Iot system authentication authorization adaptation system, method and device and storage medium

Abstract

The application discloses an Internet of Things system authentication and authorization adaptation system, method and device and a storage medium. The method comprises the following steps: when a first Internet of Things system initiates a single sign-on authentication request, performing user information verification on the first Internet of Things system according to a first token; when the verification is passed, calling a first system code, and initiating a login authentication and authorization request to a second Internet of Things system according to the first system code, so that the second Internet of Things system verifies the login authentication and authorization request; receiving a token query request returned by the second Internet of Things system, and issuing a second token to the second Internet of Things system, so that the second Internet of Things system performs user information verification according to the second token; and when the verification is passed, performing resource authorization and resource content presentation according to the first system code and the second token. The application improves the security and efficiency of Internet of Things system authentication and authorization, and can be widely applied to the technical field of Internet of Things systems.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) system technology, and in particular to an IoT system authentication and authorization adaptation system, method, apparatus, and storage medium. Background Technology

[0002] The Internet of Things (IoT) system uses hardware devices or technologies such as information sensors to collect real-time data on objects or processes that need to be connected and interacted with. Through access to various network protocols, it achieves intelligent sensing, identification, and management of these objects and processes. An IoT system is a comprehensive large-scale IoT service system composed of different subsystems, including an upper-layer application display system, IoT terminal management, terminal access subsystems, and related IoT infrastructure layer systems. Due to the relatively complex business logic of different subsystems, independent service deployment is required between them to ensure system stability. Reliable identity authentication and authorization between systems are also necessary to ensure unified authentication and authorization for resource access and mutual trust across different IoT subsystems. With the continuous development of IoT, IoT subsystems are becoming increasingly complex, their functions are becoming more intricate, and the volume of IoT data is increasing. Therefore, achieving unified mutual trust and unified authentication and authorization functions across different IoT subsystems is urgently needed. The distributed deployment of IoT systems needs to meet the authentication and mutual trust requirements of different subsystems and solve problems such as repeated logins and limited authorization resources. Therefore, a reusable and easily adaptable method is required to achieve effective identity authentication and authorized access between different systems, ensuring the complete integration of various IoT services.

[0003] Existing methods primarily focus on multi-user system compatibility. When a user system already exists, a new user system or model is added to the existing business logic to accommodate new user characteristics, enabling multiple users within the same business system to use a single business model. This approach emphasizes user management, registration, and synchronization for various user types, without addressing authorization and authentication adaptation without modifying different systems. Current authentication and authorization adaptation methods are often limited to single-system authentication and authorization methods. A client-to-server user authentication and authorization method is designed, generating a signature from user and application information, which can then be used to directly obtain an access identifier from the server. This method suffers from insufficient security and low efficiency in authentication and authorization across multiple IoT systems. Furthermore, inconsistencies in standards between multiple IoT systems often lead to difficulties in authentication and authorization adaptation. Summary of the Invention

[0004] The purpose of this invention is to at least partially solve one of the technical problems existing in the prior art.

[0005] Therefore, one objective of this invention is to provide a secure and efficient IoT system authentication and authorization adaptation system.

[0006] Another objective of this invention is to provide an IoT system authentication and authorization adaptation method.

[0007] To achieve the above-mentioned technical objectives, the technical solutions adopted in the embodiments of the present invention include:

[0008] In a first aspect, embodiments of the present invention provide an Internet of Things (IoT) system authentication and authorization adaptation system, comprising:

[0009] The system configuration module is used to configure pluggable information for single sign-on authentication requests of the first IoT system and the second IoT system.

[0010] The user synchronization module is used to synchronize the second authorized user information of the second IoT system to the first IoT system;

[0011] The token adaptation module is used to verify the user information of the first IoT system based on the first token of the first IoT system when the first IoT system initiates a single sign-on authentication request. When the verification is successful, it calls the first system code that can access the second IoT system and sends a login authentication authorization request to the second IoT system based on the first system code, so that the second IoT system can verify the login authentication authorization request.

