Method for processing multicast message and related device

Abstract

The application discloses a multicast message processing method and related device. The multicast message processing method comprises the following steps: a target node device receives a multicast message, the multicast message is a group command, the multicast message comprises group identification information and identification information of a source node device; and the target node device judges whether to execute the group command according to the group identification information, the identification information of the source node device and theme information in an access control list (ACL) of the target node device. In this way, the source of the group command is limited by the theme information, the situation that a node device in a multicast group is illegally controlled and then controls other node devices in the multicast group through the group command is avoided, and the security of communication between the node devices in the multicast group is improved.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a method and related apparatus for processing multicast messages. Background Technology

[0002] A multicast group is a collection of all node devices registered under the same multicast group identifier. After a multicast message is sent to the multicast group, it is received by all node devices in that group.

[0003] Each multicast group corresponds to a shared group key, which is managed by the group key management function set of each node device within the multicast group. This key is used for encrypting and decrypting message transmissions within the group. Each node device within a multicast group is unaware of the status of other node devices and can only ensure the security of communication within the group through the group key. However, if a node device within a multicast group is illegally controlled, that node device can construct group commands to control other node devices in the group. Other node devices cannot distinguish whether the received group commands are legitimate or illegitimate, resulting in poor security for communication between node devices within a multicast group. Summary of the Invention

[0004] This application provides a method and related apparatus for processing multicast messages, which improves the security of communication between node devices within a multicast group.

[0005] In a first aspect, this application provides a method for processing multicast messages, the method being applied to a target node device, comprising: receiving a multicast message, the multicast message being a group command, the multicast message including group identification information and source node device identification information; and determining whether to execute the group command based on the group identification information, the source node device identification information, and topic information in the access control list (ACL) of the target node device.

[0006] In the above method, the target node device receives multicast messages, which are group commands including group identifier information and source node device identifier information. The target node device determines whether to execute the group command based on the group identifier information, source node device identifier information, and topic information in the ACL. Within the multicast group, the source of the group command is restricted by the topic information in the ACL, ensuring that only group commands issued by the control node device can be executed by other devices in the group. After receiving the group command, the target node device checks the topic information in the ACL and, combined with the source node device identifier information, can determine whether the group command from the source node device can be executed. This prevents a situation where a node device within the multicast group is illegally controlled and then uses group commands to control other node devices in the group, thus improving the security of communication between node devices within the multicast group.

[0007] In conjunction with the first aspect, in one possible implementation of the first aspect, before determining whether to execute the group command based on the group identification information, the identification information of the source node device, and the topic information in the access control list (ACL) of the target node device, the method further includes: receiving ACL configuration information from a configurator, the ACL configuration information including the group identification information and the identification information of at least one control node device; and configuring the ACL based on the group identification information and the identification information of the at least one control node device.

[0008] In conjunction with the first aspect, in one possible implementation of the first aspect, configuring the ACL based on the group identification information and the identification information of the at least one control node device includes: configuring the group identification information in the first information of the first access control entity (ACE) of the ACL; configuring the identification information of the at least one control node device in at least one topic information of the first ACE, wherein the identification information of the at least one control node device corresponds one-to-one with the at least one topic information.

[0009] In conjunction with the first aspect, in one possible implementation of the first aspect, configuring the ACL based on the group identification information and the identification information of the at least one control node device further includes: configuring the number n of the identification information of the at least one control node device in the first information.

[0010] In conjunction with the first aspect, in one possible implementation of the first aspect, configuring the ACL based on the group identification information and the identification information of the at least one control node device includes: configuring the group identification information in at least one topic information of the first ACE of the ACL; compressing the identification information of each control node device in the identification information of the at least one control node device to obtain compressed identification information of at least one control node device; configuring the compressed identification information of the at least one control node device in at least one topic information containing the group identification information, wherein the compressed identification information of the at least one control node device corresponds one-to-one with the at least one topic information.

[0011] In conjunction with the first aspect, in one possible implementation of the first aspect, configuring the ACL based on the group identification information and the identification information of the at least one control node device includes: compressing the identification information of each control node device in the group identification information and the identification information of the at least one control node device to obtain at least one first compressed information; configuring the at least one first compressed information in at least one topic information of the ACL, wherein the at least one first compressed information corresponds one-to-one with the at least one topic information.

[0012] In conjunction with the first aspect, in one possible implementation of the first aspect, determining whether to execute the group command based on the group identification information, the identification information of the source node device, and the topic information in the access control list (ACL) of the target node device includes: determining the first ACE in the ACL based on the group identification information; searching in the first ACE for whether there is topic information that matches the identification information of the source node device; and if so, executing the group command.

[0013] In conjunction with the first aspect, in one possible implementation of the first aspect, determining whether to execute the group command based on the group identification information, the identification information of the source node device, and the topic information in the access control list (ACL) of the target node device includes: determining the first information in the ACL based on the group identification information; searching for information matching the identification information of the source node device in the last n topic information of the first information; and if such information exists, then executing the group command.

[0014] In conjunction with the first aspect, in one possible implementation of the first aspect, determining whether to execute the group command based on the group identification information, the identification information of the source node device, and the topic information in the access control list (ACL) of the target node device includes: determining at least one topic information in the ACL containing the group identification information based on the group identification information; compressing the identification information of the source node device to obtain compressed identification information of the source node device; searching for information matching the compressed identification information of the source node device in the at least one topic information containing the group identification information; and if such information exists, executing the group command.

[0015] In conjunction with the first aspect, in one possible implementation of the first aspect, determining whether to execute the group command based on the group identification information, the identification information of the source node device, and the topic information in the access control list (ACL) of the target node device includes: determining, based on the group identification information, at least one topic information in the ACL that contains the group identification information; decompressing the at least one topic information containing the group identification information to obtain at least one first decompressed information; searching in the at least one first decompressed information for information that matches the identification information of the source node device; and if such information exists, then executing the group command.

[0016] In conjunction with the first aspect, in one possible implementation of the first aspect, determining whether to execute the group command based on the group identification information, the identification information of the source node device, and the topic information in the access control list (ACL) of the target node device includes: compressing the group identification information and the identification information of the source node device to obtain second compressed information; searching in the ACL for topic information that matches the second compressed information; and if it does, executing the group command.

[0017] In conjunction with the first aspect, in one possible implementation of the first aspect, determining whether to execute the group command based on the group identification information, the identification information of the source node device, and the topic information in the access control list (ACL) of the target node device includes: decompressing at least one topic information in the ACL to obtain at least one second decompressed information; searching in the at least one second decompressed information for information that matches the group identification information and the identification information of the source node device; if such information exists, then executing the group command.

[0018] In conjunction with the first aspect, in one possible implementation of the first aspect, the step of determining whether to execute the group command based on the group identification information, the identification information of the source node device, and the topic information in the access control list (ACL) of the target node device further includes: if the group command does not exist, then the group command is not executed.

[0019] In conjunction with the first aspect, in one possible implementation of the first aspect, the method further includes: receiving group table configuration information from a configurator, the group table configuration information including first indication information, the first indication information being used to indicate whether the target node device is a control node device; and configuring the first indication information in the group table of the target node device.

[0020] In conjunction with the first aspect, in one possible implementation of the first aspect, the ACL configuration information further includes authentication mode configuration information, and the method further includes: configuring the authentication mode of the ACE in the ACL as enhanced group-based secure connection according to the authentication mode configuration information.

[0021] Secondly, this application provides a method for processing multicast messages, the method being applied to a configurator, comprising: sending access control list (ACL) configuration information to a target node device, the ACL configuration information including group identifier information and identifier information of at least one control node device, the ACL configuration information being used to instruct the target node device to configure the ACL according to the group identifier information and the identifier information of the at least one control node device, and the topic information in the ACL being used by the target node device to determine whether to execute a group command.

[0022] In the above method, the configurator sends ACL configuration information to the target node device. The ACL configuration information includes group identifier information and the identifier information of at least one control node device. The target node device configures the ACL based on the group identifier information and the identifier information of at least one control node device. Within the multicast group, the source of group commands is restricted by the topic information in the ACL, ensuring that only group commands issued by the control node device can be executed by other devices in the group. After receiving a group command, the target node device checks the topic information in the ACL and, combined with the identifier information of the source node device, can determine whether the group command from the source node device can be executed. This prevents a situation where a node device within the multicast group is illegally controlled and then uses group commands to control other node devices in the group, thus improving the security of communication between node devices within the multicast group.

[0023] In conjunction with the second aspect, in one possible implementation of the second aspect, the method further includes: sending group table configuration information to multiple node devices within a multicast group, the group table configuration information including first indication information, the group table configuration information being used to instruct each of the multiple node devices to configure the first indication information in the group table, the first indication information being used to indicate whether each node device is a control node device.

[0024] In conjunction with the second aspect, in one possible implementation of the second aspect, before sending the Access Control List (ACL) configuration information to the target node device, the method further includes: determining the ACL configuration information based on first indication information from the plurality of node devices.

[0025] Thirdly, this application provides a communication device applied to a target node device, comprising: a transceiver unit for receiving multicast messages, wherein the multicast message is a group command and the multicast message includes group identification information and source node device identification information; and a processing unit for determining whether to execute the group command based on the group identification information, the source node device identification information, and topic information in the access control list (ACL) of the target node device.

[0026] In conjunction with the third aspect, in one possible implementation of the third aspect, the transceiver unit is further configured to receive ACL configuration information from the configurator, the ACL configuration information including the group identification information and the identification information of at least one control node device; the processing unit is further configured to configure the ACL according to the group identification information and the identification information of the at least one control node device.

[0027] In conjunction with the third aspect, in one possible implementation of the third aspect, the processing unit is specifically configured to: configure the group identification information in the first information of the first access control entity (ACE) of the ACL; configure the identification information of the at least one control node device in at least one topic information of the first ACE, wherein the identification information of the at least one control node device corresponds one-to-one with the at least one topic information.

[0028] In conjunction with the third aspect, in one possible implementation of the third aspect, the processing unit is further configured to: configure the number n of the identification information of the at least one control node device in the first information.

[0029] In conjunction with the third aspect, in one possible implementation of the third aspect, the processing unit is specifically configured to: configure the group identification information in at least one topic information of the first ACE of the ACL; compress the identification information of each control node device in the identification information of the at least one control node device to obtain compressed identification information of at least one control node device; configure the compressed identification information of the at least one control node device in at least one topic information containing the group identification information, wherein the compressed identification information of the at least one control node device corresponds one-to-one with the at least one topic information.

