Method and apparatus for access control

Abstract

The invention provides an access control method, server-side equipment, proxy equipment and client-side equipment. The method for access control comprises: a server device controlling access control information that can be acquired by a proxy device according to binding relationship information, the binding relationship information being used for indicating that a binding relationship exists between the proxy device and a client device. In the embodiment of the invention, the server equipment can control the access control information which can be acquired by the proxy equipment according to the binding relation information. In this way, the proxy device with the proxy view authority can only obtain the access control information corresponding to the client device with the binding relation with the proxy device, and the risk of data privacy leakage is reduced.

Description

Method and apparatus for access control Technical Field

[0001] The present application relates to the field of communication technology, and more specifically, to a method for access control, a server device, a proxy device, and a client device. Background Art

[0002] In some cases, a client device can subscribe to resources on a server device through a proxy device. To facilitate the proxy device in determining whether the client device has permission to subscribe to resources on the server device, the proxy device has proxy view permission on the server device.

[0003] A proxy device with proxy view permissions can obtain all access control information of the server device. As a result, if the proxy device is compromised, it is easy to cause the access control information of the server device to be leaked, increasing the risk of data privacy leakage.

[0004] Summary of the Invention

[0005] The present application provides a method, a server device, a proxy device, and a client device for access control. The following introduces various aspects of the present application.

[0006] In a first aspect, a method for access control is provided, comprising: a server device controlling access control information that a proxy device can obtain according to binding relationship information, wherein the binding relationship information is used to indicate that a binding relationship exists between the proxy device and a client device.

[0007] In a second aspect, a method for access control is provided, comprising: a proxy device sends a first request to a server device, the first request being used to query whether a client device has access rights to a target resource of the server device; in response to binding relationship information, the proxy device receives a first response sent by the server device; wherein the binding relationship information is used to indicate that there is a binding relationship between the proxy device and the client device, and the binding relationship information is used to control the access control information that the proxy device can obtain.

[0008] In a third aspect, a method for access control is provided, comprising: a client device sending binding relationship information to a server device, wherein the binding relationship information is used to indicate that there is a binding relationship between the client device and the proxy device, and the binding relationship information is used to control the access control information that the proxy device can obtain.

[0009] In a fourth aspect, a server device is provided, comprising: a control module for controlling access control information that a proxy device can obtain according to binding relationship information, wherein the binding relationship information is used to indicate that there is a binding relationship between the proxy device and the client device.

[0010] In a fifth aspect, a proxy device is provided, comprising: a first sending module for sending a first request to a server device, wherein the first request is used to query whether the client device has access rights to a target resource of the server device; a first receiving module for receiving a first response sent by the server device in response to binding relationship information; wherein the binding relationship information is used to indicate that there is a binding relationship between the proxy device and the client device, and the binding relationship information is used to control the access control information that the proxy device can obtain.

[0011] In a sixth aspect, a client device is provided, comprising: a sending module for sending binding relationship information to a server device, wherein the binding relationship information is used to indicate that there is a binding relationship between the client device and the proxy device, and the binding relationship information is used to control the access control information that the proxy device can obtain.

[0012] In the seventh aspect, a server device is provided, comprising a processor, a memory, and a communication interface, wherein the memory is used to store one or more computer programs, and the processor is used to call the computer program in the memory so that the server device executes part or all of the steps in the method of the first aspect.

[0013] In an eighth aspect, an agent device is provided, comprising a processor, a memory, and a communication interface, wherein the memory is used to store one or more computer programs, and the processor is used to call the computer program in the memory so that the agent device executes part or all of the steps in the method of the second aspect.

[0014] In the ninth aspect, a client device is provided, comprising a processor, a memory, and a communication interface, wherein the memory is used to store one or more computer programs, and the processor is used to call the computer program in the memory so that the client device executes part or all of the steps in the method of the third aspect.

[0015] In a tenth aspect, embodiments of the present application provide a communication system comprising one or more of the aforementioned server device, proxy device, and client device. In another possible design, the system may further include other devices that interact with the server device, proxy device, or client device in the solutions provided in embodiments of the present application.

[0016] In the eleventh aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program, and the computer program enables a server device, a proxy device or a client device to execute part or all of the steps in the methods of the above aspects.

[0017] In a twelfth aspect, embodiments of the present application provide a computer program product, wherein the computer program product includes a non-transitory computer-readable storage medium storing a computer program, wherein the computer program is operable to cause a server device, a proxy device, or a client device to perform some or all of the steps of the methods described in each of the above aspects. In some implementations, the computer program product may be a software installation package.

[0018] In the thirteenth aspect, an embodiment of the present application provides a chip, which includes a memory and a processor. The processor can call and run a computer program from the memory to implement some or all of the steps described in the methods of the above aspects.

[0019] In this embodiment of the present application, the server device can control the access control information that the proxy device can obtain based on the binding relationship information. In this way, the proxy device with proxy view permission can only obtain the access control information corresponding to the client device with which it has a binding relationship, reducing the risk of data privacy leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] FIG1 is a model structure of a Matter device to which an embodiment of the present application can be applied.

[0021] FIG2 is a diagram illustrating an example of a system architecture of a communication system to which an embodiment of the present application may be applied.

[0022] FIG3 is an example diagram of the level relationship of access control permissions provided in an embodiment of the present application.

[0023] FIG4 is a diagram showing an example of a system architecture of a communication system to which a proxy mechanism can be applied.

[0024] FIG5 is a flow chart of proxy subscription provided in an embodiment of the present application.

[0025] FIG6 is a flow chart of a method for access control provided in an embodiment of the present application.

[0026] FIG7 is a schematic diagram of a process for establishing binding relationship information provided in an embodiment of the present application.

[0027] FIG8 is a flow chart of a method for access control provided in another embodiment of the present application.

[0028] FIG9 is a flow chart of a method for access control provided in yet another embodiment of the present application.

[0029] FIG10 is a flow chart of a method for access control provided in yet another embodiment of the present application.

[0030] FIG11 is a flow chart of the process of discovering and establishing a connection of a proxy device according to an embodiment of the present application.

[0031] FIG12 is a flow chart of a method for access control provided in yet another embodiment of the present application.

[0032] FIG13 is a flow chart of a method for access control provided in yet another embodiment of the present application.

[0033] FIG14 is a flow chart of a method for access control provided in yet another embodiment of the present application.

[0034] FIG15 is a schematic diagram of the structure of the server device provided in an embodiment of the present application.

[0035] FIG16 is a schematic diagram of the structure of the proxy device provided in an embodiment of the present application.

[0036] FIG17 is a schematic diagram of the structure of a client device provided in an embodiment of the present application.

[0037] FIG18 is a schematic structural diagram of a communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0038] The technical solutions in this application will be described below in conjunction with the accompanying drawings. For ease of understanding, the terms involved in the embodiments of this application are introduced below in conjunction with Figures 1 to 5. It should be noted that the following uses the Matter protocol scenario as an example to introduce the terms involved in the embodiments of this application and the solutions of the embodiments of this application. Of course, the solutions of the embodiments of this application can also be applied to other Internet of Things protocols.

[0039] The Internet of Things (IoT), or "Internet of Everything," is an extension and expansion of the Internet. Through various information sensing devices (such as radio frequency identification and global positioning systems), any object can be connected to the Internet to form a vast network for information exchange and communication, enabling interconnection and interoperability between all things. In some embodiments, IoT devices can be smart home devices, such as smart air conditioners, smart refrigerators, washing machines, rice cookers, and robot vacuums. In some embodiments, IoT devices can be smart monitoring devices, such as surveillance cameras, temperature sensors, and sound sensors.

[0040] At present, different manufacturers may use different communication protocols (also known as ecological chain protocols) to achieve interoperability between IoT devices that support the communication protocols. This may result in the inability of IoT devices produced by different manufacturers to communicate with each other, and the failure to achieve true interconnection of all things.

[0041] Based on this, the Connectivity Standards Alliance (CSA) has launched an IoT application layer technology standard - the Matter standard protocol, which can provide an interoperable application layer solution for smart home devices based on the Internet Protocol (IP). In some embodiments, the Matter standard can also be called the connected home over IP (CHIP) standard. In some embodiments, the Matter standard can support three underlying communication protocols: Ethernet, Wi-Fi, and Thread, and can enable IoT devices with different protocols to communicate with each other.

[0042] Data model of Matter device

[0043] 1 is a data model structure of a Matter device applicable to an embodiment of the present application. The data model structure 100 of the Matter device includes a node 110, an endpoint 120, and a function cluster 130.

[0044] Node 110 encapsulates a unique, addressable resource on the network, possessing a set of functions and capabilities that users can clearly perceive as a functional entity. Typically, node 110 can be the highest or outermost first-order element in a data model. In other words, node 110 is the only addressable element at the outermost level of a data model.

[0045] A physical entity (e.g., a Matter device) can be a node 110, or in other words, a node 110 can refer to a Matter device node. It should be noted that a node can have multiple node identifiers (IDs), and the scope of each node ID is a specific network (fabric). For example, when a node ID is used as the target address for an interaction, the network scoped to the specified node ID is the access network for the interaction.

[0046] A node may include one or more endpoints 120. An endpoint 120 is an instance, which can be a service or a virtual device, as indicated by a device type. Each endpoint 120 conforms to one or more device type definitions, which define the functional clusters supported by the endpoint. In some embodiments, an endpoint can be understood as a service / virtual device indicated by the device type. A functional cluster is an object class instantiated on the endpoint.

[0047] It should be noted that in this architecture model, the device type can be the highest semantic element. The device type defines a set of conformances of the endpoint 120. The device type defines a set of requirements for the node 110 or the endpoint 120.

[0048] Each endpoint 120 may be a collection of a type of functionality, which may include one or more functional clusters 130 .

[0049] Functional cluster 130 is a functional building block element of the data model. In some embodiments, functional cluster can also be referred to as functional set, cluster, cluster, etc., which is not limited by the embodiments of the present application. The functional cluster specification defines the client and server that correspond to each other through interaction. Functional cluster 130 can be regarded as an interface, service or object class, which is the lowest independent functional element in the data model. Each functional cluster 130 can be defined by a functional cluster specification, which defines the elements of the functional cluster 130, including attributes, events, commands and behaviors related to the interaction of these elements. In some embodiments, attributes, commands, and events can also be referred to as interface units of functional cluster 130, and corresponding functions can be provided through these three interface units.

[0050] In some embodiments, the attributes, events, commands, and behaviors in a functional cluster 130 are mandatory or optional, depending on the definition of the functional cluster 130 .

[0051] Generally, the above functional clusters can be divided into two categories: utility functional clusters and application functional clusters.

[0052] The utility function cluster is not part of the primary application operation of the endpoint. The utility function cluster can be used for configuration, discovery, addressing, diagnostics, monitoring device health, software updates, etc. The utility function cluster may have a temporary relationship with its function cluster counterpart. Exemplary utility function clusters may include a descriptor function cluster, a binding function cluster, a proxy configuration function cluster, etc.