[0012] The token issuance module is used to receive the token query request returned by the second IoT system and issue a second token to the second IoT system, so that the second IoT system can verify user information based on the second token. When the verification is successful, the second IoT system can authorize resources and present resource content based on the first system code and the second token.

[0013] Furthermore, in one embodiment of the present invention, the system configuration module includes:

[0014] The interface address configuration unit is used to configure the single sign-on interface addresses of the first IoT system and the second IoT system.

[0015] A system coding configuration unit is used to configure system codes that can access the first IoT system and the second IoT system;

[0016] A key configuration unit is used to configure the verification keys for the first IoT system and the second IoT system;

[0017] The whitelist configuration unit is used to configure the user whitelists of the first IoT system and the second IoT system.

[0018] Furthermore, in one embodiment of the present invention, the user synchronization module includes:

[0019] The user information query unit is used to query the second authorized user information of the second Internet of Things system.

[0020] The user information synchronization unit is used to synchronize the second authorized user information to the first Internet of Things system.

[0021] Furthermore, in one embodiment of the present invention, the token adaptation module includes:

[0022] The first receiving unit is configured to receive the single sign-on authentication request and the first token sent by the first Internet of Things system, wherein the single sign-on authentication request includes login user information;

[0023] The first acquisition unit is used to acquire the first authorized user information of the first Internet of Things system based on the first token;

[0024] The first verification unit is used to verify the login user information based on the first authorized user information;

[0025] The system code invocation module is used to invoke a first system code that can access the second IoT system, and to initiate the login authentication authorization request to the second IoT system according to the first system code, so that the second IoT system verifies the validity of the login authentication authorization request according to the first system code and the verification key.

[0026] Furthermore, in one embodiment of the present invention, the token issuance module includes:

[0027] The second receiving unit is used to receive the token query request returned by the second Internet of Things system;

[0028] The token conversion unit is used to convert the first token into the second token that can be used normally in the second Internet of Things system;

[0029] The second acquisition unit is used to send the second token to the second Internet of Things system, so that the second Internet of Things system returns the second authorized user information based on the second token;

[0030] The second verification unit is used to verify the login user information based on the second authorized user information;

[0031] The resource authorization unit is used to return the verification result to the second IoT system, so that the second IoT system can authorize resources and present resource content according to the first system code and the second token after the verification is successful.

[0032] Furthermore, in one embodiment of the present invention, the IoT system authentication and authorization adaptation system further includes:

[0033] The session persistence module is used to control the validity period of the first token and the second token, and to close the session between the first IoT system and the second IoT system when the first token or the second token expires.

[0034] Secondly, embodiments of the present invention provide an IoT system authentication and authorization adaptation method, comprising the following steps:

[0035] Configure pluggable information for single sign-on authentication requests for the first and second IoT systems;

[0036] Synchronize the second authorized user information of the second IoT system to the first IoT system;

[0037] When the first IoT system initiates a single sign-on authentication request, it verifies the user information of the first IoT system based on the first token of the first IoT system. When the verification is successful, it calls the first system code that can access the second IoT system and initiates a login authentication authorization request to the second IoT system based on the first system code, so that the second IoT system verifies the login authentication authorization request.

[0038] The system receives a token query request returned by the second IoT system and issues a second token to the second IoT system, enabling the second IoT system to verify user information based on the second token. When the verification is successful, the system authorizes resources and presents resource content based on the first system code and the second token.

[0039] Furthermore, in one embodiment of the present invention, the IoT system authentication and authorization adaptation method further includes the following steps:

[0040] The validity period of the first token and the second token is controlled, and the session between the first IoT system and the second IoT system is closed when the first token or the second token expires.

[0041] Thirdly, embodiments of the present invention provide an Internet of Things (IoT) system authentication and authorization adapter, comprising:

[0042] At least one processor;

[0043] At least one memory for storing at least one program;

[0044] When the at least one program is executed by the at least one processor, the at least one processor implements the above-described IoT system authentication and authorization adaptation method.

[0045] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing a processor-executable program, which, when executed by a processor, is used to perform the above-described IoT system authentication and authorization adaptation method.

