Device management method, device, electronic device, and storage medium

Abstract

The present application discloses a device management method, apparatus, electronic device, and storage medium. The method includes: a first control point obtains a first request; the first request carries at least a first signature; the first request is used to request management of a device in a first network; the first network includes multiple devices; the multiple devices can communicate with each other based on the Universal Plug and Play (UPnP) protocol; the first control point is a device among the multiple devices whose computing capacity meets a first condition; through a smart contract, a first node of a second network is called to verify the validity of the first signature according to a preset endorsement policy to obtain a first verification result; and if the first verification result indicates that the validity of the first signature has been verified, a management operation corresponding to the first request is executed.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a device management method, apparatus, electronic device, and storage medium. Background Art

[0002] In recent years, the number of smart home devices in digital home networks has increased significantly. Smart home devices are usually connected to digital home networks based on Universal Plug and Play (UPnP) technology, thereby achieving plug-and-play, zero configuration and network transparency of smart home devices.

[0003] However, UPnP technology has great potential security risks, and related technologies do not have sufficient requirements for the security of this technology, which makes digital home networks have great security risks. Summary of the Invention

[0004] To solve related technical problems, the embodiments of the present application provide a device management method, apparatus, electronic device and storage medium.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] The present embodiment provides a device management method, which is applied to a first control point and includes:

[0007] Obtaining a first request; the first request carries at least a first signature; the first request is used to request management of a device in a first network; the first network includes multiple devices; the multiple devices can communicate with each other based on the UPnP protocol; the first control point is a device among the multiple devices whose computing capacity meets the first condition;

[0008] Using the smart contract, calling the first node of the second network to verify the validity of the first signature according to a preset endorsement policy, thereby obtaining a first verification result;

[0009] In a case where the first verification result indicates that the validity of the first signature has passed verification, a management operation corresponding to the first request is executed.

[0010] In the above solution, the first request is sent by the first terminal; the first signature represents the identity of the operator of the first terminal; and the first node that calls the second network verifies the validity of the first signature according to a preset endorsement policy, including:

[0011] Sending a second request to the first node; the second request is used to request verification of whether the operator of the first terminal is registered in the second network, and to request verification of whether the operator of the first terminal has permission to perform the management operation corresponding to the first request;

[0012] Receive a first verification result returned by the first node in response to the second request.

[0013] In the above scheme,

[0014] If the operator of the first terminal has registered in the second network and the operator of the first terminal has permission to perform the management operation corresponding to the first request, the first verification result indicates that the validity of the first signature has been verified;

[0015] When the operator of the first terminal is not registered in the second network, or when the operator of the first terminal does not have the authority to perform the management operation corresponding to the first request, the first verification result indicates that the validity of the first signature has not passed verification.

[0016] In the above solution, the method further includes:

[0017] When the first verification result indicates that the validity of the first signature has not passed the verification, a first message is sent to the first terminal; the first message is used to prompt the operator of the first terminal to register to the second network and / or obtain permission to perform the management operation corresponding to the first request.

[0018] In the above solution, the first request is specifically used to request control of the first device to access the first network; and the performing of the management operation corresponding to the first request includes:

[0019] Calling, through the smart contract, a second node of the second network to verify the identity of the first device and obtain a second verification result;

[0020] If the second verification result indicates that the identity of the first device has passed verification, the first device is controlled to access the first network.

[0021] In the above solution, the step of calling the second node of the second network to verify the identity of the first device includes:

[0022] Sending a third request to the second node; the third request is used to request verification of whether the first device is registered in the second network;

[0023] Receive a second verification result returned by the second node in response to the third request.

[0024] In the above solution, the method further includes:

[0025] If the second verification result indicates that the identity of the first device has failed verification, control the first device to register with the second network.

[0026] In the above solution, controlling the first device to register with the second network includes:

[0027] A fourth request is sent to the first device; the fourth request is used to request the first device to send a fifth request to the first server; the fifth request is used to request to register the first device to the second network.

[0028] In the above solution, the first request is specifically used to request control of the second device to use the first capability; the second device does not have the first capability; and performing the management operation corresponding to the first request includes:

[0029] Determining whether there is a third device with the first capability in the first network, and determining whether the third device can provide the first capability based on a status of the third device, to obtain a determination result;

[0030] If the determination result indicates that the third device exists in the first network and the third device can provide the first capability, the second device is controlled to use the first capability.

[0031] In the above solution, controlling the second device to use the first capability includes:

[0032] Control the second device and the third device to transmit resources corresponding to the first capability.

[0033] In the above solution, controlling the second device and the third device to transmit resources corresponding to the first capability includes:

[0034] Control the second device and the third device to perform encrypted transmission of resources corresponding to the first capability.

[0035] In the above solution, the method further includes:

[0036] Obtaining operating information of at least one device in the first network;

[0037] Based on the Inter-Planetary File System (IPFS) protocol, the acquired operation information is stored in the second server.

[0038] The embodiment of the present application further provides a device management apparatus, which is provided at a first control point and includes:

[0039] An acquiring unit, configured to acquire a first request; the first request carries at least a first signature; the first request is used to request management of a device in a first network; the first network includes a plurality of devices; the plurality of devices are capable of communicating with each other based on the UPnP protocol; the first control point is a device among the plurality of devices whose computing capacity satisfies a first condition;

[0040] a first processing unit, configured to call, through a smart contract, a first node of the second network to verify the validity of the first signature according to a preset endorsement policy, and obtain a first verification result;

[0041] The second processing unit is configured to execute a management operation corresponding to the first request if the first verification result indicates that the validity of the first signature has passed verification.

[0042] An embodiment of the present application further provides an electronic device, comprising: a processor and a memory for storing a computer program that can be run on the processor, wherein the processor executes the steps of any of the above methods when running the computer program.

