Processing method of IPv6 access authentication and authorization control system for smart home appliances

Abstract

The present invention provides a processing method for an intelligent home appliance IPv6 access authentication and authorization control system, comprising: starting home appliances and terminal devices, connecting the terminal devices to a cloud platform; the terminal devices connecting the home appliances, and the terminal devices sending gateway information to the home appliances; the home appliances in a network distribution state connecting to a gateway based on the gateway information, connecting the home appliances to a cloud platform, the home appliances obtaining a public key of the terminal device from the cloud platform, and the home appliances sending network distribution results to the terminal devices; the cloud platform binding the terminal devices and the home appliances, the cloud platform generating an authorization control token of the home appliances, the cloud platform sending the public key and the authorization control token to the home appliances to the terminal devices, the terminal devices sending the authorization control token to the home appliances, and the home appliances binding the terminal devices based on the authorization control token. End-to-end authentication and authorization control between home appliances and terminal devices can be achieved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a processing method for an intelligent home appliance IPv6 access authentication and authorization control system. Background Art

[0002] Digital home appliances refer to home appliances that use digital technology to achieve intelligent, automated, and networked functions. These products can be remotely controlled through the Internet or other digital communication methods to improve the quality of life and convenience of users. The application of digital technology has brought new opportunities and challenges to the home appliance industry, providing consumers with a more intelligent, efficient, energy-saving, and safer home life experience.

[0003] The digital home appliance industry is an emerging industry with broad development prospects, involving many fields such as home kitchen and bathroom, air conditioning, refrigerators and washing machines, small appliances, large appliances, etc. Consumers can achieve remote control through mobile phone APP (Application) to achieve interconnection between home appliances and people. In an interconnected environment, how to ensure the authorization control of devices is the priority of the home appliance cloud platform. The supplier cloud platform will provide access authentication and authorization services to identify and authorize access devices. At present, these authentication and authorization technologies cannot fully support IPv6 devices. The mainstream technology still needs to control home appliances through the platform, and does not support end-to-end direct authentication and authorization control between IPv6 devices. Summary of the invention

[0004] In view of this, the object of the present invention is to provide a processing method for a smart home appliance IPv6 access authentication and authorization control system to achieve end-to-end authentication and authorization control between home appliances and terminal devices.

[0005] In the first aspect, an embodiment of the present invention provides a processing method for an intelligent home appliance IPv6 access authentication and authorization control system, the method comprising: starting the home appliance device, the home appliance device entering a network distribution state; turning on the terminal device, the terminal device performing two-way authentication on the authentication and authorization control system of the cloud platform, and connecting the terminal device to the cloud platform; the terminal device connects the home appliance device, and the terminal device sends gateway information to the home appliance device; the home appliance device in the network distribution state connects to the gateway based on the gateway information, the home appliance device performs two-way authentication on the authentication and authorization control system, connects the home appliance device to the cloud platform, the home appliance device obtains the public key of the terminal device from the cloud platform, and the home appliance device sends the network distribution result to the terminal device; the terminal device performs two-way authentication on the authentication and authorization control system in response to the network distribution result, the cloud platform binds the terminal device and the home appliance device, the cloud platform generates an authorization control token for the home appliance device, the cloud platform sends the public key and authorization control token to the home appliance device to the terminal device, the terminal device sends the authorization control token to the home appliance device, and the home appliance device binds the terminal device based on the authorization control token.

[0006] In an optional embodiment of the present application, the method further includes: registering the home appliance on a cloud platform, saving a public key of the cloud platform and a private key of the home appliance on the home appliance, and saving a private key of the cloud platform and a public key of the home appliance on the cloud platform; registering a terminal device on the cloud platform, saving a public key of the cloud platform and a private key of the terminal device on the terminal device, and saving a public key of the terminal device on the cloud platform.

[0007] In an optional embodiment of the present application, after the above-mentioned home appliance is bound to the terminal device based on the authorization control token, the method further includes: the terminal device controls the home appliance based on the authorization control token.

[0008] In an optional embodiment of the present application, the above-mentioned terminal device controls the home appliance based on the authorization control token, including: the terminal device performs two-way authentication on the home appliance to determine the session key, the terminal device encrypts the control message carrying the authorization control token based on the session key and the private key of the terminal device, and the terminal device sends the control message to the home appliance; the home appliance performs a first check on the control message based on the session key and the public key of the terminal device, and the home appliance performs a second check on the control message based on the authorization control token; if both the first check and the second check are passed, the home appliance executes the operation corresponding to the control message.

[0009] In an optional embodiment of the present application, the above method also includes: the terminal device unbinds the home appliance, the terminal device sends an unbinding instruction to the cloud platform and the home appliance; the cloud platform unbinds the terminal device and the home appliance based on the unbinding instruction; the home appliance unbinds the terminal device based on the unbinding instruction and deletes the authorization control token.

[0010] In an optional embodiment of the present application, the above-mentioned sender performs two-way authentication on the receiving end, including: the sender encrypts its own attribute information based on the public key of the receiving end to obtain a ciphertext, the sender signs its own attribute information based on the private key of the sender, and the sender sends the ciphertext and the signature as a message to the receiving end; the receiving end decrypts the message based on the private key of the receiving end to obtain the public key of the sender, if the public key of the sender pre-stored in the receiving end and the public key of the sender obtained by decryption by the receiving end are the same, the receiving end verification is completed; the receiving end signs its own attribute information based on the private key of the receiving end, the receiving end encrypts its own attribute information based on the public key of the sender to obtain a ciphertext, and the receiving end sends the ciphertext and the signature as a message to the receiving end; the sending end decrypts the message based on the private key of the sending end to obtain the public key of the receiving end, if the public key of the receiving end pre-stored in the sending end and the public key of the receiving end obtained by decryption by the sending end are the same, the sending end verification is completed; if both the receiving end verification and the sending end verification are completed, it is determined that the sender has completed the two-way authentication from the receiving end to the receiving end.

