Multi-level multi-domain access control method and system based on Internet of Things

Abstract

The invention discloses a multi-level multi-domain access control method and system based on the Internet of Things, and relates to the technical field of access control of the Internet of Things, and the method comprises the steps: firstly, judging whether the identity of a device end is compliant or not based on device identification data, key data and first-level access timestamp data, and avoiding the influence caused by illegal invasion, end-side communication dislocation and the like; the edge computing device firstly needs to judge whether the request data meets end computing conditions or not, if the request data meets the end computing conditions, an end computing signal is sent to the end device, the end device carries out end computing, an analysis computing result is locally stored, and meanwhile interaction with the cloud platform is carried out; if it is judged that the request data does not meet the end computing condition, whether an edge computing condition is met or not is judged, if yes, queuing computing is conducted on an edge computing device, and a computing result also needs to be interactively stored in the end device and the cloud platform; if the edge calculation condition is not met, calculation is carried out on the cloud platform; the computing power is reasonably distributed, and the computing power of each level in the Internet of Things is fully utilized.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things access control, and in particular to a multi-level and multi-domain access control method and system based on the Internet of Things. Background Art

[0002] The technical architecture of multi-level and multi-domain edge cloud is a multi-level, highly coordinated system that involves the interaction of cloud computing centers, edge computing nodes, and terminal devices.

[0003] Cloud computing center (Cloud): As a traditional cloud computing center node, it is responsible for overall management and data processing. In the edge-cloud architecture, the cloud not only needs to process data from edge nodes, but also manage and maintain the entire system to ensure service continuity and security.

[0004] Edge computing nodes (Edge): Edge computing nodes are located between users and cloud centers. They are divided into two levels: infrastructure edge and device edge. The main task of edge nodes is to handle tasks that require real-time analysis and decision-making to reduce the need to transmit data to the cloud, thereby reducing latency and bandwidth costs.

[0005] End devices: End devices are devices used directly by users, such as monitoring devices, sensors, etc. They are responsible for collecting data and transmitting it to edge nodes or directly uploading it to the cloud. In some scenarios, end devices may also have certain computing capabilities and be able to perform some simple data processing tasks.

[0006] The advantage of this architecture is that it can combine the powerful processing power of cloud computing and the low latency characteristics of edge computing to provide users with faster and more reliable services. At the same time, through the collaborative work of cloud, edge and end, it can achieve the optimal allocation of resources and improve the operating efficiency of the entire system.

[0007] The edge-cloud technology architecture is designed to meet the high requirements of modern IoT applications for data processing speed, security, and scalability. It represents an important direction for the future development of IoT and cloud computing technologies.

[0008] Therefore, how to give full play to the computing power of end, edge and cloud based on instant communication of the Internet of Things is a technical problem that needs to be urgently solved in multi-level and multi-domain end-edge cloud technology. Summary of the invention

[0009] In order to solve the above technical problems, the present invention provides a multi-level and multi-domain access control method and system based on the Internet of Things. The following technical solutions are adopted:

[0010] A multi-level multi-domain access control method based on the Internet of Things comprises the following steps:

[0011] Step 1: At a set time interval, the device sends a primary access request data to the edge computing device through the communication module. The primary access request data includes device identification data, primary access timestamp data, key data, and request data.

[0012] Step 2: The edge computing device parses the primary access request data and first determines whether the device identity is compliant based on the device identification data, key data, and primary access timestamp data.

[0013] Step 3: If the edge computing device determines in step 2 that the request data is parsed in accordance with the rules;

[0014] Perform the first analysis of the requested data to determine whether the end computing conditions are met. If so, a signal is sent to the device to process the current data using the end computing method. The device calculates and processes the current data, saves the calculation and analysis results locally, and sends the calculation and analysis results to the cloud platform through the communication module.