[0053] An application function cluster supports the primary operations of an endpoint. In some embodiments, this cluster can also be referred to as a business function cluster. It can support the interaction of one or more persistent applications between a client and a server. For example, consider the on / off function cluster in a smart light. The client can send control commands to the server (i.e., the on / off function cluster) to turn the smart light on or off.

[0054] In some embodiments, the service function cluster may refer to a function cluster on other endpoints except endpoint 0 in the node (which may be understood as the first endpoint in the node, and the device type of the endpoint is "root node").

[0055] An application functionality cluster is not a utility functionality cluster, even though it may itself support utility functionality such as calibration, operation modes, etc. An application functionality cluster specification should not involve layers and processes outside its application domain.

[0056] The following is a brief introduction to the main elements of the function cluster, such as commands, properties, and events.

[0057] A functional cluster command (also known as a "command") is a set of data fields, each of which is passed between client and server functional cluster instances to invoke behavior on the command recipient. Currently, the protocol stipulates that each command can be listed in a table, which can contain columns for the command's data quality: ID, name, direction, response, access, and conformance. Accordingly, a command can indicate zero or more fields defined in a table. Each command field is defined as a row in the table.

[0058] Attributes are functional cluster data. Currently, the protocol stipulates that each attribute can be listed in a table. The data quality columns of the attribute defined in this table may include: ID, name, (data) type, constraint, other qualities, access, default (value), and compliance. In some implementations, attributes can also define their related semantics and behaviors. Attributes can reflect the queryable / settable state, configuration, and capabilities of a device. In some cases, if no permissions are explicitly defined for an attribute, the default access permissions take effect.

[0059] An event defines a record of something that happened in the past. In this respect, an event record can be thought of as a log entry that provides a chronological view of events on a node through a stream of event records. Unlike attributes, which do not provide any edge-preserving functionality (that is, there is no guarantee that every attribute change will be passed to the observer), events allow each individual edge or change to be captured and reliably passed to the observer. This is critical for safety and security applications that rely on guarantees of correct behavior. Currently, the protocol stipulates that each functional cluster event can be listed in a table, and the data quality columns defined by the table for the event can include: ID, priority, access, and compliance.

[0060] To facilitate understanding, the following describes several common data qualities included in commands, attributes, and events. It should be noted that the commands, attributes, and events in the embodiments of this application may also include other data qualities, or may include portions of the aforementioned data qualities. This is not limited in the embodiments of this application.

[0061] Identifier, which indicates the unique field ID of a field, or the unique identifier of a command (or attribute, event).

[0062] Name: The unique name of the field, or the name of the command (or attribute).

[0063] Type indicates the data type of the field, or the data type of the command parameter (or attribute parameter).

[0064] Direction, usually present in a command list, is used to define the transmission direction of the command. For example, it can be defined as from the client to the server. Another example is from the server to the client.

[0065] Access rights define how an element can be accessed (e.g., read or write) and what permissions are required to access the data. In some implementations, access rights may include V, which indicates that read access or call access requires view permission. Access rights may also include O, which indicates that "read access," "write access," or "call access" requires operation permission. Access rights may also include R, which indicates read access. Access rights may also include W, which indicates write access.

[0066] Response, usually exists in the command list, is used to define the response message of the command.

[0067] Quality, used to define additional data qualities not covered in other columns.

[0068] Default is used to define a default value. It should be noted that the default value is not the value used when the server returns the factory refresh settings. Default values ​​can indicate that the compliance specified for a data field is optional or can change over time. Default values ​​can be defined to fulfill dependencies when the actual data field value does not exist.

[0069] Conformance defines the optionality and dependencies of any data model element or set of elements. Typically, this column is valid for attributes, commands, events, enumerations, and fields of commands, events, or structures. In some implementations, "M" indicates that the corresponding command is part of the basic mandatory feature set, and "O" indicates that the corresponding command is part of the optional feature set.

[0070] For commands, client-to-server command conformance means that the server should recognize and support the client-to-server command and generate responses as defined. Server-to-client command conformance means that the server should send commands in a manner defined by the functional cluster behavior, i.e., respond to client-to-server commands. Command conformance depends on supported server features. Clients should not be required to support optional commands or commands that depend on optional features.

[0071] Constraints include "all" and "desc." "all" in a numeric data type indicates that all values ​​are allowed. "desc" indicates that the constraint is defined in the description section.

[0072] Range indicates the value range of the field. Range can support two forms: explicit constraint and width constraint. Among them, the explicit constraint can give the minimum and maximum values ​​corresponding to the value of the field, for example, the value range of a field is (0,128). The width constraint can limit the value of the field to a specific number of bytes, for example, the value of a field is limited to 8 bytes. In some embodiments, the value of the range may include "N / A" to indicate not applicable. Of course, "N / A" can also appear in other parts (other data quality), such as defaults, constraints, etc.

[0073] Priority: Each event record has an associated priority. This priority can be used to describe the usage semantics of the event.

[0074] Communication system based on Matter protocol

[0075] The following describes a communication system applicable to an embodiment of the present application in conjunction with Figure 2. The communication system shown in Figure 2 includes a Matter client device 210, a Matter server device 220, and a configuration device 230. It should be noted that the data structure model of the Matter client device 210 and the Matter server device 220 can be as shown in Figure 1.

[0076] Matter client device 210 is a user-side client device that can communicate with Matter server device 220. In some implementations, Matter client device 210 can send control information to Matter server device 220 to control Matter server device 220. For example, when Matter server device 220 is a smart air conditioner, Matter client device 210 can send control information to Matter server device 220 to control the temperature of Matter server device 220.

[0077] In some embodiments, the Matter client device 210 may refer to a terminal device installed with a Matter client, wherein the terminal device may be a mobile phone, a computer, a tablet computer, a smart bracelet, a smart watch, etc., which is not limited in the embodiments of the present application. It should be understood that the Matter client may be an application (APP) or a mini-program, etc., which is not limited in the embodiments of the present application.

[0078] Matter server device 220 may refer to an IoT device that supports the Matter standard protocol. Matter server device 220 may communicate directly with Matter client device 210 so that Matter client device 210 can control Matter server device 220.

[0079] For example, when the Matter server device 220 is a smart air conditioner that supports the Matter standard protocol, the Matter client device 210 can control the smart air conditioner's power on and off, and set the temperature, wind speed, etc. When the Matter server device 220 is a robot vacuum that supports the Matter standard protocol, the Matter client device 210 can control the robot vacuum to start or stop working, control the robot vacuum's operating mode, etc.

[0080] Currently, the control interfaces supported by the Matter server device 220 mainly include control and subscription and reporting. Among them, control can be understood as a set of functional clusters corresponding to one or more attribute values ​​of the Matter server device that can be modified or retrieved. For example, the Matter client device is a smart speaker and the Matter server device is a smart air conditioner. The user can say "cool down" to the smart speaker, and then the smart speaker sends a control command to lower the temperature to the smart air conditioner.

[0081] In some embodiments, a subscription interaction model can be used to define subscribing attributes and subscription requirements, such as trigger thresholds, reporting intervals, and durations. As a specific example, the Matter client device is a smart speaker, and the Matter server device is a smart air conditioner. A user can subscribe to the indoor temperature measured by the air conditioning sensor of the smart air conditioner through the smart speaker, so that the user can monitor the indoor temperature by receiving reports regularly.

[0082] The configuration (commissioner) device 230 can be used to configure the Matter server device 220. In other words, the configuration device can be understood as a terminal device installed with a configuration terminal, and the user can configure the Matter server device 220 through the configuration terminal. Among them, the terminal device can be a mobile phone, computer, tablet computer, smart bracelet, smart watch, etc., which is not limited in the embodiment of the present application. In some embodiments, the configuration terminal can be an application or a small program, etc., which is not limited in the embodiment of the present application.

[0083] It should be noted that the configuration terminal can be the same APP or mini-program as the Matter client. Of course, the configuration terminal can be a different APP or mini-program from the Matter client. This embodiment of the application is not limited to this.

[0084] Access control list (ACL) function cluster

[0085] The access control feature is designed to ensure that only authorized nodes are allowed to access specific application layer functions exposed by the data model through the interaction model. Access control is the fundamental connection between the secure channel and the interaction model.

[0086] To implement access control policies, administrators on the fabric create and maintain a consistent distributed configuration of ACLs across all nodes, or in other words, create and maintain an ACL function cluster. In some embodiments, the ACL function cluster may also be referred to as an access control function cluster, although this embodiment of the present application does not make a clear distinction between the two.

[0087] The ACL function cluster controls device access permissions. It's deployed on each node and has only one instance. In other words, each node includes an ACL. When a node receives a request, it first checks the ACL to see if the requester has permission.

[0088] ACLs can contain access control entries (ACEs) that encode policies. The access control system can check and validate all attempted accesses against the rules in the ACEs contained in a node's ACL. Each ACE can encode a single permission grant on that node and is used by the access control permission grant algorithm to determine whether a subject has permission to interact with a target on the node.

[0089] The attributes included in the ACL function cluster can be seen in Table 1.

[0090] Table 1

[0091] ID Name Type Constraint Quality Access Default Compliance 0ACLList[AccessControlEntryStruct]descNRWAemptyM

[0092] As shown in Table 1, this attribute is a list-type structure (e.g., AccessControlEntryStruct). The quality of this attribute is "N," indicating that the attribute data value is non-volatile and persists across reboots. The corresponding access data quality includes RWA, indicating that read and write access require administrator privileges.

[0093] The following describes the type of the attribute included in the ACL function cluster in conjunction with Table 2. In other words, the definition of the structure (AccessControlEntryStruct) of the attribute type can be as shown in Table 2.

[0094] Table 2

[0095]

[0096] FabricIndex can limit the scope of ACE to the associated fabric.

[0097] The Privilege field specifies the level of permissions granted by the ACE. In other words, within an ACE, Privileges determine the permissions granted to the corresponding Subjects to access Targets. Privileges can be enumerated and can represent one or more items in the AccessControlEntryPrivilegeEnum. The definition of AccessControlEntryPrivilegeEnum can include the following permissions:

[0098] (1) View permission: A device granted the view permission can read and subscribe to the server device's resources, except for the ACL function cluster. In some embodiments, the view permission can also be used to indicate that the server device's target can be seen by non-proxy devices.

[0099] (2) Proxyview permission: A device granted proxyview permission can read and subscribe to the server device's resources, including the ACL function cluster. In some embodiments, proxyview can also be used to indicate that the proxy device can see the server device's targets and ACLs.

[0100] (3) Operate permission: A device granted the operate permission can obtain the view permission and can execute the main functions of the node, except for the ACL function cluster.

[0101] (4) Manage permissions: Devices granted manage permissions can obtain operate permissions and can modify and configure data on the node, except for ACL function clusters.

[0102] (5) Administrator privileges: Devices granted administrator privileges can obtain manage privileges and can subscribe to and modify ACL function clusters.

[0103] As you can see, each permission builds on its predecessor, expanding the set of operations that can be performed on the node. The administrator is the highest permission, and its special feature is that it manages the permissions of the cluster itself through the ACL function.