[0030] In conjunction with the third aspect, in one possible implementation of the third aspect, the processing unit is specifically configured to: compress the identification information of each control node device in the group identification information and the identification information of the at least one control node device to obtain at least one first compressed information; configure the at least one first compressed information in at least one topic information of the ACL, wherein the at least one first compressed information corresponds one-to-one with the at least one topic information.

[0031] In conjunction with the third aspect, in one possible implementation of the third aspect, the processing unit is specifically configured to: determine the first ACE in the ACL based on the group identification information; search in the first ACE for whether there is topic information that matches the identification information of the source node device; if so, execute the group command.

[0032] In conjunction with the third aspect, in one possible implementation of the third aspect, the processing unit is specifically configured to: determine the first information in the ACL based on the group identification information; search for whether there is information matching the identification information of the source node device in the last n topic information of the first information; if so, execute the group command.

[0033] In conjunction with the third aspect, in one possible implementation of the third aspect, the processing unit is specifically configured to: determine at least one topic information in the ACL that contains the group identification information based on the group identification information; compress the identification information of the source node device to obtain compressed identification information of the source node device; search for whether there is information matching the compressed identification information of the source node device in the at least one topic information containing the group identification information; if so, execute the group command.

[0034] In conjunction with the third aspect, in one possible implementation of the third aspect, the processing unit is specifically configured to: determine, based on the group identification information, at least one topic information in the ACL that contains the group identification information; decompress the at least one topic information containing the group identification information to obtain at least one first decompressed information; search in the at least one first decompressed information for information that matches the identification information of the source node device; if such information exists, then execute the group command.

[0035] In conjunction with the third aspect, in one possible implementation of the third aspect, the processing unit is specifically configured to: compress the group identification information and the identification information of the source node device to obtain second compressed information; search in the ACL for whether there is topic information that matches the second compressed information; if so, execute the group command.

[0036] In conjunction with the third aspect, in one possible implementation of the third aspect, the processing unit is specifically configured to: decompress at least one topic information in the ACL to obtain at least one second decompressed information; search in the at least one second decompressed information for information that matches the group identification information and the identification information of the source node device; if such information exists, then execute the group command.

[0037] In conjunction with the third aspect, in one possible implementation of the third aspect, the processing unit is further configured to: if the group command does not exist, then not execute the group command.

[0038] In conjunction with the third aspect, in one possible implementation of the third aspect, the transceiver unit is further configured to receive group table configuration information from the configurator, the group table configuration information including first indication information, the first indication information being used to indicate whether the target node device is a control node device; the processing unit is further configured to configure the first indication information in the group table of the target node device.

[0039] In conjunction with the third aspect, in one possible implementation of the third aspect, the ACL configuration information further includes authentication mode configuration information, and the processing unit is further configured to: configure the authentication mode of the ACE in the ACL as enhanced group-based secure connection according to the authentication mode configuration information.

[0040] Fourthly, this application provides a communication device applied to a configurator, comprising: a transceiver unit, configured to send Access Control List (ACL) configuration information to a target node device, the ACL configuration information including group identifier information and identifier information of at least one control node device, the ACL configuration information being used to instruct the target node device to configure the ACL according to the group identifier information and the identifier information of the at least one control node device, and the topic information in the ACL being used by the target node device to determine whether to execute a group command.

[0041] In conjunction with the fourth aspect, in one possible implementation of the fourth aspect, the transceiver unit is further configured to: send group table configuration information to multiple node devices within a multicast group, the group table configuration information including first indication information, the group table configuration information being used to instruct each of the multiple node devices to configure the first indication information in the group table, the first indication information being used to indicate whether each node device is a control node device.

[0042] In conjunction with the fourth aspect, in one possible implementation of the fourth aspect, the apparatus further includes a processing unit configured to: determine the ACL configuration information based on the first indication information of the plurality of node devices.

[0043] Fifthly, this application provides a target node device, including a memory, a processor, and a program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method of the first aspect or any possible implementation thereof.

[0044] In a sixth aspect, this application provides a configurator including a memory, a processor, and a program stored on the memory and executable on the processor, wherein the processor executes the program to implement the method of the second aspect or any possible implementation thereof.

[0045] In a seventh aspect, this application provides a computer-readable storage medium for storing instructions that, when executed by a processor, cause the method of the first aspect or any possible implementation thereof, or the method of the second aspect or any possible implementation thereof, to be performed.

[0046] Eighthly, this application provides a computer program product containing instructions that, when run on a computer, cause the method of the first aspect or any possible implementation of the first aspect, or the method of the second aspect or any possible implementation of the second aspect, to be executed. Attached Figure Description

[0047] Figure 1 A schematic diagram illustrating a group command processing method provided in an embodiment of this application;

[0048] Figure 2 A schematic diagram illustrating another group command processing method provided in an embodiment of this application;

[0049] Figure 3 A schematic diagram illustrating another group command processing method provided in an embodiment of this application;

[0050] Figure 4 A schematic diagram illustrating another group command processing method provided in an embodiment of this application;

[0051] Figure 5 A schematic diagram illustrating another group command processing method provided in an embodiment of this application;

[0052] Figure 6 A schematic diagram illustrating another group command processing method provided in an embodiment of this application;

[0053] Figure 7 A schematic diagram of a communication device provided in an embodiment of this application;

[0054] Figure 8 A schematic diagram of another communication device provided in the embodiments of this application;

[0055] Figure 9 A schematic diagram of a target node device provided in an embodiment of this application;

[0056] Figure 10 This is a schematic diagram of a configurator provided in an embodiment of this application. Detailed Implementation

[0057] The technical solutions in this application will now be described with reference to the accompanying drawings.

[0058] The following explanations of some terms used in the embodiments of this application are provided to facilitate understanding by those skilled in the art.

[0059] In this application's embodiments, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0060] Furthermore, unless otherwise stated, the ordinal numbers such as "first" and "second" mentioned in the embodiments of this application are used to distinguish multiple objects and are not used to limit the order, timing, priority, or importance of multiple objects. For example, "first information" and "second information" are only used to distinguish different information, and do not indicate that the content, priority, sending order, or importance of these two types of information are different.

[0061] To facilitate understanding of this application, the concepts involved in this application will first be explained.

[0062] Matter Protocol: Matter is an application layer protocol introduced by the Connectivity Standards Alliance (CSA). It is a new connectivity standard based on the Internet Protocol (IP). The Matter protocol defines the application layer deployed on devices based on IPv6 networks to achieve interoperability architecture goals.

[0063] A multicast group is a collection of all node devices registered under the same multicast group identifier (ID). When a multicast message is sent to a multicast group, it is received by all node devices within that group.

[0064] A group session is formed by one or more multicast messages and includes the following information:

[0065] 1. Fabric index: This indicates the fabric domain to which the group session belongs.

[0066] 2. Group ID is a unique identifier for a multicast group.

[0067] 3. Source node ID: This represents the source node device ID of the group session.

[0068] 4. Source Internet Protocol (IP) address: This refers to the IP address of the source node device of the device that sent the group session message.

[0069] 5. Source port: This refers to the source port of the source node device for the group session message.

[0070] 6. Operational group key: This refers to the encryption key for group session messages.

[0071] 7. Group session ID.

[0072] Group table: In a multicast group that supports the Matter protocol, each node device has a group table that represents the group membership. One or more endpoints on a node device can belong to the same multicast group, and any endpoint on a node device can also belong to one or more multicast groups.

[0073] Group key management cluster: In a multicast group that supports the Matter protocol, each node device has a group key management cluster for managing group keys, including attributes and methods (commands). The attributes in the group key management cluster are shown in Table 1, and the commands in the group key management cluster are shown in Table 2.

[0074] Table 1 Attributes of Key Management Function Sets

[0075]

[0076] Here, desc indicates that you should refer to the detailed explanation section.

[0077] Table 2 Commands for the Key Management Function Set

[0078]

[0079]

[0080] FA indicates that access is differentiated based on fabric and requires administrator privileges.

[0081] The attributes of the group key management function set are used to maintain the group table of the node device. The information included in the group table is shown in Table 3.

[0082] The information contained in Table 3

[0083]

[0084] Here, FabricIndex represents the fabric domain to which the group session belongs. GroupID is the unique identifier of the multicast group. GroupKeySetIndex points to the shared group key of the multicast group, used for encrypting and decrypting messages transmitted within the group. Endpoints are the endpoints on the node devices that belong to the multicast group. GroupName is the name of the multicast group. fabric-idx represents the data type of the standard-defined domain index. group-id represents the data type of the standard-defined group identifier. desc indicates that the detailed description section is available. all indicates that all values ​​are allowed in the numeric data type.

[0085] If the message received by the node device is a multicast message, the node device will check the group table after receiving the message to determine which endpoints in the group table have the same group identifier as the group identifier in the multicast message. The endpoints with the same group identifier belong to the multicast group corresponding to the multicast message. Then, the multicast message will be delivered to each endpoint on the node device that belongs to the multicast group.

[0086] Access control list (ACL): Specifies the access permissions that other node devices have for this node device.

[0087] ACL cluster: Used to control access permissions for node devices. Each node device has one ACL cluster. When a node device receives a request, it first checks the ACL to see if the requester has the necessary permissions. ACL clusters include attributes, as shown in Table 4.

[0088] Table 4 Attributes of ACL Feature Sets

[0089]

[0090] The information included in the access control entity structure of the ACL function set is shown in Table 5.

[0091] Table 5 Information included in the access control entity structure

[0092]

[0093] The permissions (Privilege) in the access control entity structure include:

[0094] The "view" option indicates read and subscribe permissions (except for ACL feature sets).

[0095] Proxy view indicates read and subscription permissions.

[0096] The term "operate" refers to the permissions to view information and to execute the main functions of the device (excluding ACL function sets).

[0097] "Manage" refers to the permissions for operations and the permission to modify configuration data (except for ACL feature sets).

[0098] The term "administrator" refers to administrative privileges, including the ability to subscribe to and modify ACL feature sets.

[0099] The authentication mode (AuthMode) in the access control entity structure includes:

[0100] PASE (passcode authenticated session) represents a key-based secure connection.

[0101] CASE (certificate authenticated session) indicates a certificate-based secure connection.

[0102] GROUP (group authenticated session) represents a group-based secure connection.

[0103] When a node device within a multicast group receives a multicast message and checks its ACL, the content of the Subjects field in the ACL is the group ID. This means that if any node device in the multicast group sends a group command, all other node devices receiving the command must execute it. If a node device in the multicast group is illegally controlled, it can construct group commands to control other node devices in the group. These other node devices cannot distinguish whether the received group commands are legitimate or illegitimate, resulting in poor security for communication between node devices within a multicast group.

[0104] The background technology of this application has been introduced above. The technical features of the embodiments of this application are described below.