[0011] In an optional embodiment of the present application, after the above-mentioned determination that the sender has completed the two-way authentication with the receiver, the method also includes: the sender generates a session key based on its own attribute information and random number calculation, the sender encrypts and signs the session key and sends it to the receiver; the receiver decrypts the encrypted and signed session key to obtain the session key; the sender and the receiver conduct a conversation based on the session key.

[0012] In an optional embodiment of the present application, after the above-mentioned sender and receiver communicate based on the session key, the method also includes: the session key becomes invalid after the session ends or expires; the sender re-performs two-way authentication to the receiver.

[0013] In an optional embodiment of the present application, the above-mentioned self-attribute information includes at least one of the following: a unique ID, a MAC address, an IPv6 address, a product ID, a category ID or a version number.

[0014] In a second aspect, an embodiment of the present invention further provides a processing device for an intelligent home appliance IPv6 access authentication and authorization control system, the device comprising: a home appliance device startup module, used to start the home appliance device, and the home appliance device enters a network distribution state; a terminal device access cloud platform module, used to turn on the terminal device, and the terminal device performs two-way authentication on the authentication and authorization control system of the cloud platform, and connects the terminal device to the cloud platform; a terminal device sends a gateway information module, used for the terminal device to connect the home appliance device, and the terminal device sends the gateway information to the home appliance device; a home appliance device access cloud platform module, used for the home appliance device in the network distribution state to connect to the gateway based on the gateway information, and the home appliance device The home appliance performs two-way authentication with the authentication and authorization control system, connects the home appliance to the cloud platform, the home appliance obtains the public key of the terminal device from the cloud platform, and the home appliance sends the network configuration result to the terminal device; the home appliance binds the terminal device to the terminal device module, which is used for the terminal device to respond to the network configuration result and perform two-way authentication with the authentication and authorization control system, the cloud platform binds the terminal device and the home appliance, the cloud platform generates an authorization control token for the home appliance, the cloud platform sends the public key and authorization control token to the home appliance to the terminal device, the terminal device sends the authorization control token to the home appliance, and the home appliance binds the terminal device based on the authorization control token.

[0015] The embodiments of the present invention bring the following beneficial effects:

[0016] The embodiment of the present invention provides a processing method for intelligent home appliance IPv6 access authentication and authorization control system, which comprises the following steps: starting the home appliance, and the home appliance enters a network distribution state; turning on the terminal device, and the terminal device performs two-way authentication on the authentication and authorization control system of a cloud platform, and connects the terminal device to the cloud platform; the terminal device connects the home appliance, and the terminal device sends gateway information to the home appliance; the home appliance in the network distribution state connects to the gateway based on the gateway information, and the home appliance performs two-way authentication on the authentication and authorization control system, and connects the home appliance to the cloud platform, and the home appliance obtains the public key of the terminal device from the cloud platform, and the home appliance sends the network distribution result to the terminal device; the terminal device performs two-way authentication on the authentication and authorization control system in response to the network distribution result, and the cloud platform binds the terminal device and the home appliance, and the cloud platform generates an authorization control token for the home appliance, and the cloud platform sends the public key and authorization control token to the home appliance to the terminal device, and the terminal device sends the authorization control token to the home appliance, and the home appliance binds the terminal device based on the authorization control token. This method can achieve end-to-end authentication and authorization control between home appliances and terminal devices, and provides standardized methods and processes to ensure the security of IPv6 home appliances accessing the IPv6 network.

[0017] Other features and advantages of the present disclosure will be set forth in the following description, or some features and advantages may be inferred or unambiguously determined from the description, or may be learned by implementing the above-mentioned technology of the present disclosure.

[0018] In order to make the above-mentioned objectives, features and advantages of the present disclosure more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 A flowchart of a processing method for a smart home appliance IPv6 access authentication and authorization control system provided by an embodiment of the present invention;

[0021] Figure 2 A schematic diagram of a network structure of a household appliance, a terminal device and a cloud platform provided in an embodiment of the present invention;

[0022] Figure 3 A flowchart of another method for processing an intelligent home appliance IPv6 access authentication and authorization control system provided by an embodiment of the present invention;

[0023] Figure 4 A schematic diagram of an access authentication and authorization control process of an IPv6 home appliance in an IPv6 network environment provided by an embodiment of the present invention;

[0024] Figure 5 A schematic diagram of an access authentication and authorization control process of an IPv6 control terminal in an IPv6 network environment provided by an embodiment of the present invention;

[0025] Figure 6 A schematic diagram of a control process between an IPv6 control terminal and an IPv6 home appliance provided by an embodiment of the present invention;

[0026] Figure 7 A schematic diagram of the structure of a processing device for a smart home appliance IPv6 access authentication and authorization control system provided by an embodiment of the present invention;

[0027] Figure 8 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] Digital home appliances refer to home appliances that use digital technology to achieve intelligent, automated, and networked functions. These products can be remotely controlled through the Internet or other digital communication methods to improve the quality of life and convenience of users. The application of digital technology has brought new opportunities and challenges to the home appliance industry, providing consumers with a more intelligent, efficient, energy-saving, and safer home life experience.

[0030] At present, the digital home appliance industry is an emerging industry with broad development prospects, involving many fields such as home kitchen and bathroom, air conditioning, refrigerators and washing machines, small appliances, large appliances, etc. Consumers can achieve remote control through mobile phone APPs and realize the interconnection between home appliances and people. In an interconnected environment, how to ensure the authorization control of devices is the priority of the home appliance cloud platform. The supplier cloud platform will provide access authentication and authorization services to identify and authorize access devices. At present, these authentication and authorization technologies cannot fully support IPv6 devices. The mainstream technology still needs to control home appliances through the platform, and does not support end-to-end direct authentication and authorization control between IPv6 devices.