[0015] If the end computing conditions are not met, a second analysis of the requested data is performed to determine whether the edge computing conditions are met. If so, a signal is sent to the device to process the current data using edge computing, and edge computing of the current data is started. The computing and analysis result data is sent to the device and the cloud platform through the communication module.

[0016] Step 4. If in step 3, the edge computing device determines that the edge computing conditions are not met, it sends secondary access request data to the cloud platform through the communication module. The secondary access request data includes device identification data, edge identification data, secondary access timestamp data, key data and request data; the cloud platform parses the secondary access request data, and determines whether the identities of the device and the edge computing device are compliant based on the device identification data, edge identification data and key data. If it complies with the rules, it calculates and processes the current data, and sends the calculation and analysis result data to the device through the communication module.

[0017] By adopting the above technical solution, for the instant communication of the Internet of Things provided by the communication module, the device end, edge computing device, and cloud platform constitute the end-edge-cloud Internet of Things architecture. The multi-level and multi-domain access control first determines whether the device end identity is compliant based on the device identification data, key data, and first-level access timestamp data, which can avoid the impact of illegal intrusion, end-edge communication dislocation, etc.

[0018] Edge computing devices have a certain amount of computing power. Generally, they can effectively cover the computing needs of multiple devices within a region. In order to give full play to the computing power of each computing unit in the IoT system, it is first necessary to determine whether the requested data meets the end computing conditions. If it is just a judgment of some threshold values, it can be done on the end device without occupying the computing power resources of the edge computing device, let alone the large computing power resources of the cloud platform. If it is determined that the end computing conditions are met, a signal for end computing can be sent to the end device, and the end device performs end computing, analyzes the calculation results and stores them locally, and interacts with the cloud platform at the same time.

[0019] If it is determined that the requested data does not meet the end computing conditions, for example, some sensitive data is not suitable for computing on the end device, or the computing requirements are more complex, then it is necessary to determine whether the edge computing conditions are met. If so, the edge computing device performs queue computing based on the time series, and the computing results also need to be interactively stored on the end device 1 and the cloud platform;

[0020] If the edge computing conditions are not met, it is usually due to some visual analysis needs or large model computing needs, and calculations need to be performed on the cloud platform;

[0021] Through multi-level and multi-domain access control and the rational allocation of computing power, computing power at all levels within the Internet of Things can be fully utilized.

[0022] Optionally, when the device is connected to the Internet of Things, it registers the device identification data on the cloud platform and downloads the device-specific key data. The cloud platform interacts with the corresponding edge computing device to obtain the corresponding device identification data and device-specific key data.

[0023] In step 2, the method for determining whether the device-side identity is compliant is: the edge computing device determines whether the device-side identity is compliant based on a compliance decision function, and the compliance decision function determines whether the following parameters are compliant: device identification, device-specific key, data sender, data responder, and timestamp.

[0024] Optionally, the formula for the compliance decision function is:

[0025] CPt=F(DeviceID,KeyData,Challenge,Response,Time);

[0026] Where CPt is the compliance decision result corresponding to the first-level access timestamp data; F is the compliance decision function; DeviceID is the device identifier; KeyData is the device-specific key data; Challenge is the data sender; Response is the data responder; Time is the first-level access timestamp data.

[0027] By adopting the above technical solution, device identification data: a string or number that uniquely identifies a device. Device-specific key: key information used by the device for encryption and authentication, including symmetric keys, asymmetric key pairs, etc.

[0028] Compliance verification: whether the device meets the predetermined safety standards and operating specifications.

[0029] When a device is connected to the Internet of Things, it registers its device identification data on the cloud platform and downloads its device-specific key data. The device side needs to perform compliance checks regularly or on demand to avoid systemic data risks caused by the access of non-compliant devices.

[0030] Optionally, in step 4, an edge identification data decision parameter is added to the compliance decision function to implement compliance judgment on the secondary access request data.

[0031] By adopting the above technical solution, the compliance judgment in step 4 is similar to the compliance judgment on the device side, except that the edge identification data is added to perform compliance judgment on the edge computing device to improve data security.