[0043] An embodiment of the present application further provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0044] The device management method, apparatus, electronic device, and storage medium provided by the embodiments of the present application include: a first control point obtains a first request; the first request carries at least a first signature; the first request is used to request management of a device in a first network; the first network includes multiple devices; the multiple devices can communicate with each other based on the UPnP protocol; the first control point is a device whose computing capacity meets a first condition among the multiple devices; through a smart contract, a first node of a second network is called to verify the validity of the first signature according to a preset endorsement policy to obtain a first verification result; if the first verification result indicates that the validity of the first signature has been verified, the management operation corresponding to the first request is executed. The solution of the embodiment of the present application, when performing management operations on devices in a UPnP network (i.e., a first network built based on UPnP technology), a node of the second network is called through a smart contract to verify the validity of the signature carried by the device management request according to a preset endorsement policy, and the corresponding management operation is executed if the validity of the signature has been verified. In other words, the blockchain network (i.e., the second network) is used to ensure the security of device management operations on the UPnP network; in this way, the security risks of the UPnP network can be reduced, the data security of the UPnP network can be guaranteed, and the security of the digital home network can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1A schematic diagram of a scenario in which a hacker invades a smart home device and conducts a malicious attack in the related technology;

[0046] Figure 2 This is a flow chart of the device management method according to an embodiment of the present application;

[0047] Figure 3 This is a schematic diagram of a smart home device accessing a home capability sharing system according to an embodiment of the present application;

[0048] Figure 4 This is a topological diagram of a user module (i.e., a client-facing module in the system) in the home capability sharing system according to an embodiment of the present application;

[0049] Figure 5 This is a schematic diagram of the workflow of the blockchain network in the application embodiment of this application;

[0050] Figure 6 This is a schematic diagram of the structure of the device management device according to an embodiment of the present application;

[0051] Figure 7 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0052] The present application will be described in further detail below with reference to the accompanying drawings and embodiments.

[0053] In related technologies, a smart home management and control system with a centralized architecture (also known as a centralized system) is usually used to manage smart home devices in a digital home network, and it is assumed that the central node (i.e., the server) and the smart home devices communicate through a secure channel. In other words, the smart home devices in the digital home network are managed by the central node, without considering the communication security between the central node and the smart home devices.

[0054] At the same time, various smart home devices in the digital home network provide their own capabilities, and capabilities cannot be shared among different smart home devices; there are also barriers between smart home devices with the same functions, and different display devices, different speaker devices, and different computing components of the devices cannot be switched seamlessly, which means that the maximum utilization of smart home devices cannot be achieved.

[0055] Furthermore, smart home devices in digital home networks generate, process, and transmit large amounts of sensitive data (such as user privacy data). Because the UPnP-based access process for smart home devices lacks a device-specific authentication mechanism, malicious devices outside the digital home network can easily join the network through port mapping, posing a security risk to user privacy and other data. Furthermore, hackers can easily clone the identity of smart home devices after capturing them. Once these cloned devices establish connections with the digital home network and smart home devices, they can steal data from the network and smart home devices, potentially compromising user privacy. Furthermore, some malicious programs (such as Mirai, Gafgyt, Dofloo, Tsunami, Hajime, and MrBlack) can exploit vulnerabilities and brute force attacks to invade and control smart home devices. Once these devices are compromised and controlled, they pose security risks such as user information and device data leakage, hardware control and damage, exploitation in distributed denial of service (DDoS) attacks or other malicious attacks, and attacks on network devices such as routers to steal user online data. For example, Figure 1 As shown, hackers (i.e., attackers, also known as the master control end) can identify the Internet Protocol (IP) addresses of smart home devices in a digital home network, and use the identified IP addresses to launch DDoS attacks on target devices through corresponding smart home devices (i.e., controlled ends, also known as zombies). This will cause the corresponding smart home services to be interrupted and user privacy to be leaked.

[0056] In summary, in the related art, the management methods for smart home devices in digital home networks have the following problems:

[0057] 1) Management and maintenance issues: A centralized system is used to manage smart home devices in a digital home network. As the number of smart home devices increases, the management and maintenance pressure of the centralized system increases.

[0058] 2) Single point of trust: Centralized systems are controlled and resolved centrally by a central node. If the host (i.e., central node) fails or is attacked, the entire system may cease to function.

[0059] 3) Data transmission is not encrypted, which may easily lead to leakage of user privacy data;

[0060] 4) Remote control commands lack hardened authorization, posing security risks such as illegal intrusion and application hijacking;

[0061] 5) Hardware devices have debugging interfaces and may use operating systems or third-party libraries with security vulnerabilities;

[0062] 6) The process of smart home devices accessing the digital home network based on UPnP technology lacks an authentication mechanism for smart home devices, which poses a security risk of malicious devices accessing the digital home network;

[0063] 7) Smart home devices cannot share capabilities, making it impossible to maximize the utilization of smart home capabilities.

[0064] Based on this, in various embodiments of the present application, when performing management operations on devices in a UPnP network, a node of the blockchain network is called through a smart contract to verify the validity of the signature carried by the device management request according to a preset endorsement policy, and the corresponding management operation is performed when the validity of the signature is verified. In other words, the blockchain network is used to ensure the security of device management operations on the UPnP network; in this way, the security risks of the UPnP network can be reduced, the data security of the UPnP network can be guaranteed, and the security of the digital home network can be improved.

[0065] At the same time, in various embodiments of the present application, decentralized authentication and authorization are implemented based on the blockchain network; in this way, it is possible to avoid dependence on a central node and solve the single point trust problem existing in a centralized system.

[0066] In addition, in various embodiments of the present application, the management operations performed on devices in the UPnP network include capability sharing operations between devices. In other words, based on the UPnP protocol and the blockchain network, capability sharing between devices is achieved, and the transmitted data can be encrypted; in this way, the device capabilities can be maximized while ensuring data security.

[0067] The embodiment of the present application provides a device management method, which is applied to a first control point, such as Figure 2 As shown, the method includes:

[0068] Step 201: Obtain a first request; the first request carries at least a first signature;

[0069] Here, the first request is used to request management of a device in a first network; the first network includes multiple devices; the multiple devices can communicate with each other based on the UPnP protocol; the first control point is a device among the multiple devices whose computing capacity meets the first condition;

[0070] Step 202: Using the smart contract, calling the first node of the second network to verify the validity of the first signature according to a preset endorsement policy, and obtaining a first verification result;

[0071] Step 203: When the first verification result indicates that the validity of the first signature has passed verification, a management operation corresponding to the first request is executed.

[0072] In actual application, the first network can also be called a UPnP network, etc., and the second network can also be called a blockchain network, etc. The embodiment of the present application does not limit the names of the first network and the second network, as long as the functions of the first network and the second network can be realized.

