Permission checking method and device, computer device, and storage medium

Abstract

Embodiments of the present application disclose a permission verification method and device, computer equipment and a storage medium. The method belongs to the technical field of Internet of Things, and comprises the following steps: if a batch import instruction is received, obtaining an Internet of Things card number to be verified according to the batch import instruction; inputting the Internet of Things card number to be verified into a first-level Bloom filter to perform card level black and white list permission verification to obtain an initial verification result; if the initial verification result is verification success, inputting the Internet of Things card number to be verified into a second-level Bloom filter to perform group level black and white list permission verification to obtain a target verification result. The embodiments of the present application can not only improve the efficiency, security and reliability of permission verification, but also improve the accuracy of permission verification.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) technology, and in particular to an authorization verification method, apparatus, computer device, and storage medium. Background Technology

[0002] Existing IoT SIM card operation permission management based on an IoT connectivity management platform employs a multi-layered permission verification scheme, namely the enterprise layer, sales unit layer, and group layer. For example, if a user binds all IoT SIM cards under a specified enterprise and sales unit, then that user has operation permissions for those IoT SIM cards. For verifying operation permissions for a specific IoT SIM card, the system typically first queries the user's authorized groups, then matches the group corresponding to the specified IoT SIM card; if successful, permission is granted; otherwise, permission is denied.

[0003] However, for large-scale IoT card operations, especially the batch addition of group members business module, the data volume can reach 1 million in a single addition. Each card needs to perform a permission verification query, which not only increases the data processing time, but may also cause the permission interface call to time out, resulting in low permission verification efficiency. Moreover, since the permission interface call first checks the cache, and if it cannot be found in the cache, it will reach the database layer, the existing permission verification scheme has the risk of cache penetration, which makes the permission verification less secure. Summary of the Invention

[0004] This invention provides a permission verification method, apparatus, computer device, and storage medium, aiming to improve the security and efficiency of permission verification in existing IoT connection management platforms.

[0005] In a first aspect, embodiments of the present invention provide a permission verification method, comprising:

[0006] If a batch import instruction is received, the IoT card number to be verified is obtained according to the batch import instruction;

[0007] The IoT card number to be verified is input into the first-level Bloom filter to perform card-level blacklist / whitelist permission verification to obtain the initial verification result;

[0008] If the initial verification result is successful, the IoT card number to be verified is input into the second-level Bloom filter for group-level blacklist / whitelist permission verification to obtain the target verification result.

[0009] Secondly, embodiments of the present invention also provide a permission verification device, which includes:

[0010] The acquisition unit is used to acquire the IoT card number to be verified according to the batch import instruction if a batch import instruction is received.

[0011] The first permission verification unit is used to input the IoT card number to be verified into the first-level Bloom filter to perform card-level blacklist and whitelist permission verification to obtain the initial verification result.

[0012] The second permission verification unit is used to input the IoT card number to be verified into the second-level Bloom filter to perform group-level blacklist / whitelist permission verification to obtain the target verification result if the initial verification result is successful.

[0013] Thirdly, embodiments of the present invention also provide a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described method.

[0014] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing a computer program that, when executed by a processor, can implement the above-described method.

[0015] This invention provides a permission verification method, apparatus, computer device, and storage medium. The method includes: if a batch import instruction is received, obtaining the IoT card number to be verified according to the batch import instruction; inputting the IoT card number to be verified into a first-level Bloom filter for card-level blacklist / whitelist permission verification to obtain an initial verification result; if the initial verification result is successful, inputting the IoT card number to be verified into a second-level Bloom filter for group-level blacklist / whitelist permission verification to obtain a target verification result. The technical solution of this invention, by using a two-level Bloom filter to perform blacklist / whitelist permission verification on the IoT card number to be verified, not only improves the efficiency, security, and reliability of permission verification, but also improves the accuracy of permission verification. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A flowchart illustrating an authorization verification method provided in an embodiment of the present invention;

[0018] Figure 2 for Figure 1 Schematic diagram of the first-stage Bloom filter;

[0019] Figure 3 for Figure 1 Schematic diagram of the second-stage Bloom filter;

[0020] Figure 4 for Figure 1 Schematic diagram of the first-stage Bloom filter and the second-stage Bloom filter;

[0021] Figure 5 A schematic block diagram of an authorization verification device provided in an embodiment of the present invention; and

[0022] Figure 6 This is a schematic block diagram of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0023] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0025] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0026] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0027] As used in this specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrases "if determined" or "if [the described condition or event] is detected" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once [the described condition or event] is detected," or "in response to detection of [the described condition or event]."