[0032] Optionally, the method for determining whether the end computing condition is met in step 3 is: first define the end computing condition, which includes: computing power resources, the computing power of the CPU on the device; data sensitivity: whether the data contains sensitive information and whether it needs to be processed locally to protect privacy; computing requirements: the computing power requirements of the task;

[0033] According to the terminal calculation conditions, formulate the terminal calculation condition judgment formula:

[0034] Com=F a (R,);

[0035] Com is the end-computation conditional scoring function; F a is the end computing decision function, R is the computing resource score; S is the data sensitivity score; C is the computing demand score;

[0036] Set the end calculation scoring threshold. If Com is greater than the end calculation scoring threshold, it is judged that the end calculation condition is met, otherwise it does not meet the end calculation condition.

[0037] Optional, the score range of R is 0-1, and a score between 0 and 1 is returned based on the computing power resources of the current device, where 1 indicates high computing power resources;

[0038] The value of S is 0 or 1. It returns a result of 0 or 1 depending on whether the data sensitivity level of the requested data exceeds the set threshold. 0 means that the data sensitivity level exceeds the threshold and the operation cannot be performed on the device side. 1 means that the data sensitivity level does not exceed the threshold and the operation is allowed on the device side.

[0039] The score range of C is 0-1. It returns a score between 0 and 1 based on the intensity of the requested data computing task, where 1 indicates high computing demand.

[0040] By adopting the above technical solution, a method can be implemented in which the edge computing device determines whether the device is compliant based on the device identification data and key data. This method relies on the irreversibility of the cryptographic hash function and the confidentiality of the key data, ensuring the security of the compliance check.

[0041] Optionally, the method for determining whether the edge computing condition is met in step 3 is:

[0042] First, define the edge computing conditions, which include: edge resource availability: whether the CPU, memory, storage and energy resources of the edge server are sufficient; edge network status: the quality of the network connection between the edge server and the end device; edge service availability: whether the required services or applications are deployed on the edge computing device; task edge adaptability: whether the task is suitable for execution in the edge computing device environment;

[0043] According to the edge computing conditions, the edge computing condition judgment formula is formulated:

[0044] Edge=G(ER,);

[0045] Where Edge is the edge computing condition scoring function; G is the edge computing decision function, ER is the edge resource availability score; EN is the edge network status score; ES is the edge service availability score; TA is the task edge adaptability score;

[0046] Set the edge computing scoring threshold. If Edge is greater than the edge computing scoring threshold, the edge computing condition is met, otherwise the edge computing condition is not met.

[0047] Optionally, the ER score range is 0-1, and a score between 0 and 1 is returned based on the resource usage of the edge computing device, where 1 indicates sufficient resources;

[0048] The EN score ranges from 0 to 1, and returns a score between 0 and 1 based on the network bandwidth, latency, and stability between the edge computing device and the device end, with 1 indicating a good network condition;

[0049] The ES score ranges from 0 to 1, and returns a score between 0 and 1 based on the availability of the required computation on the edge computing device, where 1 indicates that the computation is available;

[0050] TA's scoring range is 0-1, and it returns a score between 0 and 1 based on the task requirements and the computing power of the edge computing device, where 1 means that the task is completely suitable for execution at the edge.

[0051] By adopting the above technical solution, the edge computing scoring threshold is used to decide whether to perform computing at the edge. This edge computing scoring threshold can be adjusted according to the specific situation of the edge environment and the task requirements. The resources, network and service conditions of the edge environment, as well as the adaptability of the task itself, are taken into account. It can quickly determine whether the edge computing conditions are met.

