security (TLS) connection between the client device and the resource server; and the second identification information is obtained by the resource server from the TLS connection between the resource server and the client device.

[0015] The technical solution has the following beneficial effects. Since the TLS layer is an encryption layer, the client device and the resource server obtain the identification information according to the TLS connection, so that the first identification information obtained by the client device and the second identification information obtained by the resource server can obtain the same token, and the first identification information and the second identification information also have encryption performance, further improving the security performance of the entire system.

[0016] In some possible implementation manners, the determining, by the authorization server, that the second identification information corresponds to the first token includes: determining, by the authorization server, that the second identification information corresponds to the first token based on the second identification information and a correspondence between identification information and tokens.

[0017] In a second aspect, a method for authorization is provided, including: determining, by a resource server, second identification information, the second identification information being an identity identification number (ID) of a first token; sending, by the resource server, the second identification information to an authorization server; and receiving, by the resource server, a first token sent by the authorization server, wherein the second identification information corresponds to the first token, and the first token is used to authorize a client device to make a service request for a first service.

[0018] In some possible implementation manners, the second identification information is an identity identification number (ID) of the first token.

[0019] In some possible implementation manners, the method further includes: receiving, by the resource server, service request information sent by the client device, the service request information being used to request access to resources of the first service; and calculating, by the resource server, the second identification information according to data in the service request information.

[0020] In some possible implementation manners, the method further includes: establishing, by the resource server, a transport layer security (TLS) connection between the resource server and the client device; and obtaining, by the resource server, the second identification information according to the TLS connection.

[0021] In some possible implementation manners, the method further includes: verifying, by the resource server, the service request information based on attribute information of the first token.

[0022] In a third aspect, a method for authorization is provided, including: determining, by a client device, first identification information; sending, by the client device, authorization request information to an authorization server, the authorization request information including the first identification information; and receiving, by the client device, a first token generated by the authorization server based on the authorization request information, the first token being used to authorize a service request for a first service by the client device.

[0023] In some possible implementation manners, the first identification information is an identity number ID of the first token.

[0024] In some possible implementation manners, the method further includes: determining, by the client device, service request information sent to a resource server, the service request information being used to request access to a resource of the first service; and calculating, by the client device, the first identification information according to data in the service request information.

[0025] In some possible implementation manners, the method further includes: establishing, by the client device, a transport layer security (TLS) connection with the resource server; and obtaining, by the client device, the second identification information according to the TLS connection.

[0026] In a fourth aspect, an authorization server is provided, including units for performing the method in the first aspect or any of the implementation manners thereof.

[0027] In a fifth aspect, a resource server is provided, including units for performing the method in the second aspect or any of the implementation manners thereof.

[0028] In a sixth aspect, a client device is provided, including units for performing the method in the third aspect or any of the implementation manners thereof.

[0029] In a seventh aspect, an authorization server is provided, including: a memory configured to store a program; and a processor configured to execute the program stored in the memory, when the program stored in the memory is executed, the processor is configured to perform the method in the first aspect or any of the implementation manners thereof.

[0030] In an eighth aspect, a resource server is provided, including: a memory configured to store a program; and a processor configured to execute the program stored in the memory, when the program stored in the memory is executed, the processor is configured to perform the method in the second aspect or any of the implementation manners thereof.

[0031] In a ninth aspect, a client device is provided, including: a memory configured to store a program; and a processor configured to execute the program stored in the memory, when the program stored in the memory is executed, the processor is configured to perform the method in the third aspect or any of the implementation manners thereof. BRIEF DESCRIPTION OF DRAWINGS

[0032] Figure 1 is a topology of a BACnet network according to an embodiment of the present application.

[0033] Figure 2 is a schematic diagram of an authorization method according to an embodiment of the present application.

[0034] Figure 3 is a schematic diagram of another authorization method according to an embodiment of the present application.

[0035] Figure 4 is a schematic diagram of still another authorization method according to an embodiment of the present application.

[0036] Figure 5 is a schematic flowchart of an authorization method according to an embodiment of the present application.

[0037] Figure 6 is a schematic flowchart of another authorization method according to an embodiment of the present application.

[0038] Figure 7 is a schematic block diagram of an authorization server according to an embodiment of the present application.

[0039] Figure 8 is a schematic block diagram of a resource server according to an embodiment of the present application.

[0040] Figure 9 is a schematic block diagram of a client device according to an embodiment of the present application.

[0041] Figure 10 is a schematic block diagram of an apparatus according to an embodiment of the present application.