[0028] Please see Figure 1 , Figure 1This is a flowchart illustrating a permission verification method provided in an embodiment of the present invention. The permission verification method of this embodiment can be applied to an IoT connection management platform. For example, it can be implemented through a software program configured on the IoT connection management platform to improve the efficiency, security, reliability, and accuracy of permission verification. Figure 1 As shown, the method includes the following steps S110-S130.

[0029] S110. If a batch import instruction is received, the IoT card number to be verified is obtained according to the batch import instruction.

[0030] In this embodiment of the invention, when adding or modifying group members in the IoT connection management platform, new members are imported in batches. The import of new members requires verification of whether the IoT account corresponding to the new member has the operation permissions for the specified IoT card. Specifically, if the IoT connection management platform receives a batch import instruction, it retrieves the IoT card numbers to be verified from multiple Excel tables that need to be imported, according to the batch import instruction. Understandably, there are multiple IoT card numbers to be verified. It should be noted that in this embodiment, one IoT account has multiple IoT card numbers.

[0031] S120. Input the IoT card number to be verified into the first-level Bloom filter to perform card-level blacklist / whitelist permission verification to obtain the initial verification result.

[0032] In this embodiment of the invention, for ease of understanding, the Bloom filter is first introduced. The underlying layer of the Bloom filter includes a binary array and a random mapping function. Its advantages are low time complexity and high security. The high security is because the Bloom filter does not store the data itself, but stores the data after function mapping. It should be noted that in this embodiment of the invention, the Counting Bloom Filter is used, which can maintain the data. When inserting an element, the values ​​of the corresponding k (k is the number of hash functions) Counters are incremented by 1, and when deleting an element, the values ​​of the corresponding k Counters are decremented by 1. The Counting Bloom Filter adds dynamic adjustment of the deletion operation to the Bloom Filter by occupying several times more storage space, thereby increasing the reliability of the data. It should also be noted that in this embodiment, the underlying layer of the improved Bloom filter includes an array of length m and hash functions. The formula for calculating the array length m is shown in formula (1). In formula (1), n ​​is the preset amount of data stored in the binary array, P is the false positive probability; the number of hash functions is k, and its calculation formula is shown in formula (2). Understandably, the length of the binary array of the Bloom filter and the number of hash functions can be calculated using formulas (1) and (2).

[0033]

[0034]

[0035] Furthermore, since Bloom filter verification has a certain probability of false positives, to ensure the accuracy of permission verification, such as... Figure 2 As shown, the first-level Bloom filter in this embodiment includes a card-level whitelist and a card-level blacklist. The card-level whitelist filters for cards without permissions, and the card-level blacklist filters for cards with permissions. That is, IoT card numbers not in the card-level whitelist are considered cards without permissions, and those in the card-level blacklist are also considered cards without permissions. It should be noted that in this embodiment, the length of the card-level blacklist is the same as the length of the card-level whitelist. However, because the number of cards in the card-level blacklist is relatively smaller than the number in the corresponding card-level whitelist, the probability of false positives is lower. Furthermore, during each verification, IoT cards not in the card-level whitelist are saved to the card-level blacklist.