[0105] See Figure 1 , Figure 1 This is a schematic diagram illustrating a group command processing method provided in an embodiment of this application. Figure 1 As shown, the processing methods for this group of commands include:

[0106] S101. The target node device receives a multicast message. The multicast message is a group command and includes group identification information and source node device identification information.

[0107] Specifically, the target node device and the source node device belong to the first multicast group. Within this multicast group, the source node device sends a multicast message, which is a group command, and the target node device receives the multicast message accordingly. The group identifier information included in the multicast message is the group identifier information of the first multicast group.

[0108] S102. The target node device determines whether to execute the group command based on the group identification information, the source node device's identification information, and the topic information in the target node device's access control list (ACL).

[0109] Optionally, before determining whether to execute a group command based on the group identifier information, the identifier information of the source node device, and the topic information in the ACL, the method further includes: receiving ACL configuration information from the configurator, wherein the ACL configuration information includes the group identifier information and the identifier information of at least one control node device; and configuring the ACL based on the group identifier information and the identifier information of at least one control node device.

[0110] Specifically, the target node device receives ACL configuration information from the configurator. This ACL configuration information includes group identifier information and identifier information of at least one control node device. The target node device configures the ACL based on the group identifier information and the identifier information of the at least one control node device. Optionally, in addition to the group identifier information and the identifier information of the at least one control node device, the ACL configuration information may also include other information, such as domain index (FabricIndex), privileges (Privilege), authentication mode (AuthMode), etc. The target node device may also configure other information in the ACL.

[0111] The configurator is used to configure node devices in a multicast group, and each node device in the same multicast group is configured by a single configurator. Specifically, the group identifier information in the ACL configuration information is the group identifier information of the first multicast group, and the identifier information of at least one control node device is used to indicate at least one control node device in the first multicast group. When configuring node devices within a multicast group, the configurator identifies one or more node devices as control node devices; only group commands sent by these control node devices will be executed by other node devices within the group.

[0112] In one possible implementation, configuring the ACL based on group identification information and identification information of at least one control node device includes: configuring the group identification information in the first information of the first access control entity (ACE) of the ACL; configuring the identification information of at least one control node device in at least one topic information of the first ACE, wherein the identification information of at least one control node device corresponds one-to-one with the at least one topic information.

[0113] Specifically, the ACL of the target node device includes one or more access control entities (ACEs), each ACE including a first piece of information and one or more subject information (subject IDs). In one possible implementation, the first piece of information can be the subject information in the ACE. After receiving the ACL configuration information, the target node device configures the group identifier information in the ACL configuration information into the first piece of information of the first ACE, and also configures the identifier information of at least one control node device in the ACL configuration information into the first ACE. For example, the control node devices in the first multicast group include node device 1, node device 2, and node device 3. Only group commands issued by node device 1, node device 2, and node device 3 will be executed by other node devices in the group. The identifier information of node device 1, node device 2, and node device 3 is configured into the three subject information in the first ACE, with one identifier information corresponding to one subject information. It should be noted that in this implementation, one ACE corresponds to one multicast group, and the group identifier information and control node device identifier information of other multicast groups need to be configured in other ACEs.

[0114] In one possible implementation, configuring the ACL based on the group identification information and the identification information of at least one control node device further includes: configuring the number n of the identification information of at least one control node device in the first information.

[0115] Specifically, the ACL of the target node device includes one or more ACEs, and each ACE includes one or more first information and one or more topic information. In one possible implementation, the first information can be the topic information in the ACE. After receiving the ACL configuration information, the target node device configures the group identifier information in the ACL configuration information into the first information of the first ACE, configures the identifier information of at least one control node device in the ACL configuration information into the first ACE, and also configures the number n of the identifier information of at least one control node device into the first information. For example, the control node devices in the first multicast group include node device 1, node device 2, and node device 3. The identifier information of node device 1, node device 2, and node device 3 are respectively configured into the three topic information in the first ACE, with one identifier information corresponding to one topic information. In this case, the number n of the identifier information is 3, and n=3 is also configured into the first information. It should be noted that in this implementation, one ACE corresponds to one or more multicast groups, and the group identifier information of other multicast groups and the identifier information of control node devices can also be configured into the first ACE.

[0116] In one possible implementation, configuring the ACL based on group identification information and identification information of at least one control node device includes: configuring the group identification information in at least one topic information of the first ACE of the ACL; compressing the identification information of each control node device in the identification information of at least one control node device to obtain compressed identification information of at least one control node device; configuring the compressed identification information of at least one control node device in at least one topic information containing the group identification information, wherein the compressed identification information of at least one control node device corresponds one-to-one with the at least one topic information.

[0117] Specifically, the ACL of the target node device includes one or more ACEs, and each ACE includes one or more topic information. After receiving the ACL configuration information, the target node device configures the group identifier information in the ACL configuration information into at least one topic information of the first ACE, compresses the identifier information of each control node device in the identifier information of at least one control node device to obtain compressed identifier information of at least one control node device, and also configures the compressed identifier information of at least one control node device into at least one topic information containing the group identifier information. For example, the control node devices in the first multicast group include node device 1, node device 2, and node device 3. The group identifier information is configured into the three topic information respectively, and the compressed identifier information of node device 1, node device 2, and node device 3 is also configured into the three topic information respectively. That is, each of the three topic information includes group identifier information and compressed identifier information. It should be noted that in this embodiment, one ACE corresponds to one or more multicast groups, and the group identifier information of other multicast groups and the compressed identifier information of control node devices can also be configured in the first ACE.

[0118] In one possible implementation, configuring the ACL based on group identification information and identification information of at least one control node device includes: compressing the identification information of each control node device in the group identification information and the identification information of at least one control node device to obtain at least one first compressed information; configuring the at least one first compressed information in at least one topic information of the ACL, wherein the at least one first compressed information corresponds one-to-one with the at least one topic information.

[0119] Specifically, the ACL of the target node device includes one or more ACEs, and each ACE includes one or more topic information. After receiving the ACL configuration information, the target node device compresses the group identifier information in the ACL configuration information and the identifier information of each control node device in at least one control node device to obtain at least one first compressed information, and configures the at least one first compressed information in at least one topic information of the ACL. For example, the control node devices in the first multicast group include node device 1, node device 2, and node device 3. The group identifier information is compressed with the identifier information of node device 1, the identifier information of node device 2, and the identifier information of node device 3 respectively to obtain three first compressed information. Then, the three first compressed information are configured in three topic information respectively. That is, in the three topic information, each topic information includes one first compressed information, and one first compressed information is obtained by compressing the group identifier information and the identifier information of a control node device. It should be noted that in this embodiment, one ACE corresponds to one or more multicast groups, and the information obtained by compressing the group identifier information and the identifier information of the control node devices in other multicast groups can also be configured in the first ACE.

[0120] Optionally, determining whether to execute a group command based on the group identifier information, the source node device's identifier information, and the topic information in the target node device's Access Control List (ACL) includes: determining the first ACE in the ACL based on the group identifier information; searching the first ACE for topic information that matches the source node device's identifier information; and if it exists, executing the group command. In one possible implementation, if it does not exist, the group command is not executed.

[0121] Specifically, based on the group identifier information, the first ACE in the ACL of the target node device is determined. This first ACE also includes at least one topic information, which configures the identifier information of the control node device in the multicast group. The first ACE is searched for a topic information that matches the identifier information of the source node device. If it does, it indicates that the source node device is the control node device in the multicast group, and therefore, the group command issued by the source node device can be executed, and the target node device executes the group command; otherwise, it is not executed.

[0122] Optionally, determining whether to execute a group command based on the group identifier information, the source node device's identifier information, and the topic information in the target node device's Access Control List (ACL) includes: determining the first information in the ACL based on the group identifier information; searching for information matching the source node device's identifier information in the last n topic information of the first information; if such information exists, then the group command is executed. In one possible implementation, if such information does not exist, then the group command is not executed.

[0123] Specifically, based on the group identifier information, the first information in the ACL of the target node device is determined, and the number n of identifier information in this first information is obtained. The last n topics of the first information configure the identifier information of the control node device in the multicast group. The system searches for a topic information in the last n topics of the first information that matches the identifier information of the source node device. If a match is found, it indicates that the source node device is the control node device in the multicast group, and therefore, the group command issued by the source node device can be executed, and the target node device executes the group command; otherwise, it is not executed.

[0124] Optionally, determining whether to execute a group command based on the group identifier information, the source node device's identifier information, and the topic information in the target node device's Access Control List (ACL) includes: determining at least one topic in the ACL containing the group identifier information based on the group identifier information; compressing the source node device's identifier information to obtain compressed identifier information for the source node device; searching for information matching the compressed identifier information of the source node device in the at least one topic containing the group identifier information; and executing the group command if such information exists. In one possible implementation, if such information does not exist, the group command is not executed.

[0125] Specifically, based on the group identifier information, the target node device's ACL is determined to contain at least one topic containing that group identifier information. This topic information configures the compressed identifier information of the control node device in the multicast group. The compressed identifier information of the control node device is obtained by compressing the control node device's identifier information. The source node device's identifier information is compressed using the same algorithm as the control node device's identifier information to obtain the source node device's compressed identifier information. The at least one topic containing that group identifier information is then searched for information matching the source node device's compressed identifier information. If a match is found, the source node device is considered the control node device in the multicast group, and therefore, group commands issued by the source node device can be executed, and the target node device executes the group commands; otherwise, they are not executed.

[0126] Optionally, determining whether to execute a group command based on group identifier information, source node device identifier information, and topic information in the target node device's Access Control List (ACL) includes: determining at least one topic information in the ACL containing group identifier information based on the group identifier information; decompressing the at least one topic information containing group identifier information to obtain at least one first decompressed information; searching within the at least one first decompressed information for information matching the source node device identifier information; and if such information exists, executing the group command. In one possible implementation, if such information does not exist, the group command is not executed.

[0127] Specifically, based on the group identifier information, the ACL of the target node device is determined to contain at least one topic information containing that group identifier information. This topic information configures the compressed identifier information of the control node device in the multicast group, which is obtained by compressing the control node device's identifier information. The at least one topic information containing the group identifier information is decompressed to obtain at least one first decompressed information, which includes the control node device's identifier information. The at least one first decompressed information is then searched for information matching the source node device's identifier information. If such information exists, it indicates that the source node device is the control node device in the multicast group; therefore, group commands issued by the source node device can be executed, and the target node device executes the group commands. Otherwise, they are not executed.

