Smart home gateway transparent proxy cloud system

Abstract

The invention relates to the technical field of smart home systems, in particular to a smart home gateway transparent proxy cloud system, which comprises a cloud end, and is characterized in that the cloud end is connected with a terminal, a database and a gateway; and the cloud comprises an authentication module, a user management module, an equipment management module, a mail sending module, a bridging establishing module and a notification management module. The intelligent furniture gateway has the advantages that a user can remotely access the intelligent furniture gateway through the APP, the intelligent equipment connected to the gateway can be controlled, the APP and the cloud end are in end-to-end encryption communication, the cloud end only plays a role in bridging, the cloud end cannot obtain information of the intelligent equipment connected to the gateway and cannot control the intelligent equipment, and the intelligent furniture gateway can be remotely accessed through the APP. The cloud cannot obtain the communication key between the APP and the gateway, so that the privacy of a user cannot be leaked when the cloud has a security problem, and the security performance of the smart home gateway transparent proxy cloud system is relatively good.

Description

Technical Field

[0001] The present invention relates to the technical field of smart home systems, and in particular to a smart home gateway transparent proxy cloud system. Background Art

[0002] The smart home gateway is a home resource management and configuration center, responsible for completing functions such as home networking and node control. It connects various sensor switch nodes in the home network through wireless networking technology, and uses standard communication protocols to manage and control the internal network of the smart home. It serves as an information interaction interface between the home network and the external network. The cloud is mainly responsible for data storage, analysis and processing of data collected by terminal nodes in the smart home system. It also provides users with remote control functions, allowing users to view home data and operate devices at any time through mobile applications or web pages. By combining the smart home gateway with the cloud, comprehensive monitoring and control of the smart home system can be achieved. Users can view home data and operate devices at any time through mobile applications or web pages, and enjoy a more convenient and intelligent life experience. The cloud server can also provide real-time status display functions, allowing users to understand the status of home devices in a timely manner.

[0003] The cloud of existing smart home gateways stores device information and user information. If there is a security problem in the cloud, the user's privacy may be leaked. Therefore, it is necessary to design a smart home gateway transparent proxy cloud system to solve the above problems. Summary of the invention

[0004] In view of the deficiencies in the prior art, the present invention provides a smart home gateway transparent proxy cloud system to solve the problems existing in the prior art.

[0005] To achieve the above-mentioned purpose, the present invention provides the following technical solutions: a smart home gateway transparent proxy cloud system, including a cloud, the cloud is connected to a terminal, the cloud is connected to a database and a gateway, and the cloud includes an authentication module, a user management module, a device management module, an email sending module, a bridge establishment module and a notification management module.

[0006] Preferably, the cloud uses an HTTP authentication framework, the cloud is based on the HTTPS protocol, and the terminal communicates with the smart furniture gateway across the cloud in an end-to-end encrypted manner.

[0007] Preferably, the gateway is a smart furniture gateway.

[0008] Preferably, the timing of the terminal communicating with the smart furniture gateway across the cloud includes the following steps: 1) The terminal logs in to the cloud; 2) The cloud returns a token; 3) The terminal uses the token to request accountDigest; 4) The cloud returns accountDigest; 5) The terminal sends a request to the gateway through the cloud (using token shareKey accountDigest) and uses AES encryption; 6) After filtering out the token, the cloud sends the encrypted information directly to the gateway without processing; 7) The gateway decrypts and processes the request (using shareKey and accountDigest); 8) The gateway returns a response (using shareKey and accountDigest), encrypted using AES; 9) The cloud directly returns the information returned by the gateway to the terminal; 10) The terminal decrypts and processes (using shareKey and accountDigest).

[0009] Preferably, the cloud retains the unique ID, serial number and MAC address of the gateway, and the cloud retains the user information of the terminal.

[0010] Compared with the prior art, the present invention provides a smart home gateway transparent proxy cloud system, which has the following beneficial effects: The smart home gateway transparent proxy cloud system provides users with an APP, which allows them to remotely access their own smart furniture gateways and control the smart devices connected to the gateway. Both the APP and the cloud adopt end-to-end encrypted communication, and the cloud only plays a bridging role. The cloud cannot obtain information about the smart devices connected to the gateway, nor can it control them, because the cloud cannot obtain the communication key between the APP and the gateway. Therefore, when there is a security problem in the cloud, the user's privacy will not be leaked, making the smart home gateway transparent proxy cloud system have better security performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 is a schematic diagram of the present invention; Figure 2 This is a schematic diagram of the cloud structure of the present invention; Figure 3 This is a timing diagram of the terminal of the present invention communicating with the smart furniture gateway across the cloud. DETAILED DESCRIPTION