[0104] When a node is granted a specific permission, it is also implicitly granted all logically lower permission levels. Figure 3 illustrates how higher permission levels include lower permission levels.

[0105] The AuthMode field can be used to specify the authentication mode required by this ACE. AuthMode can be enumerated and can belong to one or more items in AccessControlEntryAuthmodeEnum. The definition of AccessControlEntryAuthmodeEnum can include several authentication modes listed in Table 3.

[0106] Table 3

[0107]

[0108] The Subjects field can be used to specify a list of subjects to which this ACE grants access rights. The meaning of a Subject is primarily to describe the source of an operation that uses a given authentication method provided by the secure channel architecture. In some embodiments, a Subject can be a source node (e.g., a client device node) authenticated through a CASE session.

[0109] In some embodiments, the subjects field may include a device ID (node ​​ID) of the client device. In some embodiments, the subjects field may include a CASE authenticated tag (CAT) corresponding to the client device.

[0110] In some embodiments, when the Subjects list is empty, it represents a wildcard, that is, the ACE will grant access to any node that successfully passes the AuthMode authentication. In some embodiments, if the AuthMode of the ACE is PASE, the subjects list cannot be empty.

[0111] The Targets field can be used to specify a list of target structures that define the clusters on the node to which this ACE grants access.

[0112] In some embodiments, a single target should contain at least one field (functional cluster, endpoint, or device type) and cannot contain both endpoint and device type fields.

[0113] In some embodiments, when the Targets list is empty, it represents a wildcard, that is, the ACE will grant access rights to all functional cluster instances on all endpoints of the node.

[0114] To facilitate understanding, the following is an example of an ACL function cluster.

[0115] ACL function cluster: {

[0116] ACL:[

[0117] 0:{

[0118] FabricIndex:1,

[0119] Privilege:Administer,

[0120] AuthMode:CASE,

[0121] Subjects:[0xAAAA_AAAA_AAAA_AAAA],

[0122] Targets:[]

[0123] },

[0124] 1:{

[0125] FabricIndex:1,

[0126] Privilege:Manage,

[0127] AuthMode:Group,

[0128] Subjects:[0x0000_0000_0000_0001],

[0129] Targets:[{Endpoint:1},{Endpoint:3}]

[0130] }

[0131] ]

[0132] }

[0133] In this example, the node with subjects 0xAAAA_AAAA_AAAA_AAAA has the admin permission for all functional cluster instances on all endpoints of the server device. The node with subjects 0x0000_0000_0000_0001 has the manage permission for all functional cluster instances on endpoints 1 and 3 on the server device.

[0134] Proxy mechanism provided for subscription operations

[0135] In some cases (e.g., insufficient server resources), the server cannot directly process the subscription request. A proxy mechanism (or proxy service) can be used to help the server process the subscription request. In other words, the proxy mechanism can implement proxy capabilities for subscribing to resources on the server.

[0136] As shown in Figure 4, a proxy mechanism typically involves a client device, a server device, and a proxy device. A server device can be a node that serves as the original source of data authenticity. A server device can act as a data publisher. A client device can be a node that wishes to subscribe to a server device. The proxy device can "mirror" the server device's data to the client device. For the client device, whether interacting with the proxy device or the server device, the client device does not need to change its interaction.

[0137] Generally, from the perspective of a client device, the proxy process may include the following steps: discovering that the server device needs a proxy; finding a proxy device on the network that can handle its subscription request; and setting up the proxy device to subscribe to the server device.

[0138] During the proxy setup process, a proxy device can indicate its ability to act as an authenticated proxy by declaring support for subscribed proxy device types. When such a proxy device is configured, the configuring device should recognize this capability and write the node IDs of all server devices to be proxied to the proxy configuration capability cluster on the proxy device. Alternatively, the configuring device can configure the proxy device as a wildcard proxy for all server devices, eliminating the need to specify a specific set of node IDs.

[0139] Additionally, the configuration device can write the node ID of the newly added proxy device to the valid proxy list cluster on the server device that needs to be proxied. This cluster can store a static list of candidate proxies for a given device. Typically, this configuration is required for server devices that support this cluster.

[0140] After the client device finds a proxy device that can handle its subscription request and successfully sets it up, it can subscribe to the server device's resources through the proxy device. Figure 5 shows a schematic diagram of a proxy subscription process. The proxy subscription process shown in Figure 5 may include steps 1 to 10.

[0141] In step 1, the client device sends a request to the proxy device to subscribe to the C1 resource on the server device.

[0142] In step 2, the proxy device sends a report data (ReportData) message to the client device, notifying the client device that it is temporarily not subscribed to the resource of the server device (ie, the proxy device is temporarily not subscribed to the C1 resource).

[0143] In step 3, the client device responds to the ReportData message sent by the proxy device.

[0144] In step 4, the proxy device returns a subscription response to the client device.

[0145] In step 5-8, the proxy device initiates a subscription to the C1 resource on the server device and completes the subscription to the C1 resource.

[0146] In steps 9-10, after the proxy device successfully subscribes to the C1 resource, it continues to process the subscription process of the client device.

[0147] Before the proxy device sends ReportData to the client device, it needs to check whether the client device has the permission to subscribe to the C1 resource of the server device (view permission). If the client device has the permission to subscribe to the C1 resource, the proxy device can return the content of the subscribed C1 resource to the client device via ReportData. If the proxy device has not yet subscribed to the C1 resource, it can first return a message to the client device indicating that it has not subscribed to the C1 resource, and then subscribe to the C1 resource and return the content of the subscribed C1 resource to the client device.

[0148] To facilitate the proxy device's determination of whether the client device has permission to subscribe to the server device's resources (i.e., the target resource below), the proxy device has proxyview permission on the server device, enabling it to obtain all access control information on the server device. In other words, the proxy device has proxyview permission on the server device's ACL function cluster resources, enabling it to subscribe to or read the ACL function cluster. Based on this, the proxy device can determine whether the client device can subscribe to the target resource (e.g., C1 resource) by obtaining the client device's permission on the server device's target resource.

[0149] It should be noted that no matter whether the client device subscribes to the target resource of the server device directly or through a proxy device, it must have the permission to subscribe to the target resource of the server device, that is, the ACL function cluster of the server device must have the ACE corresponding to the client device.

[0150] As mentioned above, after the proxy device has the proxyview permission, it can use this permission to access (read and / or subscribe to) the ACL function cluster. If the proxy device is not configured with the permission to access the ACL function cluster, the proxy device will not work.

[0151] Because neither the proxy device nor the administrator can predict which server-side target resources a client device might subscribe to, to ensure the most effective proxying, related technologies grant the entire proxy device node the proxyview permission, enabling the proxy device to obtain all access control information of the server device. This means that a proxy device with proxyview permission can obtain unlimited access to the server device's ACL information within the same fabric. This makes it very easy for the proxy device to be compromised, potentially leaking the server device's access control information and increasing the risk of data privacy breaches.

[0152] To solve the above problems, the present invention provides a method, a server device, a proxy device, and a client device for access control, which can reduce the risk of data privacy leakage. The method for access control provided by the present invention is introduced below.

[0153] FIG6 is a flow chart of a method for access control provided by an embodiment of the present application. The method shown in FIG6 can be executed by a server device, such as the Matter server device 220 shown in FIG2 above. The method shown in FIG6 can include step S610, which is described in detail below.

[0154] In step S610, the server device controls the access control information that the proxy device can obtain based on the binding relationship information.

[0155] The binding relationship information can be used to indicate that a binding relationship exists between the proxy device and the client device, that is, the binding relationship information can be used to indicate (or record) the binding relationship between the proxy device and the client device to which the proxy device has proxy subscriptions. In other words, the binding relationship information can be used to determine which client devices a proxy device has a binding relationship with, or to determine which client devices a proxy device provides proxy services for.

[0156] In some embodiments, the server device controls the access control information that the proxy device can obtain based on the binding relationship between the proxy device and the client device. This may mean that if the server device determines that the proxy device and the client device have a binding relationship, the server device may inform (e.g., send or notify) the proxy device of relevant information or content regarding the access control information corresponding to the client device (e.g., the client device's access control information to the server device's target resource). For example, if the server device determines that the proxy device and the client device have a binding relationship, the server device may inform the proxy device whether the client device has access rights to the server device's target resource, or may inform the proxy device whether the client device's access rights to the target resource have changed.

[0157] Correspondingly, in some embodiments, the server device controls the access control information that the proxy device can obtain based on the binding relationship between the proxy device and the client device. This may mean that if the server device determines that there is no binding relationship between the proxy device and the client device, the server device will not inform the proxy device of relevant information or content related to the access control information corresponding to the client device (e.g., the client device's access control information to the server device's target resource). For example, the server device will not inform the proxy device whether the client device has access rights to the server device's target resource, or the server device will not inform the proxy device whether the client device's access rights to the target resource have changed.

[0158] In some embodiments, the access rights of the client device to the target resources of the server device may refer to view permissions, or may be permissions with a higher level than view permissions, for example, operation permissions, management permissions, administrator permissions, etc.

[0159] In some embodiments, if the client device has access rights to the target resource of the server device, the client device can read or subscribe to the target resource of the server device.

[0160] In some embodiments, access control information can be used to determine whether a client device has access rights to a target resource of a server device. In other words, by knowing the access control information corresponding to a client device, it can be determined whether the client device can read or subscribe to the target resource corresponding to the access control information.

[0161] In some embodiments, the access control information may be recorded in the ACL of the server device, for example, in the ACL function cluster of the server device. In some embodiments, the ACL function cluster of the server device has one and only one instance. As an implementation, the ACL function cluster of the server device may be deployed on endpoint 0 of the server device.

[0162] In some embodiments, when access control information is recorded in an ACL function cluster, the binding relationship between the proxy device and the client device can be understood as essentially the binding relationship between the subject roles of the proxy device and the client device in the ACL function cluster, that is, the binding relationship between the subjects corresponding to the proxy device and the client device.

[0163] In some embodiments, the access control information may refer to an ACE, and the server device may check and verify whether the client device has access rights to the target resource of the server device based on the rules in the ACE. In this case, the access control information that the server device controls the proxy device to obtain based on the binding relationship information may refer to the ACE that the server device controls the proxy device to obtain based on the binding relationship information.

[0164] Compared to a proxy device with proxyview permissions that can obtain all access control information of a server device, the applicant has actually found that, in theory, a proxy device is only interested in the access control information corresponding to the client device to which it subscribes (for example, only the access rights of the client device to the target resource on the server device), while other access control information on the server device is irrelevant to the proxy device. Therefore, the embodiments of the present application can control the access control information that the proxy device can obtain based on the binding relationship information, so that the proxy device can only obtain the access control information corresponding to the client device with which it has a binding relationship, thereby reducing the risk of data privacy leakage.

[0165] To facilitate understanding, the process of establishing binding relationship information is first introduced below.

[0166] FIG7 is a schematic diagram of a process for establishing binding relationship information according to an embodiment of the present application. As shown in FIG7 , the process for establishing binding relationship information may include step S710.