[0052] A multi-level multi-domain access control system based on the Internet of Things is used to implement a multi-level multi-domain access control method based on the Internet of Things. The multi-level multi-domain access control system includes multiple end-edge modules, a communication module and a cloud platform. The end-edge module includes multiple interfaces for connecting end devices, multiple device terminals and edge computing devices. The multiple device terminals are connected to the multi-level multi-domain access control system through the interfaces of the end devices. The communication module is used to form an Internet of Things communication network coverage in the multi-level multi-domain access control system area. The multiple device terminals are respectively connected to the edge computing device and the cloud platform Internet of Things wireless communication through the communication module. The edge computing devices of the multiple end-edge modules are respectively connected to the cloud platform Internet of Things wireless communication through the communication module.

[0053] Optionally, the communication module is implemented based on 5G wireless communication technology.

[0054] In summary, the present invention includes at least one of the following beneficial technical effects:

[0055] The present invention can provide a multi-level and multi-domain access control method and system based on the Internet of Things. For the end-edge-cloud Internet of Things architecture composed of the device end, edge computing device, and cloud platform for the instant communication of the Internet of Things provided by the communication module, the multi-level and multi-domain access control first determines whether the identity of the device end is compliant based on the device identification data, key data, and the first-level access timestamp data, which can avoid the impact of illegal intrusion, end-edge communication dislocation, etc.

[0056] The edge computing device first needs to determine whether the requested data meets the end computing conditions. If it is determined that the end computing conditions are met, it can send an end computing signal to the end device, and the end device performs end computing, analyzes the calculation results, stores them locally, and interacts with the cloud platform at the same time; if it is determined that the requested data does not meet the end computing conditions, it is necessary to determine whether it meets the edge computing conditions. If it does, the edge computing device performs queue calculations based on time series, and the calculation results also need to be stored interactively with the end device and the cloud platform; if the edge computing conditions are not met, it is necessary to perform calculations on the cloud platform; through multi-level and multi-domain access control, coupled with the reasonable allocation of computing power, the computing power at all levels in the Internet of Things is fully utilized. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 It is a flow chart of a multi-level and multi-domain access control method based on the Internet of Things of the present invention;

[0058] Figure 2 It is a schematic diagram of the component connection principle of a multi-level and multi-domain access control system based on the Internet of Things of the present invention.

[0059] Explanation of the accompanying drawings: 1. Device end; 2. Edge computing device; 3. Communication module; 4. Cloud platform. DETAILED DESCRIPTION

[0060] The present invention is further described in detail below in conjunction with the accompanying drawings.

[0061] The embodiment of the present invention discloses a multi-level and multi-domain access control method and system based on the Internet of Things.

[0062] Reference Figure 1 and Figure 2 Embodiment 1: A multi-level multi-domain access control method based on the Internet of Things comprises the following steps:

[0063] Step 1: At every set time interval, the device end 1 sends primary access request data to the edge computing device 2 through the communication module 3, and the primary access request data includes device identification data, primary access timestamp data, key data and request data;

[0064] Step 2: Edge computing device 2 parses the primary access request data and first determines whether the identity of device end 1 is compliant based on the device identification data, key data, and primary access timestamp data;

[0065] Step 3: If the edge computing device 2 determines in step 2 that the request data is parsed in accordance with the rules;

[0066] Perform the first analysis of the request data to determine whether the end computing condition is met. If so, a signal is sent to the device end 1 to process the current data using the end computing method. The device end 1 calculates and processes the current data, saves the calculation and analysis result data locally, and sends the calculation and analysis result data to the cloud platform 4 through the communication module 3;

[0067] If the end computing condition is not met, the request data is analyzed for the second time to determine whether the edge computing condition is met. If so, a signal is sent to the device end 1 to process the current data using edge computing, and edge computing of the current data is started. The computing and analysis result data is sent to the device end 1 and the cloud platform 4 respectively through the communication module 3;

[0068] Step 4. If in step 3, the edge computing device 2 determines that the edge computing conditions are not met, it sends secondary access request data to the cloud platform 4 through the communication module 3. The secondary access request data includes device identification data, edge identification data, secondary access timestamp data, key data and request data; the cloud platform 4 parses the secondary access request data, and determines whether the identities of the device end 1 and the edge computing device 2 are compliant based on the device identification data, edge identification data and key data. If they are compliant, the current data is calculated and processed, and the calculation and analysis result data is sent to the device end 1 through the communication module 3.