[0031] Based on this, the embodiment of the present invention provides a processing method for a smart home appliance IPv6 access authentication and authorization control system, and specifically provides a method for a smart home appliance IPv6 access authentication and authorization control system. This embodiment specifically involves IPv6 terminal equipment, IPv6 home appliances, IPv6 access authentication and authorization control systems, processes for accessing terminal equipment and home appliances based on an IPv6 network environment to a digital home appliance cloud platform, and security control methods between terminals and devices in an IPv6 network environment. End-to-end authentication and authorization control can be achieved between home appliances and terminal equipment, and standardized methods and processes are provided to ensure the security of IPv6 home appliances accessing an IPv6 network.

[0032] To facilitate understanding of this embodiment, a processing method for a smart home appliance IPv6 access authentication and authorization control system disclosed in an embodiment of the present invention is first introduced in detail.

[0033] Embodiment 1:

[0034] The embodiment of the present invention provides a processing method for a smart home appliance IPv6 access authentication and authorization control system, see Figure 1The flowchart of a processing method of a smart home appliance IPv6 access authentication and authorization control system is shown, and the processing method of the smart home appliance IPv6 access authentication and authorization control system includes the following steps:

[0035] Step S102, start the home appliance, and the home appliance enters the network distribution state.

[0036] The method provided in this embodiment can be applied to an IPv6 network environment and can be deployed on a cloud platform and physical devices. The cloud platform, terminal devices and home appliances involved can all support the IPv6 protocol stack.

[0037] See also Figure 2 A schematic diagram of the network structure of household appliances, terminal devices and cloud platforms is shown in FIG. Figure 2 As shown, the home appliances and terminal devices (which can be APPs of mobile phones, computers and other devices) in this embodiment are connected and set in the home network. Both the home appliances and terminal devices can be connected to the digital home appliance cloud platform through the home (such as WIFI) gateway via the IPv6 network. The digital home appliance cloud platform includes a product management module and an IPv6 access authentication and authorization control system.

[0038] In this embodiment, the home appliance and the terminal device can be registered on the cloud platform first. After the registration is completed, the home appliance can be started. The home appliance checks its own network configuration status. If it is not configured, the device (Access Point, wireless access node) is turned on to enter the network configuration state; otherwise, the device AP is turned off and the network configuration is not allowed to be discovered.

[0039] Step S104, turning on the terminal device, the terminal device performs two-way authentication with the authentication and authorization control system of the cloud platform, and connecting the terminal device to the cloud platform.

[0040] This embodiment can open the IPv6 terminal device, connect to the IPv6 access authentication and authorization control system of the digital home appliance cloud platform, and the terminal device performs two-way authentication on the cloud platform. After passing, the terminal device accesses the digital home appliance cloud platform.

[0041] Step S106: the terminal device is connected to the home appliance, and the terminal device sends the gateway information to the home appliance.

[0042] In this embodiment, the user can log in to the terminal device, obtain authorization, and use automatic search, code scanning or manual methods to add nearby IPv6 home appliances on the terminal device. After the home appliances are discovered and verified, the terminal device connects to the AP of the home appliances and sets the IPv6 gateway information (such as WIFI account and password) to the home appliances through the CoAP (The Constrained Application Protocol) protocol or a private protocol. Subsequently, the home appliances and the terminal device can automatically complete network configuration and binding, and the user will be prompted on the terminal device after the network configuration and binding are completed.

[0043] Step S108, the home appliance in the network configuration state connects to the gateway based on the gateway information, the home appliance performs two-way authentication to the authentication and authorization control system, connects the home appliance to the cloud platform, obtains the public key of the terminal device from the cloud platform, and sends the network configuration result to the terminal device.

[0044] The IPv6 home appliance device in this embodiment can automatically connect to the configured IPv6 gateway (such as WIFI), and after obtaining the IPv6 address, automatically connect to the IPv6 access authentication and authorization system of the digital home appliance cloud platform to request access, and after completing the two-way authentication, access the digital home appliance cloud platform, obtain the public key of the terminal device for network configuration and save it, respond to the terminal device that the device network configuration has been completed, and carry its own attribute information.

[0045] In step S110, the terminal device responds to the network configuration result and performs two-way authentication on the authentication and authorization control system. The cloud platform binds the terminal device and the home appliance. The cloud platform generates an authorization control token for the home appliance. The cloud platform sends the public key and authorization control token of the home appliance to the terminal device. The terminal device sends the authorization control token to the home appliance. The home appliance binds the terminal device based on the authorization control token.

[0046] The terminal device in this embodiment receives the network configuration result of the home appliance (i.e., the network configuration completion notification), automatically connects to the digital home appliance cloud platform, and binds the device after completing the two-way authentication. After the cloud platform binds the user account and the device, it generates a device authorization control token (token, tag), and returns the public key of the home appliance and the authorization control token to the terminal device. The terminal device saves the device's unique ID and the public key of the home appliance, and encrypts the authorization control token and sends it to the home appliance.

[0047] After receiving the token, the home appliance saves it locally, responds to the terminal device that the device binding has been completed, and closes the AP of the home appliance.

[0048] Therefore, home appliances can bind and directly control terminal devices based on the authorization control token, thereby realizing end-to-end authentication and authorization control between home appliances and terminal devices.