[0167] In step S710 , the server device receives a registration request, where the registration request is used to register binding relationship information.

[0168] In some embodiments, the registration request may be sent by a proxy device. In other words, the proxy device may send the binding relationship information to the server device, or the binding relationship information may be set by the proxy device.

[0169] In some embodiments, the registration request may be sent by the client device. In other words, the client device may send the binding relationship information to the server device, or the binding relationship information may be set by the client device.

[0170] In some embodiments, before the proxy device or the client device sends a registration request, the server device may also pre-register the binding relationship information. As an implementation method, after the client device fails to directly subscribe to the target resource of the server device, before or after the client device requests to obtain the valid proxy list of the server device, the server device may pre-save the device identification of the client device (for example, the device ID of the client device and / or the CATs corresponding to the client device), so that the client device or the proxy device can then set the binding relationship between the proxy device and the client device based on the pre-registration information. For example, after the server device pre-saves the device identification of the client device, the client device or the proxy device may subsequently initiate a registration request to associate the device identification of the proxy device corresponding to the client device with the device identification of the client device.

[0171] In some embodiments, the proxy device or client device may register the binding relationship information via a registration request command. In other words, the registration request sent by the proxy device or client device may be a registration request command, and the proxy device or client device may set the binding relationship information via a registration request command interface provided by the server device.

[0172] As an implementation method, the input parameters of the registration request command may include the device identification of the proxy device and the device identification of the corresponding client device. For ease of understanding, an implementation method of the registration request command is given below in conjunction with Table 4.

[0173] Table 4

[0174]

[0175] In the example of Table 4, the registration request command is a RegisterProxyNode command, and the client device or proxy device can use the RegisterProxyNode command to set the binding relationship between the client device and the proxy device. As an implementation method, the client device or proxy device can use the RegisterProxyNode command to input the device identifier of the client device to be bound and the device identifier of the proxy device to register the binding relationship information with the functional cluster corresponding to the server device (for example, the first functional cluster mentioned below, or other functional clusters). In the example of Table 4, the attribute carrying the binding relationship information can be, for example, the first attribute mentioned below (for example, the obsrelationship attribute).

[0176] It should be noted that the embodiment of the present application does not specifically limit the name of the registration request command. The RegisterProxyNode command is only an example. It can be any other name as long as the command can be used to register or set the binding relationship information between the proxy device and the client device.

[0177] In some embodiments, after step S710, step S720 may be further included. In step S720, the server device stores the binding relationship information.

[0178] In some embodiments, the binding relationship information can be stored (saved) in a functional cluster of the server-side device, for example, stored in a first functional cluster of the server-side device. The embodiment of the present application does not specifically limit the first functional cluster. For example, the first functional cluster can be an existing functional cluster, and an attribute is added to an existing functional cluster, and the added attribute is used to record the binding relationship information between the proxy device and the client device. As a specific example, a new attribute can be added to the functional cluster where the valid proxy list attribute is located, and the new attribute is used to record the binding relationship information between the proxy device and the client device. Alternatively, the first functional cluster can be a newly added functional cluster, such as a dedicated functional cluster can be added to specifically record the binding relationship between the proxy device and the client device.

[0179] The embodiment of the present application does not limit the name of the first functional cluster. For example, the first functional cluster can be called the proxyobserveACL functional cluster. The proxyobserveACL functional cluster can be the name of a newly added functional cluster or the name redefined after modifying an existing functional cluster.

[0180] In some embodiments, the first functional cluster includes a first attribute, and the first attribute is used to record binding relationship information (ie, record the binding relationship between the proxy device and the client device).

[0181] In some embodiments, the binding relationship information may utilize the device identification of the proxy device and the device identification of the client device to indicate the binding relationship between the proxy device and the client device. As an implementation, the first attribute may record the device identification of the proxy device and the device identification of the client device to indicate that a binding relationship exists between the proxy device and the client device (the proxy device can perform proxy subscription for the client device).

[0182] In some embodiments, the device identification of the proxy device may refer to the device ID of the proxy device. In some embodiments, the device identification of the proxy device may refer to indication information of the proxy device, which is used to indicate the identity information of the proxy device, that is, the device identification of the proxy device may be used to obtain the device ID of the proxy device.

[0183] In some embodiments, the device identifier of a client device may refer to the device ID of the client device. In some embodiments, the device identifier of a client device may be indicative information of the client device, which indicates the identity information of the client device. That is, the device identifier of the client device may be used to obtain the device ID of the client device. In some embodiments, the device identifier of a client device may refer to a first identifier corresponding to the client device, where the first identifier is an identifier shared by a group of client devices with the same permissions. For example, the first identifier may be a CAT.

[0184] It should be noted that one client device may correspond to multiple CATs, and the first identifier may be any one or more of the multiple CATs.

[0185] As an example, the device identification of the proxy device may be the device ID of the proxy device, and the device identification of the client device may be the device ID of the client device. This approach is simple and clear to implement and facilitates control.

[0186] As another example, the device identification of the proxy device may be a device ID of the proxy device, and the device identification of the client device may be one or more CATs corresponding to the client device.

[0187] In some embodiments, in the binding relationship information recorded in the first attribute, one proxy device may correspond to one or more client devices, indicating that a binding relationship exists between the proxy device and the one or more client devices.

[0188] In some embodiments, the binding relationship information is non-volatile data. In some embodiments, the binding relationship information remains unchanged when the server device is restarted.

[0189] As an implementation method, Table 5 provides an implementation method of the first attribute.

[0190] Table 5

[0191]

[0192] In the example of Table 5, the first attribute is obsrelationship. The type of the first attribute is a structure of list type, which can be used to record the binding relationship between the proxy device and the client device, for example, by identifying the binding relationship between them through the device identification of the proxy device and the device identification of the client device (for example, the subjects corresponding to the client device). As an example, the binding relationship between them can be identified by the device ID of the proxy device and the device ID of the client device. As another example, the binding relationship between them can be identified by the device ID of the proxy device and the CATs corresponding to the client device. In the first attribute, a proxy device can correspond to one or more client devices. In the first attribute, the quality corresponding to the first attribute is "N", which means that the attribute data value is non-volatile and remains unchanged during restart.

[0193] In some embodiments, the clientsubjectID in the list can be a device ID (node ​​ID of the device) or CATs. In some embodiments, there can be multiple CATs, that is, one client device can correspond to multiple CATs.

[0194] In some embodiments, the data types of the node ID and CAT of the device may be the same, but have different value ranges. In this case, it can be determined whether the value represents the node ID or CAT of the device based on the value range.

[0195] In some embodiments, if the binding relationship information is registered by a proxy device, the device identifier of the proxy device in the input parameter can be omitted. In some embodiments, if the device identifier of the proxy device is omitted, it can be considered that the device identifier is the device identifier corresponding to the initiator in the message packet header.

[0196] In some embodiments, the first functional cluster may also include commands for proxy devices to obtain and subscribe to access control information. That is, the commands for proxy devices to obtain and subscribe to access control information and the attributes for recording binding relationship information may be in the same functional cluster. However, embodiments of the present application are not limited to this, and the commands for proxy devices to obtain and subscribe to access control information and the attributes for recording binding relationship information may be in different functional clusters.

[0197] Based on this, the binding relationship between the proxy device and the client device can be recorded in the function cluster of the server device, so that the server device can control the access control information that the proxy device can obtain according to the binding relationship information.

[0198] In some embodiments, the process of establishing the binding relationship information may occur whenever a client device selects a specific proxy device to subscribe to a target resource of a server device. For example, after a client device selects a proxy device (either before or after the client device and the proxy device establish a connection), the client device may initiate a registration request to the server device to register the binding relationship information between it and the selected proxy device. Alternatively, after a client device selects a proxy device, the proxy device may initiate a registration request to the server device to register the binding relationship information between it and the client device.

[0199] The previous section describes the process of establishing binding relationship information. The following describes how to use binding relationship information to control the access control information that a proxy device can obtain during the proxy subscription process.

[0200] In some embodiments, the server device controls the access control information that the proxy device can obtain based on the binding relationship information based on the request of the proxy device.

[0201] Figure 8 is a flow chart of a method for access control provided by another embodiment of the present application. As shown in Figure 8, the method may include steps S810 and S820. These steps are described below.

[0202] In step S810, the proxy device sends a first request to the server device, wherein the first request is used to query whether the client device has access rights to a target resource of the server device.

[0203] In some embodiments, the first request may be a read request, that is, the proxy device may send a read request message to the server device to read the access control information of the client device to the target resource, thereby determining whether the client device has permission to access the target resource.

[0204] In some embodiments, the proxy device may use a read command interface provided by the server device to obtain the access control information of the client device to the target resource.

[0205] In some embodiments, an existing read command interface can be used to obtain a client device's access control information for a target resource. After receiving the command, the server device can determine, based on the binding relationship information, whether the proxy device has permission to obtain the client device's access control information for the target resource. If the proxy device has permission to obtain the client device's access control information for the target resource, the server device can return a corresponding response message to the proxy device.

[0206] In some embodiments, a new command interface can be used to obtain access control information of a client device to a target resource. The new command interface can be used to obtain ACE information associated with the client device.

[0207] As an example, the proxy device may use the getACE command to request corresponding access control information (e.g., ACE information). The getACE command can obtain ACE information associated with the device identifier of the client device in the input parameter of getACE. For ease of understanding, Table 6 provides an implementation of the getACE command.

[0208] Table 6

[0209]

[0210] It should be noted that the embodiment of the present application does not specifically limit the name of the read command for obtaining the access control information of the client device to the target resource. The getACE command is only an example. As long as the access control information associated with the client device (for example, ACE information) can be obtained through the read command, it will be sufficient.

[0211] In some embodiments, the getACE command and the first attribute may be located in the first functional cluster together. In some embodiments, getACE may also be located in other functional clusters, which is not limited in the embodiments of the present application.

[0212] In some embodiments, there may be multiple response methods for getACE. For example, the corresponding ACE may be returned, and the proxy device may determine whether the client device has permission to access the target resource; or, an indication of whether the client device has permission to access the target resource may be directly returned (for example, "yes" may be returned to indicate that the client device has permission to access the target resource, or "no" may be returned to indicate that the client device does not have permission to access the target resource).

[0213] In some embodiments, the first request may be a subscription request, that is, the proxy device may send a subscription request message to the server device to request to subscribe to the client device's access control information for the target resource, thereby determining whether the client device has permission to access the target resource.

[0214] In some embodiments, the proxy device can use a subscription command interface provided by the server device to obtain the client device's access control information for the target resource. For example, the proxy device can use an existing subscription command interface to obtain the client device's access control information for the target resource. Alternatively, the proxy device can use a new subscription command interface to obtain the client device's access control information for the target resource, such as using the first command mentioned below to obtain the client device's access control information for the target resource.

[0215] In step S820, the server device sends a first response to the proxy device according to the binding relationship information.