[0069] For the end-edge-cloud IoT architecture composed of the device end 1, edge computing device 2, and cloud platform 4 for the instant communication of the IoT provided by the communication module 3, the multi-level and multi-domain access control first determines whether the identity of the device end 1 is compliant based on the device identification data, key data, and the first-level access timestamp data, which can avoid the impact of illegal intrusion, end-edge communication dislocation, etc.;

[0070] The edge computing device 2 has a certain computing power. Generally, it can effectively cover the computing needs of multiple device terminals 1 within the regional range. In order to give full play to the computing power of each computing unit in the Internet of Things system, it is first necessary to judge whether the request data meets the terminal computing conditions. If it is just a judgment of some threshold values, it is completely unnecessary to occupy the computing power resources of the edge computing device 2, and there is no need to occupy the large computing power resources of the cloud platform 4. If it is judged that the terminal computing conditions are met, a terminal computing signal can be sent to the terminal device 1, and the terminal device 1 performs terminal computing, analyzes the calculation results and stores them locally, and interacts with the cloud platform 4 at the same time;

[0071] If it is determined that the requested data does not meet the end computing conditions, for example, some sensitive data is not suitable for computing on the end device 1, or the computing requirements are more complex, then it is necessary to determine whether the edge computing conditions are met. If so, the edge computing device 2 performs queue computing based on the time series, and the computing results also need to be interactively stored on the end device 1 and the cloud platform 4;

[0072] If the edge computing conditions are not met, it is generally due to some visual analysis needs or large model computing needs, and in this case, the calculation needs to be performed on the cloud platform 4;

[0073] Through multi-level and multi-domain access control and the rational allocation of computing power, computing power at all levels within the Internet of Things can be fully utilized.

[0074] In embodiment 2, when the device terminal 1 is connected to the Internet of Things, it registers the device identification data on the cloud platform 4 and downloads the device-specific key data. The cloud platform 4 interacts with the corresponding edge computing device 2 to obtain the corresponding device identification data and device-specific key data.

[0075] In step 2, the method for determining whether the identity of device end 1 is compliant is: edge computing device 2 determines whether the identity of device end 1 is compliant based on a compliance decision function, and the compliance decision function determines whether the following parameters are compliant: device identification, device-specific key, data sender, data responder, and timestamp.

[0076] In Example 3, the formula of the compliance decision function is:

[0077] CPt=F(DeviceID,KeyData,Challenge,Response,Time);

[0078] Where CPt is the compliance decision result corresponding to the first-level access timestamp data; F is the compliance decision function; DeviceID is the device identifier; KeyData is the device-specific key data; Challenge is the data sender; Response is the data responder; Time is the first-level access timestamp data.

[0079] Device identification data: a string or number that uniquely identifies a device. Device-specific key: key information used by the device for encryption and authentication, including symmetric keys, asymmetric key pairs, etc.

[0080] Compliance verification: whether the device meets the predetermined safety standards and operating specifications.

[0081] When a device is connected to the Internet of Things, it registers the device identification data on the cloud platform 4 and downloads the device-specific key data. The device end 1 needs to perform compliance checks regularly or on demand to avoid systemic data risks caused by non-compliant device access.

[0082] In the fourth embodiment, in step 4, an edge identification data decision parameter is added to the compliance decision function to implement compliance judgment on the secondary access request data.

[0083] The compliance judgment in step 4 is similar to the compliance judgment on device side 1 in terms of method, except that edge identification data is added to perform compliance judgment on edge computing device 2 to improve data security.