[0128] Optionally, determining whether to execute a group command based on the group identifier information, the source node device's identifier information, and the topic information in the target node device's Access Control List (ACL) includes: compressing the group identifier information and the source node device's identifier information to obtain second compressed information; searching the ACL for topic information that matches the second compressed information; and if it exists, executing the group command. In one possible implementation, if it does not exist, the group command is not executed.

[0129] Specifically, the ACL of the target node device includes at least one topic information, which is configured with first compressed information obtained by compressing group identifier information and the identifier information of the control node device in the multicast group. The group identifier information and the identifier information of the source node device are compressed using the same algorithm as the compression of the group identifier information and the identifier information of the control node device in the multicast group, resulting in second compressed information. The ACL is then checked to see if there is topic information matching the second compressed information. If it does, it indicates that the source node device is the control node device in the multicast group, and therefore, group commands issued by the source node device can be executed, and the target node device executes the group commands; otherwise, they are not executed.

[0130] Optionally, determining whether to execute a group command based on the group identifier information, the source node device's identifier information, and the topic information in the target node device's Access Control List (ACL) includes: decompressing at least one topic information in the ACL to obtain at least one second decompressed information; searching within the at least one second decompressed information for information that matches the group identifier information and the source node device's identifier information; and if such information exists, executing the group command. In one possible implementation, if such information does not exist, the group command is not executed.

[0131] Specifically, the ACL of the target node device includes at least one topic information. This topic information is configured with first compressed information, which is obtained by compressing group identification information and the identification information of the control node device in the multicast group. The at least one topic information is decompressed to obtain at least one second decompressed information, which includes both group identification information and the identification information of the control node device. The at least one second decompressed information is searched for information that matches the group identification information and the identification information of the source node device included in the group command. If a match is found, it indicates that the source node device is the control node device in the multicast group, and therefore the group command issued by the source node device can be executed, and the target node device executes the group command; otherwise, it is not executed.

[0132] Optionally, the target node device receives group table configuration information from the configurator, the group table configuration information including first indication information, the first indication information being used to indicate whether the target node device is a control node device; and the first indication information is configured in the group table of the target node device.

[0133] Specifically, when configuring node devices within a multicast group, the configurator designates one or more devices as control node devices. Only group commands sent by the control node devices will be executed by other node devices within the group. The target node device receives group table configuration information from the configurator. This group table configuration information includes first indication information. After receiving this information, the target node device configures the first indication information in the group table, where it indicates whether the target node device is a control node device. Thus, each node device in the multicast group has the first indication information in its group table. By retrieving this first indication information from each node device's group table, the configurator can determine which node devices in the multicast group are control node devices. When sending ACL configuration information to node devices in the multicast group, the configurator can identify the control node devices within the group based on the first indication information. The ACL configuration information sent by the configurator to the control node device includes the identification information of all control node devices in the multicast group other than the target control node device itself. The ACL configuration information sent to other node devices includes the identification information of all control node devices in the multicast group.

[0134] Optionally, the ACL configuration information also includes authentication mode configuration information. The target node device configures the authentication mode of the ACE in the ACL to enhanced group-based secure connection according to the authentication mode configuration information.

[0135] In the above method, the target node device receives multicast messages, which are group commands including group identifier information and source node device identifier information. The target node device determines whether to execute the group command based on the group identifier information, source node device identifier information, and topic information in the ACL. Within the multicast group, the source of the group command is restricted by the topic information in the ACL, ensuring that only group commands issued by the control node device can be executed by other devices in the group. After receiving the group command, the target node device checks the topic information in the ACL and, combined with the source node device identifier information, can determine whether the group command from the source node device can be executed. This prevents a situation where a node device within the multicast group is illegally controlled and then uses group commands to control other node devices in the group, thus improving the security of communication between node devices within the multicast group.

[0136] See Figure 2 , Figure 2 This is a schematic diagram illustrating another group command processing method provided in an embodiment of this application. For example... Figure 2 As shown, the processing methods for this group of commands include:

[0137] S201, the configurator sends group table configuration information to the target node device. The group table configuration information includes first indication information. Correspondingly, the target node device receives the group table configuration information.

[0138] The configurator is used to configure the node devices in the multicast group, and the node devices in the same multicast group are configured by one configurator.

[0139] Specifically, when configuring node devices within a multicast group, the configurator designates one or more node devices as control node devices. Only group commands sent by the control node devices will be executed by other node devices within the group. The configurator sends group table configuration information to multiple node devices within the multicast group. This group table configuration information includes first indication information, which instructs each of the multiple node devices to configure the first indication information in the group table. The first indication information indicates whether each node device is a control node device.

[0140] Optionally, the group table configuration information may also include other information, such as domain index, group identifier, group key index, etc. The target node device will also configure the domain index, group identifier, group key index, etc. in the group table.

[0141] S202. The target node device configures the first indication information in the group table. The first indication information is used to indicate whether the target node device is a control node device.

[0142] Specifically, the target node device receives the group table configuration information and configures the first indication information included in the group table in the group table. If the group table configuration information also includes other information, such as domain index, group identifier, group key index, etc., the target node device also configures the domain index, group identifier, group key index, etc. in the group table.

[0143] In one possible implementation, a first indication information is added to the group table of the target node device, and the information contained in the group table of the target node device is shown in Table 6.

[0144] Table 6 contains information about the target node devices.

[0145]

[0146] The data type of the first indication information is boolean, which indicates that the first indication information is true or false. When the first indication information is true, it indicates that the target node device is a control node device. When the first indication information is false or default, it indicates that the target node device is not a control node device.

[0147] S203. The configurator obtains the first indication information in the group table of the target node device and determines whether the target node device is a control node device.

[0148] Specifically, before sending ACL configuration information to the target node device, the configurator needs to determine whether the target node device is a control node device within the multicast group. In one possible implementation, the configurator obtains the first indication information in the group table of each node device within the multicast group by sending a request message, thereby determining which devices in the multicast group are control node devices.

[0149] Optionally, the configurator may also save information on whether each node device is a control node device when adding each node device to the multicast group, so that it does not need to obtain it from each node device again.

[0150] S204. The configurator sends Access Control List (ACL) configuration information to the target node device. The ACL configuration information includes group identification information and identification information of at least one control node device. Accordingly, the target node device receives the ACL configuration information.

[0151] Specifically, the group identifier information in the ACL configuration information is the group identifier information of the first multicast group to which the target node device belongs, and the identifier information of at least one control node device indicates at least one control node device in the first multicast group.

[0152] If the target node device is a control node device within the multicast group, the ACL configuration information includes the identification information of all other control node devices within the multicast group besides the target node device. If the target node device is not a control node device within the multicast group, the ACL configuration information includes the identification information of all control node devices within the multicast group.

[0153] Optionally, in addition to the identification information of the group and the identification information of the at least one control node device, the ACL configuration information may also include other information, such as domain index, permissions, authentication mode, etc. The target node device may also configure other information in the ACL.

[0154] S205. The target node device configures the ACL based on the group identification information and the identification information of at least one control node device.

[0155] In one possible implementation, the target node device configures the group identification information in the first information of the first access control entity (ACE) of the ACL; and configures the identification information of at least one control node device in at least one topic information of the first ACE, wherein the identification information of at least one control node device corresponds one-to-one with the at least one topic information.

[0156] In one possible implementation, the target node device configures the number n of identification information of at least one control node device in the first information.

[0157] In one possible implementation, the target node device configures the group identification information in at least one topic information of the first ACE of the ACL; compresses the identification information of each control node device in the identification information of at least one control node device to obtain compressed identification information of at least one control node device; and configures the compressed identification information of at least one control node device in at least one topic information containing the group identification information, wherein the compressed identification information of at least one control node device corresponds one-to-one with at least one topic information.

[0158] In one possible implementation, the target node device compresses the identification information of each control node device in the group identification information and the identification information of the at least one control node device to obtain at least one first compressed information; the at least one first compressed information is configured in at least one topic information of the ACL, and the at least one first compressed information corresponds one-to-one with the at least one topic information.

[0159] In one possible implementation, a new authentication mode is added to the access control entity structure of the target node device. The authentication modes in the target node device's access control entity structure include: key-based secure connection, certificate-based secure connection, group-based secure connection, and enhanced group-based secure connection. The enhanced group-based secure connection is a newly added authentication mode, meaning it inherits the group-based secure connection mode while also satisfying the content of the topic information in the ACL of the above implementation.

[0160] S206. The target node device receives the group command, which includes group identification information and the identification information of the source node device.

[0161] Specifically, the target node device and the source node device belong to the same multicast group. Within this multicast group, the source node device sends group commands, and the target node device receives the group commands accordingly.

[0162] S207. The target node device determines whether to execute the group command based on the group identification information, the source node device's identification information, and the topic information in the target node device's access control list (ACL).

[0163] In one possible implementation, the target node device determines the first ACE in the ACL based on the group identifier information; searches the first ACE for topic information that matches the identifier information of the source node device; if it does, the group command is executed. In another possible implementation, if it does not, the group command is not executed.

[0164] In one possible implementation, the target node device determines the first information in the ACL based on the group identifier information; it then searches for information matching the source node device's identifier information among the last n topic information of the first information; if such information exists, the group command is executed. In another possible implementation, if such information does not exist, the group command is not executed.

[0165] In one possible implementation, the target node device determines at least one topic information containing group identification information in the ACL based on the group identification information; compresses the source node device's identification information to obtain compressed identification information of the source node device; searches for information matching the compressed identification information of the source node device in the at least one topic information containing group identification information; if it exists, the group command is executed. In another possible implementation, if it does not exist, the group command is not executed.

[0166] In one possible implementation, the target node device determines at least one topic information containing group identification information in the ACL based on the group identification information; decompresses the at least one topic information containing group identification information to obtain at least one first decompressed information; searches the at least one first decompressed information for information that matches the identification information of the source node device; if it does, the group command is executed. In one possible implementation, if it does not, the group command is not executed.

[0167] In one possible implementation, the target node device compresses the group identifier information and the source node device identifier information to obtain second compressed information; it then searches the ACL for a topic information that matches the second compressed information; if a match is found, the group command is executed. In another possible implementation, if a match is not found, the group command is not executed.

[0168] In one possible implementation, the target node device decompresses at least one topic information in the ACL to obtain at least one second decompressed information; it then searches within the at least one second decompressed information for information that matches the group identifier information and the source node device's identifier information; if such information exists, the group command is executed. In another possible implementation, if such information does not exist, the group command is not executed.

[0169] In the above method, the configurator sends ACL configuration information to the target node device. The ACL configuration information includes group identifier information and the identifier information of at least one control node device. The target node device configures the ACL based on the group identifier information and the identifier information of at least one control node device. Within the multicast group, the source of group commands is restricted by the topic information in the ACL, ensuring that only group commands issued by the control node device can be executed by other node devices within the group. After receiving a group command, the target node device checks the topic information in the ACL and, combined with the identifier information of the source node device, can determine whether the group command from the source node device can be executed. This prevents a situation where an unauthorized node device within the multicast group can control other node devices within the group via group commands, thus improving the security of communication between node devices within the multicast group.