[0073] In actual application, the multiple devices included in the first network can be smart devices such as desktop computers, laptops, tablets, mobile phones, etc.; they can also be smart home devices such as smart TVs, smart speakers, air conditioners, refrigerators, sweepers, etc.

[0074] In practical applications, the first control point can be any device in the first network that meets the first condition. The first condition can be set as needed. For example, the first condition can indicate that the idle computing resources of the device are greater than or equal to 70%. It is understood that the first network can include multiple control points.

[0075] In step 201, in actual application, the first request may be used to request one of the following (that is, the management operation corresponding to the first request may include one of the following):

[0076] controlling the first device to access the first network;

[0077] Controlling the second device to use the first capability of the third device, that is, implementing capability sharing between the second device and the third device;

[0078] Control the fourth device; for example, adjust the air-conditioning temperature, start the sweeper, etc.

[0079] Here, the capabilities of the device may include video capabilities, audio capabilities, microphone capabilities, camera capabilities, etc.; the capability sharing may be understood as resource sharing, that is, file sharing.

[0080] In actual application, the user can initiate a management operation on the device in the first network through the terminal, that is, the first request can be sent by the first terminal; the first control point can directly receive the first request sent by the first terminal, or obtain the first request from other devices (such as a server), that is, receive the first request of the first terminal forwarded by other devices.

[0081] In step 202, in actual application, the smart contract can be set according to needs. The smart contract can also be called chain code (which can be expressed as Chain-Code in English and abbreviated as CC).

[0082] In actual application, the first signature can represent the identity of the user, that is, the identity of the operator of the first terminal; the verification of the validity of the first signature can be understood as verifying the validity of the identity of the operator of the first terminal, that is, determining whether the operator of the first terminal has the authority to perform the management operation corresponding to the first request.

[0083] Based on this, in one embodiment, the calling of the first node of the second network to verify the validity of the first signature according to a preset endorsement policy may include:

[0084] Sending a second request to the first node; the second request is used to request verification of whether the operator of the first terminal is registered in the second network, and to request verification of whether the operator of the first terminal has permission to perform the management operation corresponding to the first request;

[0085] Receive a first verification result returned by the first node in response to the second request.

[0086] Here, verifying whether the operator of the first terminal is registered in the second network can be understood as determining whether the second network stores registration information corresponding to the first terminal, such as a public key corresponding to the first terminal.

[0087] In actual application, during the registration process of the operator of the first terminal in the second network, the first terminal and the second network can negotiate to determine and save the first private key and the first public key. The first terminal can use the first private key to generate the first signature, and the second network can use the first public key to verify the first signature. That is, the first node can use the first public key to verify the validity of the first signature according to a preset endorsement policy.

[0088] Specifically, after receiving the second request, the first node can verify whether the operator of the first terminal is registered in the second network by determining whether the second network stores a first public key capable of verifying the first signature, and can determine, based on a preset endorsement policy, whether the operator of the first terminal has permission to perform the management operation corresponding to the first request. Here, if the second network stores the first public key, it can be determined that the operator of the first terminal is registered in the second network; if the second network does not store the first public key, it can be determined that the operator of the first terminal is not registered in the second network.

[0089] Wherein, if the operator of the first terminal has registered in the second network and the operator of the first terminal has permission to perform the management operation corresponding to the first request, the first verification result indicates that the validity of the first signature has been verified;

[0090] When the operator of the first terminal is not registered in the second network, or when the operator of the first terminal does not have the authority to perform the management operation corresponding to the first request, the first verification result indicates that the validity of the first signature has not passed verification.

[0091] In actual application, the endorsement policy can be pre-set according to needs, and this embodiment of the present application does not limit this.

[0092] In actual application, the manner in which the first terminal and the second network determine the first private key and the first public key can be set as required. For example, the first terminal's Subscriber Identification Module (SIM) card serial number can be directly determined as the first public key, and the first private key can be generated using the SM9 algorithm based on the first terminal's SIM card serial number.

[0093] In actual application, when the validity of the first signature fails to be verified, the first control point may remind the operator of the first terminal to register to the second network and / or obtain permission to perform the management operation corresponding to the first request.

[0094] Based on this, in one embodiment, the method may further include:

[0095] When the first verification result indicates that the validity of the first signature has not passed the verification, a first message is sent to the first terminal; the first message is used to prompt the operator of the first terminal to register to the second network and / or obtain permission to perform the management operation corresponding to the first request.

[0096] In actual application, the manner in which the operator of the first terminal obtains the authority to execute the management operation corresponding to the first request can be set according to needs, and this embodiment of the present application does not limit this.

[0097] In step 203, in actual application, when the first request is specifically used to request control of the first device to access the first network, when executing the management operation corresponding to the first request, in order to further ensure the data security of the UPnP network, the first control point needs to authenticate the first device to determine that the first device is not a malicious device.

[0098] Based on this, in one embodiment, when the first request is specifically used to request control of the first device to access the first network, performing the management operation corresponding to the first request may include:

[0099] Calling, through the smart contract, a second node of the second network to verify the identity of the first device and obtain a second verification result;

[0100] If the second verification result indicates that the identity of the first device has passed verification, the first device is controlled to access the first network.

[0101] In actual application, verifying the identity of the first device can be understood as verifying whether the first device is registered in the second network, that is, determining whether the registration information corresponding to the first device is stored in the second network, such as the name of the first device, device identification (ID), device type (such as smart speaker, camera, etc.), manufacturer (i.e., manufacturer), etc.

[0102] Based on this, in one embodiment, calling the second node of the second network to verify the identity of the first device may include:

[0103] Sending a third request to the second node; the third request is used to request verification of whether the first device is registered in the second network;

[0104] Receive a second verification result returned by the second node in response to the third request.

[0105] Here, if the first device has been registered in the second network, the second verification result indicates that the identity of the first device has been verified; if the first device has not been registered in the second network, the second verification result indicates that the identity of the first device has not been verified.

[0106] In actual application, when the identity of the first device fails to pass verification, the first control point needs to control the first device to register with the second network.

[0107] Based on this, in one embodiment, the method may further include:

[0108] If the second verification result indicates that the identity of the first device has failed verification, control the first device to register with the second network.