[0036] Furthermore, such as Figure 2 As shown, based on formula (1), the array length of the first-level Bloom filter is calculated according to the preset card level data volume and card level misjudgment probability, wherein the preset card level data volume is 1 million data points and the card level misjudgment probability is 0.05%; based on formula (2), the number of first-level hash functions k1 is calculated according to the array length of the first-level Bloom filter and the card level data volume; the IoT card number to be verified is hashed using the k1 hash functions to obtain k1 card level hash values; the IoT card number to be verified is subjected to permission verification based on the k1 card level hash values, the card level whitelist and the card level blacklist to obtain the initial verification result. Specifically, the index values ​​corresponding to the k1 card-level hash values ​​are matched one by one with the card-level whitelist. If a match is successful, it indicates that none of the index values ​​corresponding to the k1 card-level hash values ​​are 0. Then, the index values ​​corresponding to the k1 card-level hash values ​​are matched one by one with the card-level blacklist to obtain the initial verification result. If a match fails, it indicates that there is a value of 0 among the index values ​​corresponding to the k1 card-level hash values. Then, it is determined that the user does not have operation permissions for the IoT card corresponding to the IoT card number to be verified. The network card information corresponding to the IoT card number to be verified is saved to the card-level blacklist, and the group-level blacklist is updated according to the group ID in the network card information.

[0037] Specifically, the step of matching the index values ​​corresponding to the k1 card-level hash values ​​one by one with the card-level blacklist to obtain the initial verification result includes matching the index values ​​corresponding to the k1 card-level hash values ​​one by one with the card-level blacklist to obtain the initial verification result; if the match is successful, it indicates that the user does not have operation permissions for the IoT card, and the initial verification result is set to verification failure; if the match fails, it indicates that the user may have operation permissions for the IoT card, and the initial verification result is set to verification success. To improve the accuracy of permission verification, a secondary verification is performed on the IoT card number to be verified. The specific process of the secondary verification will be described below and will not be repeated here. It should be noted that in this embodiment, the length of the card-level blacklist is the same as the length of the card-level whitelist, and the number of hash functions is the same as the number of hash functions in the card-level whitelist. It should also be noted that, in this embodiment, IoT card numbers that are not in the card-level whitelist or blacklist are determined to indicate that the user does not have operation permissions for the IoT card; IoT card numbers that are in the card-level whitelist but not in the card-level blacklist are determined to indicate that the user may have operation permissions for the IoT card.

[0038] S130. If the initial verification result is successful, the IoT card number to be verified is input into the second-level Bloom filter to perform group-level blacklist / whitelist permission verification to obtain the target verification result.

[0039] In this embodiment of the invention, to perform secondary permission verification on the IoT card number to be verified, the second-level Bloom filter includes a group-level whitelist and a group-level blacklist. When the initial verification result is successful, the IoT card number to be verified is input into the second-level Bloom filter for group-level whitelist / blacklist permission verification to obtain the target verification result. The target verification result includes permission verification passed and permission verification failed. It should be noted that in this embodiment, in the binding of IoT accounts to IoT cards, the IoT account is bound to an enterprise or an enterprise + sales unit. This allows operation of IoT cards under that enterprise or enterprise + sales unit. However, due to the large number of IoT cards, under the enterprise + sales unit, the IoT cards are further grouped to the group level. If the IoT card is in a group where the IoT account has operation permissions, the user has the operation permission to operate the IoT card. Understandably, the two-layer verification logic in this embodiment can improve the accuracy of permission verification.

[0040] Furthermore, such as Figure 3As shown, based on formula (1), the array length of the second-level Bloom filter is calculated according to the preset group-level data volume and the group-level misjudgment probability, wherein the preset group-level data volume is 10 million data points and the group-level misjudgment probability is 0.05%; based on formula (2), the number of second-level hash functions k2 is calculated according to the array length of the second-level Bloom filter and the group-level data volume, wherein the number of second-level hash functions k2 is equal to the number of first-level hash functions; the IoT card number to be verified is hashed using k2 of the hash functions to obtain k2 group-level hash values; the IoT card number to be verified is subjected to permission verification based on k2 of the group-level hash values, the group-level whitelist, and the group-level blacklist to obtain the target verification result. Specifically, the index values ​​corresponding to the k2 group-level hash values ​​are matched one by one with the group-level whitelist. If a match is successful, it indicates that none of the index values ​​corresponding to the k2 group-level hash values ​​are 0. Then, the k2 group-level hash values ​​are matched one by one with the group-level blacklist to obtain the target verification result. If a match fails, it indicates that there is a value of 0 among the index values ​​corresponding to the k2 group-level hash values. Then, it is determined that the user does not have operation permissions for the IoT card corresponding to the IoT card number to be verified. The group information corresponding to the IoT card number to be verified is saved to the group-level blacklist, and the card-level blacklist is updated according to the network card ID in the group information.