[0042] LIST OF REFERENCE NUMERALS

[0043] W, BACnet network segment;

[0044] L, physical network segment;

[0045] R, repeater;

[0046] B, bridge;

[0047] RT, router;

[0048] 1 / 2RT, half router;

[0049] N, BACnet network;

[0050] P, point-to-point (PTP) connection;

[0051] 210, the authorization server receives authorization request information sent by the client device;

[0052] 220, the authorization server generates the first token based on the authorization request information and sends the first token to the client device;

[0053] 230, the authorization server receives the second identification information sent by the resource server;

[0054] 240, the authorization server determines that the second identification information corresponds to the first token;

[0055] 250, the authorization server sends the first token to the resource server;

[0056] 310, the resource server determines the second identification information;

[0057] 320, the resource server sends the second identification information to the authorization server;

[0058] 330, the resource server receives the first token sent by the authorization server;

[0059] 410, the client device determines the first identification information;

[0060] 420, the client device sends the authorization request information to the authorization server;

[0061] 430, the client device receives the first token generated by the authorization server based on the authorization request information;

[0062] C, the client device;

[0063] AS, the authorization server;

[0064] BS: resource server;

[0065] 501-513, steps of method 500;

[0066] 601-613, steps of method 600;

[0067] 700, the authorization server;

[0068] 710, the communication unit;

[0069] 720, the processing unit;

[0070] 730, the determination unit;

[0071] 800, the resource server;

[0072] 810, the determination unit;

[0073] 820, the communication unit;

[0074] 900, the client device;

[0075] 910, determining unit;

[0076] 920, communication unit;

[0077] 1000, apparatus;

[0078] 1001, memory;

[0079] 1002, processor;

[0080] 1003, communication interface;

[0081] 1004, bus. DETAILED DESCRIPTION

[0082] The technical solutions in the embodiments of the present application will be described below with reference to the drawings. It should be understood that the specific examples in the present specification are only to help those skilled in the art better understand the embodiments of the present application, and do not limit the scope of the embodiments of the present application.

[0083] It should be understood that in various embodiments of the present application, the size of the serial number of each process does not mean the order of execution, and the execution order of each process should be determined by its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0084] It should also be understood that the various embodiments described in the present specification can be implemented alone or in combination, and the embodiments of the present application do not limit this.

[0085] Unless otherwise specified, all technical and scientific terms used in the embodiments of the present application have the same meaning as understood by those skilled in the art of the present application. The terms used in the present application are only for the purpose of describing the specific embodiments of the present application, and are not intended to limit the scope of the present application.

[0086] IoT is a network that allows all ordinary physical objects that can be independently addressed to communicate with each other based on information carriers such as the Internet and traditional telecommunications networks. With the in-depth development of IoT, various IoT devices begin to access the IoT system.

[0087] Among them, the IoT device can be a radio frequency identification device, a sensor, a global positioning system device, a laser scanner, a smart home device, a building device, etc. When the IoT device is a building device, the IoT device can include but is not limited to lighting devices, temperature controllers, dimmers, smoke alarms, etc.

[0088] The IoT device can also have at least one network interface, such as an Ethernet interface or a wireless local area network interface. Further, the IoT device can also have Internet networking capability to communicate with other devices, such as using one or more communication protocols based on the network interface described above. Exemplarily, the communication protocol can be, but is not limited to, a BACnet communication protocol, a hypertext transfer protocol (HTTP), and the like.

[0089] In order to adapt BACnet to various applications, BACnet does not specify a strict network topology. Exemplarily, Figure 1 A possible topology of a BACnet network is shown. In this topology, the IoT device can be referred to as a BACnet device.

[0090] Each BACnet device can be connected to a physical medium, which is referred to as a physical network segment. One or more physical network segments can be connected at the physical layer through a repeater, thereby forming a BACnet network segment, Figure 1 There are five BACnet network segments in total. One or more BACnet network segments can be interconnected through a bridge to form a BACnet network, from Figure 1 As can be seen from the above, Figure 1 There are three BACnet networks in total. Each BACnet network can form a single medium access control (MAC) address domain. The devices that connect the network segments at the physical layer and the data link layer can use MAC addresses to filter messages. Multiple networks using different local area network technologies can be interconnected using BACnet routers to form a BACnet network. In a BACnet network, there can be a message path between any two nodes.

[0091] In BACnet, after a BACnet device is added to the system, it can perform all functions of the system, such as data transmission, without authorization. This operation can have a high security risk, such as when a malicious attacker joins the system, it can also perform all functions of the system, thereby easily obtaining data of the system or maliciously tampering with the data, and the like.

[0092] In view of this, the embodiments of the present application propose an authorization method. When a client needs to perform a certain service, the client device can only perform the service after the authorization server authorizes, thereby effectively improving the security performance of the entire system.

[0093] The method of the authorized method of the embodiments of the present application can be applied to, but is not limited to, BACnet.

[0094] Figure 2 A schematic flowchart of the authorized method 200 of the embodiments of the present application is shown. The method 200 can be performed by an authorization server. The method 200 can include at least part of the following.

[0095] In step 210, authorization request information sent by a client device is received, the authorization request information including first identification information.

[0096] In step 220, based on the authorization request information, a first token is generated and sent to the client device, the first token being used to authorize the client device to make a service request for a first service.

[0097] In step 230, second identification information sent by a resource server is received, the second identification information being identification information determined by the resource server.

[0098] In step 240, it is determined that the second identification information corresponds to the first token.

[0099] In step 250, the first token is sent to the resource server.

[0100] Figure 3 A schematic flowchart of the authorized method 300 of the embodiments of the present application is shown. The method 300 can be performed by a resource server and can include at least part of the following.

[0101] In step 310, second identification information is determined.

[0102] In step 320, the second identification information is sent to an authorization server.