[0216] In some embodiments, the first response may include access control information of the client device to the target resource. For example, the first response may include corresponding ACE information, and the proxy device determines whether the client device has permission to subscribe to the target resource based on the ACE information returned by the server device.

[0217] In some embodiments, the first response may be used to indicate whether the client device has access rights to the target resource. For example, the first response may directly indicate whether the client device has permission to subscribe to the target resource by returning "yes" or "no" indication information.

[0218] As an example, when the first request is a read request (eg, a getACE request command), the first response may return corresponding ACE information, or the first response may return information indicating whether the client device has permission to access the target resource.

[0219] As another example, when the first request is a subscription request, the first response may return corresponding ACE information.

[0220] It should be noted that regardless of whether the existing command interface (i.e., the existing read operation or subscription operation) or the newly added command interface is adopted in step S810, the core of the embodiment of the present application is that the server device needs to check the binding relationship information between the proxy device and the client device during the proxy device reading process or subscription process to determine whether the proxy device has read permission or subscription permission.

[0221] In some embodiments, if the proxy device subscribes to the access control information of the server device (for example, the proxy device subscribes to the ACL function cluster of the server device), the server device can send the changed access control information of the client device to the proxy device based on the binding relationship information. This is described in detail below in conjunction with Figure 9.

[0222] Figure 9 is a flow chart of a method for access control provided by another embodiment of the present application. As shown in Figure 9, the method may include steps S910 to S930.

[0223] In step S910 , the proxy device requests to subscribe to access control information corresponding to the client device.

[0224] In some embodiments, the proxy device may utilize the aforementioned first request to request subscription to the access control information corresponding to the client device, for example, utilizing an existing subscription request to request subscription to the access control information corresponding to the client device.

[0225] In step S920 , the server device determines, based on the binding relationship information, whether the proxy device has the authority to subscribe to the access control information corresponding to the client device.

[0226] In some embodiments, when the proxy device and the client device have a binding relationship, the server device may authorize the proxy device to subscribe to the access control information corresponding to the client device, for example, by returning the access control information corresponding to the subscription request to the proxy device.

[0227] In some embodiments, when there is no binding relationship between the proxy device and the client device, the server device may reject the subscription request of the proxy device, for example, by returning an indication that the subscription is invalid to the proxy device.

[0228] In step S930 , if the proxy device has the authority to subscribe to the access control information corresponding to the client device, the server device sends the changed access control information of the client device to the proxy device according to the binding relationship information.

[0229] That is, the server device can determine whether to send the changed access control information of the client device to the proxy device based on the binding relationship information. Alternatively, in some embodiments, the server device can determine whether to send the changed access control information of the client device to the proxy device based on both the binding relationship information and the subscription information.

[0230] The server device determines whether to send the client device's changed access control information to the proxy device based on the binding relationship information. This can prevent the proxy device from receiving excessive irrelevant messages due to the server device sending access control information to the proxy device whenever there is a change in the access control information. In other words, this can limit the number of irrelevant messages sent to the proxy device due to excessive ACE changes.

[0231] In some embodiments, before step S930, the method may further include step S925. In step S925, the proxy device sends a second request to the server device, wherein the second request is used to request the server device to generate a notification message when the access control information corresponding to the client device changes.

[0232] In some embodiments, the second request may be used to indicate that a notification message is generated only when access control information corresponding to a client device associated with the second request changes.

[0233] In some embodiments, the second request may be sent via a newly added command interface (first command). The first command is described in detail below.

[0234] The input parameters of the first command may include a device identification of the client device (for example, the device ID of the client device and / or the CATs corresponding to the client device), and the first command may be used to indicate that a notification message is generated only when the access control information corresponding to the client device associated with the first command changes.

[0235] In some embodiments, the first command can also be used to subscribe to access control information corresponding to the client device. In other words, the first command can be used to subscribe to access control information corresponding to the client device, and a notification message is generated only when the access control information corresponding to the client device changes.

[0236] An implementation of the first command is provided below in conjunction with Table 7. In the example of Table 7, the first command is ProxyObserveACEreq. However, the present embodiment does not limit the name of the first command; ProxyObserveACEreq is merely an example. As long as the first command can be used to indicate that a notification message is generated only when the access control information corresponding to the associated client device changes, the notification message will be sufficient.

[0237] Table 7

[0238]

[0239] In some embodiments, the first command may be included in a second functional cluster of the server device. In some embodiments, the second functional cluster may be the same functional cluster as the first functional cluster. In some embodiments, the second functional cluster and the first functional cluster may be different functional clusters, which is not limited in the embodiments of the present application.

[0240] In some embodiments, the second functional cluster may further include a second command, which may be used to generate a response message to the first command. In some embodiments, the second command may include the changed content and change type of the access control information corresponding to the client device associated with the first command. An implementation of the second command is given below in conjunction with Table 8. In the example of Table 8, the second command is ProxyObserveACEresp, and changetype indicates the change type of ACE. However, the embodiment of the present application does not limit the name of the second command, and ProxyObserveACEresp is only an example.

[0241] Table 8

[0242]

[0243] In some embodiments, the ACE change type may include addition, deletion, and modification. As an implementation, when the ACE change type is deletion, the server device may send a response message corresponding to the second command to the proxy device. As another implementation, when the ACE change type is change (for example, the access rights corresponding to the client device are reduced), the server device may send a response message corresponding to the second command to the proxy device.

[0244] That is, the information in step S930 may be sent based on the second command. The changed access control information sent in step S930 may include the changed content and the change type.

[0245] In some embodiments, the change in access control information includes: a change in the access rights of the client device to the target resource, for example, the rights are reduced or lost.

[0246] In some embodiments, the first command may be used to generate a notification message only when the access rights of the client device to the target resource change.

[0247] It should be noted that the access rights corresponding to the client device mentioned in the embodiments of the present application become smaller, which means that the access rights corresponding to the client device become lower. For example, the access rights corresponding to the client device change from manage to operate, or the access rights corresponding to the client device change from manage to view, etc.

[0248] In some embodiments, changes to access control information do not include resource changes caused by merging or reducing ACE content. In other words, if the access control information changes but the change does not result in a change in the client device's access rights to the target resource, the server device may not return the client's changed access control information to the proxy device.

[0249] However, the embodiments of the present application are not limited thereto. In some embodiments, changes in access control information may include not only changes in the access rights of the client device to the target resource, but also other changes, such as changes in the content of the access control information.

[0250] In some embodiments, if the proxy device determines that the client device has lost subscription rights to the target resource of the server device during the subscription process, the proxy device may terminate the downstream subscription relationship (ie, the proxy subscription relationship between the proxy device and the client device).

[0251] In some embodiments, when a target resource on a subscribed server device changes, the server device may send a status report message to the proxy device, so that the proxy device can generate a corresponding status report message and send it to the client device. It should be noted that in some embodiments, before sending the status report message to the client device, the proxy device also needs to confirm whether the client device still has permission to subscribe to the target resource on the server device. Only if the client device still has permission to subscribe to the target resource will the proxy device send the corresponding status report message to the client device.

[0252] As previously described, in some embodiments, the proxy device requests access control information corresponding to the client device from the server device based on a first request. In some embodiments, the first request sent by the proxy device to the server device is based on a request sent by the client device to the proxy device to subscribe to a target resource. In other words, in some embodiments, the client device can send a request message to the proxy device to subscribe to a target resource on the server device, and the proxy device checks whether the client device has access rights to the target resource based on the subscription request message. This is described below in conjunction with FIG10 .

[0253] Figure 10 is a flow chart of a method for access control provided by another embodiment of the present application. The method of Figure 10 may include steps S1010 to S1050.

[0254] In step S1010 , the client device sends a request to subscribe to a target resource of the server device to the proxy device. The request is used to request to subscribe to the target resource of the server device.

[0255] In step S1020 , the proxy device sends a first request to the server device, where the first request is used to query whether the client device has access rights to the target resource.

[0256] In step S1030 , the server device sends a first response to the proxy device according to the binding relationship information.

[0257] For a detailed description of step S1020 and step S1030, please refer to the previous description of step S810 and step S820, which will not be repeated here.

[0258] In step S1040 , after the server device returns the access control information of the client device to the target resource to the proxy device, the proxy device completes the subscription process for the target resource.

[0259] In step S1050 , the proxy device returns information related to the subscription of the target resource to the client device.

[0260] In some embodiments, after the server device determines, based on the binding relationship information, that the proxy device has the authority to obtain the access control information corresponding to the client device, it also needs to check whether the proxy device has the proxyview permission to access the ACL of the server device.

[0261] That is, in some embodiments, when the proxy device has proxyview permission and has a binding relationship with the client device, the server device may return access control information corresponding to the client device to the proxy device.

[0262] In some embodiments, before the client device sends a subscription request message to the proxy device, it needs to first perform a discovery process of the proxy device and a process of establishing a connection with the proxy device. This process is described below with reference to FIG11 .

[0263] Figure 11 is a flow chart of the process of discovering and establishing a connection between a proxy device and an embodiment of the present application. As shown in Figure 11 , the method may include steps S1110 to S1140.

[0264] In step S1110 , the client device obtains a valid proxy list of the server device.

[0265] After a client fails to subscribe directly to a target resource on a server, the server prompts the client to find a proxy device to subscribe to the target resource. In this case, the client can send a message to the server to obtain a list of valid proxies on the server, i.e., the proxy devices supported by the server.

[0266] In step S1120 , the server device returns a valid proxy list supported by the server device to the client device.

[0267] In step S1130 , the client device discovers and selects a proxy device.

[0268] In step S1140 , the client device establishes a CASE connection with the proxy device.

[0269] After the client device discovers and selects the proxy device, the two can establish a secure channel, for example, through a CASE connection.

[0270] In some embodiments, during or after the secure channel is established between the client device and the proxy device, the proxy device may obtain a device identification of the client device (eg, a device ID of the client device and / or CATs corresponding to the client device).

[0271] For details about the process of the client device discovering the proxy device and the process of establishing a connection with the proxy device, please refer to the prior art and this application will not go into details.

[0272] In some embodiments, after the client device discovers and selects the proxy device (for example, before or after the two establish a connection), the client device or the proxy device can register the binding relationship information. For details about registering the binding relationship information, please refer to the above description and will not be repeated here.

[0273] In some embodiments, after the proxy device establishes a connection with the client device, the proxy device may save the device identification of the client device (eg, the device ID of the client device and / or CATs corresponding to the client device) to facilitate subsequent registration of binding relationship information.

[0274] In some embodiments, after the client device and the proxy device establish a connection, the client device may send a subscription request to the proxy device. The subsequent subscription process can be described in the above description and will not be repeated here.

[0275] For ease of understanding, the following text, in conjunction with Figures 12 to 14, introduces the method flow of an embodiment of the present application by taking the communication scenario based on the Matter protocol as an example. It should be noted that this method flow is only a schematic flow and is not intended to limit the embodiment of the present application. It should also be noted that the embodiment of the present application does not specifically limit the execution order of the steps of the method shown in Figures 12 to 14. For example, the order of some steps can be swapped, or some steps can be executed simultaneously. In addition, the functional clusters involved in the methods shown in Figures 12 to 14 are described in detail above and will not be repeated below for the sake of brevity.