[0170] See Figure 3 , Figure 3 This is a schematic diagram illustrating another group command processing method provided in an embodiment of this application. For example... Figure 3 As shown, the processing methods for this group of commands include:

[0171] S301. The target node device receives ACL configuration information from the configurator, which includes group identification information and identification information of at least one control node device.

[0172] Specifically, the configurator is used to configure node devices in a multicast group, and node devices in the same multicast group are configured by one configurator. Specifically, the group identifier information in the ACL configuration information is the group identifier information of the first multicast group to which the target node device belongs, and the identifier information of at least one control node device indicates at least one control node device in that first multicast group. When configuring node devices within a multicast group, the configurator determines one or more node devices as control node devices; only group commands sent by the control node devices will be executed by other node devices in the group.

[0173] Optionally, in addition to the identification information of the group and the identification information of the at least one control node device, the ACL configuration information may also include other information, such as domain index, permissions, authentication mode, etc. The target node device may also configure other information in the ACL.

[0174] S302. The target node device configures the group identification information in the first information of the first access control entity ACE of the ACL.

[0175] Specifically, the ACL of the target node device includes one or more access control entities (ACEs), and each ACE includes a first piece of information and one or more topic pieces of information. In one possible implementation, the first piece of information may be the topic information in the ACE. After receiving the ACL configuration information, the target node device configures the group identifier information in the ACL configuration information into the first piece of information of the first ACE.

[0176] S303, The target node device configures the identification information of at least one control node device in at least one topic information of the first ACE.

[0177] Specifically, the target node device also configures the identification information of at least one control node device in the ACL configuration information in at least one topic information of the first ACE, with a one-to-one correspondence between the identification information of at least one control node device and at least one topic information. For example, the control node devices in the first multicast group include node device 1, node device 2, and node device 3. Only group commands issued by node device 1, node device 2, and node device 3 will be executed by other node devices in the group. The identification information of node device 1, node device 2, and node device 3 is configured in three topic information of the first ACE, with one identification information corresponding to one topic information. It should be noted that in this embodiment, one ACE corresponds to one multicast group, and the group identification information and control node device identification information of other multicast groups need to be configured in other ACEs.

[0178] In one possible implementation, the Subjects structure of the first ACE of the target node device is shown in Table 7.

[0179] Table 7. The first type of thematic structure in ACE

[0180]

[0181] Specifically, in an ACE, the topic information is 64 bits long, and the first information is the topic information in the ACE. The group identifier information is 16 bits long, and the identification information of the control node device is 64 bits long. In the structure shown in Table 7, the group identifier information is configured in the lower 16 bits of the first information, and the identification information of the control node device is configured in the next 64 bits (i.e., the next topic information). It should be noted that the structure shown in Table 7 is only an example; the group identifier information can also be configured in the upper 16 bits of the first information, or it can be configured in any 16 bits of the first information. If there are multiple identification information for control node devices, then the identification information of multiple control node devices is configured in multiple topic information following the first information.

[0182] Optionally, bits 16-23 of the first information can also be configured with the number n of identification information for at least one control node device. For example, if the first ACE is configured with identification information for 3 control node devices, then n is 3, and n=3 is configured in the first information.

[0183] S304. The target node device receives the group command, which includes group identification information and the identification information of the source node device.

[0184] Specifically, the target node device and the source node device belong to the first multicast group. Within this multicast group, the source node device sends group commands, and the target node device receives the group commands accordingly.

[0185] S305. The target node device determines the first ACE in the ACL based on the group identification information.

[0186] Optionally, after receiving the group command, the target node device searches for an ACE in the ACL that meets the following conditions: the authentication mode (AuthMode) of the ACE is GROUP; the targets in the ACE match the target resource requested by the group command; and the fabric index in the ACE matches the group identifier information in the group command. The ACE that meets the aforementioned conditions is the first ACE.

[0187] S306. The target node device searches in the first ACE for whether there is topic information that matches the identification information of the source node device.

[0188] Specifically, the first ACE also includes at least one topic information, which is configured with the identification information of the control node device in the multicast group. The target node device searches in the first ACE for a topic information that matches the identification information of the source node device. If it does, it means that the source node device is the control node device in the multicast group, and therefore the group command issued by the source node device can be executed, and the target node device executes the group command; otherwise, it does not execute.

[0189] S307. If it exists, the target node device executes the group command.

[0190] S308. If it does not exist, the target node device will not execute the group command.

[0191] In the above method, within a multicast group, the source of group commands is restricted by the topic information in the ACL, ensuring that only group commands issued by the control node device can be executed by other node devices within the group. Upon receiving a group command, the target node device checks the topic information in the ACL and, combined with the source node device's identification information, determines whether the group command from the source node device can be executed. This prevents a situation where an unauthorized node device within the multicast group can control other node devices within the group via group commands, thus improving the security of communication between node devices within the multicast group.

[0192] See Figure 4 , Figure 4 This is a schematic diagram illustrating another group command processing method provided in an embodiment of this application. For example... Figure 4 As shown, the processing methods for this group of commands include:

[0193] S401. The target node device receives ACL configuration information from the configurator, which includes group identification information and identification information of at least one control node device.

[0194] Specifically, the configurator is used to configure node devices in a multicast group, and node devices in the same multicast group are configured by one configurator. Specifically, the group identifier information in the ACL configuration information is the group identifier information of the first multicast group to which the target node device belongs, and the identifier information of at least one control node device indicates at least one control node device in the first multicast group. When configuring node devices within a multicast group, the configurator identifies one or more node devices as control node devices; only group commands sent by the control node devices will be executed by other node devices in the group.

[0195] Optionally, in addition to the identification information of the group and the identification information of the at least one control node device, the ACL configuration information may also include other information, such as domain index, permissions, authentication mode, etc. The target node device may also configure other information in the ACL.

[0196] S402. The target node device configures the group identification information in the first information of the first access control entity ACE of the ACL.

[0197] Specifically, the ACL of the target node device includes one or more ACEs, and each ACE includes one or more first information and one or more topic information. After receiving the ACL configuration information, the target node device configures the group identifier information in the first information of the first ACE.

[0198] S403, The target node device configures the number n of identification information of at least one control node device in the first information.

[0199] Specifically, the ACL of the target node device includes one or more ACEs, and each ACE includes one or more first information and one or more second topic information. In one possible implementation, the first information may be the topic information in the ACE. After receiving the ACL configuration information, the target node device configures the group identifier information in the ACL configuration information into the first information of the first ACE, and also configures the number n of identifier information of at least one control node device into the first information. For example, if the control node devices in the first multicast group include node device 1, node device 2, and node device 3, then the number n of identifier information is 3, and the target node device also configures n=3 into the first information.

[0200] S404. The target node device configures the identification information of at least one control node device in at least one topic information of the first ACE.

[0201] Specifically, the target node device also configures the identification information of at least one control node device in the ACL configuration information in at least one topic information of the first ACE. For example, the control node devices in the first multicast group include node device 1, node device 2, and node device 3. The identification information of node device 1, node device 2, and node device 3 are respectively configured in three topic information of the first ACE, with one identification information corresponding to one topic information. It should be noted that in this embodiment, one ACE corresponds to one or more multicast groups, and the group identification information and control node device identification information of other multicast groups can also be configured in the first ACE.

[0202] In one possible implementation, the Subjects structure of the first ACE of the target node device is shown in Table 8.

[0203] Table 8. The second thematic structure of ACE

[0204]

[0205] Specifically, in an ACE, the topic information is 64 bits long, and the first information is the topic information in the ACE. The group identifier information is 16 bits long, and the identification information of the control node device is 64 bits long. In the structure shown in Table 8, the group identifier information is configured in the lower 16 bits of the first information, and bits 16-23 of the first information configure the number of devices corresponding to at least one control node device's identification information. It should be noted that the structure shown in Table 8 is only an example; the group identifier information can be configured in any 16 bits of the first information, and the number n of the control node device's identification information can also be configured in a position in the first information that does not overlap with the group identifier information. For example, if 3 identification information is configured in the first ACE, then n is 3, and n=3 is configured in the first information.

[0206] The identification information of the control node device is configured in the next 64 bits of the first information (i.e., the next topic information). If there are multiple identification information for control node devices, the identification information for multiple control node devices is configured in multiple topic information following the first information. In the first ACE, multiple groups of identification information can be configured in multiple pieces of first information respectively.

[0207] S405. The target node device receives a group command, which includes group identification information and source node device identification information.

[0208] Specifically, the target node device and the source node device belong to the first multicast group. Within this multicast group, the source node device sends group commands, and the target node device receives the group commands accordingly.

[0209] S406. The target node device determines the first information in the ACL based on the group identifier information.

[0210] Specifically, the target node device configures the group identifier information from the ACL configuration information into the first information of the first ACE. Therefore, the target node device can determine the first information based on the group identifier information in the group command.

[0211] S407. The target node device searches for information matching the identification information of the source node device in the last n topic information of the first information.

[0212] Specifically, after determining the first information, the number n of identification information of the control node devices in the first information is obtained. The last n topics of the first information configure the identification information of the control node devices in the multicast group. The system searches for a topic that matches the identification information of the source node device among the last n topics of the first information. If a match is found, it indicates that the source node device is a control node device in the multicast group, and therefore, the group command issued by the source node device can be executed, and the target node device executes the group command; otherwise, it is not executed.

[0213] S408. If it exists, the target node device executes the group command.

[0214] S409. If it does not exist, the target node device will not execute the group command.

[0215] In the above method, within a multicast group, the source of group commands is restricted by the topic information in the ACL, ensuring that only group commands issued by the control node device can be executed by other node devices within the group. Upon receiving a group command, the target node device checks the topic information in the ACL and, combined with the source node device's identification information, determines whether the group command from the source node device can be executed. This prevents a situation where an unauthorized node device within the multicast group can control other node devices within the group via group commands, thus improving the security of communication between node devices within the multicast group.

[0216] See Figure 5 , Figure 5 This is a schematic diagram illustrating another group command processing method provided in an embodiment of this application. For example... Figure 5 As shown, the processing methods for this group of commands include:

[0217] S501. The target node device receives ACL configuration information from the configurator, which includes group identification information and identification information of at least one control node device.