[0103] In step 330, a first token sent by the authorization server is received, wherein the second identification information corresponds to the first token, and the first token is used to authorize a client device to make a service request for a first service.

[0104] Figure 4 A schematic flowchart of the authorized method 400 of the embodiments of the present application is shown. The method 400 can be performed by a client. The method 400 can include at least part of the following.

[0105] In step 410, first identification information is determined.

[0106] In step 420, authorization request information is sent to an authorization server, the authorization request information including the first identification information.

[0107] In step 430, the receiving authorization server generates a first token based on the authorization request information, and the first token is used to authorize the service request for the first service to the client device.

[0108] The authorization method of the embodiments of the present application will be further described below. Figures 2-4 It should be understood that the embodiments are described from the perspective of the client device, and it can be understood that Y is received from R, which means that R has sent, for example, the authorization server receives the authorization request information from the client device, which means that the client device has sent the authorization request information to the authorization server.

[0109] Figures 2-4 The client device in the above embodiment can be, for example, a heating device, a ventilation device, an air conditioning device, and a lighting device, etc.

[0110] When the client device needs to perform a certain service (such as the first service), the client can first send authorization request information to the authorization server, and the authorization information includes the first identification information calculated by the client device.

[0111] The first identification information corresponds to a token. In the embodiments of the present application, the first identification information corresponds to the first token.

[0112] The first identification information can be the identification number (ID) of the first token. Since the ID of the token uniquely corresponds to the token, the first identification information is the ID of the first token, which can ensure that the authorization server can only generate the first token based on the first identification information.

[0113] Alternatively, the first identification information can also be the internet protocol (IP) address or MAC address of the client device, etc.

[0114] In an implementation manner, the client device can determine the service request information sent to the resource server, and the service request information is used to request to access the resources of the first service. Then, the client device can obtain the first identification information according to the data in the service request information.

[0115] Optionally, the resource can include time domain resource, frequency domain resource, and period of time domain resource, etc.

[0116] Optionally, the client device can use a Hash algorithm to calculate a Hash value from the data in the service request information, and the Hash value can be used as the first identification information.

[0117] Optionally, the implementation manner can be applied to the IP layer of BACnet.

[0118] In another implementation, the client device can establish a transport layer security (TLS) connection with the resource server, and thus the first identification information can be obtained according to the TLS connection.

[0119] In this implementation, the first identification information can be obtained from a unique value in the TLS layer of BACnet. The unique value can be obtained from the TLS connection value.

[0120] Alternatively, the unique value can be calculated to obtain the first identification information, considering that directly using the unique value as the first identification information may have security risks. For example, the unique value can be calculated using a hash algorithm to obtain the first identification information.

[0121] The implementation mechanism of the unique value can be different in different versions. For example, in version 1.2, the unique value can be a TLS unique value, and in version 1.3, the unique value can be an exported keying material (EKM). That is, the client device can calculate the first identification information from the EKM of the TLS connection.

[0122] The above technical solution has the following advantages. Since the TLS layer is an encryption layer, the client device obtains the first identification information according to the TLS connection, so that the first identification information has encryption performance, and other devices such as malicious attackers cannot obtain the first identification information, further improving the security performance of the entire system.

[0123] It should be noted that in the TLS layer of BACnet, the client device can also obtain the first identification information according to the data in the business request information.

[0124] In addition to the first identification information, the authorization request information can further include at least one of the following information: attribute information of the resource server, attribute information of the client device, and service information of the first business. That is, the client device can also tell the authorization server who it is, which resource server it requests, or what business it requests to perform.

[0125] Optionally, the attribute information of the resource server can include an identifier (such as an ID) of the resource server and / or an address of the resource server, such as a MAC address. Similarly, the attribute information of the client device can include an identifier of the client device and / or an address of the client device.

[0126] Optionally, the service information of the first business can include information such as a time of accessing the first business and a duration of accessing the first business.

[0127] Optionally, the client device can send the authorization request information to the authorization server based on a communication protocol such as an Http protocol or an IoT protocol other than BACnet. In this technical solution, the Http protocol and the IoT protocol other than BACnet have better scalability than BACnet, so that the client device can send the first identification information, the attribute information of the resource server, the attribute information of the client device, and the service information of the first service to the authorization server.

[0128] After the authorization server receives the authorization request information, the authorization server can determine whether to generate the first token according to a certain policy.

[0129] If the authorization server determines to generate the first token, the authorization server can send the first token to the client device after generating the first token. The first token is used to authorize the client device to make a service request for the first service.

[0130] The first token can include, but is not limited to, the validity period of the first token, the signature of the authorization server, the attribute information of the first client, the attribute information of the resource server, and the service information of the first service.

[0131] In addition, the first token can also include the state of the first token. For example, the state of the first token can include two states, one of which indicates that the authorization server authorizes the client device to make a service request for the first service, and the other of which indicates that the authorization server refuses the client device to make a service request for the first service. The embodiments of the present application take the case where the authorization server authorizes the client device to make a service request for the first service as an example for illustration.

[0132] After the client device receives the first token and determines that the authorization server has authorized access to the first service, the client device can send service request information to the resource server. After the resource server receives the service request information, the resource server can determine the second identification information.

[0133] The client device can send the service request information to the resource server using the BACnet protocol.