[0109] In one embodiment, controlling the first device to register with the second network may include:

[0110] A fourth request is sent to the first device; the fourth request is used to request the first device to send a fifth request to the first server; the fifth request is used to request to register the first device to the second network.

[0111] In actual application, after the first device receives the fourth request sent by the first control point, it can send the fifth request to the first server; after the first server receives the fifth request, it can determine whether the manufacturer corresponding to the first device has passed the certification of the certificate authority (CA) based on the manufacturer ID carried by the fifth request, that is, determine whether the manufacturer has obtained a certificate issued by the CA agency; if the manufacturer corresponding to the first device has passed the certification of the CA agency, the first server can also verify the legitimacy of the first device, that is, determine whether the device information obtained from the first device is consistent with the relevant information of the first device obtained from the manufacturer corresponding to the first device (such as the name of the first device, device ID, device type, etc.); if the device information obtained from the first device is consistent with the relevant information of the first device obtained from the manufacturer corresponding to the first device, that is, if the first device passes the legitimacy verification, the first server can register the first device to the second network, that is, store the registration information of the first device to the second network.

[0112] In actual application, when the first request is specifically used to request control of the second device to use the first capability, when executing the management operation corresponding to the first request, it is necessary to first determine whether there is a third device with the first capability in the first network, and determine whether the third device can currently provide the first capability based on the status of the third device.

[0113] Based on this, in one embodiment, when the first request is specifically used to request controlling the second device to use the first capability, performing the management operation corresponding to the first request may include:

[0114] Determining whether there is a third device with the first capability in the first network, and determining whether the third device can provide the first capability based on a status of the third device, to obtain a determination result;

[0115] If the determination result indicates that the third device exists in the first network and the third device can provide the first capability, the second device is controlled to use the first capability.

[0116] Here, the capability can also be understood as a service, and determining whether the third device can provide the first capability can be understood as determining whether the third device can provide the corresponding service. In actual application, the third device may be unable to provide the first capability if, for example, the third device fails or is using the first capability (i.e., the third device is providing the corresponding service).

[0117] In one embodiment, controlling the second device to use the first capability may include:

[0118] Control the second device and the third device to transmit resources corresponding to the first capability.

[0119] In actual application, when controlling the second device and the third device to transmit the resources corresponding to the first capability, the first control point can obtain the resource list corresponding to the first capability from the third device, and the resource list can include relevant information of multiple files corresponding to the first capability (such as name, file type, creation date, file size, etc.) and the transmission protocol supported by each file; at the same time, the first control point can also obtain the transmission protocol and resource format supported by the second device, and determine a target transmission protocol and a target transmission format supported by the second device and the third device at the same time based on the resource list corresponding to the first capability, the transmission protocol supported by the second device, and the resource format supported by the second device, and notify the second device and the third device of the target transmission protocol and the target transmission format to control the second device and the third device to transmit the resources corresponding to the first capability based on the target transmission protocol and the target transmission format.

[0120] In actual application, in order to further ensure data security of the UPnP network, the first control point may control the second device and the third device to perform encrypted transmission of resources corresponding to the first capability.

[0121] Based on this, in one embodiment, controlling the second device and the third device to transmit resources corresponding to the first capability may include:

[0122] Control the second device and the third device to perform encrypted transmission of resources corresponding to the first capability.

[0123] In actual application, during the encrypted transmission of the resources corresponding to the first capability between the second device and the third device, the manner in which the third device encrypts the corresponding resources and the manner in which the second device decrypts the corresponding resources can be configured as required. For example, the third device can encrypt the corresponding resources using the first public key, and the second device can decrypt the corresponding resources using the first private key.

[0124] In actual application, in order to further ensure the data security of the UPnP network, the first control point can store the operation information of the devices in the first network based on the IPFS protocol.

[0125] Based on this, in one embodiment, the method may further include:

[0126] Obtaining operating information of at least one device in the first network;

[0127] Based on the IPFS protocol, the acquired operation information is stored in the second server.

[0128] Here, the operation information of the device may include the working time, power consumption, system version, etc. of the device.

[0129] In actual application, in order to further ensure data security of the UPnP network, when the first control point stores the acquired operation information in the second server, it can use a preset algorithm to encrypt the operation information; the preset algorithm can be set according to demand.

[0130] The device management method, apparatus, electronic device, and storage medium provided by the embodiments of the present application include: a first control point obtaining a first request; the first request carries at least a first signature; the first request is used to request management of a device in a first network; the first network includes multiple devices; the multiple devices can communicate with each other based on the UPnP protocol; the first control point is a device among the multiple devices whose computing capacity meets a first condition; a smart contract is used to call a first node of a second network to verify the validity of the first signature according to a preset endorsement policy, thereby obtaining a first verification result; and if the first verification result indicates that the validity of the first signature has been verified, the management operation corresponding to the first request is executed. The solution of the embodiments of the present application, when performing management operations on devices in the UPnP network, the smart contract calls a node of a blockchain network to verify the validity of the signature carried by the device management request according to a preset endorsement policy, and executes the corresponding management operation if the validity of the signature has been verified. In other words, the blockchain network is used to ensure the security of device management operations on the UPnP network; thus, the security risks of the UPnP network can be reduced, the data security of the UPnP network can be ensured, and the security of the digital home network can be improved.

[0131] At the same time, in various embodiments of the present application, decentralized authentication and authorization are implemented based on the blockchain network; in this way, it is possible to avoid dependence on a central node and solve the single point trust problem existing in a centralized system.

[0132] In addition, in various embodiments of the present application, the management operations performed on devices in the UPnP network include capability sharing operations between devices. In other words, based on the UPnP protocol and the blockchain network, capability sharing between devices is achieved, and the transmitted data can be encrypted; in this way, the device capabilities can be maximized while ensuring data security.

[0133] The present application will be described in further detail below in conjunction with application examples.