[0084] In Example 5, the method for determining whether the end computing condition is met in step 3 is: first define the end computing condition, the end computing condition includes: computing power resources, the computing power of the CPU of the device end 1; data sensitivity: whether the data contains sensitive information, whether it needs to be processed locally to protect privacy; computing requirements: the computing power requirements of the task;

[0085] According to the terminal calculation conditions, formulate the terminal calculation condition judgment formula:

[0086] Com=F a (R, S, C);

[0087] Com is the end-computation conditional scoring function; F a is the end computing decision function, R is the computing resource score; S is the data sensitivity score; C is the computing demand score;

[0088] Set the end calculation scoring threshold. If Com is greater than the end calculation scoring threshold, it is judged that the end calculation condition is met, otherwise it does not meet the end calculation condition.

[0089] In Example 6, the score range of R is 0-1, and a score between 0 and 1 is returned according to the computing power resources of the current device end 1, where 1 indicates high computing power resources;

[0090] The value of S is 0 or 1. It returns a result of 0 or 1 depending on whether the data sensitivity level of the requested data exceeds the set threshold. 0 means that the data sensitivity level exceeds the threshold and the operation cannot be performed on the device 1. 1 means that the data sensitivity level does not exceed the threshold and the operation is allowed on the device 1.

[0091] The score range of C is 0-1. It returns a score between 0 and 1 based on the intensity of the requested data computing task, where 1 indicates high computing demand.

[0092] A method can be implemented in which the edge computing device 2 determines whether the device is compliant based on the device identification data and the key data. This method relies on the irreversibility of the cryptographic hash function and the confidentiality of the key data, ensuring the security of the compliance check.

[0093] In Example 7, the method for determining whether the edge computing condition is met in step 3 is:

[0094] First, define the edge computing conditions, which include: edge resource availability: whether the CPU, memory, storage and energy resources of the edge server are sufficient; edge network status: the quality of the network connection between the edge server and the end device; edge service availability: whether the required services or applications are deployed on the edge computing device 2; task edge adaptability: whether the task is suitable for execution in the edge computing device 2 environment;

[0095] According to the edge computing conditions, the edge computing condition judgment formula is formulated:

[0096] Edge=G(ER,EN,ES,TA);

[0097] Where Edge is the edge computing condition scoring function; G is the edge computing decision function, ER is the edge resource availability score; EN is the edge network status score; ES is the edge service availability score; TA is the task edge adaptability score;

[0098] Set the edge computing scoring threshold. If Edge is greater than the edge computing scoring threshold, the edge computing condition is met, otherwise the edge computing condition is not met.

[0099] The ER score range is 0-1, and a score between 0 and 1 is returned based on the resource usage of the edge computing device 2, where 1 indicates sufficient resources;

[0100] The EN score ranges from 0 to 1, and returns a score between 0 and 1 based on the network bandwidth, latency, and stability between edge computing device 2 and device end 1, where 1 indicates a good network condition;

[0101] The ES score ranges from 0 to 1, and returns a score between 0 and 1 based on the availability of the required computation on the edge computing device 2, where 1 indicates that the computation is available;

[0102] The TA score range is 0-1, and a score between 0 and 1 is returned based on the task requirements and the computing power of the edge computing device 2, where 1 means that the task is completely suitable for execution at the edge.

[0103] The edge computing scoring threshold is used to decide whether to perform computing at the edge. This edge computing scoring threshold can be adjusted according to the specific situation of the edge environment and the task requirements. It takes into account the resources, network and service conditions of the edge environment, as well as the adaptability of the task itself. It can quickly determine whether the edge computing conditions are met.

[0104] Embodiment 8, a multi-level multi-domain access control system based on the Internet of Things, is used to implement a multi-level multi-domain access control method based on the Internet of Things, the multi-level multi-domain access control system includes multiple end-edge modules, a communication module 3 and a cloud platform 4, the end-edge module includes multiple interfaces for connecting end devices, multiple device ends 1 and edge computing devices 2, multiple device ends 1 are connected to the multi-level multi-domain access control system through the interfaces of the end devices, the communication module 3 is used to form an Internet of Things communication network coverage in the multi-level multi-domain access control system area, multiple device ends 1 are respectively connected to the edge computing device 2 and the cloud platform 4 Internet of Things wireless communication through the communication module 3, and the edge computing devices 2 of multiple end-edge modules are respectively connected to the cloud platform 4 Internet of Things wireless communication through the communication module 3.