[0046] The advantages and beneficial effects of the present invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention:

[0047] This invention, through its system configuration module, user synchronization module, token adaptation module, and token issuance module, addresses the challenge of compatibility in authentication and authorization among multiple IoT systems due to differing standards, achieving single sign-on authentication across different IoT systems. The user synchronization module maintains consistency in user identity data across different IoT systems, enabling independent authentication of user identities and providing a foundation for user authorization. The token adaptation and issuance modules prevent different IoT systems from failing to recognize each other's custom tokens, facilitating token compatibility and conversion between systems, thus improving both the security and efficiency of IoT system authentication and authorization. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the embodiments of the present invention are described below. It should be understood that the drawings described below are only for the convenience of clearly describing some embodiments of the technical solutions of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 A flowchart illustrating the steps of an IoT system authentication and authorization adaptation method provided in this embodiment of the invention;

[0050] Figure 2 A structural block diagram of an IoT system authentication and authorization adaptation system provided in an embodiment of the present invention;

[0051] Figure 3This is a schematic diagram illustrating the working principle of an IoT system authentication and authorization adaptation system provided in an embodiment of the present invention.

[0052] Figure 4 This is a structural block diagram of an IoT system authentication and authorization adapter provided in an embodiment of the present invention. Detailed Implementation

[0053] The embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention. The step numbers in the following embodiments are set only for ease of explanation, and there is no limitation on the order between the steps. The execution order of each step in the embodiments can be adaptively adjusted according to the understanding of those skilled in the art.

[0054] In the description of this invention, "multiple" means two or more. The use of "first" and "second" is for distinguishing technical features only and should not be construed as indicating or implying relative importance, or implicitly indicating the number of indicated technical features, or the order of the indicated technical features. Furthermore, unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art.

[0055] Reference Figure 2 This invention provides an IoT system authentication and authorization adaptation system, comprising:

[0056] The system configuration module is used to configure pluggable information for single sign-on authentication requests of the first IoT system and the second IoT system.

[0057] The user synchronization module is used to synchronize the second authorized user information of the second Internet of Things system to the first Internet of Things system.

[0058] The token adaptation module is used to verify the user information of the first IoT system based on the first token of the first IoT system when the first IoT system initiates a single sign-on authentication request. When the verification is successful, the first system code that can access the second IoT system is called, and a login authentication authorization request is sent to the second IoT system based on the first system code, so that the second IoT system can verify the login authentication authorization request.

[0059] The token issuance module is used to receive the token query request returned by the second IoT system and issue a second token to the second IoT system, so that the second IoT system can verify user information based on the second token. When the verification is successful, the system can authorize resources and present resource content based on the first system code and the second token.

[0060] Specifically, this invention is used to implement authentication and authorization between multiple IoT systems. Taking single sign-on from system A to system B as an example, it requires authentication and authorization for both systems A and B. However, since the authentication methods of systems A and B are not consistent, it can cause problems with the compatibility of authentication and authorization when multiple systems are connected. This invention enables single sign-on authentication and authorization from system A to system B, solving the problem of incompatibility between authentication and authorization between multiple IoT systems due to different standards. This allows system A to directly access authorized resources of system B without secondary login authentication. This invention is generally applicable to scenarios where multiple systems converge to a single system, and it also allows for pluggable configuration to implement authentication and authorization for different system standards for different system authentication and authorization scenarios.

[0061] The user synchronization module addresses the inconsistency of user information between different systems, enabling effective user authentication when logging in from system A to system B. The module synchronizes authorized user information from system B to system A, maintaining data consistency through a user information synchronization interface, ensuring that user information from system B can be queried and authenticated within system A.

[0062] When System A initiates single sign-on authentication for System B, System A, acting as the server, automatically generates a first token. This first token is carried by the token adaptation module for access authentication. The token adaptation module interfaces with System A, using System A's first token to verify the user information and confirm the user's identity within System A. Simultaneously, the token adaptation module interfaces with System B, pre-setting a first system code in System B. System B pre-authorizes resources for the token adaptation module, allocating accessible resources to ensure proper authorization functionality. Based on the token adaptation module, an IoT system authentication and authorization credential adaptation system is implemented, facilitating interoperability between different IoT systems. This credential enables user authentication and resource authorization across different systems, resolving the issue of incompatibility between custom tokens and achieving credential adaptation and conversion between different systems.