[0134] This application embodiment provides a trusted smart home capability sharing system based on the UPnP protocol (hereinafter referred to as the home capability sharing system), including: a UPnP network (i.e., the first network mentioned above), a blockchain network (i.e., the second network mentioned above), an IPFS storage device (i.e., the second server mentioned above), a device authentication center (i.e., the first server mentioned above), a user management module, a home network control center, a device authentication module, and an authentication management module. The home capability sharing system constructs a smart home capability resource pool (i.e., the UPnP network) based on the UPnP protocol, and realizes seamless sharing of device capabilities (i.e., resources) through the UPnP protocol (i.e., capability sharing is achieved without the need for device drivers), thereby realizing distributed sharing of smart home device capabilities. At the same time, devices connected to the UPnP network are registered through the authentication mode of the public key infrastructure (PKI), and the registration information of the devices is saved using the blockchain network to realize secure access to smart devices. The blockchain network is specifically used to implement user identity authentication, device identity authentication and device management (i.e., device control). Due to the high storage cost of blockchain, the home capability sharing system uses IPFS storage devices to store the encrypted operating information and user data of devices in the UPnP network; through the blockchain network and IPFS storage devices, the security and privacy of the data of the home capability sharing system are guaranteed.

[0135] In this application embodiment, if Figure 3 As shown, the workflow of the home capability sharing system based on the UPnP network includes: device authentication, device addressing, service discovery (i.e., device discovery), device description, device control, device events, and device display. In order to prevent malicious devices from accessing the home network, before device addressing, that is, before using the Dynamic Host Configuration Protocol (DHCP) to assign an Internet Protocol (IP) address to the device, the home capability sharing system needs to perform device authentication, which can also be understood as user authorization, that is, to determine whether the access device is a malicious device and grant the device the right to access the UPnP network (i.e., register the device to the blockchain network), and the authorized device information (i.e., the device registration information) is placed on the blockchain network. The data generated during the operation of the device is stored through the IPFS storage device.

[0136] In this application embodiment, the multiple modules included in the home capability sharing system can be divided into device-oriented modules and client-oriented modules (also called user modules); wherein the device-oriented modules include: UPnP network, device authentication center, user management module, home network control center and device authentication module; Figure 4 As shown, the client-oriented modules include: blockchain network, IPFS storage device and authentication management module.

[0137] The functions of the home capability sharing system are described in detail below.

[0138] First, when a user uses the home capability sharing system, he needs to register with the home capability sharing system.

[0139] Specifically, the user logs in to the home capability sharing system through the SIM card application of the client. In the home network, in order to reduce the difficulty of user registration and improve the security of user identity information, the home capability sharing system uses the SM9 algorithm as the encryption algorithm. Compared with the traditional PKI algorithm, the SM9 algorithm does not require the application of a digital certificate and is suitable for the security protection of various emerging applications of Internet applications. The home capability sharing system uses the user management module to obtain the user's SIM card serial number as the public key of the home network, stores the public key in the blockchain network, and uses the key to perform data encryption, user identity authentication (that is, the blockchain smart contract uses the public key to verify the user's identity), and data channel encryption between the system and the SIM card. At the same time, the card application uses the SM9 algorithm to generate a private key based on the user's SIM card serial number and stores it on the SIM card side.

[0140] In practical applications, the home capability sharing system can be used by multiple households. When the first user in each household logs in to the system, they register through the SIM card application. After confirming the user, the system queries the SIM card information, stores information such as the blank SIM card serial number in the blockchain, and sets the user's permissions to super administrator. Additional users and guests joining the home network need to obtain authorization from the super administrator before registering. Only the super administrator or the user who has transferred the super administrator status can delete household users or guests.

[0141] Secondly, the home capability sharing system needs to build a UPnP network, that is, to connect smart devices to the data home network; the process of connecting smart devices to the data home network includes: a manufacturer access process, a smart device registration process, and a smart device access process.

[0142] The manufacturer access process includes the following steps:

[0143] Step 1: The smart home device manufacturer sends an access request (i.e., a registration request) to the home network control center; then proceed to step 2;

[0144] Step 2: The home network control center verifies the manufacturer's certificate with the CA. If the CA does not have the manufacturer's certificate, it is determined that the corresponding manufacturer has failed certificate verification, and step 3 is performed. If the certificate verification is successful (i.e., the CA has the manufacturer's certificate), the manufacturer is added to the certificate trust list (CTL), and step 5 is performed.

[0145] Step 3: The manufacturer applies for a certificate from the CA; then proceed to step 4;

[0146] Step 4: The CA decides whether to issue a certificate to the manufacturer based on the authenticity of the manufacturer's identity. If the manufacturer passes the authenticity verification and successfully issues a certificate, proceed to step 2. Otherwise, the registration fails, i.e., the access fails.

[0147] Step 5: The manufacturer information completes the registration process on the home network control center (i.e., saves the manufacturer information to the blockchain network), and the manufacturer registration is successful.

[0148] The smart device registration process includes the following steps:

[0149] Step A: The smart device initiates a registration request (i.e., the fifth request) to the device authentication center; then executes step B;

[0150] Here, the registration request may include device information such as manufacturer ID and device ID;

[0151] Step B: The device authentication center checks whether the home network control center has connected to the manufacturer based on the manufacturer ID; if not, execute step C; if so, execute step D;

[0152] Step C: The manufacturer initiates a registration request to the home network control center; if the registration is successful, proceed to step D; otherwise, the device registration fails;

[0153] Step D: The home network control center obtains device information from the manufacturer based on the device ID and verifies the legitimacy of the device identity by comparing the device information obtained from the manufacturer with the device information included in the registration request. If the device passes the legitimacy verification, step E is executed; otherwise, the device registration fails.

[0154] Step E: The home network control center saves the device information to the blockchain network, and the device is successfully registered.

[0155] The smart device access process includes the following steps:

[0156] Step F: The smart device applies to join (i.e., access) the digital home and sends an access request to the device authentication center. After receiving the request, the device authentication center checks whether the device is registered. If not, step G is executed; if it is registered, step H is executed.

[0157] Step G: The smart device initiates a registration request to the device authentication module; if the registration is successful, proceed to step H; if the registration is unsuccessful, proceed to step I;

[0158] Step H: The device authentication module queries the blockchain network through the smart contract to verify the device identity; if the device passes the authentication, execute step J; if the device fails the authentication, execute step I;

[0159] Step I: The device fails to pass authentication and fails to access the digital home;

[0160] Step J: The device passes the verification of authenticity (the device has been registered and the blockchain network stores the device's information) and legitimacy (the device manufacturer is legitimate), and successfully connects to the smart home network (i.e., digital home). Through the SM9 algorithm, a unique public and private key pair is generated for the device, and the private key is stored in the device's hardware storage module.