[0041] Furthermore, the step of matching the index values ​​corresponding to the k2 group-level hash values ​​one by one with the group-level blacklist to obtain the target verification result specifically involves matching the index values ​​corresponding to the k2 group-level hash values ​​one by one with the group-level blacklist; if the match is successful, it indicates that the user does not have operation permissions for the IoT card, and the target verification result is set to permission verification failure; if the match fails, it indicates that the user has operation permissions for the IoT card, and the target verification result is set to permission verification pass. It should be noted that in this embodiment, the length of the group-level blacklist is the same as the length of the group-level whitelist, and the number of hash functions is the same as the number of hash functions in the group-level whitelist. It should also be noted that in this embodiment, IoT card numbers not in the group-level whitelist or group-level blacklist are determined to indicate that the user does not have operation permissions for the IoT card; IoT card numbers in the group-level whitelist but not in the group-level blacklist are determined to indicate that the user has operation permissions for the IoT card.

[0042] In this embodiment, for ease of understanding, regarding the IoT card permission verification issue for adding group members in batches, this embodiment will address the following: Figure 4As shown, a large number of IoT cards to be verified are first obtained. These IoT cards are then input into a two-layer blacklist / whitelist Bloom filter for permission verification. During the first-layer Bloom filter (card-level Bloom filter) verification, both the card-level and group-level blacklists are updated. Similarly, during the second-layer Bloom filter (group-level Bloom filter) verification, both the card-level and group-level blacklists are updated. This dual dynamic change mechanism allows for synchronized updates to the blacklist data, resulting in high responsiveness. Furthermore, the use of Bloom filters effectively reduces interface call pressure, avoids cache penetration risks, consumes less memory, and the stored data itself does not contain data information, leading to higher security, reliability, and processing efficiency. It should be noted that, in this embodiment, IoT card numbers that are not in the card-level whitelist or card-level blacklist, or that are not in the group-level whitelist or group-level blacklist, are determined to indicate that the user does not have operation permissions for the IoT card; IoT card numbers that are in the card-level whitelist, not in the card-level blacklist, and in the group-level whitelist and not in the group-level blacklist are determined to indicate that the user has operation permissions for the IoT card.

[0043] Figure 5 This is a schematic block diagram of a permission verification device 200 provided in an embodiment of the present invention. Figure 5 As shown, corresponding to the above permission verification method, the present invention also provides a permission verification device 200. This permission verification device 200 includes a unit for performing the above permission verification method. Specifically, please refer to... Figure 5 The permission verification device 200 includes an acquisition unit 201, a first permission verification unit 202, and a second permission verification unit 203.

[0044] The acquisition unit 201 is used to acquire the IoT card number to be verified according to the batch import instruction if a batch import instruction is received; the first permission verification unit 202 is used to input the IoT card number to be verified into a first-level Bloom filter to perform card-level blacklist / whitelist permission verification to obtain an initial verification result; the second permission verification unit 203 is used to input the IoT card number to be verified into a second-level Bloom filter to perform group-level blacklist / whitelist permission verification to obtain a target verification result if the initial verification result is successful.

[0045] In some embodiments, such as this embodiment, the first permission verification unit 202 includes a first calculation unit, a second calculation unit, a third calculation unit, and a first permission verification subunit.