[0218] Specifically, the configurator is used to configure node devices in a multicast group, and node devices in the same multicast group are configured by one configurator. Specifically, the group identifier information in the ACL configuration information is the group identifier information of the first multicast group to which the target node device belongs, and the identifier information of at least one control node device indicates at least one control node device in the first multicast group. When configuring node devices within a multicast group, the configurator identifies one or more node devices as control node devices; only group commands sent by the control node devices will be executed by other node devices in the group.

[0219] Optionally, in addition to the identification information of the group and the identification information of the at least one control node device, the ACL configuration information may also include other information, such as domain index, permissions, authentication mode, etc. The target node device may also configure other information in the ACL.

[0220] S502, The target node device configures the group identification information in at least one topic information of the first ACE of the ACL.

[0221] Specifically, the ACL of the target node device includes one or more ACEs, and each ACE includes one or more topic information. After receiving the ACL configuration information, the target node device configures the group identifier information in the ACL configuration information into at least one topic information of the first ACE.

[0222] S503. The target node device compresses the identification information of each control node device in the identification information of at least one control node device to obtain compressed identification information of at least one control node device.

[0223] S504. The target node device configures the compressed identification information of at least one control node device in at least one topic information containing group identification information, and the compressed identification information of at least one control node device corresponds one-to-one with at least one topic information.

[0224] Specifically, the target node device also configures the compressed identification information of at least one control node device in at least one topic information containing group identification information. For example, the control node devices in the first multicast group include node device 1, node device 2, and node device 3. The group identification information is configured in three topic information respectively, and the compressed identification information of node device 1, node device 2, and node device 3 is also configured in these three topic information respectively. That is, each of the three topic information includes group identification information and compressed identification information. It should be noted that in this embodiment, one ACE corresponds to one or more multicast groups, and the group identification information and compressed identification information of control node devices in other multicast groups can also be configured in the first ACE.

[0225] In one possible implementation, the Subjects structure of the first ACE of the target node device is shown in Table 9.

[0226] Table 9. The third type of thematic structure for ACE

[0227]

[0228] Specifically, in an ACE, the topic information is 64 bits long, the group identifier information is 16 bits long, and the control node device identifier information is 64 bits long. In the structure shown in Table 9, the group identifier information is configured in the lower 16 bits of the topic information, and the 64 bits of control node device identifier information is compressed to 48 bits and configured in the upper 48 bits of the topic information. It should be noted that the structure shown in Table 9 is only an example; the group identifier information can also be configured in the upper 16 bits of the topic information, and the 64 bits of control node device identifier information can be compressed to 48 bits and configured in the lower 48 bits of the topic information. If there are multiple control node device identifiers, each control node device identifier is compressed separately, and the compressed identifier information of each control node device and the group identifier information form the structure shown in Table 9 and are configured in the topic information. Optionally, in the first ACE, multiple group identifiers can be configured in multiple topic information sets, that is, group identifier 1 and group identifier 2 can be the same or different.

[0229] S505. The target node device receives the group command, which includes group identification information and the identification information of the source node device.

[0230] Specifically, the target node device and the source node device belong to the first multicast group. Within this multicast group, the source node device sends group commands, and the target node device receives the group commands accordingly.

[0231] S506. The target node device determines at least one topic information in the ACL based on the group identifier information.

[0232] Specifically, the target node device configures the group identification information in at least one topic information. Therefore, the target node device can determine the topic information containing the group identification information in the ACL based on the group identification information in the group command.

[0233] S507. Compress the identification information of the source node device to obtain the compressed identification information of the source node device.

[0234] Specifically, the topic information configures the compressed identification information of the control node device in the multicast group. The compressed identification information of the control node device is obtained by compressing the identification information of the control node device. The identification information of the source node device is then compressed using the same algorithm as that used to compress the identification information of the control node device to obtain the compressed identification information of the source node device.

[0235] S508. Search in at least one topic information for information that matches the compressed identification information of the source node device.

[0236] Specifically, the topic information configures the compressed identification information of the control node device in the multicast group. The compressed identification information of the control node device is obtained by compressing the identification information of the control node device. At least one topic information is searched for information that matches the compressed identification information of the source node device. If it does, it indicates that the source node device is the control node device in the multicast group, and therefore, the group command issued by the source node device can be executed, and the target node device executes the group command; otherwise, it is not executed.

[0237] S509. If it exists, the target node device executes the group command.

[0238] S510. If it does not exist, the target node device will not execute the group command.

[0239] In the above method, within a multicast group, the source of group commands is restricted by the topic information in the ACL, ensuring that only group commands issued by the control node device can be executed by other node devices within the group. Upon receiving a group command, the target node device checks the topic information in the ACL and, combined with the source node device's identification information, determines whether the group command from the source node device can be executed. This prevents a situation where an unauthorized node device within the multicast group can control other node devices within the group via group commands, thus improving the security of communication between node devices within the multicast group.

[0240] See Figure 6 , Figure 6 This is a schematic diagram illustrating another method for processing group commands provided in an embodiment of this application. For example... Figure 6 As shown, the processing methods for this group of commands include:

[0241] S601. The target node device receives ACL configuration information from the configurator, which includes group identification information and identification information of at least one control node device.

[0242] Specifically, the configurator is used to configure node devices in a multicast group, and node devices in the same multicast group are configured by one configurator. Specifically, the group identifier information in the ACL configuration information is the group identifier information of the first multicast group to which the target node device belongs, and the identifier information of at least one control node device indicates at least one control node device in the first multicast group. When configuring node devices within a multicast group, the configurator identifies one or more node devices as control node devices; only group commands sent by the control node devices will be executed by other node devices in the group.

[0243] Optionally, in addition to the identification information of the group and the identification information of the at least one control node device, the ACL configuration information may also include other information, such as domain index, permissions, authentication mode, etc. The target node device may also configure other information in the ACL.

[0244] S602, The target node device compresses the identification information of each control node device in the group identification information and the identification information of at least one control node device to obtain at least one first compressed information.

[0245] Specifically, the ACL of the target node device includes one or more ACEs, and each ACE includes one or more topic information. After receiving the ACL configuration information, the target node device compresses the group identifier information in the ACL configuration information and the identifier information of each control node device in the identifier information of at least one control node device to obtain at least one first compressed information. For example, if the control node devices in the first multicast group include node device 1, node device 2, and node device 3, the group identifier information is compressed with the identifier information of node device 1, the identifier information of node device 2, and the identifier information of node device 3 respectively to obtain three first compressed information pieces.

[0246] S603. The target node device configures at least one first compression information in at least one topic information of the ACL, and at least one first compression information corresponds one-to-one with at least one topic information.

[0247] Specifically, the target node device configures at least one first compressed information in at least one topic information of the ACL. For example, the control node devices in the first multicast group include node device 1, node device 2, and node device 3. The group identification information is compressed with the identification information of node device 1, node device 2, and node device 3 respectively to obtain three first compressed information pieces. Then, the three first compressed information pieces are configured in three topic information pieces respectively. That is, in the three topic information pieces, each topic information piece includes one first compressed information piece, and each first compressed information piece is obtained by compressing the group identification information and the identification information of the control node device. It should be noted that in this embodiment, one ACE corresponds to one or more multicast groups, and the information obtained by compressing the group identification information and the identification information of the control node device in other multicast groups can also be configured in the first ACE.

[0248] In one possible implementation, the Subjects structure of the first ACE of the target node device is shown in Table 10.

[0249] Table 10 The fourth thematic structure of ACE

[0250] Theme Information

[0251] First compressed information ……

[0252] Specifically, in an ACE, the topic information is 64 bits long, the group identifier information is 16 bits long, and the control node device identifier information is 64 bits long. In the structure shown in Table 10, the 64-bit control node device identifier information and the 16-bit group identifier information are compressed into 64-bit compressed information and configured in the topic information. If there are multiple control node device identifier information, the identifier information of each control node device and the group identifier information are compressed to form the structure shown in Table 9 and configured in the topic information. Optionally, in the first ACE, the compressed information obtained by compressing the identifier information of the control node devices and the group identifier information of other multicast groups can be configured in different topic information.

[0253] S604. The target node device receives a group command, which includes group identification information and the identification information of the source node device.

[0254] Specifically, the target node device and the source node device belong to the first multicast group. Within this multicast group, the source node device sends group commands, and the target node device receives the group commands accordingly.

[0255] S605. The target node device compresses the group identification information and the source node device identification information to obtain the second compressed information.

[0256] Specifically, the ACL of the target node device includes at least one topic information, which is configured with first compressed information obtained by compressing the group identifier information and the identifier information of the control node device in the multicast group. Second compressed information is obtained by compressing the group identifier information and the identifier information of the source node device using the same algorithm as that used to compress the group identifier information and the identifier information of the control node device in the multicast group.

[0257] S606. The target node device checks in the ACL whether there is topic information that matches the second compressed information.

[0258] Specifically, the topic information is configured with first compressed information obtained by compressing the group identifier information and the identifier information of the control node device in the multicast group. The group identifier information and the source node device's identifier information are then compressed using the same compression algorithm to obtain second compressed information. The ACL is then checked to see if a topic information matching the second compressed information exists. If it does, it indicates that the source node device is the control node device in the multicast group; therefore, group commands issued by the source node device can be executed, and the target node device executes the group commands. Otherwise, they are not executed.

[0259] S607. If it exists, the target node device executes the group command.

[0260] S608. If it does not exist, the target node device will not execute the group command.

[0261] In the above method, within a multicast group, the source of group commands is restricted by the topic information in the ACL, ensuring that only group commands issued by the control node device can be executed by other node devices within the group. Upon receiving a group command, the target node device checks the topic information in the ACL and, combined with the source node device's identification information, determines whether the group command from the source node device can be executed. This prevents a situation where an unauthorized node device within the multicast group can control other node devices within the group via group commands, thus improving the security of communication between node devices within the multicast group.

[0262] The above describes the group command processing method provided in the embodiments of this application. The following will describe the communication device provided in the embodiments of this application.

[0263] See Figure 7 , Figure 7 This is a schematic diagram of a communication device 700 provided in an embodiment of this application. The communication device 700 is applied to a target node device and includes a transceiver unit 710 and a processing unit 720. The communication device 700 can be the target node device itself, or it can be a chip or integrated circuit inside the target node device, wherein:

[0264] The transceiver unit 710 is used to receive multicast messages, which are group commands and include group identification information and source node device identification information.

[0265] The processing unit 720 is configured to determine whether to execute the group command based on the group identification information, the identification information of the source node device, and the topic information in the access control list (ACL) of the target node device.