[0161] Third, the home capability sharing system can authenticate users when they initiate action proposals based on the blockchain network. The authentication management module of the home capability sharing system is responsible for providing identity management for all nodes in the blockchain network. During blockchain network initialization, all nodes must register and verify their identities within the authentication management module to obtain legal identities and become valid nodes in the blockchain network. Nodes with different identities have different permissions. For example, service nodes deployed with smart contracts can endorse action proposals based on endorsement policies, determining whether the user initiating the action proposal has permission to perform the action.

[0162] Specifically, if Figure 5 As shown, in the process of performing user authentication when a user initiates an operation proposal based on the blockchain network in the home capability sharing system, the workflow of the blockchain network may include the following steps:

[0163] Step K: The user logs into the digital home network (i.e., logs into the home capability sharing system). The blockchain network authenticates the user's identity and determines whether the user is legitimate (i.e., registered). If the user passes the legitimacy verification, the login is successful and step L is executed; otherwise, the user needs to log in again.

[0164] Step L: The user initiates an operation proposal, such as storing specific information, viewing specific information, modifying permission policies, deploying chaincode, etc.; then executes step M;

[0165] Step M: The service node with the smart contract deployed in the blockchain network completes the endorsement of the operation proposal according to the endorsement policy and determines whether the user has the permission to perform the operation; then executes step N;

[0166] Step N: If the user has the authority to perform the operation, the operation is performed; otherwise, user authority information and prompt information (ie, the first information mentioned above) are returned.

[0167] Fourth, the home capability sharing system can realize family capability sharing.

[0168] Specifically, the process of implementing family capability sharing by the home capability sharing system may include the following steps:

[0169] Step O: The home capability sharing system divides the different capability attributes of the device into different categories of capability pools according to the device description of the UPnP protocol, such as video capability, audio capability, microphone capability, camera capability, etc.; then executes step P;

[0170] Step P: The control point in the UPnP network verifies the device identity and status of the resource provider for capability sharing (i.e., determines whether the device can provide the corresponding service). After verification, the control point makes a function call, i.e., sends a function call request to the resource provider. Then, step Q is executed.

[0171] Step Q: The control point obtains the shared resource list of the service provider (i.e., resource provider). The list contains detailed information about the files, such as file name, file type, file creation date, and resource size (i.e., file size), as well as the transmission protocols supported by the resource provider for each type of resource (i.e., file). At the same time, the control point needs to obtain the transmission protocols and resource formats supported by the resource acquirer. By comparing the resource transmission protocols supported by the resource provider with those supported by the resource acquirer, the control point needs to select a transmission protocol and data format supported by both parties for resource transmission. Then, step R is executed.

[0172] Step R: The user determines the resources to be shared and starts sharing the resources; then executes step S;

[0173] Step S: After resource sharing is completed, the state of the corresponding device is restored to idle, and the state restoration result is returned to the control point.

[0174] In this application embodiment, the core workflow of the home capability sharing system includes the following steps:

[0175] Step 1: The user logs in to the home capability sharing system through the SIM card application. The blockchain network authenticates the user's identity and checks whether the user is legitimate (i.e., registered). If the user passes the legitimacy verification, the login is successful; otherwise, the process ends.

[0176] Step 2: After successful login, when the user needs to operate the device (i.e., control the device) or share capabilities, the SIM card application uses the user's private key to sign the operation request (i.e., the first request) and sends it to the control point; after receiving the operation request, the control point verifies the validity of the signature and performs the corresponding operation if the validity of the signature is verified;

[0177] Step 3: When the control point performs the corresponding operation, such as when sharing capabilities, it instructs (i.e., controls) the corresponding smart device to encrypt the data using the user's public key through the encryption system. In this way, only the device with the user's private key can decrypt the corresponding data and view it. Other devices (i.e., devices without the corresponding user's private key) cannot access the specific content of the data even if they intercept the data stream.

[0178] Step 4: The home capability sharing system uses IPFS storage devices to store various types of user information. Families connected to the blockchain network record the information of various smart home devices (such as working hours, power consumption, system version, etc.) on the IPFS storage device; the IPFS storage device divides the permission levels according to the different identities of users when accessing the network, thereby distinguishing the permissions of different family users.

[0179] The solution provided by this application embodiment has the following advantages:

[0180] 1) Device registration is performed through manufacturer and CA certification, and authorization and on-chaining (the process of storing user information on the blockchain network) of the user's SIM card application ensures the legitimacy of devices entering the home network and on-chain; that is, the legitimacy of the device can be authenticated, thereby enabling secure device access control;

[0181] 2) User registration and login are completed using highly secure SIM card information (i.e., SIM card serial number). User information is stored in a decentralized manner through the blockchain network and IPFS protocol, avoiding reliance on central nodes and protecting user privacy from being stolen, thus ensuring data immutability and security.

[0182] 3) Decentralized authentication and authorization through blockchain avoids reliance on central nodes, effectively resists attacks such as DDoS, improves the robustness of the system, and ensures the immutability and traceability of system transactions.

[0183] In order to implement the method of the embodiment of the present application, the embodiment of the present application further provides a device management device, which is set at the first control point, such as Figure 6 As shown, the device includes:

[0184] An acquiring unit 601 is configured to acquire a first request; the first request carries at least a first signature; the first request is used to request management of a device in a first network; the first network includes a plurality of devices; the plurality of devices can communicate with each other based on the UPnP protocol; the first control point is a device among the plurality of devices whose computing capability meets a first condition;

[0185] A first processing unit 602 is configured to call, through a smart contract, a first node of the second network to verify the validity of the first signature according to a preset endorsement policy, and obtain a first verification result;

[0186] The second processing unit 603 is configured to execute a management operation corresponding to the first request if the first verification result indicates that the validity of the first signature has passed verification.

[0187] In one embodiment, the first request is sent by the first terminal; the first signature represents the identity of the operator of the first terminal; and the first processing unit 602 is specifically configured to:

[0188] Sending a second request to the first node; the second request is used to request verification of whether the operator of the first terminal is registered in the second network, and to request verification of whether the operator of the first terminal has permission to perform the management operation corresponding to the first request;

[0189] Receive a first verification result returned by the first node in response to the second request.