[0063] Since System A lacks a corresponding authorization code identifier in System B, System A's first token cannot be used correctly in System B. After the token adaptation module initiates a login authentication and authorization request for System B with the pre-set System B's first system code, System B verifies the validity of the request based on the first system code and a key. Upon successful verification, System B initiates a token query request with the first system code. Upon receiving the request, the token issuing module issues a valid second token to System B. This second token serves as the interface call credential between the IoT system authentication and authorization adaptation system and System B. Simultaneously, the system B application is invoked to pass the second token to System B. System B then requests user information authentication from the token issuing module based on the second token. The token issuing module verifies the logged-in user's identity. Once the user identity verification is successful, a response is returned to System B. System B then authorizes resources and presents resource content based on the first system code and the token issuing module's information.

[0064] It can be recognized that the embodiments of the present invention can solve the problem of difficult adaptation of authentication and authorization between multiple IoT systems due to different standards by using a system configuration module, a user synchronization module, a token adaptation module, and a token issuance module, thereby realizing single sign-on authentication between different IoT systems. The user synchronization module can maintain the consistency of user identity data between different IoT systems, realize independent authentication of user identities in different IoT systems, and provide a foundation for user identity authorization in different IoT systems. The token adaptation module and the token issuance module can avoid the inability of different IoT systems to recognize each other's custom tokens, realize the adaptation and conversion of tokens between different IoT systems, improve the security and efficiency of IoT system authentication and authorization.

[0065] As a further optional implementation, the system configuration module includes:

[0066] The interface address configuration unit is used to configure the single sign-on interface address of the first IoT system and the second IoT system.

[0067] The system coding configuration unit is used to configure the system coding that can access the first IoT system and the second IoT system.

[0068] The key configuration unit is used to configure the verification keys for the first IoT system and the second IoT system.

[0069] The whitelist configuration unit is used to configure the user whitelists for the first IoT system and the second IoT system.

[0070] Specifically, this embodiment of the invention designs a pluggable adapter for multiple system interfaces for different system authentication and authorization scenarios. The system configuration module configures the interface address of the corresponding IoT system, the encoding and key of different systems, and the whitelist of information synchronization interfaces of different systems, thereby ensuring that the interface addresses of different IoT systems are pluggable and adaptable.

[0071] As a further optional implementation, the user synchronization module includes:

[0072] The user information query unit is used to query the second authorized user information of the second Internet of Things system.

[0073] The user information synchronization unit is used to synchronize the second authorized user information to the first Internet of Things system.

[0074] Specifically, user information may be inconsistent between different systems, which may prevent effective user authentication when logging in from system A to system B. The user synchronization module is used to synchronize authorized user information from system B to system A. It maintains the consistency of user information data through the user information synchronization interface, ensuring that user information from system B can be queried and authenticated in system A.

[0075] As an optional implementation, the token adaptation module includes:

[0076] The first receiving unit is used to receive a single sign-on authentication request and a first token sent by the first Internet of Things system. The single sign-on authentication request includes login user information.

[0077] The first acquisition unit is used to acquire the first authorized user information of the first Internet of Things system based on the first token.

[0078] The first verification unit is used to verify the login user information based on the first authorized user information;

[0079] The system code invocation module is used to invoke the first system code that can access the second IoT system, and to initiate a login authentication and authorization request to the second IoT system based on the first system code, so that the second IoT system can verify the validity of the login authentication and authorization request based on the first system code and the verification key.

[0080] Specifically, when System A uses a first token to perform single sign-on on System B, System B needs to perform token adaptation because it cannot identify the source and validity of the first token. When System A initiates single sign-on on System B, System A, as the server, automatically generates the first token and sends it to the token adaptation module for access authentication. The token adaptation module interfaces with System A and verifies the user information of System A based on System A's first token, checking whether the user's identity exists in System A. Simultaneously, the token adaptation module interfaces with System B, pre-setting a first system code in System B. System B pre-authorizes resources for the token adaptation module, allocating accessible resources to ensure proper authorization functionality. When the token adaptation module successfully verifies the user information in System A, the authentication and authorization request for System A is approved. It then calls the second system code, which allows access to System B, to initiate a login authentication and authorization request for System B.