[0134] The second identification information corresponds to the first token, that is, the first identification information and the second identification information correspond to the same token.

[0135] Optionally, the first identification information and the second identification information can be the same. For example, the first identification information and the second identification information are both the ID of the first token.

[0136] The first identification information and the second identification information are the same, and thus the authorization server can more easily determine the token corresponding to the second identification information after receiving the second identification information sent by the resource server, and the accuracy of the token sent to the resource server being the same as the token sent to the client device is improved.

[0137] The resource server can generate the second identification information in the same manner as the client device. In an implementation, if the client device obtains the first identification information according to data in the service request information, the resource server also obtains the second identification information according to data in the received service request information.

[0138] Optionally, the resource server can calculate a hash value from the data in the service request information using the same hash algorithm as the client device, and the hash value can be used as the second identification information.

[0139] Optionally, the implementation can be applied to the IP layer of BACnet.

[0140] In another implementation, if the client device obtains the first identification information from a TLS connection, the resource server can also establish a TLS connection with the client device, and thus obtain the second identification information from the TLS connection.

[0141] The implementation can be applied to the TLS layer of BACnet. In the TLS layer, a unique value can be obtained from the TLS connection value, and the unique value can be used as the second identification information.

[0142] Alternatively, the unique value can be calculated to obtain a calculated value, and the calculated value can be used as the second identification information. For example, the unique value is calculated using a hash algorithm to obtain the second identification information.

[0143] Optionally, in the embodiments of the present application, if the client device and the resource server both obtain the identification information from the TLS connection, since one TLS connection corresponds to one token, the client device can only apply for one token for the same type of service. In this way, not only the signaling overhead is saved, but also the rate is improved.

[0144] As an example, the same type of service can refer to multiple services being read operations, or being write operations.

[0145] The above technical solution uses the same manner for the client device and the resource server to obtain the identification information, so that the first identification information obtained by the client device and the second identification information obtained by the resource server can obtain the same token, and the normal access of the client device to the first service can be ensured.

[0146] It should be noted that the client device obtains the first identification information and the resource server obtains the second identification information in the same way. For example, if the client device uses a hash algorithm to calculate a unique value obtained from the TLS connection to obtain the first identification information, the resource server also uses the hash algorithm to calculate the unique value obtained from the TLS connection to obtain the second identification information.

[0147] The client device and the resource server can agree in advance on the way to determine the first identification information and the second identification information. For example, it is agreed in advance to use which algorithm to obtain the first identification information and the second identification information.

[0148] Alternatively, the client device and the resource server can respectively receive indication information indicating the implementation of the client device obtaining the first identification information, and indicating the implementation of the resource server obtaining the second identification information. For example, the authorization server can send indication information to the client and the resource server respectively.

[0149] It should be noted that the application embodiment does not specifically limit the time when the client device sends the service request information to the resource server. The client device can send the service request information to the resource server after obtaining the first token as described above, or can send the service request information before sending the authorization request information to the authorization server, or can send the service request information at the same time as sending the authorization request information to the authorization server.

[0150] After the resource server obtains the second identification information, the resource server can send the second identification information to the authorization server. Similar to the client device, the resource server can send the second identification information to the authorization server based on the Http protocol or other IoT protocols other than BACnet.

[0151] After the authorization server receives the second identification information, the authorization server can determine the token corresponding to the second identification information. After determining that the second identification information corresponds to the first token, the authorization server can send the first token to the resource server.

[0152] As an example, the authorization server can determine the second identification information corresponding to the first token based on the second identification information and the correspondence between the identification information and the token. Alternatively, the correspondence between the identification information and the token can be obtained by the authorization server after generating and storing a token based on an identification information each time.

[0153] After the resource server receives the first token, the resource server can first verify the first token. For example, it is verified whether the first token is generated by the authorization server. Illustratively, the resource server can verify the signature on the first token to determine whether the first token is generated by the authorization server.

[0154] After the first token is verified, the resource server can verify the service request information sent by the client based on the attribute information of the first token.

[0155] As described above, the attribute information of the first token can include, but is not limited to, the validity period of the first token, the attribute information of the first client, the attribute information of the resource server, and the service information of the first service.

[0156] If the attribute information of the first token matches the service request information, the resource server feeds back an acknowledgment (ACK) to the client device, and allocates resources for accessing the first service to the client device, so that the client device can access the first service on the resources allocated by the resource server.

[0157] If the attribute information of the first token does not match the service request information, for example, the service requested in the service request information is the first service, and the attribute information of the first token includes the service information of the second service; for another example, the validity period of the first token is inconsistent with the time of the first service in the service request information, then the resource server feeds back a negative acknowledgment (NACK) to the client device, and does not allocate resources for accessing the first service to the client device.

[0158] In order to more clearly understand the authorization method 200-400 of the embodiments of the present application, the following describes two possible authorization methods of the present application. Figure 5 and Figure 6 The method 500 can be applied to the BACnet IP layer, and the method 600 can be applied to the BACnet TLS layer. In the method 500 and the method 600, the first identification information and the second identification information are the same, and are the token ID of the first token.

[0159] In 501, the client device determines the service request information sent to the resource server.