[0105] In Example 9, the communication module 3 is implemented based on 5G wireless communication technology.

[0106] The above are all preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Therefore, any equivalent changes made based on the structure, shape, and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A multi-level and multi-domain access control method based on the Internet of Things, characterized in that: The following steps are involved: Step 1: At every set time interval, the device end (1) sends primary access request data to the edge computing device (2) through the communication module (3), where the primary access request data includes device identification data, primary access timestamp data, key data and request data; Step 2, the edge computing device (2) parses the primary access request data, and first determines whether the identity of the device end (1) is compliant based on the device identification data, key data, and primary access timestamp data; Step 3: If the edge computing device (2) in step 2 determines that the request data is parsed in accordance with the rules; Perform a first analysis on the requested data to determine whether the end computing condition is met. If so, a signal is sent to the device end (1) to process the current data using the end computing method. The device end (1) calculates and processes the current data, stores the calculation and analysis result data locally, and sends the calculation and analysis result data to the cloud platform (4) through the communication module (3); If the end computing condition is not met, a second analysis of the requested data is performed to determine whether the edge computing condition is met. If so, a signal is sent to the device end (1) to process the current data using edge computing, and edge computing of the current data is started. The computing and analysis result data is sent to the device end (1) and the cloud platform (4) respectively through the communication module (3); Step 4: If in step 3, the edge computing device (2) determines that the edge computing conditions are not met, it sends secondary access request data to the cloud platform (4) through the communication module (3), and the secondary access request data includes device identification data, edge identification data, secondary access timestamp data, key data and request data; the cloud platform (4) parses the secondary access request data, and determines whether the identities of the device end (1) and the edge computing device (2) are compliant based on the device identification data, edge identification data and key data. If they are compliant, the current data is calculated and processed, and the calculation and analysis result data is sent to the device end (1) through the communication module (3).

2. According to claim 1, a multi-level and multi-domain access control method based on the Internet of Things is characterized in that: When the device end (1) is connected to the Internet of Things, it registers the device identification data on the cloud platform (4) and downloads the device-specific key data. The cloud platform (4) interacts with the corresponding edge computing device (2) to exchange the corresponding device identification data and device-specific key data. In step 2, the method for determining whether the identity of the device side (1) is compliant is: the edge computing device (2) determines whether the identity of the device side (1) is compliant based on a compliance decision function, and the compliance decision function determines whether the following parameters are compliant: device identification, device-specific key, data sender, data responder, and timestamp.

3. According to claim 2, a multi-level and multi-domain access control method based on the Internet of Things is characterized in that: The formula for the compliance decision function is: CPt=F(DeviceID,KeyData,Challenge,Response,Time); Where CPt is the compliance decision result corresponding to the first-level access timestamp data; F is the compliance decision function; DeviceID is the device identifier; KeyData is the device-specific key data; Challenge is the data sender; Response is the data responder; Time is the first-level access timestamp data.

4. According to claim 3, a multi-level and multi-domain access control method based on the Internet of Things is characterized in that: In step 4, an edge identification data decision parameter is added to the compliance decision function to implement compliance judgment on the secondary access request data.