[0081] As an optional implementation, the token issuance module includes:

[0082] The second receiving unit is used to receive the token query request returned by the second Internet of Things system;

[0083] The token conversion unit is used to convert the first token into a second token that can be used normally in the second Internet of Things system.

[0084] The second acquisition unit is used to send the second token to the second Internet of Things system, so that the second Internet of Things system returns the second authorized user information based on the second token;

[0085] The second verification unit is used to verify the logged-in user information based on the second authorized user information;

[0086] The resource authorization unit is used to return the verification result to the second IoT system, so that the second IoT system can authorize resources and present resource content according to the first system code and the second token after the verification is successful.

[0087] Specifically, because System A lacks a corresponding authorization code identifier in System B, System A's first token cannot be used normally in System B. The token adaptation module, similar to a token converter, transforms the first token, which System B cannot recognize, into a second token that System B can recognize. After the token adaptation module initiates a login authentication and authorization request for System B with a pre-set first system code, System B verifies the validity of the request based on the first system code and a key. Upon successful verification, System B initiates a token query request with the first system code. Upon receiving the request, the token issuing module issues a valid second token to System B. This second token serves as the interface call credential between the IoT system authentication and authorization adaptation system and System B. Simultaneously, the system B application is invoked to transmit the second token to System B. System B requests user information authentication from the token issuing module based on the second token, and the token issuing module verifies the logged-in user's identity. Once the user identity verification is successful, a response is returned to System B, which then authorizes resources and presents resource content based on the first system code and the token issuing module's information.

[0088] As an optional implementation, the IoT system authentication and authorization adaptation system further includes:

[0089] The session persistence module is used to control the validity period of the first token and the second token, and to close the session between the first IoT system and the second IoT system when the first token or the second token expires.

[0090] Specifically, when System A logs into System B, session state maintenance is required to ensure that the session expires. The session persistence module controls the validity of the token, guaranteeing its validity within a session. The session begins after successful authentication in System A and ends when the token expires. The second token issued by the session IoT system authentication and authorization adapter system has the same validity period as System A's first token, ensuring that System A's first token can be used normally within its validity period. The session persistence module also maintains the user authentication status of System B, ensuring the timeliness of single sign-on requests initiated by System A and user authentication requests initiated by System B through the adapter module.

[0091] The system structure of the embodiments of the present invention has been described above. The data interaction process of the embodiments of the present invention will be further explained below with reference to a specific embodiment.

[0092] like Figure 3As shown, the system configuration module pre-configures the data for authorization and authentication requests initiated by systems A and B based on the pluggable information of the identity authentication request. The pluggable multi-system interface enables authentication and authorization for different systems. When system A initiates a single-point authentication authorization request to system B, the user synchronization module synchronizes the authorized user information of system B to system A, maintaining consistency of user information data through the user information synchronization interface. The token adaptation module interfaces with system A, verifying the user information of system A based on system A's token1, verifying the logged-in user's identity, and simultaneously invoking the code that can access system B to initiate a login authentication and authorization request to system B. The token issuance module interfaces with system B's login authentication and authorization request based on the code, and simultaneously issues a valid token2 to system B based on the request result. System B verifies the user's identity based on the token authentication request from the token issuance module. When the user's identity verification is successful, it returns a response to system B, which then authorizes resources and presents resource content based on the code and token2. The session persistence module maintains the user authentication status of both system A and system B, ensuring the timeliness of single sign-on requests initiated by system A and user authentication requests initiated by system B through the adaptation module.

[0093] It is understood that the embodiments of the present invention can solve the problem of incompatibility between authentication and authorization systems due to different standards by using a system configuration module, a user synchronization module, a token adaptation module, and a token issuance module, thereby achieving single sign-on authentication between different IoT systems. The user synchronization module can maintain the consistency of user identity data between different IoT systems, enabling independent authentication of user identities in different IoT systems and providing a foundation for user identity authorization in different IoT systems. The token adaptation module and the token issuance module can prevent different IoT systems from being unable to recognize each other's custom tokens, enabling token adaptation and conversion between different IoT systems, improving the security and efficiency of IoT system authentication and authorization.