[0049] The embodiment of the present invention provides a processing method for intelligent home appliance IPv6 access authentication and authorization control system, which comprises the following steps: starting the home appliance, and the home appliance enters a network distribution state; turning on the terminal device, and the terminal device performs two-way authentication on the authentication and authorization control system of a cloud platform, and connects the terminal device to the cloud platform; the terminal device connects the home appliance, and the terminal device sends gateway information to the home appliance; the home appliance in the network distribution state connects to the gateway based on the gateway information, and the home appliance performs two-way authentication on the authentication and authorization control system, and connects the home appliance to the cloud platform, and the home appliance obtains the public key of the terminal device from the cloud platform, and the home appliance sends the network distribution result to the terminal device; the terminal device performs two-way authentication on the authentication and authorization control system in response to the network distribution result, and the cloud platform binds the terminal device and the home appliance, and the cloud platform generates an authorization control token for the home appliance, and the cloud platform sends the public key and authorization control token to the home appliance to the terminal device, and the terminal device sends the authorization control token to the home appliance, and the home appliance binds the terminal device based on the authorization control token. This method can achieve end-to-end authentication and authorization control between home appliances and terminal devices, and provides standardized methods and processes to ensure the security of IPv6 home appliances accessing the IPv6 network.

[0050] Embodiment 2:

[0051] The embodiment provides a method for processing an intelligent home appliance IPv6 access authentication and authorization control system. The method is implemented on the basis of the above embodiment. Figure 3 The flowchart of another processing method of the smart home appliance IPv6 access authentication and authorization control system is shown. The processing method of the smart home appliance IPv6 access authentication and authorization control system in this embodiment includes the following steps:

[0052] Step S302, register the home appliance on the cloud platform, save the public key of the cloud platform and the private key of the home appliance on the home appliance, and save the private key of the cloud platform and the public key of the home appliance on the cloud platform.

[0053] In this embodiment, IPv6 home appliances can be registered on the digital home appliance cloud platform, the device ID and the public key and private key of the home appliance can be generated, and the public key of the cloud platform and the private key of the home appliance can be saved on the home appliance; the private key of the cloud platform and the private and public keys of the home appliance can be saved on the digital home appliance cloud platform and associated with the home appliance ID.

[0054] In this embodiment, the household appliance is an air conditioner and the terminal device is an APP as an example for explanation: a digital household appliance cloud platform (referred to as the "cloud platform") and a household appliance IPv6 access authentication and authorization control system (referred to as the "authentication and authorization system") are deployed to generate a public key and a private key of the cloud platform. The private key of the cloud platform is stored in the authentication and authorization system, and the public key of the cloud platform is ready to be sent to the registered terminal device or household appliance; an IPv6 air conditioner device (referred to as the "air conditioner") is registered to generate a unique device ID and a public key and a private key of the air conditioner. The air conditioner stores the unique ID, the private key of the air conditioner and the public key of the cloud platform, and the cloud platform stores the unique device ID and the public key of the air conditioner.

[0055] Step S304, register the terminal device on the cloud platform, save the public key of the cloud platform and the private key of the terminal device on the terminal device, and save the public key of the terminal device on the cloud platform.

[0056] In this embodiment, the IPv6 terminal device can be registered on the digital home appliance cloud platform, the terminal device application ID and the public key and private key of the terminal device can be generated, and the public key of the cloud platform and the private key of the terminal device can be saved on the terminal device; the private key of the cloud platform and the public key of the terminal device can be saved on the digital home appliance cloud platform and associated with the terminal device application ID.

[0057] Continuing with the example that the home appliance is an air conditioner and the terminal device is an APP: the cloud platform registers the control terminal, generates a unique ID, public key and private key for the APP, the unique ID is saved in the APP and the cloud platform, the authentication and authorization system saves the public key of the APP, and the control terminal saves the private key of the APP and the public key of the cloud platform.

[0058] Step S306, start the home appliance, and the home appliance enters the network distribution state.

[0059] See also Figure 4 The diagram shows an access authentication and authorization control process of an IPv6 home appliance in an IPv6 network environment. The example in which the home appliance is an air conditioner and the terminal device is an APP is used for explanation: when the air conditioner is started and has not yet been network bound, the air conditioner's AP is automatically turned on, and the APP is waiting for connection and network configuration. If the air conditioner has already been networked, the air conditioner's AP will be turned off, and the air conditioner's module program will not be automatically opened. It is necessary to manually enter the network configuration mode on the air conditioner and turn on the device AP.

[0060] Step S308, turn on the terminal device, and the terminal device performs two-way authentication on the authentication and authorization control system of the cloud platform to connect the terminal device to the cloud platform.

[0061] See also Figure 5The schematic diagram of the access authentication and authorization control process of an IPv6 control terminal in an IPv6 network environment is shown, and the home appliance is an air conditioner and the terminal device is an APP as an example: the APP is configured to connect to the home WIFI to obtain an IPv6 address, the user opens the APP and logs in to the user account, the APP automatically initiates an access authentication request to the cloud platform, performs two-way authentication, and accesses the cloud platform after passing.

[0062] In some embodiments, the sending end may perform two-way authentication on the receiving end through the following steps: the sending end encrypts its own attribute information based on the public key of the receiving end to obtain a ciphertext, the sending end signs its own attribute information based on the private key of the sending end, and the sending end sends the ciphertext and the signature as a message to the receiving end;

[0063] The receiving end decrypts the message based on the receiving end's private key to obtain the sending end's public key. If the sending end's public key pre-stored by the receiving end is the same as the sending end's public key decrypted by the receiving end, the receiving end verification is completed; the receiving end signs its own attribute information based on the receiving end's private key, and the receiving end encrypts its own attribute information based on the sending end's public key to obtain a ciphertext, and the receiving end sends the ciphertext and the signature as a message to the receiving end; the sending end decrypts the message based on the sending end's private key to obtain the receiving end's public key. If the receiving end's public key pre-stored by the sending end is the same as the receiving end's public key decrypted by the sending end, the sending end verification is completed; if both the receiving end verification and the sending end verification are completed, it is determined that the sending end has completed the two-way authentication from the receiving end to the receiving end.