[0160] In 502, the client device calculates the token ID of the first token according to the data in the service request information and using a hash algorithm.

[0161] In 503, the client device sends an authorization request information to the authorization server.

[0162] The authorization request information includes the token ID and other information, such as the attribute information of the resource server, the attribute information of the client, and the service information of the requested first service.

[0163] Exemplarily, the client sends the authorization request information to the authorization server using the Http protocol.

[0164] In 504, the authorization server generates the first token based on the authorization request information.

[0165] In 505, the authorization server sends the first token to the client device.

[0166] In 506, the client device sends the service request information to the resource server.

[0167] In 506, the client device sends the service request information to the resource server using the BACnet protocol.

[0168] In 507, the resource server determines the token ID.

[0169] In 507, the resource server determines the token ID.

[0170] In 508, the resource server sends the determined token ID to the authorization server.

[0171] In 508, the resource server sends the determined token ID to the authorization server using the Http protocol.

[0172] In 509, the authorization server determines that the token ID sent by the resource server corresponds to the first token.

[0173] In 510, the authorization server sends the first token to the resource server.

[0174] In 511, the resource server verifies the first token and verifies the service request information according to the attribute information of the first token.

[0175] In 512, if the verification is passed, the resource server feeds back ACK to the client device.

[0176] In 512, if the verification is passed, the resource server feeds back ACK to the client device using the BACnet protocol.

[0177] In 513, the resource server allocates the resource for accessing the first service to the client device.

[0178] The method 600 is described below.

[0179] In 601, the client establishes a TLS connection with the resource server.

[0180] In 602, the client device uses a hash algorithm to obtain a token ID of the first token based on a unique value obtained from the TLS connection.

[0181] In 603, the client device sends authorization request information to the authorization server.

[0182] The authorization request information includes a token ID and other information, such as attribute information of the resource server, attribute information of the client, and service information of the requested first service.

[0183] Exemplarily, the client sends the authorization request information to the authorization server using an Http protocol.

[0184] In 604, the authorization server generates the first token based on the authorization request information.

[0185] In 605, the authorization server sends the first token to the client device.

[0186] In 606, the client device sends service request information to the resource server.

[0187] Exemplarily, the client device sends the service request information to the resource server using a BACnet protocol.

[0188] In 607, the resource server determines the token ID.

[0189] Exemplarily, the resource server uses the same hash algorithm as in 602 to obtain the token ID based on the unique value obtained from the TLS connection.

[0190] In 608, the resource server sends the determined token ID to the authorization server.

[0191] Exemplarily, the resource server sends the token ID to the authorization server using an Http protocol.

[0192] In 609, the authorization server determines that the token ID sent by the resource server corresponds to the first token.

[0193] In 610, the authorization server sends the first token to the resource server.

[0194] In 611, the resource server verifies the first token and verifies the service request information according to the attribute information of the first token.

[0195] In 612, if the verification is passed, the resource server feeds back an ACK to the client device.

[0196] Exemplarily, the resource server feeds back the ACK to the client device using a BACnet protocol.

[0197] In 613, the resource server allocates resources for accessing the first service to the client device.

[0198] The embodiment of the present application, when the client device needs to access the first service, needs to request the authorization server for a token of a service request authorizing the first service, and the resource server also requests the token from the authorization server, and the resource server can allocate the resource of the first service to the client device only after receiving the token. Compared with the case that the client device directly accesses the first service without any authorization, the security performance of the whole system is effectively improved.

[0199] Further, the client device sends the determined first identification information to the authorization server when requesting the token, so that the authorization server generates the token based on the first identification information. In addition, the resource server also sends the determined second identification information to the authorization server, and the second identification information corresponds to the same token as the first identification information. In this way, the authorization server can send the token sent to the client device to the resource server after receiving the second identification information. In this technical solution, the client device and the resource server obtain the same token from the authorization server, so that the client device does not need to send the token to the resource server, thereby saving the signaling overhead between the client device and the resource server. In addition, the problem that the token cannot be transmitted if the client device sends the token to the resource server is avoided, because the token needs to be sent together with the message, but the message does not have an additional field to store the token.

[0200] The method embodiment of the embodiment of the present application is described in detail above, and the device embodiment of the embodiment of the present application is described below. The device embodiment corresponds to the method embodiment, and therefore, the parts not described in detail can be referred to the method embodiments described above, and the device can implement any possible manner in the above method.

[0201] Figure 7 A schematic block diagram of an authorization server 700 of one embodiment of the present application is shown. The authorization server 700 can execute the method 200 of authorizing the embodiment of the present application described above, and the authorization server 700 can be the authorization server in the above method.

[0202] As shown in Figure 7 , the authorization server 700 includes:

[0203] A communication unit 710, configured to receive authorization request information sent by a client device, the authorization request information including first identification information;

[0204] A processing unit 720, configured to generate a first token based on the authorization request information, the first token being used to authorize a service request for a first service to the client device;

[0205] The communication unit 710 is further configured to send the first token to the client device;

[0206] The communication unit 710 is further configured to receive second identification information sent by the resource server, wherein the second identification information is identification information determined by the resource server;

[0207] Determining unit 730 is used to determine the first token corresponding to the second identification information;

[0208] The communication unit 710 is also used to send a first token to the resource server.