[0012] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0013] See also Figure 1-3 , including the cloud, the cloud is connected to the terminal, the cloud is connected to the database and the gateway, the cloud includes an authentication module, a user management module, a device management module, an email sending module, a bridge establishment module and a notification management module, the cloud has an API interface, and the code of the communication process of the API interface is as follows: Request address: https: / / IP-address / PATH

[0014] AES: AES / CBC / PKCS7Padding key: MD5((accountDigest + shareKey) | matchCode), 16 bytes, onlyMatch Mixtile Hub interface use matchCode. iv: MD5(salt), 16 bytes

[0015] POST / GET / PUT / DELETE / cipher* Authorization: Bearer <token> Content-Type: application / mixtile-cipher (not applicable to GET / DELETE method) Mixtile-Device-Id: mobile phone ID Mixtile-Username: login email Mixtile-Salt: unix timestamp Mixtile-Salt-Hash: BASE64(SHA-1(salt + ( accountDigest + sharekey ) |matchCode)) Mixtile-Content-Type: original plain content type Mixtile-Resource: BASE64(AES(MD5((accountDigest + shareKey)|matchCode), MD5(salt), Original Plain URI)) Content-Length: length Body: BASE64(AES(MD5(accountDigest + shareKey), MD5(salt), Plainbody)) Note that if you request the Match Mixtile Hub interface, the key value is MD5((matchCode), Mixtile-Username is 'Mixtile', and Mixtile-Salt-Hash is BASE64(SHA-1(salt + matchCode)). For other interface requests, the key value is MD5((accountDigest +shareKey)), Mixtile-Username is the login email, and Mixtile-Salt-Hash is BASE64(SHA-1(salt + accountDigest + sharekey)). If it is the first time pairing, the matchCode is located below the Mixtile Hub. It is the pairing code. If it is not the first time pairing, you can get the matchCode through the Get Match Code interface. The salt value is Mixtile-Salt. The Mixtile-Salt value is unix timestampaccountDigest obtained through the Get AccountDigest interface or the Match Mixtile Hub interface response. The sharekey value has been described in the Match Mixtile Hub interface. The authorization password is obtained through the Login Cloud interface. The validity period of salt is (+ / -) 1 minute.

[0016] The response codes of the API interface are as follows: Response HTTP / 1.0 200 OK Content-Type: application / mixtile-cipher Mixtile-Content-Type: original plain content type Content-Length: Length Body: BASE64(AES(MD5(accountDigest + shareKey), MD5(salt), Plainbody)) + "\n\n" It should be noted that all requests must be authorized, except for user login and user register, the authorization type is Bearer Token, and the password is valid for 30 days.

[0017] The API interface can be used to implement user account management functions, including obtaining login codes, logging in, logging out, obtaining new login codes, obtaining AccountDigest, obtaining all information, and clearing all information. The code for obtaining login codes is as follows: Request GET https: / / domain / api / login / code / <username> Response { "message": "Success or Failure message", "timeout": 60 } The login code is as follows: POST https: / / domain / api / login Request { "username": "Email Address", "code": "Base64 String" } Response { "message": "Success or Failure message", "token": "Base64 token string" } The logout code is as follows: POST https: / / domain / api / logout Request { "regId": "deviceToken", "deviceType": "ios or android" } If can not get DeviceToken, regId can be null or does not post it. Response { "message": "Success or Failure message", "code": error code } When logging out, it should be noted that when the client sends a logout request to the server, the server will delete the corresponding deviceToken to cancel the notification, and the client should delete the local authorization holder password.

[0018] The code to obtain a new login code is as follows: Request GET https: / / domain / api / token Response { "message": "Success or Failure message", "token": "Base64 token string" } If the request for a new login code is successful, the server will send a new password, and the password will be valid for 30 days.

[0019] The code for getting AccountDigest is as follows: Request GET https: / / domain / api / accountDigest / <uuid> Response { "message": "Success or Failure message", "accountDigest": "hex String" } The code to get all the information is as follows: Request GET https: / / domain / api / allInformation Response { "message": "all information", } The code to clear all information is as follows: Request DELETE https: / / domain / api / allInformation Response { "message": "Success or Failure message", "code": error code } The API interface can be used to implement user management functions, including obtaining all users, inviting users, deleting users, and updating user permissions. The code for obtaining all users is as follows: Get all users. Request GET https: / / domain / api / users Response { "users": [ { "username": "", "permissions": [ { "uuid": "UUID-1", "role": "master" }, { "uuid": "UUID-2", "role": "user" } ] } ] } The code to invite a user is as follows: POST https: / / domain / api / users Request { "username": "Email Address", "permissions": [ { "uuid": "UUID-1", "role": "master" }, { "uuid": "UUID-2", "role": "user" } ] } Response { "message": "Success or Failure message", "code": error code } If the server invites the user successfully, the server will send an email to the invited user.