[0276] Figure 12 is a flow chart of a method for access control provided by another embodiment of the present application. The method shown in Figure 12 includes steps S1201 to S1214.

[0277] In step S1201 , the client device requests to obtain a valid proxy list.

[0278] After a client fails to subscribe directly to a target resource on a server, the server prompts the client to find a proxy device to subscribe to the target resource. Therefore, the client requests the server to obtain a list of valid proxies to learn which proxy devices the server supports.

[0279] In step S1202, the server device registers the client device information as being in a queryable ACL state.

[0280] After receiving the request in step S1201 , the server device may perform a pre-registration and save the information of the client device (eg, the node ID of the client device and / or the CATs corresponding to the client device).

[0281] In some embodiments, step S1202 may be merged into step S1207 mentioned later and processed together.

[0282] In step S1203 , the server device returns the valid proxy list corresponding to step S1201 to the client device.

[0283] In step S1204 , the client device discovers and selects the proxy device.

[0284] In step S1205 , the client device and the proxy device establish a secure channel.

[0285] During the process of establishing a secure channel between the client device and the proxy device or after the secure channel is established, the proxy device may obtain the device ID of the client device and / or CATs corresponding to the client device.

[0286] In step S1206 , the proxy device saves the device ID of the client device and / or the CATs corresponding to the client device.

[0287] In step S1207 , after the client device selects the proxy device (before or after establishing a connection with the proxy device), the client device may establish a connection with the server device and set binding relationship information between the proxy device and the client device.

[0288] In some embodiments, the binding relationship information may be stored in a proxyobserveACL function cluster.

[0289] In some embodiments, the proxyobserveACL functional cluster includes methods for proxy devices to obtain and subscribe to access control information (such as ACEs), as well as information about the binding relationship between the proxy device and the client device. In some embodiments, the binding relationship between the proxy device and the client device is actually the binding relationship between the proxy device and the client device's subjects role in the ACL functional cluster. As an example, in the simplest case, the binding relationship is the device ID of the proxy device and the device ID of the client device.

[0290] It should be noted that, in step S1207 , the aforementioned RegisterProxyNode command may be used to register the binding relationship information.

[0291] In step S1208 , the client device sends a request message to the proxy device to subscribe to the target resource on the server device.

[0292] In step S1209 , the proxy device sends a first request to the server device to obtain corresponding access control information.

[0293] In some embodiments, the proxy device may use the getACE command to request the corresponding access control information. It should be noted that the access control information obtained in this step may be access control information related only to the client device, which is different from the existing method of obtaining access control information.

[0294] In step S1210 , the server device checks whether there is a binding relationship between the proxy device and the client device.

[0295] In some embodiments, the server device may check in the first attribute (eg, the obsrelationship attribute) whether there is a binding relationship between the proxy device and the client device (eg, the device ID of the proxy device and the subjects of the client device).

[0296] In some embodiments, the server device can return corresponding access control information to the proxy device only when a binding relationship exists between the proxy device and the client device.

[0297] In step S1211 , the server device checks whether the proxy device has the proxyview permission to access the access control information.

[0298] In step S1212 , if a binding relationship exists between the proxy device and the client device and the proxy device has proxyview permission to access access control information, the server device returns access control information corresponding to the client device to the proxy device.

[0299] In steps S1213-S1214, the subsequent subscription process is completed.

[0300] FIG13 is a flow chart of a method for access control provided by another embodiment of the present application. The method shown in FIG13 includes steps S1301 to S1314. It should be noted that the methods shown in FIG12 and FIG13 are mainly used to prevent the proxy device from having excessive authority to obtain access control information. It should also be noted that the main difference between the method shown in FIG13 and the method shown in FIG12 is that the method shown in FIG13 is for the proxy device to register the binding relationship information between the proxy device and the client device, while the method shown in FIG12 is for the client device to register the binding relationship information between the proxy device and the client device.

[0301] In step S1301 , the client device requests to obtain a valid proxy list.

[0302] After a client fails to subscribe directly to a target resource on a server, the server prompts the client to find a proxy device to subscribe to the target resource. Therefore, the client requests the server to obtain a list of valid proxies to learn which proxy devices the server supports.

[0303] In step S1302, the server device registers the client device information as being in a queryable ACL state.

[0304] After receiving the request in step S1301 , the server device may perform a pre-registration and save the information of the client device (eg, the node ID of the client device and / or the CATs corresponding to the client device).

[0305] In some embodiments, step S1302 may be merged into step S1307 mentioned later and processed together.

[0306] In step S1303 , the server device returns the valid proxy list corresponding to step S1301 to the client device.

[0307] In step S1304 , the client device discovers and selects the proxy device.

[0308] In step S1305 , the client device and the proxy device establish a secure channel.

[0309] During the process of establishing a secure channel between the client device and the proxy device or after the secure channel is established, the proxy device may obtain the device ID of the client device and / or CATs corresponding to the client device.

[0310] In step S1306 , the proxy device saves the device ID of the client device and / or the CATs corresponding to the client device.

[0311] In step S1307 , after the client device selects the proxy device (before or after establishing a connection with the proxy device), the proxy device may establish a connection with the server device and set binding relationship information between the proxy device and the client device.

[0312] In some embodiments, the binding relationship information may be stored in a proxyobserveACL function cluster.

[0313] In some embodiments, the proxyobserveACL functional cluster includes methods for proxy devices to obtain and subscribe to access control information (such as ACEs), as well as information about the binding relationship between the proxy device and the client device. In some embodiments, the binding relationship between the proxy device and the client device is actually the binding relationship between the proxy device and the client device's subjects role in the ACL functional cluster. As an example, in the simplest case, the binding relationship is the device ID of the proxy device and the device ID of the client device.

[0314] It should be noted that the aforementioned RegisterProxyNode command can be used to register the binding relationship information in step S1307. It should be noted that when the RegisterProxyNode command is used to register the binding relationship information in step S1307, the device identifier of the proxy device in the input parameter can be omitted, that is, the device identifier of the proxy device is optional.

[0315] In step S1308 , the client device sends a request message to the proxy device to subscribe to the target resource on the server device.

[0316] In step S1309, the proxy device sends a first request to the server device to obtain corresponding access control information.

[0317] In some embodiments, the proxy device may use the getACE command to request the corresponding access control information. It should be noted that the access control information obtained in this step may be access control information related only to the client device, which is different from the existing method of obtaining access control information.

[0318] In step S1310 , the server device checks whether there is a binding relationship between the proxy device and the client device.

[0319] In some embodiments, the server device may check in the first attribute (eg, the obsrelationship attribute) whether there is a binding relationship between the proxy device and the client device (eg, the device ID of the proxy device and the subjects of the client device).

[0320] In some embodiments, the server device can return corresponding access control information to the proxy device only when a binding relationship exists between the proxy device and the client device.

[0321] In step S1311 , the server device checks whether the proxy device has the proxyview permission to access the access control information.

[0322] In step S1312 , if a binding relationship exists between the proxy device and the client device and the proxy device has proxyview permission to access access control information, the server device returns access control information corresponding to the client device to the proxy device.

[0323] In steps S1313-S1314, the subsequent subscription process is completed.

[0324] Figure 14 is a flow chart of a method for access control provided by another embodiment of the present application. The method shown in Figure 14 includes steps S1401 to S1409. It should be noted that the solution shown in Figure 14 is mainly to prevent excessive changes in access control information from causing excessive irrelevant messages to be sent to the proxy device.

[0325] In step S1401 , the proxy device subscribes to access control information corresponding to the client device.

[0326] In some embodiments, the proxy device may use the first command described above to subscribe to the access control information corresponding to the client device.

[0327] In step S1402, the server device completes the subscription registration and determines whether the proxy device has the authority to subscribe to the access control information based on the binding relationship information.

[0328] As previously mentioned, a proxy device can actively retrieve or subscribe to access control information (e.g., ACL function cluster resources) from a server device. This process is limited by the binding relationship between the proxy device and the client device. In other words, the access control information returned by the server device to the proxy device is only relevant to the client device to which the proxy device has subscribed.

[0329] In step S1403, the server device returns a request response message to the proxy device.

[0330] In step S1404 , if the access control information corresponding to the client device changes, the proxy device is notified so that the proxy device can determine whether to continue to maintain the subscription relationship with the client device.

[0331] In some embodiments, step S1404 can reuse an existing ReportData message. In some embodiments, step S1404 can formulate a new subscription ReportData message. It should be noted that, regardless of reusing an existing ReportData message or formulating a new subscription ReportData message, the server device only feeds back to the proxy device the content of the actual permission change. For example, the server device only feeds back to the proxy device the access permission information corresponding to the client device that has a binding relationship with the proxy device, or the server device only feeds back to the proxy device when the client device's permissions change (for example, the permissions become smaller or the permissions are lost).

[0332] In step S1405 , the proxy device determines that if the authority of the client device is lost, then the downstream subscription relationship is terminated.

[0333] If the proxy device determines that the client device has lost the subscription authority to the target resource on the server device during the subscription process, the proxy device needs to terminate the downstream subscription relationship (ie, the proxy subscription relationship between the proxy device and the client device).

[0334] In step S1406 , when the target resource subscribed by the client device changes, the server device sends a notification message to the proxy device.

[0335] In step S1407 , the proxy device generates a ReportData message according to the notification message of the subscription resource change sent by the server device in step S1406 , so as to send the ReportData message to the client device.

[0336] In step S1408, the proxy device determines whether to check the access control information corresponding to the client device to determine whether the client device still has the authority to subscribe to the target resource. It should be noted that step S1408 is an optional step.

[0337] In step S1409 , the proxy device sends a ReportData message to the client device to indicate that the target resource subscribed by the client device has changed.

[0338] The method embodiment of the present application is described in detail above in conjunction with Figures 1 to 14 . The device embodiment of the present application is described in detail below in conjunction with Figures 15 to 18 . It should be understood that the description of the method embodiment corresponds to the description of the device embodiment. Therefore, for parts not described in detail, reference can be made to the above method embodiment.

[0339] FIG15 is a schematic diagram of the structure of a server device provided in an embodiment of the present application. The server device shown in FIG15 can execute any of the methods described above that can be executed by the server device. The server device 1500 shown in FIG15 can include a control module 1510.

[0340] The control module 1510 may be configured to control the access control information that the proxy device can obtain according to the binding relationship information, wherein the binding relationship information is used to indicate that there is a binding relationship between the proxy device and the client device.

[0341] Optionally, the server device 1500 further includes: a first receiving module 1520. The first receiving module 1520 may be configured to receive a registration request, where the registration request is used to register the binding relationship information.

[0342] Optionally, the registration request is sent by the proxy device, or the registration request is sent by the client device.

[0343] Optionally, the server device 1500 further includes: a second receiving module, configured to receive a first request sent by the proxy device, where the first request is used to query whether the client device has access rights to the target resource of the server device.