[0190] In one embodiment, the second processing unit 603 is further used to send a first message to the first terminal when the first verification result indicates that the validity of the first signature has not been verified; the first message is used to prompt the operator of the first terminal to register to the second network and / or obtain permission to perform the management operation corresponding to the first request.

[0191] In one embodiment, the first request is specifically used to request control of the first device to access the first network; accordingly, the second processing unit 603 is specifically used to:

[0192] Calling, through the smart contract, a second node of the second network to verify the identity of the first device and obtain a second verification result;

[0193] If the second verification result indicates that the identity of the first device has passed verification, the first device is controlled to access the first network.

[0194] In one embodiment, the second processing unit 603 is further configured to:

[0195] Sending a third request to the second node; the third request is used to request verification of whether the first device is registered in the second network;

[0196] Receive a second verification result returned by the second node in response to the third request.

[0197] In one embodiment, the second processing unit 603 is further configured to control the first device to register with the second network if the second verification result indicates that the identity of the first device has not passed verification.

[0198] In one embodiment, the second processing unit 603 is further configured to send a fourth request to the first device; the fourth request is configured to request the first device to send a fifth request to the first server; and the fifth request is configured to request registration of the first device to the second network.

[0199] In one embodiment, the first request is specifically used to request control of the second device to use the first capability; the second device does not have the first capability; accordingly, the second processing unit 603 is specifically used to:

[0200] Determining whether there is a third device with the first capability in the first network, and determining whether the third device can provide the first capability based on a status of the third device, to obtain a determination result;

[0201] If the determination result indicates that the third device exists in the first network and the third device can provide the first capability, the second device is controlled to use the first capability.

[0202] In one embodiment, the second processing unit 603 is further configured to control the second device and the third device to transmit resources corresponding to the first capability.

[0203] In one embodiment, the second processing unit 603 is further configured to control the second device and the third device to perform encrypted transmission of resources corresponding to the first capability.

[0204] In one embodiment, the apparatus further includes a third processing unit configured to:

[0205] Obtaining operating information of at least one device in the first network;

[0206] Based on the IPFS protocol, the acquired operation information is stored in the second server.

[0207] In actual application, the acquisition unit 601, the first processing unit 602, the second processing unit 603 and the third processing unit can be implemented by a processor in the equipment management device in combination with a communication interface.

[0208] It should be noted that the device management apparatus provided in the above embodiment is merely illustrated by the division of the aforementioned program modules when managing devices. In actual application, the aforementioned processing can be assigned to different program modules as needed, that is, the internal structure of the apparatus can be divided into different program modules to complete all or part of the aforementioned processing. Furthermore, the device management apparatus provided in the above embodiment and the device management method embodiment are based on the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0209] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiment of the present application, the embodiment of the present application further provides an electronic device, namely a first control point, such as Figure 7 As shown, the electronic device 700 includes:

[0210] Communication interface 701, capable of exchanging information with other electronic devices;

[0211] A processor 702 is connected to the communication interface 701 to implement information exchange with other electronic devices, and is used to execute the methods provided by one or more of the above technical solutions when running a computer program;

[0212] The memory 703 stores computer programs that can be executed on the processor 702 .

[0213] Specifically, the processor 702 is configured to:

[0214] Obtaining a first request; the first request carries at least a first signature; the first request is used to request management of a device in a first network; the first network includes multiple devices; the multiple devices can communicate based on the UPnP protocol; the electronic device 700 is a device among the multiple devices whose computing capacity meets the first condition;

[0215] Using the smart contract, calling the first node of the second network to verify the validity of the first signature according to a preset endorsement policy, thereby obtaining a first verification result;

[0216] In a case where the first verification result indicates that the validity of the first signature has passed verification, a management operation corresponding to the first request is executed.

[0217] In one embodiment, the first request is sent by the first terminal; the first signature represents the identity of the operator of the first terminal; the processor 702 is specifically configured to:

[0218] Sending a second request to the first node; the second request is used to request verification of whether the operator of the first terminal is registered in the second network, and to request verification of whether the operator of the first terminal has permission to perform the management operation corresponding to the first request;

[0219] Receive a first verification result returned by the first node in response to the second request.

[0220] In one embodiment, the processor 702 is further configured to send a first message to the first terminal when the first verification result indicates that the validity of the first signature has not been verified; the first message is used to prompt the operator of the first terminal to register to the second network and / or obtain permission to perform the management operation corresponding to the first request.

[0221] In one embodiment, the first request is specifically used to request control of the first device to access the first network; the processor 702 is further configured to:

[0222] Calling, through the smart contract, a second node of the second network to verify the identity of the first device and obtain a second verification result;

[0223] If the second verification result indicates that the identity of the first device has passed verification, the first device is controlled to access the first network.

[0224] In one embodiment, the processor 702 is further configured to:

[0225] Sending a third request to the second node; the third request is used to request verification of whether the first device is registered in the second network;

[0226] Receive a second verification result returned by the second node in response to the third request.

[0227] In one embodiment, the processor 702 is further configured to control the first device to register with the second network if the second verification result indicates that the identity of the first device has not passed verification.

[0228] In one embodiment, the processor 702 is further configured to send a fourth request to the first device; the fourth request is configured to request the first device to send a fifth request to the first server; and the fifth request is configured to request registration of the first device to the second network.

[0229] In one embodiment, the first request is specifically used to request control of the second device to use the first capability; the second device does not have the first capability; the processor 702 is further configured to:

[0230] Determining whether there is a third device with the first capability in the first network, and determining whether the third device can provide the first capability based on a status of the third device, to obtain a determination result;

[0231] If the determination result indicates that the third device exists in the first network and the third device can provide the first capability, the second device is controlled to use the first capability.

[0232] In one embodiment, the processor 702 is further configured to control the second device and the third device to transmit resources corresponding to the first capability.

[0233] In one embodiment, the processor 702 is further configured to control the second device and the third device to perform encrypted transmission of resources corresponding to the first capability.

[0234] In one embodiment, the processor 702 is further configured to:

[0235] Obtaining operating information of at least one device in the first network;

[0236] Based on the IPFS protocol, the acquired operation information is stored in the second server.

[0237] It should be noted that the specific process of the processor 702 performing the above operations is detailed in the method embodiment and will not be repeated here.