[0266] In this embodiment, the target node device receives a multicast message, which is a group command. This message includes group identifier information and the identifier information of the source node device. The target node device determines whether to execute the group command based on the group identifier information, the source node device's identifier information, and the topic information in the ACL. Within the multicast group, the source of the group command is restricted by the topic information in the ACL, ensuring that only group commands issued by the control node device can be executed by other devices in the group. After receiving the group command, the target node device checks the topic information in the ACL and, combined with the source node device's identifier information, determines whether the group command from the source node device can be executed. This prevents a situation where a node device within the multicast group is illegally controlled and then uses group commands to control other node devices in the group, thus improving the security of communication between node devices within the multicast group.

[0267] Optionally, as an embodiment, the transceiver unit 710 is further configured to receive ACL configuration information from the configurator, the ACL configuration information including the group identification information and the identification information of at least one control node device; the processing unit 720 is further configured to configure the ACL according to the group identification information and the identification information of the at least one control node device.

[0268] Optionally, as an embodiment, the processing unit 720 is specifically used to: configure the group identification information in the first information of the first access control entity (ACE) of the ACL; configure the identification information of the at least one control node device in at least one topic information of the first ACE, wherein the identification information of the at least one control node device corresponds one-to-one with the at least one topic information.

[0269] Optionally, as an embodiment, the processing unit 720 is further configured to: configure the number n of the identification information of the at least one control node device in the first information.

[0270] Optionally, as an embodiment, the processing unit 720 is specifically configured to: configure the group identification information in at least one topic information of the first ACE of the ACL; compress the identification information of each control node device in the identification information of the at least one control node device to obtain compressed identification information of at least one control node device; configure the compressed identification information of the at least one control node device in at least one topic information containing the group identification information, wherein the compressed identification information of the at least one control node device corresponds one-to-one with the at least one topic information.

[0271] Optionally, as an embodiment, the processing unit 720 is specifically used to: compress the identification information of each control node device in the group identification information and the identification information of the at least one control node device to obtain at least one first compressed information; configure the at least one first compressed information in at least one topic information of the ACL, wherein the at least one first compressed information corresponds one-to-one with the at least one topic information.

[0272] Optionally, as an embodiment, the processing unit 720 is specifically configured to: determine the first ACE in the ACL based on the group identification information; search in the first ACE for whether there is topic information that matches the identification information of the source node device; if so, execute the group command.

[0273] Optionally, as an embodiment, the processing unit 720 is specifically configured to: determine the first information in the ACL based on the group identification information; search for whether there is information matching the identification information of the source node device in the last n topic information of the first information; if so, execute the group command.

[0274] Optionally, as an embodiment, the processing unit 720 is specifically configured to: determine at least one topic information in the ACL that contains the group identification information based on the group identification information; compress the identification information of the source node device to obtain compressed identification information of the source node device; search for whether there is information matching the compressed identification information of the source node device in the at least one topic information containing the group identification information; if so, execute the group command.

[0275] Optionally, as an embodiment, the processing unit 720 is specifically configured to: determine at least one topic information containing the group identification information in the ACL based on the group identification information; decompress the at least one topic information containing the group identification information to obtain at least one first decompressed information; search in the at least one first decompressed information for information that matches the identification information of the source node device; if it does, execute the group command.

[0276] Optionally, as an embodiment, the processing unit 720 is specifically used to: compress the group identification information and the identification information of the source node device to obtain second compressed information; search in the ACL for whether there is topic information that matches the second compressed information; if so, execute the group command.

[0277] Optionally, as an embodiment, the processing unit 720 is specifically configured to: decompress at least one topic information in the ACL to obtain at least one second decompressed information; search in the at least one second decompressed information for information that matches the group identification information and the identification information of the source node device; if such information exists, then execute the group command.

[0278] Optionally, as an embodiment, the processing unit 720 is further configured to: if the group command does not exist, then not execute the group command.

[0279] Optionally, as an embodiment, the transceiver unit 710 is further configured to receive group table configuration information from the configurator, the group table configuration information including first indication information, the first indication information being used to indicate whether the target node device is a control node device; the processing unit 720 is further configured to configure the first indication information in the group table of the target node device.

[0280] Optionally, as an embodiment, the ACL configuration information further includes authentication mode configuration information, and the processing unit 720 is further configured to: configure the authentication mode of the ACE in the ACL as enhanced group-based secure connection according to the authentication mode configuration information.

[0281] It should be understood that the transceiver unit 710 in the embodiments of this application can be implemented by a transceiver or transceiver-related circuit components, and the processing unit 720 can be implemented by a processor or processor-related components.

[0282] See Figure 8 , Figure 8 This is a schematic diagram of another communication device provided in an embodiment of this application. The communication device 800 is applied to a configurator and includes a transceiver unit 810. The communication device 800 can be a configurator, or a chip or integrated circuit within the configurator, wherein:

[0283] The transceiver unit 810 is used to send Access Control List (ACL) configuration information to the target node device. The ACL configuration information includes group identifier information and identifier information of at least one control node device. The ACL configuration information is used to instruct the target node device to configure the ACL according to the group identifier information and the identifier information of the at least one control node device. The topic information in the ACL is used by the target node device to determine whether to execute the group command.

[0284] In this embodiment, the configurator sends ACL configuration information to the target node device. The ACL configuration information includes group identifier information and identifier information of at least one control node device. The target node device configures the ACL based on the group identifier information and the identifier information of at least one control node device. Within the multicast group, the source of group commands is restricted by the topic information in the ACL, ensuring that only group commands issued by the control node device can be executed by other devices within the group. After receiving a group command, the target node device checks the topic information in the ACL and, combined with the identifier information of the source node device, can determine whether the group command from the source node device can be executed. This prevents a situation where a node device within the multicast group is illegally controlled and then uses group commands to control other node devices within the group, thus improving the security of communication between node devices within the multicast group.

[0285] Optionally, as an embodiment, the transceiver unit 810 is further configured to: send group table configuration information to multiple node devices within a multicast group, the group table configuration information including first indication information, the group table configuration information being used to instruct each of the multiple node devices to configure the first indication information in the group table, the first indication information being used to indicate whether each node device is a control node device.

[0286] Optionally, as an embodiment, the device further includes a processing unit 820, which is configured to: determine the ACL configuration information based on the first indication information of the plurality of node devices.

[0287] It should be understood that the transceiver unit 810 in the embodiments of this application can be implemented by a transceiver or transceiver-related circuit components, and the processing unit 820 can be implemented by a processor or processor-related components.

[0288] See Figure 9 , Figure 9 This is a schematic diagram of a target node device 900 provided in an embodiment of this application. The target node device 900 includes a processor 910, a memory 920, and a transceiver 930. The memory 920 stores instructions or programs, and the processor 910 executes the instructions or programs stored in the memory 920. When the instructions or programs stored in the memory 920 are executed, the processor 910 performs the operations performed by the processing unit 720 in the above embodiment, and the transceiver 930 performs the operations performed by the transceiver unit 710 in the above embodiment.

[0289] It should be understood that the communication device 700 in this application embodiment can correspond to the target node device in the group command processing method of this application embodiment, and the operation and / or function of each unit in the communication device 700 or the target node device 900 are respectively to implement the corresponding process of the above-mentioned group command processing method. For the sake of brevity, it will not be described in detail here.

[0290] See Figure 10 , Figure 10 This is a schematic diagram of a configurator provided in an embodiment of this application. The configurator 1000 includes a processor 1010, a memory 1020, and a transceiver 1030. The memory 1020 stores instructions or programs, and the processor 1010 executes the instructions or programs stored in the memory 1020. When the instructions or programs stored in the memory 1020 are executed, the processor 1010 performs the operations performed by the processing unit 820 in the above embodiment, and the transceiver 1030 performs the operations performed by the transceiver unit 810 in the above embodiment.

[0291] It should be understood that the communication device 800 in this application embodiment can correspond to the configurator in the group command processing method of this application embodiment, and the operation and / or function of each unit in the communication device 800 or the configurator 1000 are respectively to implement the corresponding process of the above-mentioned group command processing method. For the sake of brevity, it will not be described in detail here.

[0292] This application also provides a computer-readable storage medium for storing instructions that, when executed by a processor, can implement the processes related to the target node device described in the above method embodiments.

[0293] This application also provides a computer-readable storage medium for storing instructions that, when executed by a processor, can implement the processes related to the configurator in the above method embodiments.

[0294] This application also provides a computer program product containing instructions that, when run on a computer or processor, cause the computer or processor to perform one or more steps in the above-described method embodiments. If the constituent modules of the aforementioned devices are implemented as software functional units and sold or used as independent products, they can be stored in the computer-readable storage medium.

[0295] It should be noted that the memories described herein are intended to include, but are not limited to, these and any other suitable types of memories.

[0296] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0297] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0298] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0299] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0300] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0301] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0302] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0303] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for processing multicast messages, characterized in that, The method is applied to the target node device and includes: Receive a multicast message, wherein the multicast message is a group command, and the multicast message includes group identification information and source node device identification information, wherein the group identification information is the group identification information of the multicast group to which the target node device and the source node device belong; Based on the group identifier information, the identifier information of the source node device, and the topic information in the access control list (ACL) of the target node device, determine whether to execute the group command; Before determining whether to execute the group command based on the group identifier information, the identifier information of the source node device, and the topic information in the access control list (ACL) of the target node device, the method further includes: Receive ACL configuration information from the configurator, the ACL configuration information including the group identification information and the identification information of at least one control node device, and also including domain index, permissions and authentication mode; Configure the ACL based on the group identification information and the identification information of the at least one control node device; The step of configuring the ACL based on the group identification information and the identification information of the at least one control node device includes: The group identification information is configured in at least one topic information of the first ACE of the ACL; The identification information of each control node device in the identification information of the at least one control node device is compressed to obtain the compressed identification information of at least one control node device. The compression identification information of the at least one control node device is configured in at least one topic information containing the group identification information, and the compression identification information of the at least one control node device corresponds one-to-one with the at least one topic information; The step of determining whether to execute the group command based on the group identifier information, the identifier information of the source node device, and the topic information in the access control list (ACL) of the target node device includes: Based on the group identifier information, at least one topic information containing the group identifier information is determined in the ACL; Decompress at least one topic information containing the group identifier information to obtain at least one first decompressed information; Search the at least one first decompression information for information that matches the identification information of the source node device; If it exists, then execute the group command.

2. The method according to claim 1, characterized in that, The step of configuring the ACL based on the group identification information and the identification information of the at least one control node device further includes: Configure the group identification information in the first information of the first access control entity (ACE) of the ACL; The identification information of the at least one control node device is configured in at least one topic information of the first ACE, and the identification information of the at least one control node device corresponds one-to-one with the at least one topic information.