[0020] The code to delete a user is as follows: Request DELETE https: / / domain / api / users / <username> Response { "message": "Success or Failure message", "code": error code } If the server deletes the user successfully, the server will send an email to the deleted user.

[0021] The code to update user permissions is as follows: PUT https: / / domain / api / users / <username> Request { "permissions": [ { "uuid": "UUID-1", "role": "master" }, { "uuid": "UUID-2", "role": "user" } ] } Response { "message": "Success or Failure message", "code": error code } If the server updates the user's permissions successfully, the server will send an email to the updated user. The registration notification service can be implemented through the API interface. The registration notification service includes mobile phone registration notification service, obtaining all registered notification mobile phones and canceling notification service, and the notification service methods include APN / GCM message format and GCM message format (GCM Message Format).

[0022] The code for the mobile phone registration notification service is as follows: POST https: / / domain / api / addRegistration[Deprecated] POST https: / / domain / api / notification / registration Request { "regId": "deviceToken", "deviceId": "UUID", "deviceType": "ios or android", "deviceModel": "iPhone 6s", "deviceName": "Alexa iPhone 6s" } Response { "message": "Success or Failure message", "code": error code } The phone registers the notification service in the cloud, and then it will receive notifications from the Hub. The notification service supports APN / GCM.

[0023] The code to get all the mobile phones registered for notifications is as follows: Request GET https: / / domain / api / notification / registration Response { "devices":[ { "deviceId": "UUID", "deviceType": "ios or android", "deviceModel": "iPhone 6s", "deviceName": "Alexa iPhone 6s" } ] } The code to cancel the notification service is as follows: Request DELETE https: / / domain / api / notification / registration / <deviceid> Response { "message": "Success or Failure message", "code": error code } The code for the APN message format is as follows:

[0024] { "badge": 0, "sound": "ping.aiff", "alert": { "body": "Message Content" } } { "extend": { "uuid": "UUID", "itemName": "itemName", "thingUID": "thingUID" }, "aps": { "badge": 0, "sound": "ping.aiff", "alert": { "title": "Message Title", "body": "Message Content" } } } or { "extend": { "uuid": "UUID", "hubStatus": "offline" }, "aps": { "badge": 0, "sound": "ping.aiff", "alert": { "title": "Message Title", "body": "Message Content" } } } The code for the GCM message format is as follows: { "delayWhileIdle": "false", "data": { "type": "notification", "notificationId": "androidNotificationId", "message": "Message Content" } } { "delayWhileIdle": "false", "data": { "type": "notification", "notificationId": "androidNotificationId", "uuid": "UUID", "itemName": "itemName", "thingUID": "thingUID", }, "notification": { "title": "Message Title", "body": "Message Content" } } or { "delayWhileIdle": "false", "data": { "type": "notification", "notificationId": "androidNotificationId", "uuid": "UUID", "hubStatus": "online" }, "notification": { "title": "Message Title", "body": "Message Content" } } The API interface has the function of gateway device management, among which gateway setting management includes obtaining device list, adding devices, obtaining device details and deleting devices.