[0046] The first calculation unit is used to calculate the array length of the first-level Bloom filter based on the preset card-level data volume and the card-level misjudgment probability; the second calculation unit is used to calculate the number k1 of the first-level hash functions based on the array length of the first-level Bloom filter and the card-level data volume; the third calculation unit is used to perform hash calculations on the IoT card number to be verified using the k1 hash functions to obtain k1 card-level hash values; the first permission verification subunit is used to perform permission verification on the IoT card number to be verified based on the k1 card-level hash values, the card-level whitelist, and the card-level blacklist to obtain an initial verification result.

[0047] In some embodiments, such as this one, the first permission verification subunit includes a first matching unit, a second matching unit, and a first determination and storage unit.

[0048] The first matching unit is used to match the index values ​​corresponding to the k1 card-level hash values ​​with the card-level whitelist one by one; the second matching unit is used to match the index values ​​corresponding to the k1 card-level hash values ​​with the card-level blacklist one by one if the matching is successful to obtain an initial verification result; the first determination and storage unit is used to determine that the user does not have operation permissions for the IoT card corresponding to the IoT card number to be verified if the matching fails, save the network card information corresponding to the IoT card number to be verified to the card-level blacklist, and update the group-level blacklist according to the group ID in the network card information.

[0049] In some embodiments, such as this embodiment, the second matching unit includes a third matching unit, a first setting unit, and a second setting unit.

[0050] The third matching unit is used to match the index values ​​corresponding to the k1 card-level hash values ​​with the card-level blacklist one by one to obtain the initial verification result; the first setting unit is used to set the initial verification result to verification failure if the matching is successful; the second setting unit is used to set the initial verification result to verification success if the matching is unsuccessful.

[0051] In some embodiments, such as this embodiment, the second permission verification unit 203 includes a fourth calculation unit, a fifth calculation unit, a sixth calculation unit, and a second permission verification subunit.

[0052] The fourth calculation unit is used to calculate the array length of the second-level Bloom filter based on the preset group-level data volume and group-level misjudgment probability; the fifth calculation unit is used to calculate the number k2 of the second-level hash functions based on the array length of the second-level Bloom filter and the group-level data volume; the sixth calculation unit is used to perform hash calculation on the IoT card number to be verified using the k2 hash functions to obtain the group k2-level hash values; the second permission verification subunit is used to perform permission verification on the IoT card number to be verified based on the k2 group-level hash values, the group-level whitelist, and the group-level blacklist to obtain the target verification result.

[0053] In some embodiments, such as this one, the second permission verification subunit includes a fourth matching unit, a fifth matching unit, and a second determination and storage unit.

[0054] The fourth matching unit is used to match the index values ​​corresponding to the k2 group-level hash values ​​with the group-level whitelist one by one; the fifth matching unit is used to match the index values ​​corresponding to the k2 group-level hash values ​​with the group-level blacklist one by one if the matching is successful to obtain the target verification result; the second determination and storage unit is used to determine that the user does not have operation permissions for the IoT card corresponding to the IoT card number to be verified if the matching fails, save the group information corresponding to the IoT card number to be verified to the group-level blacklist, and update the card-level blacklist according to the network card ID in the group information.

[0055] In some embodiments, such as this one, the fifth matching unit includes a sixth matching unit, a third setting unit, and a fourth setting unit.

[0056] The sixth matching unit is used to match the index values ​​corresponding to the k2 group-level hash values ​​with the group-level blacklist one by one; the third setting unit is used to set the target verification result to permission verification failure if the matching is successful; the fourth setting unit is used to set the target verification result to permission verification successful if the matching fails.

[0057] It should be noted that those skilled in the art can clearly understand that the specific implementation process of the above-mentioned permission verification device 200 and each unit can be referred to the corresponding description in the foregoing method embodiments. For the sake of convenience and brevity, it will not be repeated here.

[0058] The aforementioned permission verification device can be implemented as a computer program, which can perform operations such as... Figure 6 It runs on the computer device shown.

[0059] Please see Figure 6 , Figure 6 This is a schematic block diagram of a computer device provided in an embodiment of this application. The computer device 900 is a server equipped with an Internet of Things (IoT) connection management platform.