[0209] Optionally, in one embodiment of this application, the first identification information and the second identification information are the same.

[0210] Optionally, in one embodiment of this application, the first identification information and the second identification information are a first token ID.

[0211] Optionally, in one embodiment of this application, the first identification information is obtained by the client device based on data in the service request information sent to the resource server; the second identification information is obtained by the resource server based on data in the received service request information.

[0212] Optionally, in one embodiment of this application, the first identification information is obtained by the client device from the TLS connection with the resource server; the second identification information is obtained by the resource server from the TLS connection with the client device.

[0213] Optionally, in one embodiment of this application, the determining unit 730 is specifically used to: determine that the second identification information corresponds to the first token based on the second identification information and the correspondence between the identification information and the token.

[0214] Figure 8 A schematic block diagram of a resource server 800 according to an embodiment of this application is shown. This resource server 800 can execute the authorized method 300 of the above-described embodiment of this application, and the resource server 800 can be the resource server in the aforementioned method.

[0215] like Figure 8 As shown, the resource server 800 includes:

[0216] The determining unit 810 is used to determine the second identification information, wherein the second identification information is the identity identification number ID of the first token;

[0217] Communication unit 820 is used to send the second identification information to the authorization server;

[0218] The communication unit 820 is further configured to receive a first token sent by the authorization server, wherein the second identification information corresponds to the first token, and the first token is used to authorize the client device for a service request for the first service.

[0219] Optionally, in an embodiment of the present application, the second identification information is an identity number ID of the first token.

[0220] Optionally, in an embodiment of the present application, the communication unit 820 is further configured to receive service request information sent by the client device, the service request information being used to request access to resources of the first service.

[0221] The determination unit 810 is further configured to calculate the second identification information according to data in the service request information.

[0222] Optionally, in an embodiment of the present application, the resource server 800 further includes an establishment unit configured to establish a transport layer security (TLS) connection with the client device.

[0223] The determination unit 810 is further configured to obtain the second identification information according to the TLS connection.

[0224] Optionally, in an embodiment of the present application, the resource server 800 further includes a verification unit configured to verify the service request information based on attribute information of the first token.

[0225] Figure 9 A schematic block diagram of a client device 900 is shown, which is an embodiment of the present application. The client device 900 can execute the authorized method 400 of the above embodiment of the present application.

[0226] As shown in Figure 9 the client device 900 can include:

[0227] a determination unit 910 configured to determine first identification information;

[0228] a communication unit 920 configured to send authorization request information to the authorization server, the authorization request information including the first identification information;

[0229] The communication unit 920 is further configured to receive a first token generated by the authorization server based on the authorization request information, the first token being used to authorize the client device to make a service request for a first service.

[0230] Optionally, in an embodiment of the present application, the first identification information is an identity number ID of the first token.

[0231] Optionally, in an embodiment of the present application, the determination unit 910 is further configured to determine service request information sent to a resource server, the service request information being used to request access to resources of the first service.

[0232] According to data in the service request information, the first identification information is calculated.

[0233] Optionally, in an embodiment of the present application, the client device 900 can further include an establishing unit configured to establish a transport layer security (TLS) connection with the resource server.

[0234] The determining unit 910 can be further configured to obtain the second identification information according to the TLS connection.

[0235] Figure 10 FIG. 1 is a schematic diagram of a hardware structure of an apparatus according to an embodiment of the present application. Figure 10 The apparatus 1000 shown can be an authorization server, a resource server or a client device, and the apparatus 1000 includes a memory 1001, a processor 1002, a communication interface 1003 and a bus 1004. The memory 1001, the processor 1002 and the communication interface 1003 are in communication connection with each other through the bus 1004.

[0236] The memory 1001 can be a read-only memory (ROM), a static storage device and a random access memory (RAM). The memory 1001 can store a program, and when the program stored in the memory 1001 is executed by the processor 1002, the processor 1002 and the communication interface 1003 are configured to perform various steps of the method for authorizing according to an embodiment of the present application.

[0237] The processor 1002 can be a general-purpose central processing unit (CPU), a microprocessor, an application specific integrated circuit (ASIC), a graphics processing unit (GPU) or one or more integrated circuits, configured to execute a related program to implement the functions required by the units in the apparatus according to an embodiment of the present application or to execute the method for replacing the device according to an embodiment of the present application.

[0238] The processor 1002 can also be an integrated circuit chip with a signal processing capability. In the implementation process, each step of the method for replacing the device according to an embodiment of the present application can be completed by the integrated logic circuit or the instruction in the form of software in the processor 1002.

[0239] The processor 1002 can also be a general-purpose processor, a digital signal processor (DSP), an ASIC, a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as hardware processor execution or executed by a combination of hardware and software modules in the processor. The software module can be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register or other mature storage medium in the art. The storage medium is located in the memory 1001, and the processor 1002 reads the information in the memory 1001, and combines the hardware to complete the functions required by the units included in the device in the embodiments of the present application, or executes the authorized method of the embodiments of the present application.