[0344] Optionally, the control module 1510 is further used to: send a first response to the proxy device based on the binding relationship information; wherein the first response includes the access control information of the client device to the target resource, or the first response is used to indicate whether the client device has access rights to the target resource.

[0345] Optionally, the control module 1510 is further configured to: send the changed access control information of the client device to the proxy device according to the binding relationship information.

[0346] Optionally, the change in the access control information includes: a change in access rights of the client device to a target resource of the server device.

[0347] Optionally, the server device 1500 further includes: a third receiving module, configured to receive a second request sent by the proxy device, wherein the second request is configured to request the server device to generate a notification message when access control information corresponding to the client device changes.

[0348] Optionally, the binding relationship information is recorded in a first functional cluster, the first functional cluster includes a first attribute, and the first attribute records a device identifier of the proxy device and a device identifier of the client device.

[0349] Optionally, the device identification of the client device includes: a device ID of the client device, and / or a first identification corresponding to the client device, where the first identification is an identification shared by a group of client devices with the same authority.

[0350] Optionally, the server device includes a second functional cluster, the second functional cluster includes a first command, and the first command is used to instruct the server device to generate a notification message when access control information corresponding to the client device associated with the first command changes.

[0351] Optionally, the second functional cluster further includes a second command, where the second command is used to generate a response message to the first command, and the second command includes the changed content and change type of the access control information corresponding to the client device associated with the first command.

[0352] Optionally, the access control information is recorded in an access control list ACL of the server device.

[0353] Optionally, the control module 1510 may be a processor 1810, and the first receiving module 1520 may be a transceiver 1830. The server device may further include a memory 1820, as specifically shown in FIG18 .

[0354] Figure 16 is a schematic diagram of the structure of a proxy device provided in an embodiment of the present application. The proxy device shown in Figure 16 can execute any of the methods described above that can be executed by the proxy device. The proxy device 1600 shown in Figure 16 can include a first sending module 1610 and a first receiving module 1620.

[0355] The first sending module 1610 may be configured to send a first request to the server device, where the first request is configured to query whether the client device has access rights to a target resource of the server device.

[0356] The first receiving module 1620 can be used to receive a first response sent by the server device in response to the binding relationship information; wherein the binding relationship information is used to indicate that there is a binding relationship between the proxy device and the client device, and the binding relationship information is used to control the access control information that the proxy device can obtain.

[0357] Optionally, the proxy device 1600 further includes: a second sending module, configured to send a registration request to the server device, where the registration request is used to register the binding relationship information.

[0358] Optionally, the first response includes access control information of the client device to the target resource, or the first response is used to indicate whether the client device has access rights to the target resource.

[0359] Optionally, the proxy device 1600 further includes: a second receiving module, configured to receive the changed access control information of the client device sent by the server device in response to the binding relationship information.

[0360] Optionally, the change in the access control information includes: a change in access rights of the client device to the target resource.

[0361] Optionally, the proxy device 1600 further includes: a third sending module, configured to send a second request to the server device, wherein the second request is configured to request the server device to generate a notification message when access control information corresponding to the client device changes.

[0362] Optionally, the binding relationship information is recorded in a first functional cluster, the first functional cluster includes a first attribute, and the first attribute records a device identifier of the proxy device and a device identifier of the client device.

[0363] Optionally, the device identification of the client device includes: a device ID of the client device, and / or a first identification corresponding to the client device, where the first identification is an identification shared by a group of client devices with the same authority.

[0364] Optionally, the server device includes a second functional cluster, the second functional cluster includes a first command, and the first command is used to instruct the server device to generate a notification message when access control information corresponding to the client device associated with the first command changes.

[0365] Optionally, the second functional cluster further includes a second command, where the second command is used to generate a response message to the first command, and the second command includes the changed content and change type of the access control information corresponding to the client device associated with the first command.

[0366] Optionally, the access control information is recorded in an access control list ACL of the server device.

[0367] Optionally, the first sending module 1610 and the first receiving module 1620 may be a transceiver 1830. The proxy device may further include a processor 1810 and a memory 1820, as specifically shown in FIG18 .

[0368] FIG17 is a schematic diagram of the structure of a client device provided in an embodiment of the present application. The client device shown in FIG17 can execute any of the methods described above that can be executed by the client device. The client device 1700 shown in FIG17 can include a sending module 1710.

[0369] The sending module 1710 may be configured to send binding relationship information to the server device, where the binding relationship information is used to indicate that there is a binding relationship between the client device and the proxy device, and the binding relationship information is used to control access control information that the proxy device can obtain.

[0370] Optionally, the binding relationship information is recorded in a first functional cluster, the first functional cluster includes a first attribute, and the first attribute records a device identifier of the proxy device and a device identifier of the client device.

[0371] Optionally, the device identification of the client device includes: a device ID of the client device, and / or a first identification corresponding to the client device, where the first identification is an identification shared by a group of client devices with the same authority.

[0372] Optionally, the server device includes a second functional cluster, the second functional cluster includes a first command, and the first command is used to instruct the server device to generate a notification message when access control information corresponding to the client device associated with the first command changes.

[0373] Optionally, the change in the access control information includes: a change in access rights of the client device to a target resource of the server device.

[0374] Optionally, the second functional cluster further includes a second command, where the second command is used to generate a response message to the first command, and the second command includes the changed content and change type of the access control information corresponding to the client device associated with the first command.

[0375] Optionally, the access control information is recorded in an access control list ACL of the server device.

[0376] Optionally, the sending module 1710 may be a transceiver 1830. The client device may further include a processor 1810 and a memory 1820, as specifically shown in FIG18 .

[0377] Figure 18 is a schematic block diagram of a communication device according to an embodiment of the present application. The dashed lines in Figure 18 indicate that the unit or module is optional. Device 1800 may be used to implement the method described in the above method embodiment. Device 1800 may be a chip, a terminal device, or a network device.

[0378] The device 1800 may include one or more processors 1810. The processor 1810 may support the device 1800 to implement the method described in the method embodiment above. The processor 1810 may be a general-purpose processor or a special-purpose processor. For example, the processor may be a central processing unit (CPU). Alternatively, the processor may be another general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, etc. The general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0379] The apparatus 1800 may further include one or more memories 1820. The memories 1820 store programs that can be executed by the processor 1810, causing the processor 1810 to perform the methods described in the above method embodiments. The memories 1820 may be independent of the processor 1810 or integrated into the processor 1810.

[0380] The apparatus 1800 may further include a transceiver 1830. The processor 1810 may communicate with other devices or chips via the transceiver 1830. For example, the processor 1810 may transmit and receive data with other devices or chips via the transceiver 1830.

[0381] The present application also provides a computer-readable storage medium for storing a program. The computer-readable storage medium can be applied to a terminal or network device provided in the present application, and the program enables a computer to execute the method performed by the terminal or network device in each embodiment of the present application.

[0382] The present application also provides a computer program product. The computer program product includes a program. The computer program product can be applied to a terminal or network device provided in the present application, and the program causes a computer to execute the method performed by the terminal or network device in each embodiment of the present application.

[0383] The embodiments of the present application also provide a computer program. The computer program can be applied to the terminal or network device provided in the embodiments of the present application, and the computer program enables a computer to execute the method performed by the terminal or network device in each embodiment of the present application.

[0384] It should be understood that the terms "system" and "network" in this application can be used interchangeably. In addition, the terms used in this application are only used to explain the specific embodiments of this application and are not intended to limit this application. The terms "first", "second", "third", and "fourth" in the specification and claims of this application and the accompanying drawings are used to distinguish different objects rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions.

[0385] In the embodiments of this application, the term "indication" may refer to a direct indication, an indirect indication, or an indication of an association. For example, "A indicates B" may refer to a direct indication of B, e.g., B can obtain information through A; it may refer to an indirect indication of B, e.g., A indicates C, e.g., B can obtain information through C; or it may refer to an association between A and B.

[0386] In the embodiment of the present application, "B corresponding to A" means that B is associated with A and B can be determined based on A. However, it should be understood that determining B based on A does not mean determining B based solely on A, but B can also be determined based on A and / or other information.

[0387] In the embodiments of the present application, the term "corresponding" may indicate a direct or indirect correspondence between the two, or an association relationship between the two, or a relationship between indication and indication, configuration and configuration, etc.

[0388] In the embodiments of the present application, "pre-definition" or "pre-configuration" may be implemented by pre-storing corresponding codes, tables, or other methods that can be used to indicate relevant information in a device (e.g., a terminal device and a network device). The present application does not limit the specific implementation method. For example, pre-definition may refer to information defined in a protocol.

[0389] In the embodiments of the present application, the “protocol” may refer to a standard protocol in the communications field, for example, it may include an LTE protocol, an NR protocol, and related protocols used in future communication systems, and the present application does not limit this.

[0390] In the embodiments of this application, the term "and / or" is simply a description of the association relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this document generally indicates that the related objects are in an "or" relationship.

[0391] In various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0392] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0393] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0394] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0395] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that can be read by a computer or a data storage device such as a server or data center that includes one or more available media integrated therein. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital versatile disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0396] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A method for access control, characterized in that include: The server device controls the access control information that the proxy device can obtain according to the binding relationship information, wherein the binding relationship information is used to indicate that there is a binding relationship between the proxy device and the client device.

2. The method according to claim 1, characterized in that The method further comprises: The server device receives a registration request, where the registration request is used to register the binding relationship information.

3. The method according to claim 2, characterized in that The registration request is sent by the proxy device, or the registration request is sent by the client device.

4. The method according to any one of claims 1 to 3, characterized in that Before the server device controls the access control information that the proxy device can obtain based on the binding relationship information, the method further includes: The server device receives a first request sent by the proxy device, where the first request is used to query whether the client device has access rights to a target resource of the server device.

5. The method according to claim 4, characterized in that The server device controls the access control information that the proxy device can obtain based on the binding relationship information, including: The server device sends a first response to the proxy device according to the binding relationship information; The first response includes access control information of the client device to the target resource, or the first response is used to indicate whether the client device has access rights to the target resource.

6. The method according to any one of claims 1 to 4, characterized in that The server device controls the access control information that the proxy device can obtain based on the binding relationship information, including: The server device sends the changed access control information of the client device to the proxy device according to the binding relationship information.

7. The method according to claim 6, characterized in that The change in the access control information includes: a change in the access rights of the client device to the target resource of the server device.

8. The method according to claim 6 or 7, characterized in that Before the server device sends the changed access control information of the client device to the proxy device according to the binding relationship information, the method further includes: The server device receives a second request sent by the proxy device, where the second request is used to request the server device to generate a notification message when access control information corresponding to the client device changes.

9. The method according to any one of claims 1 to 8, characterized in that The binding relationship information is recorded in a first functional cluster, the first functional cluster includes a first attribute, and the first attribute records the device identification of the proxy device and the device identification of the client device.

10. The method according to claim 9, characterized in that The device identification of the client device includes: the device ID of the client device, and / or a first identification corresponding to the client device, where the first identification is an identification shared by a group of client devices with the same authority.