[0238] Of course, in actual application, the various components in the electronic device 700 are coupled together through the bus system 704. It is understood that the bus system 704 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 704 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Figure 7 Various buses are labeled as bus system 704 .

[0239] The memory 703 in the embodiment of the present application is used to store various types of data to support the operation of the electronic device 700. Examples of such data include: any computer program used to operate on the electronic device 700.

[0240] The methods disclosed in the above embodiments of the present application can be applied to the processor 702 or implemented by the processor 702. The processor 702 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by the hardware integrated logic circuit in the processor 702 or by instructions in the form of software. The above processor 702 may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 702 can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of the present application can be directly embodied as being executed by a hardware decoding processor, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the memory 703. The processor 702 reads the information in the memory 703 and completes the steps of the above method in combination with its hardware.

[0241] In an exemplary embodiment, the electronic device 700 can be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to perform the aforementioned method.

[0242] It is understood that the memory 703 of the embodiment of the present application can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a magnetic disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus random access memory (DRRAM).The memories described in the embodiments of this application are intended to include, but are not limited to, these and any other suitable types of memories.

[0243] In an exemplary embodiment, the present application also provides a storage medium, namely, a computer storage medium, specifically a computer-readable storage medium, including, for example, a memory 703 storing a computer program. The computer program can be executed by a processor 702 of an electronic device 700 to perform the steps of the aforementioned method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface storage, optical disk, or CD-ROM.

[0244] It should be noted that: "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0245] In addition, the technical solutions described in the embodiments of the present application can be arbitrarily combined without conflict.

[0246] The above description is merely a preferred embodiment of the present application and is not intended to limit the scope of protection of the present application.

Claims

1. A device management method, characterized in that: Applied to the first control point, including: Obtaining a first request; the first request carries at least a first signature; the first request is used to request management of a device in a first network; the first network includes multiple devices; the multiple devices can communicate with each other based on the Universal Plug and Play (UPnP) protocol; the first control point is a device among the multiple devices whose computing capacity meets a first condition; the first network is a UPnP network; Through the smart contract, calling a first node of a second network to verify the validity of the first signature according to a preset endorsement policy, thereby obtaining a first verification result; the second network is a blockchain network; In a case where the first verification result indicates that the validity of the first signature has passed verification, a management operation corresponding to the first request is executed.

2. The method according to claim 1, characterized in that The first request is sent by a first terminal; the first signature represents the identity of the operator of the first terminal; The calling of the first node of the second network verifies the validity of the first signature according to a preset endorsement policy, including: Sending a second request to the first node; the second request is used to request verification of whether the operator of the first terminal is registered in the second network, and to request verification of whether the operator of the first terminal has permission to perform the management operation corresponding to the first request; Receive a first verification result returned by the first node in response to the second request.

3. The method according to claim 2, characterized in that If the operator of the first terminal has registered in the second network and the operator of the first terminal has permission to perform the management operation corresponding to the first request, the first verification result indicates that the validity of the first signature has been verified; When the operator of the first terminal is not registered in the second network, or when the operator of the first terminal does not have the authority to perform the management operation corresponding to the first request, the first verification result indicates that the validity of the first signature has not passed verification.

4. The method according to claim 2, characterized in that The method further comprises: When the first verification result indicates that the validity of the first signature has not passed the verification, a first message is sent to the first terminal; the first message is used to prompt the operator of the first terminal to register to the second network and / or obtain permission to perform the management operation corresponding to the first request.

5. The method according to any one of claims 1 to 4, characterized in that The first request is specifically used to request control of the first device to access the first network; and the performing of the management operation corresponding to the first request includes: Calling, through the smart contract, a second node of the second network to verify the identity of the first device and obtain a second verification result; If the second verification result indicates that the identity of the first device has passed verification, the first device is controlled to access the first network.

6. The method according to claim 5, characterized in that The calling the second node of the second network to verify the identity of the first device includes: Sending a third request to the second node; the third request is used to request verification of whether the first device is registered in the second network; Receive a second verification result returned by the second node in response to the third request.

7. The method according to claim 6, characterized in that The method further comprises: If the second verification result indicates that the identity of the first device has failed verification, control the first device to register with the second network.

8. The method according to claim 7, characterized in that The controlling the first device to register with the second network includes: A fourth request is sent to the first device; the fourth request is used to request the first device to send a fifth request to the first server; the fifth request is used to request to register the first device to the second network.

9. The method according to any one of claims 1 to 4, characterized in that The first request is specifically used to request controlling the second device to use the first capability; the second device does not have the first capability; and performing the management operation corresponding to the first request includes: Determining whether there is a third device with the first capability in the first network, and determining whether the third device can provide the first capability based on a status of the third device, to obtain a determination result; If the determination result indicates that the third device exists in the first network and the third device can provide the first capability, the second device is controlled to use the first capability.

10. The method according to claim 9, characterized in that The controlling the second device to use the first capability includes: Control the second device and the third device to transmit resources corresponding to the first capability.

11. The method according to claim 10, characterized in that The controlling the second device and the third device to transmit resources corresponding to the first capability includes: Control the second device and the third device to perform encrypted transmission of resources corresponding to the first capability.

12. The method according to any one of claims 1 to 4, characterized in that The method further comprises: Obtaining operating information of at least one device in the first network; Based on the InterPlanetary File System (IPFS) protocol, the acquired operation information is stored on the second server.

13. A device management device, characterized in that: Set on the first control point, including: an acquiring unit configured to acquire a first request; the first request carries at least a first signature; the first request is used to request management of a device in a first network; the first network includes a plurality of devices; the plurality of devices are capable of communicating with each other based on the UPnP protocol; the first control point is a device among the plurality of devices whose computing capacity meets a first condition; and the first network is a UPnP network; a first processing unit, configured to call, through a smart contract, a first node of a second network to verify the validity of the first signature according to a preset endorsement policy, and obtain a first verification result; the second network being a blockchain network; The second processing unit is configured to execute a management operation corresponding to the first request if the first verification result indicates that the validity of the first signature has passed verification.

14. An electronic device, characterized in that: include: A processor and a memory for storing a computer program that can be run on the processor, wherein the processor performs the steps of the method according to any one of claims 1 to 12 when running the computer program.

15. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 12 are implemented.

Images