[0240] The communication interface 1003 uses a transceiver such as but not limited to a transceiver to realize the communication between the device 1000 and other devices or communication networks. For example, when the device 1000 is an authorization server, the authorization request information sent by the client device can be received through the communication interface 1003.

[0241] The bus 1004 can include a path for transmitting information between various components (e.g., memory 1001, processor 1002, communication interface 1003) of the device 1000.

[0242] It should be noted that although the above device 1000 only shows the memory, processor, communication interface, but in the specific implementation process, those skilled in the art should understand that the device 1000 can also include other necessary devices for normal operation. At the same time, according to the specific needs, those skilled in the art should understand that the device 1000 can also include hardware devices for realizing other additional functions. In addition, those skilled in the art should understand that the device 1000 can also only include the necessary devices for realizing the embodiments of the present application, and does not have to include all the devices shown in the above device 1000. Figure 10

[0243] The embodiments of the present application also provide a computer readable storage medium, which stores program code for device execution, and the program code includes instructions for executing the steps in the above authorized method.

[0244] ​The embodiment of the present application further provides a computer program product, which comprises a computer program stored on a computer readable storage medium, and the computer program comprises program instructions, which, when executed by a computer, cause the computer to execute the authorized method.

[0245] The computer readable storage medium described above can be a transitory computer readable storage medium or a non-transitory computer readable storage medium.

[0246] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the apparatus described above can refer to the corresponding process in the foregoing method embodiments, and will not be described here.

[0247] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can be implemented in other manners. For example, the described apparatus embodiments are merely schematic, and the division of the units is merely a logical function division, and there can be another division manner in actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms.

[0248] The words used in the present application are only used to describe embodiments and not to limit the claims. As used in the description of embodiments and the claims, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. Similarly, the term "and / or" as used in the present application refers to any and all possible combinations of one or more associated listed items. In addition, when used in the present application, the term "comprising" refers to the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups of these.

[0249] The aspects, implementations, or features of the described embodiments can be used individually or in any combination. The aspects of the described embodiments can be implemented by software, hardware, or a combination of both. The described embodiments can also be embodied in a computer-readable medium storing computer-readable code, including instructions executable by at least one computing device. The computer-readable medium can be associated with any data storage device capable of storing data readable by a computer system. Examples of computer-readable media include read-only memory, random access memory, compact disc read-only memory (CD-ROM), hard disk drive (HDD), digital video disc (DVD), magnetic tape, and optical data storage devices. The computer-readable medium can also be distributed across a network-connected computer system, allowing the computer-readable code to be distributed for storage and execution.

[0250] The above technical description is illustrated with reference to the accompanying drawings, which form part of this application, and which show implementations according to the described embodiments. While these embodiments are described in sufficient detail to enable those skilled in the art to implement them, they are not limiting; thus, other embodiments can be used, and variations can be made without departing from the scope of the described embodiments. For example, the order of operations described in the flowcharts is not limiting, and the order of two or more operations illustrated and described in the flowcharts may be changed according to several embodiments. As another example, in several embodiments, one or more operations illustrated and described in the flowcharts are optional or can be deleted. Additionally, certain steps or functions may be added to the disclosed embodiments, or the order of two or more steps may be interchanged. All such variations are considered to be included in the disclosed embodiments and the claims.

[0251] Furthermore, terminology is used in the above technical description to provide a thorough understanding of the described embodiments. However, excessive detail is not required to implement the described embodiments. Therefore, the above description of the embodiments is presented for illustrative and descriptive purposes. The embodiments presented in the above description, as well as the examples disclosed according to these embodiments, are provided separately to add context and aid in understanding the described embodiments. The above specification is not intended to be exhaustive or to limit the described embodiments to the precise form of this application. Based on the above teachings, several modifications, selections, and variations are possible. In some cases, well-known processing steps have not been described in detail to avoid unnecessarily affecting the described embodiments.

[0252] The above merely provides the specific implementation of the embodiments of the present application, but the protection scope of the embodiments of the present application is not limited to this. Any person skilled in the art can easily think of the changes or replacements within the technical range disclosed by the embodiments of the present application, which should be covered in the protection scope of the embodiments of the present application. Therefore, the protection scope of the embodiments of the present application should be subject to the protection scope of the claims.

Claims

1. A method of authorization in a building automation control network, characterized by, The method comprises: The authorization server receives (210) authorization request information sent by a client device, the authorization request information comprising first identification information; The authorization server generates (220) a first token based on the authorization request information and sends the first token to the client device, the first token being used to authorize the client device to make a service request for a first service, the first token containing information required by a resource server for permission verification, and being used for the resource server to perform permission verification on the service request of the client device; The authorization server receives (230) second identification information sent by a resource server, the second identification information being identification information determined by the resource server; The authorization server determines (240) that the second identification information corresponds to the first token; The authorization server sends (250) the first token to the resource server, so that the resource server performs permission verification on the service request of the client device based on the first token.

2. The method of claim 1, wherein, The first identification information and the second identification information are the same.

3. The method of claim 2, wherein, The first identification information and the second identification information are an identity identification number ID of the first token.

4. The method according to any one of claims 1 to 3, characterized in that, The first identification information is obtained by the client device from data in service request information sent to the resource server; The second identification information is obtained by the resource server from data in the received service request information.