[0094] Reference Figure 1 This invention provides an IoT system authentication and authorization adaptation method, comprising the following steps:

[0095] S101. Configure pluggable information for single sign-on authentication requests of the first IoT system and the second IoT system;

[0096] S102. Synchronize the second authorized user information of the second Internet of Things system to the first Internet of Things system;

[0097] S103. When the first IoT system initiates a single sign-on authentication request, the user information of the first IoT system is verified based on the first token of the first IoT system. When the verification is successful, the first system code that can access the second IoT system is called, and a login authentication authorization request is initiated to the second IoT system based on the first system code, so that the second IoT system verifies the login authentication authorization request.

[0098] S104. Receive the token query request returned by the second IoT system and issue the second token to the second IoT system, so that the second IoT system can verify user information based on the second token. When the verification is successful, resource authorization and resource content presentation are performed based on the first system code and the second token.

[0099] As an optional implementation, the IoT system authentication and authorization adaptation method further includes the following steps:

[0100] The validity period of the first token and the second token is controlled, and the session between the first IoT system and the second IoT system is closed when the first token or the second token expires.

[0101] The content of the above system embodiments is applicable to this method embodiment. The specific functions implemented in this method embodiment are the same as those in the above system embodiments, and the beneficial effects achieved are also the same as those achieved in the above system embodiments.

[0102] Reference Figure 4 This invention provides an IoT system authentication and authorization adapter, comprising:

[0103] At least one processor;

[0104] At least one memory for storing at least one program;

[0105] When the above-mentioned at least one program is executed by the above-mentioned at least one processor, the above-mentioned at least one processor implements the above-mentioned IoT system authentication and authorization adaptation method.

[0106] The content of the above method embodiments is applicable to the device embodiments. The specific functions implemented by the device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0107] This invention also provides a computer-readable storage medium storing a processor-executable program that, when executed by a processor, performs the aforementioned IoT system authentication and authorization adaptation method.

[0108] A computer-readable storage medium according to an embodiment of the present invention can execute an IoT system authentication and authorization adaptation method provided in an embodiment of the present invention, and can execute any combination of implementation steps of the method embodiment, and has the corresponding functions and beneficial effects of the method.

[0109] This invention also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, causing the computer device to perform... Figure 1 The method shown.

[0110] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the aforementioned blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this invention are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is changed and sub-operations described as part of a larger operation are executed independently.

[0111] Furthermore, although the invention has been described in the context of functional modules, it should be understood that, unless otherwise stated, one or more of the aforementioned functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the invention. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of conventional skill of an engineer. Therefore, those skilled in the art can implement the invention as set forth in the claims using ordinary techniques without excessive experimentation. It is also understood that the specific concepts disclosed are merely illustrative and not intended to limit the scope of the invention, which is determined by the full scope of the appended claims and their equivalents.

[0112] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0113] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0114] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the aforementioned program can be printed, because the aforementioned program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or, if necessary, processing in other suitable ways, and then stored in computer memory.

[0115] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0116] In the foregoing description of this specification, references to terms such as "one embodiment," "another embodiment," or "some embodiments" indicate that a specific feature, structure, material, or characteristic described in connection with an embodiment or example is included in at least one embodiment or example of the present invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0117] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

[0118] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of this application.

Claims

1. An Internet of Things (IoT) system authentication and authorization adaptation system, characterized in that, include: The system configuration module is used to configure pluggable information for single sign-on authentication requests of the first IoT system and the second IoT system. The user synchronization module is used to synchronize the second authorized user information of the second IoT system to the first IoT system; The token adaptation module is used to verify the user information of the first IoT system based on the first token of the first IoT system when the first IoT system initiates a single sign-on authentication request. When the verification is successful, it calls the first system code that can access the second IoT system and initiates a login authentication authorization request to the second IoT system based on the first system code, so that the second IoT system can verify the login authentication authorization request. The token issuance module is used to receive the token query request returned by the second IoT system and issue a second token to the second IoT system, so that the second IoT system can verify user information based on the second token. When the verification is successful, the system can authorize resources and present resource content based on the first system code and the second token. The pluggable information includes the single sign-on interface address, system code, verification key, and user whitelist of the first IoT system and the second IoT system.