11. The method according to any one of claims 1 to 10, characterized in that The server device includes a second functional cluster, the second functional cluster includes a first command, and the first command is used to instruct the server device to generate a notification message when access control information corresponding to the client device associated with the first command changes.

12. The method according to claim 11, characterized in that The second functional cluster further includes a second command, where the second command is used to generate a response message to the first command, and the second command includes the changed content and change type of the access control information corresponding to the client device associated with the first command.

13. The method according to any one of claims 1 to 12, characterized in that The access control information is recorded in the access control list ACL of the server device.

14. A method for access control, characterized in that: include: The proxy device sends a first request to the server device, where the first request is used to query whether the client device has access rights to a target resource of the server device; In response to the binding relationship information, the proxy device receives a first response sent by the server device; The binding relationship information is used to indicate that there is a binding relationship between the proxy device and the client device, and the binding relationship information is used to control the access control information that the proxy device can obtain.

15. The method according to claim 14, characterized in that The method further comprises: The proxy device sends a registration request to the server device, where the registration request is used to register the binding relationship information.

16. The method according to claim 14 or 15, characterized in that The first response includes access control information of the client device to the target resource, or the first response is used to indicate whether the client device has access rights to the target resource.

17. The method according to any one of claims 14 to 16, characterized in that The method further comprises: In response to the binding relationship information, the proxy device receives the changed access control information of the client device sent by the server device.

18. The method according to claim 17, characterized in that The change in the access control information includes: a change in the access permission of the client device to the target resource.

19. The method according to claim 17 or 18, characterized in that Before the proxy device receives the changed access control information of the client device sent by the server device in response to the binding relationship information, the method further includes: The proxy device sends a second request to the server device, where the second request is used to request the server device to generate a notification message when access control information corresponding to the client device changes.

20. The method according to any one of claims 14 to 19, characterized in that The binding relationship information is recorded in a first functional cluster, the first functional cluster includes a first attribute, and the first attribute records the device identification of the proxy device and the device identification of the client device.

21. The method according to claim 20, characterized in that The device identification of the client device includes: the device ID of the client device, and / or a first identification corresponding to the client device, where the first identification is an identification shared by a group of client devices with the same authority.

22. The method according to any one of claims 14 to 21, characterized in that The server device includes a second functional cluster, the second functional cluster includes a first command, and the first command is used to instruct the server device to generate a notification message when access control information corresponding to the client device associated with the first command changes.

23. The method according to claim 22, characterized in that The second functional cluster further includes a second command, where the second command is used to generate a response message to the first command, and the second command includes the changed content and change type of the access control information corresponding to the client device associated with the first command.

24. The method according to any one of claims 14 to 23, wherein: The access control information is recorded in the access control list ACL of the server device.

25. A method for access control, characterized in that include: The client device sends binding relationship information to the server device, where the binding relationship information is used to indicate that there is a binding relationship between the client device and the proxy device, and the binding relationship information is used to control access control information that the proxy device can obtain.

26. The method according to claim 25, characterized in that The binding relationship information is recorded in a first functional cluster, the first functional cluster includes a first attribute, and the first attribute records the device identification of the proxy device and the device identification of the client device.

27. The method according to claim 26, characterized in that The device identification of the client device includes: the device ID of the client device, and / or a first identification corresponding to the client device, where the first identification is an identification shared by a group of client devices with the same authority.

28. The method according to any one of claims 25 to 27, characterized in that The server device includes a second functional cluster, the second functional cluster includes a first command, and the first command is used to instruct the server device to generate a notification message when access control information corresponding to the client device associated with the first command changes.

29. The method according to claim 28, characterized in that The change in the access control information includes: a change in the access rights of the client device to the target resource of the server device.

30. The method according to claim 28 or 29, characterized in that The second functional cluster further includes a second command, where the second command is used to generate a response message to the first command, and the second command includes the changed content and change type of the access control information corresponding to the client device associated with the first command.

31. The method according to any one of claims 25 to 30, characterized in that The access control information is recorded in the access control list ACL of the server device.

32. A server device, characterized in that: include: The control module is configured to control the access control information that the proxy device can obtain according to the binding relationship information, wherein the binding relationship information is used to indicate that there is a binding relationship between the proxy device and the client device.

33. The server device according to claim 32, characterized in that: The server device further includes: The first receiving module is configured to receive a registration request, where the registration request is used to register the binding relationship information.

34. The server device according to claim 33, wherein: The registration request is sent by the proxy device, or the registration request is sent by the client device.

35. The server device according to any one of claims 32 to 34, characterized in that: The server device further includes: The second receiving module is configured to receive a first request sent by the proxy device, where the first request is used to query whether the client device has access rights to a target resource of the server device.

36. The server device according to claim 35, characterized in that: The control module is further configured to: Sending a first response to the proxy device according to the binding relationship information; The first response includes access control information of the client device to the target resource, or the first response is used to indicate whether the client device has access rights to the target resource.

37. The server device according to any one of claims 32 to 35, characterized in that: The control module is further configured to: The changed access control information of the client device is sent to the proxy device according to the binding relationship information.

38. The server device according to claim 37, characterized in that: The change in the access control information includes: a change in the access rights of the client device to the target resource of the server device.

39. The server device according to claim 37 or 38, characterized in that: The server device further includes: The third receiving module is configured to receive a second request sent by the proxy device, where the second request is used to request the server device to generate a notification message when the access control information corresponding to the client device changes.

40. The server device according to any one of claims 32-39, characterized in that: The binding relationship information is recorded in a first functional cluster, the first functional cluster includes a first attribute, and the first attribute records the device identification of the proxy device and the device identification of the client device.

41. The server device according to claim 40, characterized in that: The device identification of the client device includes: the device ID of the client device, and / or a first identification corresponding to the client device, where the first identification is an identification shared by a group of client devices with the same authority.

42. The server device according to any one of claims 32 to 41, characterized in that: The server device includes a second functional cluster, the second functional cluster includes a first command, and the first command is used to instruct the server device to generate a notification message when access control information corresponding to the client device associated with the first command changes.

43. The server device according to claim 42, characterized in that: The second functional cluster further includes a second command, where the second command is used to generate a response message to the first command, and the second command includes the changed content and change type of the access control information corresponding to the client device associated with the first command.

44. The server device according to any one of claims 32-43, characterized in that: The access control information is recorded in the access control list ACL of the server device.

45. A proxy device, characterized in that include: A first sending module, configured to send a first request to a server device, wherein the first request is used to query whether the client device has access rights to a target resource of the server device; A first receiving module, configured to receive a first response sent by the server device in response to the binding relationship information; The binding relationship information is used to indicate that there is a binding relationship between the proxy device and the client device, and the binding relationship information is used to control the access control information that the proxy device can obtain.

46. ​​The proxy device according to claim 45, characterized in that The proxy device further includes: The second sending module is used to send a registration request to the server device, where the registration request is used to register the binding relationship information.

47. The proxy device according to claim 45 or 46, characterized in that The first response includes access control information of the client device to the target resource, or the first response is used to indicate whether the client device has access rights to the target resource.

48. The proxy device according to any one of claims 45 to 47, characterized in that: The proxy device further includes: The second receiving module is configured to receive the changed access control information of the client device sent by the server device in response to the binding relationship information.

49. The proxy device according to claim 48, characterized in that The change in the access control information includes: a change in the access permission of the client device to the target resource.

50. The proxy device according to claim 48 or 49, characterized in that The proxy device further includes: The third sending module is used to send a second request to the server device, where the second request is used to request the server device to generate a notification message when the access control information corresponding to the client device changes.

51. The proxy device according to any one of claims 45 to 50, characterized in that: The binding relationship information is recorded in a first functional cluster, the first functional cluster includes a first attribute, and the first attribute records the device identification of the proxy device and the device identification of the client device.

52. The proxy device according to claim 51, characterized in that The device identification of the client device includes: the device ID of the client device, and / or a first identification corresponding to the client device, where the first identification is an identification shared by a group of client devices with the same authority.

53. The proxy device according to any one of claims 45 to 52, characterized in that: The server device includes a second functional cluster, the second functional cluster includes a first command, and the first command is used to instruct the server device to generate a notification message when access control information corresponding to the client device associated with the first command changes.

54. The proxy device according to claim 53, characterized in that The second functional cluster further includes a second command, where the second command is used to generate a response message to the first command, and the second command includes the changed content and change type of the access control information corresponding to the client device associated with the first command.

55. The proxy device according to any one of claims 45 to 54, characterized in that: The access control information is recorded in the access control list ACL of the server device.

56. A client device, characterized in that include: The sending module is used to send binding relationship information to the server device, wherein the binding relationship information is used to indicate that there is a binding relationship between the client device and the proxy device, and the binding relationship information is used to control the access control information that the proxy device can obtain.

57. The client device according to claim 56, wherein: The binding relationship information is recorded in a first functional cluster, the first functional cluster includes a first attribute, and the first attribute records the device identification of the proxy device and the device identification of the client device.

58. The client device according to claim 57, wherein The device identification of the client device includes: the device ID of the client device, and / or a first identification corresponding to the client device, where the first identification is an identification shared by a group of client devices with the same authority.

59. The client device according to any one of claims 56-58, characterized in that The server device includes a second functional cluster, the second functional cluster includes a first command, and the first command is used to instruct the server device to generate a notification message when access control information corresponding to the client device associated with the first command changes.

60. The client device according to claim 59, wherein: The change in the access control information includes: a change in the access rights of the client device to the target resource of the server device.

61. The client device according to claim 59 or 60, characterized in that The second functional cluster further includes a second command, where the second command is used to generate a response message to the first command, and the second command includes the changed content and change type of the access control information corresponding to the client device associated with the first command.

62. The client device according to any one of claims 56 to 61, wherein: The access control information is recorded in the access control list ACL of the server device.

63. A server device, characterized in that: The server comprises a memory and a processor, wherein the memory is used to store a program, and the processor is used to call the program in the memory so that the server device executes the method according to any one of claims 1 to 13.

64. A proxy device, characterized in that The device comprises a memory and a processor, wherein the memory is used to store a program, and the processor is used to call the program in the memory so as to enable the agent device to execute the method according to any one of claims 14 to 24.

65. A client device, characterized in that The method comprises a memory and a processor, wherein the memory is used to store a program, and the processor is used to call the program in the memory so that the client device executes the method according to any one of claims 25 to 31.

66. A device, characterized in that The device comprises a processor configured to call a program from a memory so as to enable the device to execute the method according to any one of claims 1 to 31.

67. A chip, characterized in that: The device comprises a processor configured to call a program from a memory so that a device equipped with the chip executes the method according to any one of claims 1 to 31.

68. A computer-readable storage medium, characterized in that A program is stored thereon, and the program causes a computer to execute the method according to any one of claims 1 to 31.

69. A computer program product, characterized in that The method comprises a program for causing a computer to execute the method according to any one of claims 1 to 31.

70. A computer program, characterized in that The computer program causes a computer to execute the method according to any one of claims 1 to 31.

Images