5. The method according to any one of claims 1 to 3, characterized in that, The first identification information is obtained by the client device from a transport layer security (TLS) connection between the client device and the resource server; The second identification information is obtained by the resource server from the TLS connection between the resource server and the client device.

6. The method of claim 1, wherein, The authorization server determines (240) that the second identification information corresponds to the first token, comprising: The authorization server determines that the second identification information corresponds to the first token based on the second identification information and a correspondence between identification information and tokens.

7. A method of authorization in a building automation control network, characterized by The method comprises: The resource server determines (310) second identification information, the second identification information being an identity identification number ID of a first token; The resource server sends (320) the second identification information to an authorization server; The resource server receives (330) the first token sent by the authorization server, wherein the second identification information corresponds to the first token, the first token containing information required by the resource server for permission verification, and being used to authorize a client device to make a service request for a first service; and the resource server performs permission verification on the service request of the client device based on the first token. The authorization server receives authorization request information sent by a client device, generates a first token based on the authorization request information, and sends the first token to the client device, the authorization request information comprising first identification information.

8. The method of claim 7, wherein, The method further comprises: The resource server receives service request information sent by a client device, the service request information being used to request access to resources of the first service; The resource server calculates the second identification information according to data in the service request information.

9. The method of claim 7, wherein, The method further comprises: The resource server establishes a transport layer security (TLS) connection with the client device; The resource server obtains the second identification information according to the TLS connection.

10. The method according to any one of claims 7 to 9, characterized in that, The method further comprises: The resource server verifies the service request information based on attribute information of the first token.

11. A method of authorization in a building automation control network, characterized by, The method comprises: The client device determines (410) first identification information; The client device sends (420) authorization request information to an authorization server, the authorization request information comprising the first identification information; The client device receives (430) a first token generated by the authorization server based on the authorization request information, the first token being used to authorize the client device to make a service request for a first service; the first token containing information required by a resource server for permission verification, and being used by the resource server to verify the permission of the service request of the client device. The authorization server receives second identification information sent by the resource server, the second identification information being identification information determined by the resource server, and the second identification information corresponding to the first token; and the resource server sends the first token, so that the resource server verifies the permission of the service request of the client device based on the first token.

12. The method of claim 11, wherein, The first identification information is an identity identification number (ID) of the first token.

13. The method according to claim 11 or 12, characterized in that, The method further comprises: The client device determines service request information sent to a resource server, the service request information being used to request access to resources of the first service; The client device calculates the first identification information according to data in the service request information.

14. The method of claim 11, wherein, The method further comprises: The client device establishes a transport layer security (TLS) connection with the resource server; The client device obtains the second identification information according to the TLS connection.

15. An authorization server (700) in a building automation control network, characterized by Comprise: A communication unit (710) configured to receive authorization request information sent by a client device, the authorization request information comprising first identification information; A processing unit (720) configured to generate a first token based on the authorization request information, the first token being used to authorize the client device to make a service request for a first service, and the first token containing information required by a resource server for permission verification, and being used by the resource server to verify the permission of the service request of the client device; The communication unit (710) is further configured to send the first token to the client device; The communication unit (710) is further configured to receive second identification information sent by a resource server, the second identification information being identification information determined by the resource server; A determination unit (730) configured to determine that the second identification information corresponds to the first token; The communication unit (710) is further configured to send the first token to the resource server, so that the resource server verifies the permission of the service request of the client device based on the first token.

16. A resource server (800) in a building automation control network, characterized by Comprise: The determining unit (810) is configured to determine second identification information, the second identification information being an identity number ID of the first token. The communication unit (820) is configured to send the second identification information to an authorization server. The communication unit (820) is further configured to receive the first token sent by the authorization server, wherein the second identification information corresponds to the first token, the first token containing information required by the resource server for permission verification, and being used for authorizing the client device to make a service request for a first service. The resource server performs permission verification on the service request of the client device based on the first token. The authorization server receives authorization request information sent by the client device, generates the first token based on the authorization request information, and sends the first token to the client device, wherein the authorization request information includes first identification information.

17. A client device (900) in a building automation control network, characterized by The determining unit (910) is configured to determine first identification information. The communication unit (920) is configured to send authorization request information to an authorization server, the authorization request information including the first identification information. The communication unit (920) is further configured to receive a first token generated by the authorization server based on the authorization request information, the first token being used for authorizing the client device to make a service request for a first service; the first token containing information required by a resource server for permission verification, and being used for the resource server to perform permission verification on the service request of the client device. The authorization server receives second identification information sent by the resource server, the second identification information being identification information determined by the resource server, determines that the second identification information corresponds to the first token, and sends the first token by the resource server, so that the resource server performs permission verification on the service request of the client device based on the first token. The memory (1001) is configured to store a program.

18. An apparatus (1000) for authorization in a building automation control network, characterized by The processor (1002) is configured to execute the program stored in the memory, and when the program stored in the memory is executed, the processor is configured to execute the authorization method according to any one of claims 1-14. The computer readable medium stores program code for execution by a device, the program code including instructions for performing steps in the authorization method according to any one of claims 1-14. ​ 19. A computer-readable storage medium, characterized in that, ​

Images