[0025] The code to get the device list is as follows: Request GET https: / / domain / api / hubs Response { "hubs": [ { uuid: "UUID-1", role: "owner", label: "label", model: "model", manufacturer: "manufacturer", status: "online" }, { uuid: "UUID-2", role: "master", label: "label", model: "model", manufacturer: "manufacturer", status: "offline" }, { uuid: "UUID-3", role: "user", label: "label", model: "model", manufacturer: "manufacturer", status: "online" }...... ] } The code for adding a device is as follows: Request POST https: / / domain / api / hubs { "uuid": "UUID", "secret": "secret" } curl -X POST -d '{"uuid":"UUID", "secret":"secret"}' -H 'Content-Type: application / json' -H 'Authorization: Bearer token' https: / / domain / api / hubs Response { "message": "success", "uuid": "UUID", "status": "offline" } The code to get device details is as follows: Request GET https: / / domain / api / hubs / <uuid> Response { "uuid": "UUID", "label": "label", "model": "model", "manufacturer": "manufacturer", "status": "online" } The code to delete the device is as follows: Only the last 'owener' can delete this hub, then all users will lose the control of this hub and the users will receive an E-mail, otherwise only this user loses the control of the hub. Request DELETE https: / / domain / api / hubs / <uuid> Response { "message": "success", "uuid": "uuid", "reset": true or false } The cloud uses the HTTP authentication framework and the cloud is based on the HTTPS protocol. The terminal communicates with the smart furniture gateway across the cloud in an end-to-end encrypted manner. End-to-end encryption is a data transmission protection technology that ensures that only the sender and receiver of the communication can access and interpret the data. Any third party in the transmission process, including network service providers and intermediate nodes, cannot decrypt the data. The end-to-end encryption method and HTTPS protocol can not only protect the integrity and confidentiality of the data during transmission, but also ensure the reliability of identity authentication, ensuring that the data transmitted between the client and the server will not be eavesdropped or tampered with.

[0026] The gateway is a smart furniture gateway. A smart home gateway is a networked device with specific hardware and software functions that can connect smart devices to the Internet, allowing the gateway to better connect to the cloud.

[0027] The sequence of the terminal communicating with the smart furniture gateway across the cloud includes the following steps: 1) The terminal logs in to the cloud; 2) The cloud returns a token; 3) The terminal uses the token to request accountDigest; 4) The cloud returns accountDigest; 5) The terminal sends a request to the gateway through the cloud (using token shareKey accountDigest) and uses AES encryption; 6) After filtering out the token, the cloud sends the encrypted information directly to the gateway without processing; 7) The gateway decrypts and processes the request (using shareKey and accountDigest); 8) The gateway returns a response (using shareKey and accountDigest), encrypted using AES; 9) The cloud directly returns the information returned by the gateway to the terminal; 10) The terminal decrypts and processes (using shareKey and accountDigest).

[0028] The cloud retains the unique ID, serial number and MAC address of the gateway, and the user information of the terminal, so that the APP used by the terminal customer can establish a connection with the gateway.

[0029] To sum up, the smart home gateway transparent proxy cloud system allows users to remotely access their smart furniture gateways through APP, and can control the smart devices connected to the gateway. Both APP and the cloud adopt end-to-end encrypted communication, and the cloud only plays a bridging role. The cloud cannot obtain the information of the smart devices connected to the gateway, nor can it control them, because the cloud cannot obtain the communication key between the APP and the gateway. Therefore, when there is a security problem in the cloud, the user's privacy will not be leaked, making the smart home gateway transparent proxy cloud system have better security performance.

[0030] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "includes a" does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0031] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.< / uuid> < / uuid> < / deviceid> < / username> < / username> < / uuid> < / username> < / token>

Claims

1. A smart home gateway transparent proxy cloud system, characterized in that: It includes a cloud, the cloud is connected to a terminal, the cloud is connected to a database and a gateway, and the cloud includes an authentication module, a user management module, a device management module, an email sending module, a bridge establishment module and a notification management module.

2. The intelligent home gateway transparent proxy cloud system according to claim 1, characterized in that: The cloud uses an HTTP authentication framework, the cloud is based on the HTTPS protocol, and the terminal communicates with the smart furniture gateway across the cloud in an end-to-end encrypted manner.

3. The intelligent home gateway transparent proxy cloud system according to claim 2, characterized in that: The gateway is a smart furniture gateway.

4. The intelligent home gateway transparent proxy cloud system according to claim 3, characterized in that: The timing sequence of the terminal communicating with the smart furniture gateway across the cloud includes the following steps: 1) The terminal logs in to the cloud; 2) The cloud returns a token; 3) The terminal uses the token to request accountDigest; 4) The cloud returns accountDigest; 5) The terminal sends a request to the gateway through the cloud, using token shareKey accountDigest and AES encryption; 6) After filtering out the token, the cloud sends the encrypted information directly to the gateway without processing; 7) The gateway decrypts and processes the request, using shareKey and accountDigest; 8) The gateway returns a response message, using shareKey and accountDigest, and using AES encryption; 9) The cloud directly returns the information returned by the gateway to the terminal; 10) The terminal decrypts and processes, using shareKey and accountDigest.

5. The intelligent home gateway transparent proxy cloud system according to claim 4, characterized in that: The cloud retains the unique ID, serial number and MAC address of the gateway, and the cloud retains the user information of the terminal.

Images