[0064] Continuing with the example that the home appliance is an air conditioner and the terminal device is an APP, we can prepare an IPv6 home WIFI that supports DHCPv6 (DHCPv6 is a network protocol used to configure the IP address, IP prefix and / or other configurations required by IPv6 hosts working on an IPv6 network), and the APP is configured to connect to the home WIFI to obtain an IPv6 address. After the APP is configured, the cloud platform's public key is used to encrypt the APP's attribute information and the APP's private key is used to sign. The ciphertext and signature are sent to the cloud platform authentication and authorization system. The authentication and authorization system uses the cloud platform's private key to decrypt and find the APP's public key to verify the signature. After passing, the authentication and authorization system uses the APP's public key to encrypt the cloud platform's attribute information and signs with the cloud platform's private key, and responds to the APP with the ciphertext and signature. After receiving the response message, the APP decrypts it with its own private key and verifies the signature with the cloud platform's public key. After passing, the two-way authentication is completed.

[0065] After the two-way authentication is completed, in some embodiments, the sender generates a session key based on its own attribute information and random number calculation, the sender encrypts and signs the session key and sends it to the receiver; the receiver decrypts the encrypted and signed session key to obtain the session key; the sender and the receiver conduct a conversation based on the session key.

[0066] Let's continue to use the example that the home appliance is an air conditioner and the terminal device is an APP: the APP negotiates the encryption algorithm with the cloud platform, and generates a session key based on its own attribute information and random numbers on the APP side. The session key is used to encrypt and decrypt the transmitted data. The negotiation process also uses public and private keys for encryption and signing. After the above steps are completed, the APP is connected to the cloud platform.

[0067] In some embodiments, the session key becomes invalid after the session ends or expires, and the sender re-performs two-way authentication with the receiver. That is, the session key becomes invalid after the session ends or expires, and needs to be regenerated through two-way authentication again.

[0068] Step S310: the terminal device is connected to the home appliance, and the terminal device sends gateway information to the home appliance.

[0069] See also Figure 6 The schematic diagram of the control process between an IPv6 control terminal and an IPv6 home appliance is shown, and the home appliance is an air conditioner and the terminal device is an APP. The user logs in to the APP, discovers and adds the air conditioner, sets the home WIFI account and password for the air conditioner, and then the APP and the air conditioner automatically complete the network binding of the air conditioner and add the air conditioner to the home.

[0070] Among them, users can log in to the APP and connect to the air conditioner's device AP by automatic search or scanning. After connecting to the AP, set the WIFI account and password to the air conditioner. The configuration process uses the CoAP protocol and private protocol communication, and uses ECDH (Elliptic Curve Diffie-Hellman key Exchange) to negotiate the transmission key, encrypt and decrypt the transmission message, and ensure communication security. The APP and the air conditioner automatically complete the network binding and prompt the user to complete the device addition.

[0071] Step S312, the home appliance in the network configuration state connects to the gateway based on the gateway information, the home appliance performs two-way authentication to the authentication and authorization control system, connects the home appliance to the cloud platform, obtains the public key of the terminal device from the cloud platform, and sends the network configuration result to the terminal device.

[0072] Let's continue to use the example that the home appliance is an air conditioner and the terminal device is an APP: the air conditioner automatically connects to the home WIFI and obtains an IPv6 address, initiates access authentication to the cloud platform, accesses the cloud platform after the two-way authentication is passed, obtains the APP public key and saves it, responds to the APP with the network configuration result, and the response message carries the device's own attribute information.

[0073] In some embodiments, the above-mentioned self-attribute information includes at least one of the following: unique ID, MAC address, IPv6 address, product ID, category ID or version number.

[0074] Continuing with the example that the home appliance is an air conditioner and the terminal device is an APP, the air conditioner and the cloud platform perform two-way authentication and negotiate to determine the encryption algorithm and session key, complete access to the cloud platform, obtain and save the public key of the APP, and respond to the network configuration result to the APP. The message includes the device's unique ID, MAC (Media Access Control Address) address, IPv6 address and other self-attribute information.

[0075] In step S314, the terminal device responds to the network configuration result and performs two-way authentication on the authentication and authorization control system. The cloud platform binds the terminal device and the home appliance. The cloud platform generates an authorization control token for the home appliance. The cloud platform sends the public key and authorization control token of the home appliance to the terminal device. The terminal device sends the authorization control token to the home appliance. The home appliance binds the terminal device based on the authorization control token.

[0076] Let's continue to use the example that the home appliance is an air conditioner and the terminal device is an APP: After the APP receives the response that the network configuration is completed from the air conditioner, it automatically connects to the cloud platform and completes the two-way authentication to bind the device. After the cloud platform binds the user account and the air conditioner, it generates an authorization control token for the air conditioner and returns the public key and authorization control token of the air conditioner to the APP. The APP saves the unique ID and public key of the air conditioner and encrypts the authorization control token and sends it to the air conditioner. After receiving the authorization control token, the air conditioner saves it locally, responds to the APP that the device binding has been completed, and closes the device AP.

[0077] In some embodiments, the terminal device controls the home appliance based on the authorization control token. Therefore, the terminal device in this embodiment can directly communicate and control the home appliance. Specifically, it can be performed through the following steps A1-A2:

[0078] In step A1, the terminal device performs two-way authentication on the home appliance to determine the session key. The terminal device encrypts the control message carrying the authorization control token based on the session key and the private key of the terminal device, and the terminal device sends the control message to the home appliance.

[0079] After the network binding is completed, the user logs in to the terminal device, obtains the authorization control token of the bound home appliance, and performs end-to-end device control of the bound home appliance through the terminal device. First, the terminal device and the home appliance complete two-way authentication, and then use the session key to encrypt and sign the communication message. The authorization control token must be carried in the control message.