5. The multi-level and multi-domain access control method based on the Internet of Things according to claim 4 is characterized in that: The method for determining whether the end computing conditions are met in step 3 is: first define the end computing conditions, which include: computing power resources, the computing power of the CPU of the device end (1); data sensitivity: whether the data contains sensitive information and whether it needs to be processed locally to protect privacy; computing requirements: the computing power requirements of the task; According to the terminal calculation conditions, formulate the terminal calculation condition judgment formula: Com=F a (R,); Com is the end-computation conditional scoring function; F a is the end computing decision function, R is the computing resource score; S is the data sensitivity score; C is the computing demand score; Set the end calculation scoring threshold. If Com is greater than the end calculation scoring threshold, it is judged that the end calculation condition is met, otherwise it does not meet the end calculation condition.

6. The multi-level and multi-domain access control method based on the Internet of Things according to claim 5 is characterized in that: The score range of R is 0-1. It returns a score between 0 and 1 based on the computing resources of the current device (1), where 1 indicates high computing resources; The value of S is 0 or 1. Depending on whether the data sensitivity level of the requested data exceeds the set threshold, a result of 0 or 1 is returned. 0 means that the data sensitivity level exceeds the threshold and the operation cannot be performed on the device side (1). 1 means that the data sensitivity level does not exceed the threshold and the operation is allowed on the device side (1). The score range of C is 0-1. It returns a score between 0 and 1 based on the intensity of the requested data computing task, where 1 indicates high computing demand.

7. The multi-level and multi-domain access control method based on the Internet of Things according to claim 6 is characterized in that: The method for determining whether the edge computing conditions are met in step 3 is: First, we define the edge computing conditions, which include: edge resource availability: whether the CPU, memory, storage and energy resources of the edge server are sufficient; edge network status: the quality of the network connection between the edge server and the end device; edge service availability: whether the required services or applications are deployed on the edge computing device (2); task edge adaptability: whether the task is suitable for execution in the edge computing device (2) environment; According to the edge computing conditions, the edge computing condition judgment formula is formulated: Edge = G(ER,); Where Edge is the edge computing condition scoring function; G is the edge computing decision function, ER is the edge resource availability score; EN is the edge network status score; ES is the edge service availability score; TA is the task edge adaptability score; Set the edge computing scoring threshold. If Edge is greater than the edge computing scoring threshold, the edge computing condition is met, otherwise the edge computing condition is not met.

8. The multi-level and multi-domain access control method based on the Internet of Things according to claim 7 is characterized in that: The ER score ranges from 0 to 1, and returns a score between 0 and 1 based on the resource usage of the edge computing device (2), where 1 indicates sufficient resources; The EN score ranges from 0 to 1, and returns a score between 0 and 1 based on the network bandwidth, latency, and stability between the edge computing device (2) and the device end (1), where 1 indicates a good network condition; The ES score ranges from 0 to 1, and returns a score between 0 and 1 based on the availability of the required computation on the edge computing device (2), where 1 indicates that the computation is available; TA's score range is 0-1, and it returns a score between 0 and 1 based on the task requirements and the computing power of the edge computing device (2), where 1 means that the task is completely suitable for execution at the edge.

9. A multi-level and multi-domain access control system based on the Internet of Things, characterized by: A multi-level multi-domain access control method based on the Internet of Things is used to implement the multi-level multi-domain access control method described in claim 8, wherein the multi-level multi-domain access control system includes multiple end-edge modules, a communication module (3) and a cloud platform (4), wherein the end-edge module includes multiple interfaces for connecting end devices, multiple device ends (1) and edge computing devices (2), wherein the multiple device ends (1) are connected to the multi-level multi-domain access control system through the interfaces of the end devices, and the communication module (3) is used to form an Internet of Things communication network coverage in the multi-level multi-domain access control system area, wherein the multiple device ends (1) are respectively connected to the edge computing device (2) and the cloud platform (4) through the Internet of Things wireless communication through the communication module (3), and the edge computing devices (2) of the multiple end-edge modules are respectively connected to the cloud platform (4) through the Internet of Things wireless communication through the communication module (3).

10. The multi-level and multi-domain access control system based on the Internet of Things according to claim 9, characterized in that: The communication module (3) is implemented based on 5G wireless communication technology.

Images