[0060] See Figure 6 The computer device 900 includes a processor 902, a memory, and an interface 907 connected via a system bus 901, wherein the memory may include a storage medium 903 and internal memory 904.

[0061] The storage medium 903 may store an operating system 9031 and a computer program 9032. When the computer program 9032 is executed, it causes the processor 902 to perform an access control method.

[0062] The processor 902 provides computing and control capabilities to support the operation of the entire computer device 900.

[0063] The internal memory 904 provides an environment for the execution of the computer program 9032 in the storage medium 903. When the computer program 9032 is executed by the processor 902, the processor 902 can perform an access control method.

[0064] This interface 905 is used for communication with other devices. Those skilled in the art will understand that... Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device 900 to which the present application is applied. The specific computer device 900 may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0065] The processor 902 is used to run a computer program 9032 stored in a memory to implement the process steps of the above-described method embodiments.

[0066] It should be understood that in the embodiments of this application, the processor 902 may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0067] It will be understood by those skilled in the art that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a storage medium, which is a computer-readable storage medium. The computer program is executed by at least one processor in the wireless communication system to implement the process steps of the embodiments of the above methods.

[0068] Therefore, the present invention also provides a storage medium. This storage medium can be a computer-readable storage medium. The storage medium stores a computer program. When executed by a processor, the computer program causes the processor to perform any embodiment of the above-described permission verification method.

[0069] The storage medium can be any computer-readable storage medium capable of storing program code, such as a USB flash drive, portable hard drive, read-only memory (ROM), magnetic disk, or optical disk.

[0070] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, wireless communication software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0071] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For example, the division of each unit is merely a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0072] The steps in the method of this invention can be adjusted, merged, or reduced in order according to actual needs. The units in the device of this invention can be merged, divided, or reduced according to actual needs. Furthermore, the functional units in the various embodiments of this invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0073] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This wireless communication software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal wireless communication device, a terminal, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention.

[0074] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0075] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Since these modifications and variations fall within the scope of the claims and their equivalents, this invention also intends to include these modifications and variations.

[0076] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A permission verification method applied to an Internet of Things connection management platform, characterized in that, The method comprises the steps of: If a batch import instruction is received, the Internet of Things card number to be verified is obtained according to the batch import instruction; The Internet of Things card number to be verified is input into a first-level Bloom filter for card-level black and white list authority verification to obtain an initial verification result; If the initial verification result is a verification success, the Internet of Things card number to be verified is input into a second-level Bloom filter for group-level black and white list authority verification to obtain a target verification result; The first-level Bloom filter comprises a card-level white list and a card-level black list, and the step of inputting the Internet of Things card number to be verified into the first-level Bloom filter for card-level black and white list authority verification to obtain an initial verification result comprises the steps of: According to the preset card-level data amount and card-level misjudgment probability, the array length of the first-level Bloom filter is calculated; According to the array length of the first-level Bloom filter and the card-level data amount, the number k1 of first-level hash functions is calculated; k1 card-level hash values are obtained by performing hash calculation on the Internet of Things card number to be verified through k1 hash functions; According to the k1 card-level hash values, the card-level white list and the card-level black list, the Internet of Things card number to be verified is verified for authority to obtain an initial verification result; The second-level Bloom filter comprises a group-level white list and a group-level black list, and the step of inputting the Internet of Things card number to be verified into the second-level Bloom filter for group-level black and white list authority verification to obtain a target verification result comprises the steps of: According to the preset group-level data amount and group-level misjudgment probability, the array length of the second-level Bloom filter is calculated; According to the array length of the second-level Bloom filter and the group-level data amount, the number k2 of second-level hash functions is calculated; k2 group-level hash values are obtained by performing hash calculation on the Internet of Things card number to be verified through k2 hash functions; According to the k2 group-level hash values, the group-level white list and the group-level black list, the Internet of Things card number to be verified is verified for authority to obtain a target verification result.