3. The method according to claim 2, characterized in that, The step of configuring the ACL based on the group identification information and the identification information of the at least one control node device further includes: The number n of the identification information of the at least one control node device is configured in the first information.

4. The method according to claim 1, characterized in that, The step of configuring the ACL based on the group identification information and the identification information of the at least one control node device further includes: The identification information of each control node device in the group identification information and the identification information of the at least one control node device is compressed to obtain at least one first compressed information; The at least one first compression information is configured in at least one topic information of the ACL, and the at least one first compression information corresponds one-to-one with the at least one topic information.

5. The method according to claim 2, characterized in that, The step of determining whether to execute the group command based on the group identifier information, the identifier information of the source node device, and the topic information in the access control list (ACL) of the target node device includes: Based on the group identifier information, the first ACE in the ACL is determined; Search the first ACE for whether there is topic information that matches the identification information of the source node device; If it exists, then execute the group command.

6. The method according to claim 3, characterized in that, The step of determining whether to execute the group command based on the group identifier information, the identifier information of the source node device, and the topic information in the access control list (ACL) of the target node device includes: Based on the group identifier information, the first information in the ACL is determined; Search among the last n topic information of the first information to see if there is information that matches the identification information of the source node device; If it exists, then execute the group command.

7. The method according to claim 1, characterized in that, The step of determining whether to execute the group command based on the group identifier information, the identifier information of the source node device, and the topic information in the access control list (ACL) of the target node device further includes: Based on the group identifier information, at least one topic information containing the group identifier information is determined in the ACL; The identification information of the source node device is compressed to obtain the compressed identification information of the source node device; Search at least one topic information containing the group identification information for information that matches the compressed identification information of the source node device; If it exists, then execute the group command.

8. The method according to claim 4, characterized in that, The step of determining whether to execute the group command based on the group identifier information, the identifier information of the source node device, and the topic information in the access control list (ACL) of the target node device further includes: The group identification information and the source node device identification information are compressed to obtain the second compressed information; Search the ACL for a topic that matches the second compressed information; If it exists, then execute the group command.

9. The method according to claim 4, characterized in that, The step of determining whether to execute the group command based on the group identifier information, the identifier information of the source node device, and the topic information in the access control list (ACL) of the target node device further includes: Decompress at least one topic information in the ACL to obtain at least one second decompressed information; Search the at least one second decompression information for information that matches the group identification information and the source node device identification information; If it exists, then execute the group command.

10. The method according to any one of claims 5-9, characterized in that, The step of determining whether to execute the group command based on the group identifier information, the identifier information of the source node device, and the topic information in the access control list (ACL) of the target node device further includes: If it does not exist, the group command will not be executed.

11. The method according to claim 1, characterized in that, The method further includes: Receive group table configuration information from the configurator, the group table configuration information including first indication information, the first indication information being used to indicate whether the target node device is a control node device; Configure the first indication information in the group table of the target node device.

12. The method according to claim 1, characterized in that, The ACL configuration information also includes authentication mode configuration information, and the method further includes: Based on the authentication mode configuration information, the authentication mode of the ACE in the ACL is configured as enhanced group-based secure connection.

13. A method for processing multicast messages, characterized in that, The method is applied to the configurator and includes: Access Control List (ACL) configuration information is sent to the target node device. The ACL configuration information includes group identifier information and identifier information of at least one control node device, as well as domain index, permissions, and authentication mode. The ACL configuration information is used to instruct the target node device to configure the ACL according to the group identifier information and the identifier information of the at least one control node device. The topic information in the ACL is used by the target node device to determine whether to execute the group command. The group identifier information is the group identifier information of the multicast group to which the target node device and the source node device belong. The ACL configuration information is used to instruct the target node device to configure the ACL according to the group identification information and the identification information of the at least one control node device, including: The ACL configuration information is used to instruct the target node device to configure the group identification information in at least one topic information of the first ACE of the ACL; The identification information of each control node device in the identification information of the at least one control node device is compressed to obtain the compressed identification information of at least one control node device. The compressed identification information of the at least one control node device is configured in at least one topic information containing the group identification information, and the compressed identification information of the at least one control node device corresponds one-to-one with the at least one topic information.

14. The method according to claim 13, characterized in that, The method further includes: Group table configuration information is sent to multiple node devices within a multicast group. The group table configuration information includes first indication information, which is used to instruct each of the multiple node devices to configure the first indication information in the group table. The first indication information is used to indicate whether each node device is a control node device.

15. The method according to claim 14, characterized in that, Before sending the Access Control List (ACL) configuration information to the target node device, the method further includes: The ACL configuration information is determined based on the first indication information of the plurality of node devices.

16. A communication device, characterized in that, The device is applied to the target node device and includes: The transceiver unit is used to receive multicast messages, which are group commands. The multicast messages include group identification information and source node device identification information, wherein the group identification information is the group identification information of the multicast group to which the target node device and the source node device belong. The processing unit is configured to determine whether to execute the group command based on the group identification information, the identification information of the source node device, and the topic information in the access control list (ACL) of the target node device. The transceiver unit is further configured to receive ACL configuration information from the configurator, the ACL configuration information including the group identifier information and the identifier information of at least one control node device, as well as domain index, permissions, and authentication mode; the processing unit is further configured to configure the ACL according to the group identifier information and the identifier information of the at least one control node device. Specifically, the processing unit is used for: The group identification information is configured in at least one topic information of the first ACE of the ACL; The identification information of each control node device in the identification information of the at least one control node device is compressed to obtain the compressed identification information of at least one control node device. The compression identification information of the at least one control node device is configured in at least one topic information containing the group identification information, and the compression identification information of the at least one control node device corresponds one-to-one with the at least one topic information; The processing unit is further specifically used for: Based on the group identifier information, at least one topic information containing the group identifier information is determined in the ACL; Decompress at least one topic information containing the group identifier information to obtain at least one first decompressed information; Search the at least one first decompression information for information that matches the identification information of the source node device; If it exists, then execute the group command.

17. The apparatus according to claim 16, characterized in that, The processing unit is also specifically used for: Configure the group identification information in the first information of the first access control entity (ACE) of the ACL; The identification information of the at least one control node device is configured in at least one topic information of the first ACE, and the identification information of the at least one control node device corresponds one-to-one with the at least one topic information.

18. The apparatus according to claim 17, characterized in that, The processing unit is also used for: The number n of the identification information of the at least one control node device is configured in the first information.

19. The apparatus according to claim 16, characterized in that, The processing unit is also specifically used for: The identification information of each control node device in the group identification information and the identification information of the at least one control node device is compressed to obtain at least one first compressed information; The at least one first compression information is configured in at least one topic information of the ACL, and the at least one first compression information corresponds one-to-one with the at least one topic information.

20. The apparatus according to claim 17, characterized in that, The processing unit is also specifically used for: Based on the group identifier information, the first ACE in the ACL is determined; Search the first ACE for whether there is topic information that matches the identification information of the source node device; If it exists, then execute the group command.

21. The apparatus according to claim 18, characterized in that, The processing unit is also specifically used for: Based on the group identifier information, the first information in the ACL is determined; Search among the last n topic information of the first information to see if there is information that matches the identification information of the source node device; If it exists, then execute the group command.

22. The apparatus according to claim 16, characterized in that, The processing unit is also specifically used for: Based on the group identifier information, at least one topic information containing the group identifier information is determined in the ACL; The identification information of the source node device is compressed to obtain the compressed identification information of the source node device; Search at least one topic information containing the group identification information for information that matches the compressed identification information of the source node device; If it exists, then execute the group command.

23. The apparatus according to claim 19, characterized in that, The processing unit is also specifically used for: The group identification information and the source node device identification information are compressed to obtain the second compressed information; Search the ACL for a topic that matches the second compressed information; If it exists, then execute the group command.

24. The apparatus according to claim 19, characterized in that, The processing unit is also specifically used for: Decompress at least one topic information in the ACL to obtain at least one second decompressed information; Search the at least one second decompression information for information that matches the group identification information and the source node device identification information; If it exists, then execute the group command.

25. The apparatus according to any one of claims 20-24, characterized in that, The processing unit is also used for: If it does not exist, the group command will not be executed.

26. The apparatus according to claim 16, characterized in that, The transceiver unit is further configured to receive group table configuration information from the configurator, the group table configuration information including first indication information, the first indication information being used to indicate whether the target node device is a control node device; the processing unit is further configured to configure the first indication information in the group table of the target node device.

27. The apparatus according to claim 16, characterized in that, The ACL configuration information also includes authentication mode configuration information, and the processing unit is further used for: Based on the authentication mode configuration information, the authentication mode of the ACE in the ACL is configured as enhanced group-based secure connection.

28. A communication device, characterized in that, The device is applied to the configurator and includes: The transceiver unit is used to send Access Control List (ACL) configuration information to the target node device. The ACL configuration information includes group identifier information and identifier information of at least one control node device, as well as domain index, permissions, and authentication mode. The ACL configuration information is used to instruct the target node device to configure the ACL according to the group identifier information and the identifier information of the at least one control node device. The topic information in the ACL is used by the target node device to determine whether to execute a group command. The group identifier information is the group identifier information of the multicast group to which the target node device and the source node device belong. The ACL configuration information is used to instruct the target node device to configure the ACL according to the group identification information and the identification information of the at least one control node device, including: The ACL configuration information is used to instruct the target node device to configure the group identification information in at least one topic information of the first ACE of the ACL; The identification information of each control node device in the identification information of the at least one control node device is compressed to obtain the compressed identification information of at least one control node device. The compressed identification information of the at least one control node device is configured in at least one topic information containing the group identification information, and the compressed identification information of the at least one control node device corresponds one-to-one with the at least one topic information.

29. The apparatus according to claim 28, characterized in that, The transceiver unit is also used for: Group table configuration information is sent to multiple node devices within a multicast group. The group table configuration information includes first indication information, which is used to instruct each of the multiple node devices to configure the first indication information in the group table. The first indication information is used to indicate whether each node device is a control node device.

30. The apparatus according to claim 29, characterized in that, The device further includes a processing unit, the processing unit being used for: The ACL configuration information is determined based on the first indication information of the plurality of node devices.

31. A target node device, characterized in that, It includes a memory, a processor, and a program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the method as claimed in any one of claims 1 to 12.

32. A configurator, characterized in that, It includes a memory, a processor, and a program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the method as described in any one of claims 13 to 15.

33. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store instructions that, when executed by a processor, cause the method as described in any one of claims 1 to 12 or any one of claims 13 to 15 to be performed.

34. A computer program product containing instructions, characterized in that, When it is run on a computer, it causes the method as described in any one of claims 1 to 12, or as described in any one of claims 13 to 15, to be performed.

Images