[0080] Let's continue to use the example that the home appliance is an air conditioner and the terminal device is an APP: the user logs in to the APP, obtains the authorization control token of the air conditioner, and controls the air conditioner through the APP. In this case, the user logs in to the APP, obtains the authorization control token of the air conditioner, and uses the APP to control the air conditioner. During the process, the APP first completes two-way authentication with the air conditioner, negotiates to determine the encryption algorithm and session key, carries the token in the control request message, encrypts and signs the message using the session key and the APP private key, and sends the message to the air conditioner.

[0081] In step A2, the home appliance performs a first check on the control message based on the session key and the public key of the terminal device, and performs a second check on the control message based on the authorization control token; if both the first check and the second check pass, the home appliance executes the operation corresponding to the control message.

[0082] The home appliance receives the device control message sent by the terminal device, decrypts the message using the session key, and verifies the signature and token. It will execute the control instruction only after all of them pass. If any of them fails, the control instruction will be refused to be executed, and finally the result will be responded to the terminal device.

[0083] Let's continue to use the example that the home appliance is an air conditioner and the terminal device is an APP: the air conditioner receives the control request message from the APP, decrypts the message, verifies the signature and verifies the token. After all the processes are passed, it executes the control instruction and returns a control response message.

[0084] Among them, the air conditioner receives the control request message, uses the session key and APP public key to decrypt and verify the signature, and then verifies the authorization control token. After the authentication is passed, the operation command is executed and the operation result is returned. If any link in the whole process fails, the device will refuse to execute the control instruction; the control response message is encrypted with the session key and signed with the air conditioner private key.

[0085] In summary, the overall process of device control token and end-to-end control can include the following steps 1-5:

[0086] Step 1: The authorization control token is generated by the IPv6 access authentication and authorization control system when the device is bound, and contains information: device ID, device MAC address, device IPv6 address, user ID, function permissions, validity period, version number, etc.

[0087] Step 2: After two-way authentication, the terminal device is connected to the digital home appliance cloud platform. The user logs in to the terminal device and obtains the authorization control token bound to the device from the platform.

[0088] Step 3: After the terminal device and the controlled home appliance are mutually authenticated, a control message is sent to the IPv6 home appliance. The communication message carries the authorization control token and is encrypted.

[0089] Step 4: The IPv6 home appliance decrypts the message, verifies the authorization control token, and executes the operation instruction if it passes; otherwise, the operation is rejected.

[0090] Step 5: After the authorization control token expires, it needs to be updated in the IPv6 access authentication and authorization control system.

[0091] In addition, some embodiments also provide a method for unbinding a terminal device from a home appliance, for example: the terminal device unbinds the home appliance, the terminal device sends an unbinding instruction to the cloud platform and the home appliance; the cloud platform unbinds the terminal device from the home appliance based on the unbinding instruction; the home appliance unbinds the terminal device based on the unbinding instruction and deletes the authorization control token.

[0092] When a user logs in to a terminal device to unbind a home appliance, the cloud platform deletes the binding relationship between the user account and the home appliance, as well as the authorization control token of the home appliance; the home appliance deletes the authorization control token of the device. After unbinding, the user cannot control the home appliance through the terminal device.

[0093] Let's continue to use the example that the home appliance is an air conditioner and the terminal device is an APP: the user logs in to the APP and unbinds the air conditioner. The unbinding operation will delete the authorization control token on the cloud platform and the air conditioner. After unbinding, the air conditioner will reject the control request sent by the user through the APP.

[0094] The above method provided by the embodiment of the present invention can realize end-to-end authentication and authorization control between home appliances and terminal devices, and provides a standardized method and process to ensure the security of IPv6 home appliances accessing the IPv6 network.

[0095] Embodiment three:

[0096] Corresponding to the above method embodiment, the embodiment of the present invention provides a processing device for a smart home appliance IPv6 access authentication and authorization control system, see Figure 7 The structure diagram of a processing device of a smart home appliance IPv6 access authentication and authorization control system is shown, and the processing device of the smart home appliance IPv6 access authentication and authorization control system includes:

[0097] The home appliance startup module 71 is used to start the home appliance, and the home appliance enters the network distribution state;

[0098] The terminal device access cloud platform module 72 is used to open the terminal device, and the terminal device performs two-way authentication with the authentication and authorization control system of the cloud platform to connect the terminal device to the cloud platform;

[0099] The terminal device sends gateway information module 73, which is used for the terminal device to connect to the home appliance, and the terminal device sends the gateway information to the home appliance;

[0100] The home appliance access cloud platform module 74 is used for the home appliance in the network configuration state to connect to the gateway based on the gateway information, the home appliance performs two-way authentication to the authentication and authorization control system, connects the home appliance to the cloud platform, the home appliance obtains the public key of the terminal device from the cloud platform, and the home appliance sends the network configuration result to the terminal device;

[0101] The home appliance binding terminal device module 75 is used for the terminal device to respond to the network configuration result to perform two-way authentication with the authentication and authorization control system. The cloud platform binds the terminal device and the home appliance, and the cloud platform generates an authorization control token for the home appliance. The cloud platform sends the public key and authorization control token of the home appliance to the terminal device, and the terminal device sends the authorization control token to the home appliance. The home appliance binds the terminal device based on the authorization control token.