2. The method of claim 1, wherein, The step of verifying the Internet of Things card number to be verified for authority according to the k1 card-level hash values, the card-level white list and the card-level black list to obtain an initial verification result comprises the steps of: The index values corresponding to the k1 card-level hash values are matched with the card-level white list one by one; If the matching is successful, the index values corresponding to the k1 card-level hash values are matched with the card-level black list one by one to obtain an initial verification result; If the matching fails, it is determined that the user does not have operation authority on the Internet of Things card corresponding to the Internet of Things card number to be verified, the card information corresponding to the Internet of Things card number to be verified is saved to the card-level black list, and the group-level black list is updated according to the group ID in the card information.

3. The method of claim 2, wherein, The step of matching the index values corresponding to the k1 card-level hash values with the card-level black list one by one to obtain an initial verification result comprises the steps of: The index values corresponding to the k1 card-level hash values are matched with the card-level blacklist one by one to obtain an initial check result; If the matching is successful, the initial check result is set as a check failure; If the matching fails, the initial check result is set as a check success.

4. The method of claim 1, wherein, The step of performing permission check on the to-be-checked IoT card number according to the k2 group-level hash values, the group-level whitelist and the group-level blacklist to obtain a target check result, comprises: The index values corresponding to the k2 group-level hash values are matched with the group-level whitelist one by one; If the matching is successful, the index values corresponding to the k2 group-level hash values are matched with the group-level blacklist one by one to obtain a target check result; If the matching fails, it is determined that the user does not have the operation permission on the IoT card corresponding to the to-be-checked IoT card number, group information corresponding to the to-be-checked IoT card number is saved to the group-level blacklist, and the card-level blacklist is updated according to the card ID in the group information.

5. The method of claim 4, wherein, The step of matching the index values corresponding to the k2 group-level hash values with the group-level blacklist one by one to obtain a target check result, comprises: The index values corresponding to the k2 group-level hash values are matched with the group-level whitelist one by one; If the matching is successful, the target check result is set as a permission check failure; If the matching fails, the target check result is set as a permission check success.

6. A permission checking device applied to an Internet of Things connection management platform, characterized in that, Comprises: The acquisition unit is used for acquiring the to-be-checked IoT card number according to the batch import instruction if the batch import instruction is received; The first permission check unit is used for inputting the to-be-checked IoT card number into a first-level Bloom filter to perform card-level whitelist and blacklist permission check to obtain an initial check result; The second permission check unit is used for inputting the to-be-checked IoT card number into a second-level Bloom filter to perform group-level whitelist and blacklist permission check to obtain a target check result if the initial check result is a check success; The first-level Bloom filter comprises a card-level whitelist and a card-level blacklist, and the first permission check unit comprises: The first calculation unit is used for calculating the array length of the first-level Bloom filter according to a preset card-level data amount and a card-level false positive probability; The second calculation unit is used for calculating the number k1 of first-level hash functions according to the array length of the first-level Bloom filter and the card-level data amount; The third calculation unit is used for performing hash calculation on the to-be-checked IoT card number through k1 hash functions to obtain k1 card-level hash values; The first permission check sub-unit is used for performing permission check on the to-be-checked IoT card number according to the k1 card-level hash values, the card-level whitelist and the card-level blacklist to obtain an initial check result; The second-level Bloom filter comprises a group-level whitelist and a group-level blacklist, and the second permission check unit comprises: A fourth computing unit is configured to calculate an array length of the second-level Bloom filter according to a preset group-level data amount and a group-level false positive probability; A fifth computing unit is configured to calculate a number k2 of second-level hash functions according to the array length of the second-level Bloom filter and the group-level data amount; A sixth computing unit is configured to perform hash calculation on the to-be-verified Internet of Things card number by the k2 hash functions to obtain k2 group-level hash values; A second permission verification subunit is configured to perform permission verification on the to-be-verified Internet of Things card number according to the k2 group-level hash values, the group-level whitelist and the group-level blacklist to obtain a target verification result.

7. A computer device, comprising: The computer device comprises a memory and a processor, the memory stores a computer program, and the processor implements the method in any one of claims 1-5 when executing the computer program.

8. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, and the computer program can implement the method in any one of claims 1-5 when executed by a processor.

Images