2. The IoT system authentication and authorization adaptation system according to claim 1, characterized in that, The system configuration module includes: The interface address configuration unit is used to configure the single sign-on interface addresses of the first IoT system and the second IoT system. A system coding configuration unit is used to configure system codes that can access the first IoT system and the second IoT system; A key configuration unit is used to configure the verification keys for the first IoT system and the second IoT system; The whitelist configuration unit is used to configure the user whitelists of the first IoT system and the second IoT system.

3. The IoT system authentication and authorization adaptation system according to claim 1, characterized in that, The user synchronization module includes: The user information query unit is used to query the second authorized user information of the second Internet of Things system. The user information synchronization unit is used to synchronize the second authorized user information to the first Internet of Things system.

4. The IoT system authentication and authorization adaptation system according to claim 1, characterized in that, The token adaptation module includes: The first receiving unit is configured to receive the single sign-on authentication request and the first token sent by the first Internet of Things system, wherein the single sign-on authentication request includes login user information; The first acquisition unit is used to acquire the first authorized user information of the first Internet of Things system based on the first token; The first verification unit is used to verify the login user information based on the first authorized user information; The system code invocation module is used to invoke a first system code that can access the second IoT system, and to initiate the login authentication authorization request to the second IoT system according to the first system code, so that the second IoT system verifies the validity of the login authentication authorization request according to the first system code and the verification key.

5. The IoT system authentication and authorization adaptation system according to claim 4, characterized in that, The token issuance module includes: The second receiving unit is used to receive the token query request returned by the second Internet of Things system; The token conversion unit is used to convert the first token into the second token that can be used normally in the second Internet of Things system; The second acquisition unit is used to send the second token to the second Internet of Things system, so that the second Internet of Things system returns the second authorized user information based on the second token; The second verification unit is used to verify the login user information based on the second authorized user information; The resource authorization unit is used to return the verification result to the second IoT system, so that the second IoT system can authorize resources and present resource content according to the first system code and the second token after the verification is successful.

6. The IoT system authentication and authorization adaptation system according to claim 1, characterized in that, The IoT system authentication and authorization adaptation system also includes: The session persistence module is used to control the validity period of the first token and the second token, and to close the session between the first IoT system and the second IoT system when the first token or the second token expires.

7. A method for authentication and authorization adaptation in an Internet of Things (IoT) system, characterized in that, Includes the following steps: Configure pluggable information for single sign-on authentication requests for the first and second IoT systems; Synchronize the second authorized user information of the second IoT system to the first IoT system; When the first IoT system initiates a single sign-on authentication request, it verifies the user information of the first IoT system based on the first token of the first IoT system. When the verification is successful, it calls the first system code that can access the second IoT system and initiates a login authentication authorization request to the second IoT system based on the first system code, so that the second IoT system verifies the login authentication authorization request. The system receives a token query request returned by the second IoT system and issues a second token to the second IoT system, enabling the second IoT system to verify user information based on the second token. When the verification is successful, the system authorizes resources and presents resource content based on the first system code and the second token. The pluggable information includes the single sign-on interface address, system code, verification key, and user whitelist of the first IoT system and the second IoT system.

8. The IoT system authentication and authorization adaptation method according to claim 7, characterized in that, The IoT system authentication and authorization adaptation method also includes the following steps: The validity period of the first token and the second token is controlled, and the session between the first IoT system and the second IoT system is closed when the first token or the second token expires.

9. An Internet of Things (IoT) system authentication and authorization adapter, characterized in that, include: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements an IoT system authentication and authorization adaptation method as described in claim 7 or 8.

10. A computer-readable storage medium storing a processor-executable program, characterized in that, The processor-executable program, when executed by the processor, is used to perform an IoT system authentication and authorization adaptation method as described in claim 7 or 8.

Images