[0102] The embodiment of the present invention provides a processing device for an intelligent home appliance IPv6 access authentication and authorization control system, which starts the home appliance and puts the home appliance into a network distribution state; turns on the terminal device, and the terminal device performs two-way authentication on the authentication and authorization control system of a cloud platform, and connects the terminal device to the cloud platform; the terminal device connects the home appliance, and the terminal device sends gateway information to the home appliance; the home appliance in the network distribution state connects to the gateway based on the gateway information, and the home appliance performs two-way authentication on the authentication and authorization control system, and connects the home appliance to the cloud platform, and the home appliance obtains the public key of the terminal device from the cloud platform, and the home appliance sends the network distribution result to the terminal device; the terminal device performs two-way authentication on the authentication and authorization control system in response to the network distribution result, and the cloud platform binds the terminal device and the home appliance, and the cloud platform generates an authorization control token for the home appliance, and the cloud platform sends the public key and authorization control token to the home appliance to the terminal device, and the terminal device sends the authorization control token to the home appliance, and the home appliance binds the terminal device based on the authorization control token. This method can achieve end-to-end authentication and authorization control between home appliances and terminal devices, and provides standardized methods and processes to ensure the security of IPv6 home appliances accessing the IPv6 network.

[0103] The above-mentioned device includes: a cloud platform registration module, which is used to register home appliances on the cloud platform, save the public key of the cloud platform and the private key of the home appliances on the home appliances, and save the private key of the cloud platform and the public key of the home appliances on the cloud platform; register terminal devices on the cloud platform, save the public key of the cloud platform and the private key of the terminal devices on the terminal devices, and save the public key of the terminal devices on the cloud platform.

[0104] The above-mentioned device includes: a terminal device controlling household electrical appliances module, which is used for the terminal device to control the household electrical appliances based on the authorization control token.

[0105] The above-mentioned terminal device controls the home appliance module, which is used for the terminal device to perform two-way authentication on the home appliance to determine the session key. The terminal device encrypts the control message carrying the authorization control token based on the session key and the private key of the terminal device, and the terminal device sends the control message to the home appliance; the home appliance performs a first check on the control message based on the session key and the public key of the terminal device, and the home appliance performs a second check on the control message based on the authorization control token; if both the first check and the second check are passed, the home appliance executes the operation corresponding to the control message.

[0106] The above-mentioned device includes: a home appliance unbinding terminal device module, which is used for the terminal device to unbind the home appliance, and the terminal device sends an unbinding instruction to the cloud platform and the home appliance; the cloud platform unbinds the terminal device and the home appliance based on the unbinding instruction; the home appliance unbinds the terminal device based on the unbinding instruction and deletes the authorization control token.

[0107] The above-mentioned device also includes: a two-way authentication module, which is used for the sender to encrypt its own attribute information based on the public key of the receiving end to obtain a ciphertext, the sender to sign its own attribute information based on the private key of the sender, and the sender sends the ciphertext and the signature as a message to the receiving end; the receiving end decrypts the message based on the private key of the receiving end to obtain the public key of the sender, if the public key of the sender pre-stored in the receiving end and the public key of the sender obtained by decryption by the receiving end are the same, the receiving end verification is completed; the receiving end signs its own attribute information based on the private key of the receiving end, the receiving end encrypts its own attribute information based on the public key of the sending end to obtain a ciphertext, and the receiving end sends the ciphertext and the signature as a message to the receiving end; the sending end decrypts the message based on the private key of the sending end to obtain the public key of the receiving end, if the public key of the receiving end pre-stored in the sending end and the public key of the receiving end obtained by decryption by the sending end are the same, the sending end verification is completed; if both the receiving end verification and the sending end verification are completed, it is determined that the sending end has completed the two-way authentication to the receiving end.

[0108] The above-mentioned device also includes: a session module, which is used for the sender to generate a session key based on its own attribute information and random number calculation, and the sender encrypts and signs the session key and sends it to the receiving end; the receiving end decrypts the encrypted and signed session key to obtain the session key; the sender and the receiving end conduct a session based on the session key.

[0109] The above session module is also used for the session key to become invalid after the session ends or expires; the sending end re-performs two-way authentication with the receiving end.

[0110] The above-mentioned self-attribute information includes at least one of the following: unique ID, MAC address, IPv6 address, product ID, category ID or version number.

[0111] Technical personnel in the relevant field can clearly understand that, for the convenience and brevity of description, the specific working process of the processing device of the smart home appliance IPv6 access authentication and authorization control system described above can refer to the corresponding process in the embodiment of the processing method of the smart home appliance IPv6 access authentication and authorization control system aforementioned, and will not be repeated here.

[0112] Embodiment 4:

[0113] The embodiment of the present invention also provides an electronic device for running the processing method of the above-mentioned smart home appliance IPv6 access authentication and authorization control system; see Figure 8 A structural schematic diagram of an electronic device is shown, which includes a memory 100 and a processor 101, wherein the memory 100 is used to store one or more computer instructions, and the one or more computer instructions are executed by the processor 101 to implement the above-mentioned processing method of the smart home appliance IPv6 access authentication and authorization control system.

[0114] Further, Figure 8 The electronic device shown further includes a bus 102 and a communication interface 103 , and the processor 101 , the communication interface 103 and the memory 100 are connected via the bus 102 .

[0115] The memory 100 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk storage. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 103 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used. The bus 102 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0116] The processor 101 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 101. The above processor 101 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present invention can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module may be located in a storage medium mature in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 100, and the processor 101 reads the information in the memory 100 and completes the steps of the method of the above embodiment in combination with its hardware.

[0117] An embodiment of the present invention also provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to implement the above-mentioned smart home appliance IPv6 access authentication and authorization control system processing method. The specific implementation can be found in the method embodiment, which will not be repeated here.

[0118] The processing method of the smart home appliance IPv6 access authentication and authorization control system provided in the embodiment of the present invention includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the method in the previous method embodiment. The specific implementation can be referred to the method embodiment, which will not be repeated here.

[0119] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system and / or device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0120] In addition, in the description of the embodiments of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0121] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0122] In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc., indicating the orientation or positional relationship, are based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", and "third" are used for descriptive purposes only, and cannot be understood as indicating or implying relative importance.

[0123] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A processing method for intelligent home appliance IPv6 access authentication and authorization control system, characterized in that: The method comprises: Starting the home appliance, and the home appliance enters the network distribution state; Turn on the terminal device, perform two-way authentication on the authentication and authorization control system of the cloud platform, and connect the terminal device to the cloud platform; The terminal device is connected to the home appliance, and the terminal device sends gateway information to the home appliance; The home appliance in the network configuration state connects to the gateway based on the gateway information, the home appliance performs two-way authentication on the authentication and authorization control system, connects the home appliance to the cloud platform, the home appliance obtains the public key of the terminal device from the cloud platform, and the home appliance sends the network configuration result to the terminal device; The terminal device performs two-way authentication on the authentication and authorization control system in response to the network configuration result, the cloud platform binds the terminal device and the home appliance, the cloud platform generates an authorization control token for the home appliance, the cloud platform sends the public key of the home appliance and the authorization control token to the terminal device, the terminal device sends the authorization control token to the home appliance, and the home appliance binds the terminal device based on the authorization control token.

2. The method according to claim 1, characterized in that Starting the home appliance, before the home appliance enters the network distribution state, the method further includes: Register the home appliance on the cloud platform, save the public key of the cloud platform and the private key of the home appliance on the home appliance, and save the private key of the cloud platform and the public key of the home appliance on the cloud platform; The terminal device is registered on the cloud platform, a public key of the cloud platform and a private key of the terminal device are stored on the terminal device, and the public key of the terminal device is stored on the cloud platform.

3. The method according to claim 2, characterized in that After the home appliance is bound to the terminal device based on the authorization control token, the method further includes: The terminal device controls the home appliance based on the authorization control token.

4. The method according to claim 3, characterized in that The terminal device controls the home appliance based on the authorization control token, including: The terminal device performs two-way authentication on the home appliance to determine a session key, the terminal device encrypts a control message carrying the authorization control token based on the session key and a private key of the terminal device, and the terminal device sends the control message to the home appliance; The home appliance performs a first verification on the control message based on the session key and the public key of the terminal device, and performs a second verification on the control message based on the authorization control token; if both the first verification and the second verification pass, the home appliance executes the operation corresponding to the control message.

5. The method according to claim 1, characterized in that The method further comprises: The terminal device unbinds the home appliance, and the terminal device sends an unbinding instruction to the cloud platform and the home appliance; The cloud platform unbinds the terminal device from the home appliance based on the unbinding instruction; The home appliance unbinds the terminal device based on the unbinding instruction and deletes the authorization control token.

6. The method according to any one of claims 1 to 5, characterized in that: The sender performs two-way authentication on the receiver, including: The sending end encrypts its own attribute information based on the public key of the receiving end to obtain a ciphertext, the sending end signs its own attribute information based on the private key of the sending end, and the sending end sends the ciphertext and the signature as a message to the receiving end; The receiving end decrypts the message based on the private key of the receiving end to obtain the public key of the sending end. If the public key of the sending end pre-stored by the receiving end is the same as the public key of the sending end obtained by the decryption of the receiving end, the receiving end verification is completed; The receiving end signs its own attribute information based on the private key of the receiving end, the receiving end encrypts its own attribute information based on the public key of the sending end to obtain a ciphertext, and the receiving end sends the ciphertext and the signature as a message to the receiving end; The sender decrypts the message based on the private key of the sender to obtain the public key of the receiver. If the public key of the receiver pre-stored by the sender is the same as the public key of the receiver obtained by decryption by the sender, the sender verification is completed; If both the receiving end authentication and the sending end authentication are completed, it is determined that the sending end has completed the two-way authentication with the receiving end.

7. The method according to claim 6, characterized in that After determining that the sending end has completed the two-way authentication with the receiving end, the method further includes: The sending end generates a session key based on its own attribute information and random number calculation, and the sending end encrypts and signs the session key and sends it to the receiving end; The receiving end decrypts the encrypted and signed session key to obtain the session key; The sending end and the receiving end conduct a session based on the session key.

8. The method according to claim 7, characterized in that After the sending end and the receiving end communicate based on the session key, the method further includes: The session key becomes invalid after the session ends or expires; The sending end re-performs bidirectional authentication with the receiving end.

9. The method according to claim 6, characterized in that The self-attribute information includes at least one of the following: unique ID, MAC address, IPv6 address, product ID, category ID or version number.

10. A processing device for a smart home appliance IPv6 access authentication and authorization control system, characterized in that: The device comprises: A home appliance startup module, used to start the home appliance, and the home appliance enters a network distribution state; The terminal device access cloud platform module is used to open the terminal device, the terminal device performs two-way authentication with the authentication and authorization control system of the cloud platform, and access the terminal device to the cloud platform; A terminal device sending gateway information module is used for the terminal device to connect to the home appliance, and the terminal device sends gateway information to the home appliance; A home appliance access cloud platform module, which is used for the home appliance in the network configuration state to connect to the gateway based on the gateway information, the home appliance to perform two-way authentication on the authentication and authorization control system, connect the home appliance to the cloud platform, the home appliance to obtain the public key of the terminal device from the cloud platform, and the home appliance to send the network configuration result to the terminal device; A home appliance binding terminal device module is used for the terminal device to perform two-way authentication on the authentication and authorization control system in response to the network configuration result, the cloud platform binds the terminal device and the home appliance, the cloud platform generates an authorization control token for the home appliance, the cloud platform sends the public key of the home appliance and the authorization control token to the terminal device, the terminal device sends the authorization control token to the home appliance, and the home appliance binds the terminal device based on the authorization control token.

Images